solana: deterministic builds via Docker

Author: kcsongor

Tiltfile

@@ -19,7 +19,7 @@ docker_build(
     ref = "solana-contract",
     context = ".wormhole/solana",
     dockerfile = ".wormhole/solana/Dockerfile",
-    target = "builder",
+    target = "dev-builder",
     build_args = {"BRIDGE_ADDRESS": "Bridge1p5gheXUvJ6jGWGeCsgPKgnE3YgdGKRVCMY9o"}
 )
 # Solana deploy

solana/.gitignore

@@ -2,3 +2,4 @@
 **/*.rs.bk
 node_modules
 test-ledger
+artifacts-*

solana/Dockerfile

@@ -8,10 +8,11 @@ COPY solana/Cargo.toml Cargo.toml
 COPY solana/modules modules
 COPY solana/programs programs
 COPY solana/rust-toolchain rust-toolchain
+COPY solana/scripts scripts
 
 ENV RUST_BACKTRACE=1
 
-FROM anchor AS builder
+FROM anchor AS dev-builder
 
 RUN mkdir -p /opt/solana/deps
 
@@ -37,8 +38,19 @@ COPY --from=solana-contract /opt/solana/deps/cpi_poster.so /opt/solana/deps/cpi_
 COPY --from=solana-contract /opt/solana/deps/mpl_token_metadata.so /opt/solana/deps/mpl_token_metadata.so
 COPY --from=solana-contract /opt/solana/deps/wormhole_migration.so /opt/solana/deps/wormhole_migration.so
 
-COPY sdk ../sdk
 COPY solana/Makefile Makefile
-COPY solana/scripts scripts
-
 RUN make target/idl/example_native_token_transfers.json
+COPY solana/ts ts
+
+FROM anchor as mainnet-builder
+
+ARG SOLANA_NETWORK
+RUN [ -z "$SOLANA_NETWORK" ] && echo "SOLANA_NETWORK is required" && exit 1 || echo "SOLANA_NETWORK=$SOLANA_NETWORK"
+
+RUN --mount=type=cache,target=/opt/solana/deps/target,id=build_anchor_ntt_target \
+    --mount=type=cache,target=/usr/local/cargo/registry,id=cargo_registry \
+    --mount=type=cache,target=.anchor,id=anchor_cache \
+    anchor build --arch sbf -- --no-default-features --features $SOLANA_NETWORK
+
+FROM scratch as export
+COPY --from=mainnet-builder /usr/src/solana/target/deploy /

solana/Makefile

@@ -29,6 +29,28 @@ idl: target/idl/example_native_token_transfers.json
 node_modules: package-lock.json
 	npm ci
 
+.PHONY: artifacts-mainnet
+artifacts-mainnet: NETWORK=mainnet
+artifacts-mainnet: _artifacts
+	mv _artifacts $@
+
+.PHONY: artifacts-solana-devnet
+artifacts-solana-devnet: NETWORK=solana-devnet
+artifacts-solana-devnet: _artifacts
+	mv _artifacts $@
+
+.PHONY: artifacts-tilt-devnet
+artifacts-tilt-devnet: NETWORK=tilt-devnet
+artifacts-tilt-devnet: _artifacts
+	mv _artifacts $@
+
+.PHONY: _artifacts
+_artifacts:
+	rm -rf $@
+	DOCKER_BUILDKIT=1 cd .. && docker build -f solana/Dockerfile --build-arg="SOLANA_NETWORK=$(NETWORK)" -t export -o solana/$@ .
+	@cd $@ && ls | xargs sha256sum > checksums.txt
+	@cat $@/checksums.txt
+
 .PHONY: clean
 clean:
 	anchor clean

solana/README.md

@@ -1,15 +1,32 @@
-# Solana 
+# Solana
 
 ## Prequisities
 
 Ensure that you are using the correct version of the Solana and Anchor CLI tools by consulting `Anchor.toml`.
 ```toml
 [toolchain]
 anchor_version = "0.29.0"   # CLI
-solana_version = "1.17.2"
+solana_version = "1.18.10"
 ```
 
-You will also need to install the toolchain listed in `rust-toolchain`.
+You will also need `rustup`.
+
+For building the mainnet binaries, the only requirements are `docker` and `make`:
+
+```sh
+make artifacts-mainnet
+```
+
+which will produce the object files into the `artifacts-mainnet` directory.
+This is the recommended way of building the binaries as it results in deterministic builds.
+For Solana devnet builds, or local testing builds, use the
+
+``` sh
+make artifacts-solana-devnet
+make artifacts-tilt-devnet
+```
+
+commands.
 
 ## Design Overview
 
@@ -104,4 +121,4 @@ To ensure the SDK has the generated IDL, run the tests with the make command:
 
 ```sh
 make anchor-test
-```
+```