solana: Add Docker for generating governance instructions (wormhole-foundation#639)

This PR is based on wormhole-foundation#428.

Example usage:

1. `cd solana`
2. Save this file into `solana/claimOwnership.ts`

```ts
import { Connection } from "@solana/web3.js";
import { NTT } from "./ts/lib/ntt.ts";
import { OWNER, serializeInstruction } from "./ts/lib/utils.ts";
import { SolanaNtt } from "./ts/sdk/ntt.ts";

(async () => {
  const connection = new Connection("https://localhost");
  const ntt = new SolanaNtt(
    "Testnet",
    "Solana",
    connection,
    {
      coreBridge: "INSERT_WORMHOLE_ADDRESS",
      ntt: {
        token: "",
        manager: "INSERT_NTT_ADDRESS",
        transceiver: {},
      },
    },
    "INSERT_VERSION"
  );
  const ix = await NTT.createClaimOwnershipInstruction(ntt.program, {
    newOwner: OWNER,
  });
  console.log(serializeInstruction(ix).toString("hex"));
})();
```
3. `docker build --target governance --tag governance --file Dockerfile ..`
4. `docker run -i --rm governance < claimOwnership.ts`

Author: nvsriram

Tiltfile

@@ -12,6 +12,7 @@ docker_build(
     context = "./",
     only = ["./sdk", "./solana"],
     ignore=["./sdk/__tests__", "./sdk/Dockerfile", "./sdk/ci.yaml", "./sdk/**/dist", "./sdk/node_modules", "./sdk/**/node_modules"],
+    target = "builder",
     dockerfile = "./solana/Dockerfile",
 )
 docker_build(

solana/Dockerfile

@@ -1,4 +1,4 @@
-FROM backpackapp/build:v0.29.0@sha256:9aee169b2d8b89b4a4243419ae35c176773136e78d751b3e439eff692c9c1293 as anchor
+FROM backpackapp/build:v0.29.0@sha256:9aee169b2d8b89b4a4243419ae35c176773136e78d751b3e439eff692c9c1293 AS anchor
 
 WORKDIR /usr/src/solana/
 
@@ -43,7 +43,7 @@ COPY solana/scripts scripts
 
 RUN make target/idl/example_native_token_transfers.json
 
-FROM scratch as export
+FROM scratch AS export
 
 COPY --from=builder /opt/solana/deps /opt/solana/deps
 COPY --from=builder /usr/src/solana/ts /usr/src/solana/ts
@@ -52,3 +52,24 @@ COPY --from=builder /usr/src/solana/tsconfig.esm.json /usr/src/solana/tsconfig.e
 COPY --from=builder /usr/src/solana/tsconfig.cjs.json /usr/src/solana/tsconfig.cjs.json
 COPY --from=builder /usr/src/solana/target/idl  /usr/src/solana/target/idl 
 COPY --from=builder /usr/src/solana/target/types /usr/src/solana/target/types
+
+FROM node:lts-alpine@sha256:41e4389f3d988d2ed55392df4db1420ad048ae53324a8e2b7c6d19508288107e AS governance
+
+WORKDIR /app
+
+# RUN apk add python3
+RUN apk add --no-cache make python3 gcc g++
+
+COPY tsconfig.json tsconfig.json
+COPY tsconfig.cjs.json tsconfig.cjs.json
+COPY tsconfig.esm.json tsconfig.esm.json
+COPY package.json package.json
+COPY package-lock.json package-lock.json
+COPY sdk sdk
+RUN npm ci
+RUN npm run build
+
+WORKDIR /app/solana
+COPY solana/ts ts
+
+ENTRYPOINT [ "npx", "tsx" ]

solana/ts/lib/ntt.ts

@@ -1,5 +1,4 @@
 import {
-  BN,
   Program,
   parseIdlErrors,
   translateError,
@@ -33,6 +32,7 @@ import {
   VAA,
   keccak256,
 } from "@wormhole-foundation/sdk-definitions";
+import BN from "bn.js";
 
 import { Ntt } from "@wormhole-foundation/sdk-definitions-ntt";
 
@@ -93,6 +93,7 @@ export namespace NTT {
         ["inbox_item", Ntt.messageDigest(chain, nttMessage)],
         programId
       );
+    const upgradeLock = (): PublicKey => derivePda("upgrade_lock", programId);
     const outboxRateLimitAccount = (): PublicKey =>
       derivePda("outbox_rate_limit", programId);
     const tokenAuthority = (): PublicKey =>
@@ -131,6 +132,7 @@ export namespace NTT {
       outboxRateLimitAccount,
       inboxRateLimitAccount,
       inboxItemAccount,
+      upgradeLock,
       sessionAuthority,
       tokenAuthority,
       pendingTokenAuthority,
@@ -720,19 +722,66 @@ export namespace NTT {
     return transferIx;
   }
 
+  export async function createTransferOwnershipOneStepUncheckedInstruction(
+    program: Program<NttBindings.NativeTokenTransfer<IdlVersion>>,
+    args: {
+      owner: PublicKey;
+      newOwner: PublicKey;
+    },
+    pdas?: Pdas
+  ) {
+    pdas = pdas ?? NTT.pdas(program.programId);
+    return program.methods
+      .transferOwnershipOneStepUnchecked()
+      .accountsStrict({
+        config: pdas.configAccount(),
+        owner: args.owner,
+        newOwner: args.newOwner,
+        upgradeLock: pdas.upgradeLock(),
+        programData: programDataAddress(program.programId),
+        bpfLoaderUpgradeableProgram: BPF_LOADER_UPGRADEABLE_PROGRAM_ID,
+      })
+      .instruction();
+  }
+
   export async function createTransferOwnershipInstruction(
     program: Program<NttBindings.NativeTokenTransfer<IdlVersion>>,
     args: {
+      owner: PublicKey;
       newOwner: PublicKey;
     },
     pdas?: Pdas
   ) {
     pdas = pdas ?? NTT.pdas(program.programId);
     return program.methods
       .transferOwnership()
-      .accounts({
+      .accountsStrict({
         config: pdas.configAccount(),
+        owner: args.owner,
         newOwner: args.newOwner,
+        upgradeLock: pdas.upgradeLock(),
+        programData: programDataAddress(program.programId),
+        bpfLoaderUpgradeableProgram: BPF_LOADER_UPGRADEABLE_PROGRAM_ID,
+      })
+      .instruction();
+  }
+
+  export async function createClaimOwnershipInstruction(
+    program: Program<NttBindings.NativeTokenTransfer<IdlVersion>>,
+    args: {
+      newOwner: PublicKey;
+    },
+    pdas?: Pdas
+  ) {
+    pdas = pdas ?? NTT.pdas(program.programId);
+    return program.methods
+      .claimOwnership()
+      .accountsStrict({
+        config: pdas.configAccount(),
+        newOwner: args.newOwner,
+        upgradeLock: pdas.upgradeLock(),
+        programData: programDataAddress(program.programId),
+        bpfLoaderUpgradeableProgram: BPF_LOADER_UPGRADEABLE_PROGRAM_ID,
       })
       .instruction();
   }
@@ -1035,7 +1084,7 @@ export namespace NTT {
       .instruction();
   }
 
-  export async function setInboundLimit(
+  export async function createSetInboundLimitInstruction(
     program: Program<NttBindings.NativeTokenTransfer<IdlVersion>>,
     args: {
       owner: PublicKey;

solana/ts/lib/utils.ts

@@ -1,5 +1,8 @@
-import { BN } from "@coral-xyz/anchor";
-import { PublicKey, PublicKeyInitData } from "@solana/web3.js";
+import {
+  PublicKey,
+  PublicKeyInitData,
+  TransactionInstruction,
+} from "@solana/web3.js";
 import {
   Chain,
   ChainId,
@@ -8,6 +11,7 @@ import {
   encoding,
   toChainId,
 } from "@wormhole-foundation/sdk-base";
+import BN from "bn.js";
 
 export const BPF_LOADER_UPGRADEABLE_PROGRAM_ID = new PublicKey(
   "BPFLoaderUpgradeab1e11111111111111111111111"
@@ -115,3 +119,41 @@ export const quoterAddresses = (programId: PublicKeyInitData) => {
     registeredNttAccount,
   };
 };
+
+// governance utils
+
+export function serializeInstruction(ix: TransactionInstruction): Buffer {
+  const programId = ix.programId.toBuffer();
+  const accountsLen = Buffer.alloc(2);
+  accountsLen.writeUInt16BE(ix.keys.length);
+  const accounts = Buffer.concat(
+    ix.keys.map((account) => {
+      const isSigner = Buffer.alloc(1);
+      isSigner.writeUInt8(account.isSigner ? 1 : 0);
+      const isWritable = Buffer.alloc(1);
+      isWritable.writeUInt8(account.isWritable ? 1 : 0);
+      const pubkey = account.pubkey.toBuffer();
+      return Buffer.concat([pubkey, isSigner, isWritable]);
+    })
+  );
+  const dataLen = Buffer.alloc(2);
+  dataLen.writeUInt16BE(ix.data.length);
+  return Buffer.concat([programId, accountsLen, accounts, dataLen, ix.data]);
+}
+
+export function appendGovernanceHeader(
+  data: Buffer,
+  governanceProgramId: PublicKey
+): Buffer {
+  const module = Buffer.from("GeneralPurposeGovernance".padStart(32, "\0"));
+  const action = Buffer.alloc(1);
+  action.writeUInt8(2); // SolanaCall
+  const chainId = Buffer.alloc(2);
+  chainId.writeUInt16BE(1); // solana
+  const programId = governanceProgramId.toBuffer();
+  return Buffer.concat([module, action, chainId, programId, data]);
+}
+
+// sentinel values used in governance
+export const OWNER = new PublicKey(Buffer.from("owner".padEnd(32, "\0")));
+export const PAYER = new PublicKey(Buffer.from("payer".padEnd(32, "\0")));

solana/ts/sdk/index.ts

@@ -3,6 +3,7 @@ import { _platform } from "@wormhole-foundation/sdk-solana";
 import { SolanaNtt } from "./ntt.js";
 import { SolanaNttWithExecutor } from "./nttWithExecutor.js";
 import "@wormhole-foundation/sdk-definitions-ntt";
+import "./side-effects";
 
 registerProtocol(_platform, "Ntt", SolanaNtt);
 registerProtocol(_platform, "NttWithExecutor", SolanaNttWithExecutor);

solana/ts/sdk/ntt.ts

@@ -511,6 +511,7 @@ export class SolanaNtt<N extends Network, C extends SolanaChains>
   async *setOwner(newOwner: AnySolanaAddress, payer: AccountAddress<C>) {
     const sender = new SolanaAddress(payer).unwrap();
     const ix = await NTT.createTransferOwnershipInstruction(this.program, {
+      owner: new SolanaAddress(await this.getOwner()).unwrap(),
       newOwner: new SolanaAddress(newOwner).unwrap(),
     });
 
@@ -1144,7 +1145,7 @@ export class SolanaNtt<N extends Network, C extends SolanaChains>
     payer: AccountAddress<C>
   ) {
     const sender = new SolanaAddress(payer).unwrap();
-    const ix = await NTT.setInboundLimit(this.program, {
+    const ix = await NTT.createSetInboundLimitInstruction(this.program, {
       owner: sender,
       chain: fromChain,
       limit: new BN(limit.toString()),

solana/ts/sdk/nttWithExecutor.ts

@@ -1,18 +1,9 @@
-import { toChainId, type Network } from "@wormhole-foundation/sdk-base";
+import { Program } from "@coral-xyz/anchor";
 import {
-  type AccountAddress,
-  type ChainAddress,
-  type ChainsConfig,
-  Contracts,
-  UnsignedTransaction,
-} from "@wormhole-foundation/sdk-definitions";
-import { Ntt, NttWithExecutor } from "@wormhole-foundation/sdk-definitions-ntt";
-import {
-  SolanaPlatform,
-  type SolanaPlatformType,
-  type SolanaChains,
-  SolanaAddress,
-} from "@wormhole-foundation/sdk-solana";
+  createAssociatedTokenAccountIdempotentInstruction,
+  createTransferInstruction,
+  getAssociatedTokenAddressSync,
+} from "@solana/spl-token";
 import {
   AddressLookupTableAccount,
   AddressLookupTableProgram,
@@ -23,22 +14,32 @@ import {
   TransactionMessage,
   VersionedTransaction,
 } from "@solana/web3.js";
-import { SolanaNtt } from "./ntt.js";
+import { toChainId, type Network } from "@wormhole-foundation/sdk-base";
 import {
-  createAssociatedTokenAccountIdempotentInstruction,
-  createTransferInstruction,
-  getAssociatedTokenAddressSync,
-} from "@solana/spl-token";
-import { BN, Program } from "@coral-xyz/anchor";
+  Contracts,
+  UnsignedTransaction,
+  type AccountAddress,
+  type ChainAddress,
+  type ChainsConfig,
+} from "@wormhole-foundation/sdk-definitions";
+import { Ntt, NttWithExecutor } from "@wormhole-foundation/sdk-definitions-ntt";
 import {
-  ExampleNttWithExecutor,
-  ExampleNttWithExecutorIdl,
-} from "../idl/executor/example_ntt_with_executor.js";
+  SolanaAddress,
+  SolanaPlatform,
+  type SolanaChains,
+  type SolanaPlatformType,
+} from "@wormhole-foundation/sdk-solana";
+import BN from "bn.js";
 import {
   ExampleNttSvmLut,
   ExampleNttSvmLutIdl,
 } from "../idl/executor/example_ntt_svm_lut.js";
+import {
+  ExampleNttWithExecutor,
+  ExampleNttWithExecutorIdl,
+} from "../idl/executor/example_ntt_with_executor.js";
 import { chainToBytes } from "../lib/utils.js";
+import { SolanaNtt } from "./ntt.js";
 
 export class SolanaNttWithExecutor<N extends Network, C extends SolanaChains>
   implements NttWithExecutor<N, C>

solana/ts/sdk/side-effects.ts

@@ -0,0 +1,26 @@
+// <sigh>
+// when the native secp256k1 is missing, the eccrypto library decides TO PRINT A MESSAGE TO STDOUT:
+// https://github.com/bitchan/eccrypto/blob/a4f4a5f85ef5aa1776dfa1b7801cad808264a19c/index.js#L23
+//
+// do you use a CLI tool that depends on that library and try to pipe the output
+// of the tool into another? tough luck
+//
+// for lack of a better way to stop this, we patch the console.info function to
+// drop that particular message...
+// </sigh>
+const info = console.info;
+console.info = function (x: string) {
+  if (x !== "secp256k1 unavailable, reverting to browser version") {
+    info(x);
+  }
+};
+
+const warn = console.warn;
+console.warn = function (x: string) {
+  if (
+    x !==
+    "bigint: Failed to load bindings, pure JS will be used (try npm run rebuild?)"
+  ) {
+    warn(x);
+  }
+};