chore: port hotfix branch changes to main

.dockerignore

@@ -6,7 +6,6 @@
 !/Cargo.toml
 !/config.json
 !/docker/entrypoint.sh
-!/docker/enclave-key.pem
 !/docker/cargo-config.toml
 !/.env
 !/lib

.env

@@ -16,7 +16,7 @@ SP1_BATCH_VK_HASH=4e8ed79204df0fec11c3bacb3c517e0f33783f9626cb2b6e0e1e46b519ae09
 SP1_SHASTA_AGGREGATION_VK_HASH=69640eee59d46fae18ecadf92189b4b20b63eb206bf4034d5aaf2bcf68a8b53b
 
 # SGX MRENCLAVE
-SGX_MRENCLAVE=cc28d7121684a5141435a4eb660a2f44ad3fdd67c44f0c351e6c1c2d1c043a8f
+SGX_MRENCLAVE=72258d3cae0e9901d0efc1f630064f1c44f11950bd25fee0b62ec8df84532da2
 
 # SGXGETH MRENCLAVE
-SGXGETH_MRENCLAVE=d8395bb1ae83b13c2a9d8430f09137ec179a424926aee9c0639cda70936305b9
+SGXGETH_MRENCLAVE=398be8424f27802b38e6e8d3413bf6a0b187349e68522a218f5bfc00279006ac

.gitignore

@@ -63,6 +63,7 @@ perf.data.old
 .vscode/
 
 log.build.*
+docker/enclave-key.pem
 
 # Python
 # -----------------------------------------------------------------------------------------

Cargo.toml

@@ -47,19 +47,19 @@ raiko-reqactor = { path = "./reqactor" }
 raiko-ballot = { path = "./ballot" }
 
 # reth
-reth-primitives = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "v1.0.0-rc.2-taiko-shasta", default-features = false, features = [
+reth-primitives = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "ignore-anchor-failure", default-features = false, features = [
     "alloy-compat",
     "taiko",
     "k256",
 ] }
-reth-evm-ethereum = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "v1.0.0-rc.2-taiko-shasta", default-features = false }
-reth-evm = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "v1.0.0-rc.2-taiko-shasta", default-features = false }
-reth-rpc-types = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "v1.0.0-rc.2-taiko-shasta", default-features = false }
-reth-revm = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "v1.0.0-rc.2-taiko-shasta", default-features = false }
-reth-chainspec = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "v1.0.0-rc.2-taiko-shasta", default-features = false, features = [
+reth-evm-ethereum = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "ignore-anchor-failure", default-features = false }
+reth-evm = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "ignore-anchor-failure", default-features = false }
+reth-rpc-types = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "ignore-anchor-failure", default-features = false }
+reth-revm = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "ignore-anchor-failure", default-features = false }
+reth-chainspec = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "ignore-anchor-failure", default-features = false, features = [
     "taiko",
 ] }
-reth-provider = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "v1.0.0-rc.2-taiko-shasta", default-features = false }
+reth-provider = { git = "https://github.com/taikoxyz/taiko-reth.git", branch = "ignore-anchor-failure", default-features = false }
 
 # risc zero
 risc0-zkvm = { version = "3.0.3", features = ["prove", "getrandom"] }

Dockerfile

@@ -1,3 +1,5 @@
+ARG RAIKO_RUNTIME_BASE_IMAGE=us-docker.pkg.dev/evmchain/images/raiko:base-clean
+
 FROM ghcr.io/edgelesssys/ego-dev:v1.8.1 AS build-gaiko
 WORKDIR /opt/gaiko
 
@@ -12,8 +14,22 @@ RUN ego-go build -o gaiko-ego ./cmd/gaiko
 
 # Sign with our enclave config and private key
 COPY gaiko/ego/enclave.json .
-COPY docker/enclave-key.pem private.pem
-RUN ego sign && ego bundle gaiko-ego gaiko
+ARG ENCLAVE_KEY_PUBLIC_SHA256
+# CI/local compose builds use a throwaway key; release builds pass a secret and hash.
+RUN --mount=type=secret,id=enclave_key,target=/run/secrets/enclave-key.pem \
+    set -e; \
+    trap 'rm -f private.pem' EXIT; \
+    if [ -s /run/secrets/enclave-key.pem ]; then \
+        if [ -n "${ENCLAVE_KEY_PUBLIC_SHA256}" ]; then \
+            test "$(openssl rsa -in /run/secrets/enclave-key.pem -pubout 2>/dev/null | openssl sha256 | awk '{print $2}')" = "${ENCLAVE_KEY_PUBLIC_SHA256}"; \
+        fi; \
+        cp /run/secrets/enclave-key.pem private.pem; \
+    else \
+        test -z "${ENCLAVE_KEY_PUBLIC_SHA256}"; \
+        openssl genrsa -3 -out private.pem 3072; \
+    fi; \
+    ego sign && \
+    ego bundle gaiko-ego gaiko
 RUN ego uniqueid gaiko-ego 2>&1 | tee /tmp/gaiko_uniqueid.log
 RUN ego signerid gaiko-ego
 
@@ -64,9 +80,9 @@ RUN cargo build --release ${BUILD_FLAGS} --features "sgx" --features "docker_bui
 # RUN sed -i 's/#default quoting type = ecdsa_256/default quoting type = ecdsa_256/' /etc/aesmd.conf && \
 #     sed -i 's/,"use_secure_cert": true/,"use_secure_cert": false/' /etc/sgx_default_qcnl.conf
 
-# use base image from us-docker.pkg.dev/evmchain/images/raiko:base
+# use base image from us-docker.pkg.dev/evmchain/images/raiko:base-clean
 # to avoid re-setup all intel sgx dependencies, some of them are not available in repository
-FROM us-docker.pkg.dev/evmchain/images/raiko:base AS runtime
+FROM ${RAIKO_RUNTIME_BASE_IMAGE} AS runtime
 ENV DEBIAN_FRONTEND=noninteractive
 WORKDIR /opt/raiko
 
@@ -87,13 +103,26 @@ COPY --from=builder /opt/raiko/host/config/chain_spec_list_devnet.json /etc/raik
 COPY --from=builder /opt/raiko/target/release/sgx-guest ./bin/
 COPY --from=builder /opt/raiko/target/release/raiko-host ./bin/
 COPY --from=builder /opt/raiko/target/release/raiko-setup ./bin/
-COPY --from=builder /opt/raiko/docker/enclave-key.pem /root/.config/gramine/enclave-key.pem
 
 ARG EDMM=0
+ARG ENCLAVE_KEY_PUBLIC_SHA256
 ENV EDMM=${EDMM}
 WORKDIR /opt/raiko/bin
-RUN gramine-manifest -Dlog_level=error -Ddirect_mode=0 -Darch_libdir=/lib/x86_64-linux-gnu/ ../provers/sgx/config/sgx-guest.local.manifest.template sgx-guest.manifest && \
-    gramine-sgx-sign --manifest sgx-guest.manifest --output sgx-guest.manifest.sgx && \
+RUN --mount=type=secret,id=enclave_key,target=/run/secrets/enclave-key.pem \
+    set -e; \
+    enclave_key_path=/tmp/enclave-key.pem; \
+    trap 'rm -f "$enclave_key_path"' EXIT; \
+    if [ -s /run/secrets/enclave-key.pem ]; then \
+        if [ -n "${ENCLAVE_KEY_PUBLIC_SHA256}" ]; then \
+            test "$(openssl rsa -in /run/secrets/enclave-key.pem -pubout 2>/dev/null | openssl sha256 | awk '{print $2}')" = "${ENCLAVE_KEY_PUBLIC_SHA256}"; \
+        fi; \
+        cp /run/secrets/enclave-key.pem "$enclave_key_path"; \
+    else \
+        test -z "${ENCLAVE_KEY_PUBLIC_SHA256}"; \
+        openssl genrsa -3 -out "$enclave_key_path" 3072; \
+    fi; \
+    gramine-manifest -Dlog_level=error -Ddirect_mode=0 -Darch_libdir=/lib/x86_64-linux-gnu/ ../provers/sgx/config/sgx-guest.local.manifest.template sgx-guest.manifest && \
+    gramine-sgx-sign --key "$enclave_key_path" --manifest sgx-guest.manifest --output sgx-guest.manifest.sgx && \
     gramine-sgx-sigstruct-view "sgx-guest.sig" 2>&1 | tee /tmp/sgx_sigstruct.log
 
 

core/src/lib.rs

@@ -325,17 +325,16 @@ pub fn merge(a: &mut Value, b: &Value) {
 
 #[cfg(test)]
 mod tests {
-    use crate::interfaces::{aggregate_shasta_proposals, ShastaProposalCheckpoint};
+    use crate::interfaces::aggregate_shasta_proposals;
     use crate::preflight::parse_l1_batch_proposal_tx_for_shasta_fork;
     use crate::{interfaces::ProofRequest, provider::rpc::RpcBlockDataProvider, ChainSpec, Raiko};
     use alloy_primitives::Address;
-    use alloy_provider::Provider;
     use env_logger;
     use raiko_lib::input::{RawProof, ShastaAggregationGuestInput, ShastaRawAggregationGuestInput};
     use raiko_lib::protocol_instance::shasta_pcd_aggregation_hash;
     use raiko_lib::{
-        consts::{Network, SupportedChainSpecs},
-        input::{AggregationGuestOutput, BlobProofType, GuestBatchInput, GuestBatchOutput},
+        consts::SupportedChainSpecs,
+        input::{AggregationGuestOutput, BlobProofType},
         primitives::B256,
         proof_type::ProofType,
         prover::Proof,
@@ -349,11 +348,6 @@ mod tests {
         ProofType::from_str(&proof_type).unwrap()
     }
 
-    fn is_ci() -> bool {
-        let ci = env::var("CI").unwrap_or("0".to_string());
-        ci == "1"
-    }
-
     fn test_proof_params(enable_aggregation: bool) -> HashMap<String, Value> {
         let mut prover_args = HashMap::new();
         prover_args.insert(

core/src/preflight/mod.rs

@@ -158,13 +158,19 @@ pub async fn batch_preflight<BDP: BlockDataProvider>(
         .cloned()
         .zip(pool_txs_list.iter().cloned())
         .collect();
+    let mut batch_block_offset: usize = 0;
     for task_batch in tasks.chunks(chunk_size) {
+        let batch_start_idx = batch_block_offset;
+        batch_block_offset += task_batch.len();
         let task_batch_vec = task_batch.to_vec();
         let taiko_guest_batch_input = taiko_guest_batch_input.clone();
         let taiko_chain_spec = taiko_chain_spec.clone();
         let handle = tokio::spawn(async move {
             let mut chunk_guest_input = Vec::new();
-            for ((prove_block, parent_block), txs_with_force_inc_flag) in task_batch_vec {
+            for (local_i, ((prove_block, parent_block), txs_with_force_inc_flag)) in
+                task_batch_vec.into_iter().enumerate()
+            {
+                let batch_block_idx = batch_start_idx + local_i;
                 let taiko_chain_spec = taiko_chain_spec.clone();
                 let taiko_guest_batch_input = taiko_guest_batch_input.clone();
 
@@ -222,8 +228,11 @@ pub async fn batch_preflight<BDP: BlockDataProvider>(
                 )
                 .await?;
 
-                // Now re-execute the transactions in the block to collect all required data
-                let mut builder = RethBlockBuilder::new(&input, provider_db);
+                // Now re-execute the transactions in the block to collect all required data.
+                // Match guest batch execution (`core::Raiko::batch_input`): only the first L2 block
+                // in this proposal batch must satisfy Shasta anchor `prevAnchorBlockNumber` rules.
+                let mut builder = RethBlockBuilder::new(&input, provider_db)
+                    .set_is_first_block_in_proposal(batch_block_idx == 0);
 
                 // Optimize data gathering by executing the transactions multiple times so data can be requested in batches
                 let mut pool_txs = vec![anchor_tx.clone()];

docker/Dockerfile.base-clean

@@ -0,0 +1,12 @@
+FROM us-docker.pkg.dev/evmchain/images/raiko:base AS scrubber
+
+RUN rm -f /root/.config/gramine/enclave-key.pem
+
+FROM scratch
+COPY --from=scrubber / /
+
+ENV PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ENV DEBIAN_FRONTEND=noninteractive
+ENV EDMM=1
+WORKDIR /opt/raiko/bin
+ENTRYPOINT ["/opt/raiko/bin/entrypoint.sh"]

host/config/chain_spec_list_default.json

@@ -97,10 +97,10 @@
         "beacon_rpc": null,
         "verifier_address_forks": {
             "SHASTA": {
-                "SGX": "0xa1018Ba2e22139076f91dA2A856B2CAB22d968F6",
+                "SGX": "0x9D3C595BFf6Ff7D2b2CbdEcF94aD917eB2fCFFd8",
                 "RISC0": "0x059dAF31F571da48Ab4e74Ae12F64f907681Cd8b",
                 "SP1": "0x96337327648dcFA22b014009cf10A2D5E2F305f6",
-                "SGXGETH": "0x08568Df252ecf37D6C3eFD24f6ca3688118697F1"
+                "SGXGETH": "0x41e79EB4F03aBB5DF8716B759528dc5d8f6a84Ee"
             }
         },
         "genesis_time": 0,
@@ -173,4 +173,4 @@
         "seconds_per_slot": 1,
         "is_taiko": true
     }
-]
+]

host/config/chain_spec_list_devnet.json

@@ -31,7 +31,7 @@
                 "RISC0": null
             }
         },
-        "genesis_time": 1769395300,
+        "genesis_time": 1782220308,
         "seconds_per_slot": 12,
         "is_taiko": false
     },
@@ -50,7 +50,7 @@
                 "Block": 0
             },
             "SHASTA": {
-                "Timestamp": 1769396301
+                "Timestamp": 0
             },
             "CANCUN": "TBD"
         },
@@ -61,28 +61,21 @@
             "elasticity_multiplier": "0x2"
         },
         "l1_contract": {
-            "PACAYA": "0x3b37a799290950fef954dfF547608baC52A12571",
-            "SHASTA": "0x12100faa7b157e9947340B44409fC7E27EC0ABef"
+            "SHASTA": "0xb432bbe475e569B2ADef4830Ae43D587932F139C"
         },
         "l2_contract": "0x1670010000000000000000000000000000010001",
         "rpc": "https://rpc.internal.taiko.xyz",
         "beacon_rpc": null,
         "verifier_address_forks": {
-            "PACAYA": {
-                "SGX": "0x9D351F6E72e3095F24dD854c9B8CA69F99A2C538",
-                "SP1": "0xCb2D625BF8C2187B180646aF4738AF5F1413Fb70",
-                "RISC0": "0x48940F7ab2C674Aa66C09eDa71614aD704E9d007",
-                "SGXGETH": "0x6B455442C8C4cAC2e09c40409E8bf7FfcdB1Fc50"
-            },
             "SHASTA": {
-                "SGX": "0x9D351F6E72e3095F24dD854c9B8CA69F99A2C538",
+                "SGX": "0x6fF4A33Fe3766D08251247Daab78F7ebEAD7Db72",
                 "SP1": "0xCb2D625BF8C2187B180646aF4738AF5F1413Fb70",
                 "RISC0": "0x48940F7ab2C674Aa66C09eDa71614aD704E9d007",
-                "SGXGETH": "0x6B455442C8C4cAC2e09c40409E8bf7FfcdB1Fc50"
+                "SGXGETH": "0xb31e61a8b6Fb5A9573dC1a0B328b1BD184dca98E"
             }
         },
         "genesis_time": 0,
         "seconds_per_slot": 1,
         "is_taiko": true
     }
-]
+]

lib/src/consts.rs

@@ -357,7 +357,7 @@ mod tests {
             .unwrap();
         assert_eq!(
             verifier_address,
-            address!("a1018Ba2e22139076f91dA2A856B2CAB22d968F6")
+            address!("9D3C595BFf6Ff7D2b2CbdEcF94aD917eB2fCFFd8")
         );
     }