feat: Cross platform reproducible builds

rust-toolchain.toml

@@ -1,3 +1,2 @@
 [toolchain]
-channel = "nightly"
-
+channel = "nightly-2025-07-25"

tools/reproduce/Dockerfile

@@ -1,26 +1,44 @@
 # Use a specific version of Rust for reproducibility
-# FROM debian:bullseye-slim as builder
-FROM debian:bullseye-slim@sha256:f527627d07c18abf87313c341ee8ef1b36f106baa8b6b6dc33f4c872d988b651 AS builder
-
-RUN apt-get update && apt-get install -y \
-    curl \
-    build-essential \
-    git \
-    libssl-dev \
-    pkg-config
-
-# version MUST be the same as in /tools/verifier/rust-toolchain.toml    
-RUN curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain nightly-2025-07-25
-ENV PATH="/root/.cargo/bin:${PATH}"
-
-RUN rustup target add riscv32i-unknown-none-elf
-RUN rustup component add llvm-tools-preview
-RUN rustup component add rust-src
-RUN cargo install cargo-binutils
-
-# RUN git clone  --depth 1 -b mmzk_0608_reproduce  https://github.com/matter-labs/zksync-airbender.git
+# Pinning os version and architecture for reproducibility
+FROM --platform=linux/amd64 debian:bullseye-slim@sha256:4edd2740ebd41d71ef78eed0081c8979e287e2496c6fca892f5936d1e22adcd3 AS builder
+
+
+# Freeze APT to a specific point in time (matches base image date)
+ARG DEBIAN_SNAPSHOT=20250811T000000Z
+
+# Use snapshot.debian.org and disable Valid-Until
+RUN set -eux; \
+  printf 'Acquire::Check-Valid-Until "false";\n' > /etc/apt/apt.conf.d/99snapshot; \
+  printf 'Acquire::http::No-Cache "true";\n'     > /etc/apt/apt.conf.d/99no-cache; \
+  echo "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian/${DEBIAN_SNAPSHOT} bullseye main"            >  /etc/apt/sources.list; \
+  echo "deb [check-valid-until=no] http://snapshot.debian.org/archive/debian-security/${DEBIAN_SNAPSHOT} bullseye-security main" >> /etc/apt/sources.list; \
+  apt-get -o Acquire::Check-Valid-Until=false update
+
+# Setting a fixed SOURCE_DATE_EPOCH for reproducible builds
+# reproduce.sh will set it based on last commit date
+ARG SOURCE_DATE_EPOCH=1700000000
+ENV SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH} \
+    CARGO_INCREMENTAL=0 \
+    TZ=UTC LANG=C.UTF-8 LC_ALL=C.UTF-8
+
+# Toolchain (paths pinned so absolute paths don’t leak)
+ENV CARGO_HOME=/opt/cargo RUSTUP_HOME=/opt/rustup
+ENV PATH=/opt/cargo/bin:$PATH
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      ca-certificates curl git build-essential libssl-dev pkg-config \
+ && rm -rf /var/lib/apt/lists/*
+# version MUST be the same as in /tools/verifier/rust-toolchain.toml
+RUN curl -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain nightly-2025-07-25 --profile minimal
+RUN rustup target add riscv32i-unknown-none-elf \
+ && cargo install cargo-binutils --locked \
+ && rustup component add llvm-tools-preview \
+ && rustup component add rust-src
+
+ENV CARGO_TARGET_RISCV32I_UNKNOWN_NONE_ELF_AR=llvm-ar
+ENV CARGO_TARGET_RISCV32I_UNKNOWN_NONE_ELF_RANLIB=llvm-ranlib
+
 COPY . zksync-airbender
 
-WORKDIR zksync-airbender/tools/verifier
+WORKDIR /zksync-airbender/tools/verifier
 
-RUN ./build.sh
+RUN ./build.sh

tools/reproduce/reproduce.sh

@@ -2,14 +2,21 @@
 
 # Make sure to run from the main zksync-airbender directory.
 
-set -e  # Exit on any error
+set -euo pipefail
+
+# Set source date epoch for reproducible builds
+SDE="$(git log -1 --format=%ct || echo 1700000000)"
 
 export DOCKER_DEFAULT_PLATFORM=linux/amd64
 
 # create a fresh docker
-docker build -t airbender-verifiers  -f tools/reproduce/Dockerfile .
+docker build \
+  --build-arg SOURCE_DATE_EPOCH="$SDE" \
+  --platform linux/amd64 \
+  -t airbender-verifiers \
+  -f tools/reproduce/Dockerfile .
 
-docker create --name verifiers airbender-verifiers
+cid="$(docker create --platform=linux/amd64 airbender-verifiers)"
 
 FILES=(
     base_layer.bin
@@ -35,9 +42,9 @@ FILES=(
 )
 
 for FILE in "${FILES[@]}"; do
-    docker cp verifiers:/zksync-airbender/tools/verifier/$FILE tools/verifier/
+    docker cp "$cid":/zksync-airbender/tools/verifier/"$FILE" tools/verifier/
     md5sum tools/verifier/$FILE
 done
 
 
-docker rm verifiers
+docker rm -f "$cid" >/dev/null

tools/verifier/.cargo/config.toml

@@ -7,5 +7,9 @@ rustflags = [
   "-C", "link-arg=-Tsrc/lds/link.x",
   "-C", "link-arg=--save-temps",
   "-C", "force-frame-pointers",
+  # reproducibility
+  "--remap-path-prefix= /=/src",
+  "-C", "link-arg=--build-id=sha1",
+  "-C", "codegen-units=1",
 ]
 

tools/verifier/base_layer.reduced.vk.json

@@ -1,15 +1,15 @@
 {
   "machine_type": "Reduced",
-  "bytecode_hash_hex": "6e76331e962f0d5dffa25b21276296fcf96d4890272018a989d28f5ace491e63",
+  "bytecode_hash_hex": "4b7203932783159c48cc43cb1139c5156697d73c6c0b130640f677f0e6f7f2d4",
   "params": [
-    1503040098,
-    4215699226,
-    2017225750,
-    2651109157,
-    13103954,
-    86424153,
-    2246580420,
-    4055292153
+    1742862739,
+    2054196298,
+    3992237103,
+    2624353922,
+    1445814132,
+    1743517346,
+    1968670208,
+    2416818837
   ],
-  "params_hex": "59969262fb46771a783c6c169e04b72500c7f3520526ba5985e818c4f1b6d8f9"
+  "params_hex": "67e1f9937a708c4aedf4b42f9c6c7682562d5f7467ebf6a275578600900dba95"
 }

tools/verifier/final_recursion_layer.final.vk.json

@@ -1,15 +1,15 @@
 {
   "machine_type": "ReducedFinal",
-  "bytecode_hash_hex": "b8749fdec85e44ac773d75265187f1c055f6fc36051c9541ac23d91b9cd678bf",
+  "bytecode_hash_hex": "03a3b21da190ccef5cab36854dfde994ac0cafe72c584aee38a9a044bfa54922",
   "params": [
-    4066937387,
-    2968710192,
-    1044530528,
-    2031792993,
-    842952069,
-    4230516830,
-    2917931802,
-    2533265646
+    3242033644,
+    3048195710,
+    1337453984,
+    619282302,
+    1268913589,
+    1102518883,
+    1916899583,
+    4152938801
   ],
-  "params_hex": "f2688a2bb0f2ec303e424560791ab361323e6d85fc28905eadec1b1a96fe90ee"
+  "params_hex": "c13d81ecb5afc67e4fb7eda024e97f7e4ba215b541b71a63724190fff788d131"
 }

tools/verifier/recursion_layer.reduced.vk.json

@@ -1,15 +1,15 @@
 {
   "machine_type": "Reduced",
-  "bytecode_hash_hex": "be47579000570ebd9cd65602939c05c6661ec8554418b3954670d7304d336949",
+  "bytecode_hash_hex": "26a08b32c8895344e1d592f549804307092f906438b5d1dd3592c3b34bcf38a0",
   "params": [
-    1273764681,
-    3283117427,
-    2311065517,
-    2753943270,
-    2241835076,
-    930387060,
-    4223816505,
-    866191144
+    1463204384,
+    4088982648,
+    3637016449,
+    2558999117,
+    3252539606,
+    3746793385,
+    1889633210,
+    2299360267
   ],
-  "params_hex": "4bec1b49c3b0657389c00fada425d6e6859fb04437749474fbc2533933a10728"
+  "params_hex": "5736ba20f3b8ec78d8c8778198873a4dc1ddd0d6df5387a970a183ba890d740b"
 }

tools/verifier/recursion_layer_no_delegation.final.vk.json

@@ -1,15 +1,15 @@
 {
   "machine_type": "ReducedFinal",
-  "bytecode_hash_hex": "da7fe91bd699fe927ae782761b30d2c2dc6d018f790150008eb4d40ee34625fe",
+  "bytecode_hash_hex": "e9c8ec4a8ef22f113a20584dd1a028f4c11045862c2501c581d8152f4757b5e5",
   "params": [
-    492132458,
-    3000861315,
-    3565836757,
-    2185042515,
-    1407086205,
-    2632110902,
-    4063630414,
-    639174793
+    844727740,
+    1379124395,
+    2307359121,
+    1196921438,
+    1769303654,
+    802594396,
+    2606795692,
+    1182326777
   ],
-  "params_hex": "1d55586ab2dd8283d48a59d5823d1a5353de6e7d9ce2d336f236144e26190889"
+  "params_hex": "325985bc5233c4ab898781914757925e69756e662fd69e5c9b608bac4678dff9"
 }

tools/verifier/recursion_log_23_layer.reduced.vk.json

@@ -1,15 +1,15 @@
 {
   "machine_type": "ReducedLog23",
-  "bytecode_hash_hex": "be47579000570ebd9cd65602939c05c6661ec8554418b3954670d7304d336949",
+  "bytecode_hash_hex": "26a08b32c8895344e1d592f549804307092f906438b5d1dd3592c3b34bcf38a0",
   "params": [
-    3579220309,
-    3011048269,
-    4265564452,
-    4060763684,
-    2727570466,
-    1454311012,
-    4005559723,
-    1294772114
+    3972316823,
+    3863004232,
+    1560367591,
+    1522184996,
+    1521651600,
+    2600527396,
+    2001995741,
+    2615717753
   ],
-  "params_hex": "d5569155b378f34dfe3f5924f20a5624a2936c2256af0664eebffdab4d2ca792"
+  "params_hex": "ecc4be97e640c4485d0151e75abab3245ab28f909b00e624775407dd9be8af79"
 }

tools/verifier/rust-toolchain.toml

@@ -1,2 +1,3 @@
+# If changed, also change tools/reproduce/Dockerfile
 [toolchain]
-channel = "nightly-2025-07-25"
+channel = "nightly-2025-07-25"

tools/verifier/universal.reduced.vk.json

@@ -1,15 +1,15 @@
 {
   "machine_type": "Reduced",
-  "bytecode_hash_hex": "e35b3a128022a048e891ef5d2a373ed8ad128a587d019000f8ebb44e2fa63e43",
+  "bytecode_hash_hex": "5995aae8e7d800fafcc73859e5ffb04de67df8a30fd01eaf16163fd4540b272d",
   "params": [
-    860058423,
-    3640415478,
-    2384303882,
-    1724860185,
-    4002833746,
-    400750227,
-    1814308475,
-    3620614667
+    1942872871,
+    1028302631,
+    1638441815,
+    4050296367,
+    1850554751,
+    2499319548,
+    1674290002,
+    2056735351
   ],
-  "params_hex": "33437337d8fc54f68e1d970a66cf4719ee96655217e2f6936c24267bd7ce320b"
+  "params_hex": "73cde3273d4aa72761a8a357f16a9e2f6e4d397f94f896fc63cba3527a974a77"
 }

tools/verifier/universal.reduced_log23.vk.json

@@ -1,15 +1,15 @@
 {
   "machine_type": "ReducedLog23",
-  "bytecode_hash_hex": "e35b3a128022a048e891ef5d2a373ed8ad128a587d019000f8ebb44e2fa63e43",
+  "bytecode_hash_hex": "5995aae8e7d800fafcc73859e5ffb04de67df8a30fd01eaf16163fd4540b272d",
   "params": [
-    1769135556,
-    2750069066,
-    261141979,
-    1444565367,
-    2056362079,
-    3466625596,
-    3123703739,
-    836672824
+    684568426,
+    1231895172,
+    3297454049,
+    3879418560,
+    1447504336,
+    2186399283,
+    1854672719,
+    3963139281
   ],
-  "params_hex": "6972ddc4a3eab94a0f90b5db561a51777a91985fcea0823cba2fefbb31de9d38"
+  "params_hex": "28cdaf6a496d3a84c48b27e1e73b3ac0564729d08251ce336e8c0f4fec38b4d1"
 }

tools/verifier/universal_no_delegation.final.vk.json

@@ -1,15 +1,15 @@
 {
   "machine_type": "ReducedFinal",
-  "bytecode_hash_hex": "9247f4c84d6a5b4472f374e87688910f14fad55ed7a9587c67f8295512c55389",
+  "bytecode_hash_hex": "6b17b2679ec46c204d4e5fb52433007de8d33e54673ba3a274345f2150ff2ace",
   "params": [
-    2224705490,
-    2565817870,
-    3003796587,
-    14309538,
-    4275886385,
-    534049063,
-    1788641825,
-    4135795200
+    1720712920,
+    1795095799,
+    3480056291,
+    2731798709,
+    3740582,
+    4216821218,
+    2721914260,
+    4239380501
   ],
-  "params_hex": "849a4fd298ef460eb30a4c6b00da58a2fedcd9311fd4f1276a9c8221f6833a00"
+  "params_hex": "668ffed86afefcf7cf6d71e3a2d3f0b5003913a6fb5795e2a23d1d94fcafd015"
 }