Repository navigation
platform: Move the OpenVM platform to this package (bflat manifest schema 2) - #5
Merged
Merged
Conversation
The package manifest uses the bflat manifest, schema 2: objects in place of static_lib, a platform condition (zkvm_openvm) in place of libc, and version in place of package_version. Unknown top-level keys are an error in schema 2, so the release workflow injects openvm_ref under metadata. The guest-link job checks the new layout path of the OpenVM memory map (lib/modules/zkvm_openvm). Needs a bflat that reads schema 2 (bflat-riscv64 refactor/prep). Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
bflat no longer knows OpenVM: the openvm platform is here. platform/ has the entry point (entry.S, from bflat's zkvm_openvm), the memory map and the platform manifest with the ISA, ABI, RyuJIT options, ZKVM_OPENVM and the memcpy/memmove/memset wraps that entry.S defines. platform/build.sh builds it with the RISC-V binutils only; build/build.sh runs it, and the package and the release carry the files next to libopenvm.a. The bindings manifest applies on the openvm platform only and links libopenvm.a in front of the linker script as before. --extlib with libopenvm.bflat.manifest reads the platform manifest in the same directory, so consumers do not change. The guest-link job no longer compares the layout copy of the memory map: there is none. The entry-point unit tests came with the code (tests/platform, run under qemu-user in the new platform-tests job). Needs the bflat that reads platforms from packages (bflat-riscv64 refactor/prep; the link-guest job takes it through bflat_ref). Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
bflat's pal no longer holds code for any one zkVM; the entry object defines what it calls, and no longer exports the __zkvm_target_openvm marker: TERMINATE becomes zkvm_platform_exit and the PrintStr phantom becomes zkvm_platform_write (the descriptor is ignored, as before). OpenVM defines no zkvm_platform_syscall, so raw syscalls keep failing. The unit tests check that zkvm_platform_exit traps under qemu-user instead of falling back to a Linux exit. Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
bflat does not read this flag any more. Its only reader was an IL rewrite that bflat removed when the nofp module stopped trapping the exact libm operations. Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
bflat now checks the signature of an --extlib .nupkg (docs/signing.md in bflat-riscv64). The release job signs the package after dotnet pack and before the push and the GitHub release, with the secret BFLAT_SIGNING_KEY. scripts/sign_package.py is a copy of the script in bflat-riscv64. A run that publishes nothing can be unsigned when the secret is not set; a run that publishes stops without the secret. Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
bflat added JitObjectStackAllocation=1, JitObjectStackAllocationSize=2000, JitExtDefaultPolicyMaxIL=200 and JitExtDefaultPolicyMaxBB=10 to every optimized build. bflat now takes them from codegen.options of the platform, so this manifest gives them, with the same condition.
The build job had BFLAT_SIGNING_KEY, so the whole build ran where the key was. Now the build job lists the package entries without a key (sign_package.py list-nupkg), the sign job (sign.yml of bflat-riscv64) signs the lists, and a new publish job adds the signatures (sign_package.py embed), checks them with BFLAT_SIGNING_PUBLIC_KEY, and pushes the package. The GitHub release takes the signed package from the publish job. sign_package.py is the new copy from bflat-riscv64.
A run that is run again keeps its run number, and with it the package version. The NuGet push skipped the package that was there already (--skip-duplicate), and the GitHub release step then replaced the files of the release of that version. The release and the package on NuGet did not agree after that. Stop the build when the GitHub release of the version exists, before the sign job. Let the NuGet push fail on a duplicate version, so that a release step cannot run without a new package. Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
The release step did not give a commit for the tag, so the tag went on the head of the default branch. A run from another branch then made a release whose tag did not name its sources. Tag github.sha. Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
The sign job gets the private key, so a change to sign.yml in bflat-riscv64 must not reach this workflow before this repository takes it. The sign job gets no token permissions, and the third-party actions are given by SHA. The other jobs get only contents: read. Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
The configuration in openvm.toml was SdkVmConfig::standard() of the SDK, which is also what ere uses. The runner now makes it from SdkVmConfig::standard() and the parameters of AppConfig by default, and takes only the ELF and the input. A guest of bflat --libc openvm then needs no file next to the ELF. The jobs that run the published image give it "-", the standard configuration that the image ships, until the next image is released. Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
The published image takes the path of a configuration file, and the runner no longer has one. The job of the division hint builds the image of this commit; it now saves it as an artifact, and the u256 and secp256k1 jobs load it and run the guests with no configuration. Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
The platform of this package is for the schema 2 manifest, which only the bflat of refactor/prep reads; the bflat of feature/new_zkvms stops with "No matching build in manifest". That bflat builds for .NET 11 only, with no variant arguments of build.sh, and checks the signatures of the releases that it downloads. - bflat_ref is refactor/prep. Change it to master when refactor/prep is in master. - The job takes the .NET 11 SDK of the CI of bflat-riscv64, and gives bflat BFLAT_SIGNING_PUBLIC_KEY. Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
maximmenshikov
force-pushed
the
manifest-schema-2
branch
from
October 27, 2026 14:38
3de61fa to
1ffdf10
Compare
refactor/prep is in master of bflat-riscv64 (NethermindEth/bflat-riscv64#65), thus the link-guest job builds bflat from master. The bflat_ref input is removed: CodeQL reports the checkout of a ref from a dispatch input, followed by the execution of its code, as a cache poisoning risk (actions/cache-poisoning/poisonable-step). Signed-off-by: Maxim Menshikov <maksim.menshikov@nethermind.io>
maximmenshikov
force-pushed
the
manifest-schema-2
branch
from
October 27, 2026 19:57
5bc89b1 to
0c946a1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Move the OpenVM platform from bflat-riscv64 to this package, with the schema 2 manifest of bflat.
build: the bflat manifest is schema 2.platform/: the manifests and the code of the openvm platform(s): entry, memory map, linker script, the platform interface of the bflat PAL, the RyuJIT tuning and the post-link steps. bflat no longer knows the zkVM by itself;--libcselects the platform and--extlibgives the package.release: the nupkg is signed by the reusable workflowsign.ymlof bflat-riscv64. The workflow stops when the release of the version exists, and the tag goes on the commit that was built.Merge together with NethermindEth/bflat-riscv64 refactor/prep, before it: the CI of bflat-riscv64 takes the platforms from
mainof this repo.Testing: release
2.1.0.52is built and signed from this branch. bflat-riscv64 CI withpackages_ref=manifest-schema-2(run 40440053236) builds the guest for this platform.Also in this PR (from #6):
SdkVmConfig::standard()and takes noopenvm.toml(openvm-runelf <elf> <input-bytes>).runner/openvm.tomlwas the standard configuration, in the same order. ere uses the same configuration, so a guest needs only its ELF. The division hint is still registered only by this runner.link-guestbuilds bflat fromrefactor/prep(.NET 11, signature checks on). Changebflat_reftomasterwhen bflat: Move the zkVM platforms to the packages, sign the downloads, build only .NET 11 perf bflat-riscv64#65 is in master.🤖 Generated with Claude Code