Optional proofs

.dockerignore

@@ -1,3 +1,8 @@
+.git
+.claude
+.config
+book
+md-docs
 testing/ef_tests/consensus-spec-tests
 testing/execution_engine_integration/execution_clients
 target/

.github/workflows/docker.yml

@@ -1,22 +1,18 @@
 name: docker
 
 on:
-    push:
-        branches:
-            - unstable
-            - stable
-        tags:
-            - v*
+    workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 env:
-    DOCKER_PASSWORD: ${{ secrets.DH_KEY }}
-    DOCKER_USERNAME: ${{ secrets.DH_ORG }}
     # Enable self-hosted runners for the sigp repo only.
     SELF_HOSTED_RUNNERS: ${{ github.repository == 'sigp/lighthouse' }}
+    REGISTRY: ghcr.io
+    CC: clang-5.0
+    CXX: clang++-5.0
 
 jobs:
     # Extract the VERSION which is either `latest` or `vX.Y.Z`, and the VERSION_SUFFIX
@@ -38,6 +34,11 @@ jobs:
               run: |
                     echo "VERSION=latest" >> $GITHUB_ENV
                     echo "VERSION_SUFFIX=-unstable" >> $GITHUB_ENV
+            - name: Extract version (if optional-proofs)
+              if: github.event.ref == 'refs/heads/optional-proofs'
+              run: |
+                    echo "VERSION=latest" >> $GITHUB_ENV
+                    echo "VERSION_SUFFIX=-optional-proofs" >> $GITHUB_ENV
             - name: Extract version (if tagged release)
               if: startsWith(github.event.ref, 'refs/tags')
               run: |
@@ -48,12 +49,14 @@ jobs:
             VERSION_SUFFIX: ${{ env.VERSION_SUFFIX }}
     build-docker-single-arch:
         name: build-docker-${{ matrix.binary }}-${{ matrix.cpu_arch }}${{ matrix.features.version_suffix }}
+        permissions:
+            contents: read
+            packages: write
         # Use self-hosted runners only on the sigp repo.
         runs-on: ${{ github.repository == 'sigp/lighthouse' && fromJson('["self-hosted", "linux", "release"]') || 'ubuntu-22.04'  }}
         strategy:
             matrix:
-                binary:   [lighthouse,
-                           lcli]
+                binary:   [lighthouse]
                 cpu_arch: [aarch64,
                            x86_64]
                 include:
@@ -68,9 +71,12 @@ jobs:
             - name: Update Rust
               if: env.SELF_HOSTED_RUNNERS == 'false'
               run: rustup update stable
-            - name: Dockerhub login
-              run: |
-                  echo "${DOCKER_PASSWORD}" | docker login --username ${DOCKER_USERNAME} --password-stdin
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@v3
+              with:
+                  registry: ${{ env.REGISTRY }}
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Sets env vars for Lighthouse
               if: startsWith(matrix.binary, 'lighthouse')
@@ -82,11 +88,6 @@ jobs:
               run: |
                 echo "MAKE_CMD=build-${{ matrix.cpu_arch }}" >> $GITHUB_ENV
 
-            - name: Set `make` command for lcli
-              if: startsWith(matrix.binary, 'lcli')
-              run: |
-                echo "MAKE_CMD=build-lcli-${{ matrix.cpu_arch }}" >> $GITHUB_ENV
-
             - name: Cross build binaries
               run: |
                   cargo install cross
@@ -123,28 +124,17 @@ jobs:
                 platforms: linux/${{ env.SHORT_ARCH }}
                 push: true
                 tags: |
-                  ${{ github.repository_owner}}/${{ matrix.binary }}:${{ env.VERSION }}-${{ env.SHORT_ARCH }}${{ env.VERSION_SUFFIX }}
-
-            - name: Build and push (lcli)
-              if: startsWith(matrix.binary, 'lcli')
-              uses: docker/build-push-action@v5
-              with:
-                file: ./lcli/Dockerfile.cross
-                context: .
-                platforms: linux/${{ env.SHORT_ARCH }}
-                push: true
-
-                tags: |
-                  ${{ github.repository_owner}}/${{ matrix.binary }}:${{ env.VERSION }}-${{ env.SHORT_ARCH }}${{ env.VERSION_SUFFIX }}
-
+                  ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.binary }}:${{ env.VERSION }}-${{ env.SHORT_ARCH }}${{ env.VERSION_SUFFIX }}
 
     build-docker-multiarch:
         name: build-docker-${{ matrix.binary }}-multiarch
+        permissions:
+            contents: read
+            packages: write
         runs-on: ubuntu-22.04
         strategy:
             matrix:
-                binary: [lighthouse,
-                         lcli]
+                binary: [lighthouse]
         needs: [build-docker-single-arch, extract-version]
         env:
             VERSION: ${{ needs.extract-version.outputs.VERSION }}
@@ -153,13 +143,21 @@ jobs:
             - name: Set up Docker Buildx
               uses: docker/setup-buildx-action@v3
 
-            - name: Dockerhub login
-              run: |
-                  echo "${DOCKER_PASSWORD}" | docker login --username ${DOCKER_USERNAME} --password-stdin
+            - name: Login to GitHub Container Registry
+              uses: docker/login-action@v3
+              with:
+                  registry: ${{ env.REGISTRY }}
+                  username: ${{ github.actor }}
+                  password: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Create and push multiarch manifests
               run: |
-                  docker buildx imagetools create -t ${{ github.repository_owner}}/${{ matrix.binary }}:${VERSION}${VERSION_SUFFIX} \
-                      ${{ github.repository_owner}}/${{ matrix.binary }}:${VERSION}-arm64${VERSION_SUFFIX} \
-                      ${{ github.repository_owner}}/${{ matrix.binary }}:${VERSION}-amd64${VERSION_SUFFIX};
-
+                  docker buildx imagetools create -t ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.binary }}:${VERSION}${VERSION_SUFFIX} \
+                      ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.binary }}:${VERSION}-arm64${VERSION_SUFFIX} \
+                      ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.binary }}:${VERSION}-amd64${VERSION_SUFFIX};
+            - name: Tag optional-proofs image as latest
+              if: github.event.ref == 'refs/heads/optional-proofs'
+              run: |
+                  docker buildx imagetools create -t ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.binary }}:latest \
+                      ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.binary }}:${VERSION}-arm64${VERSION_SUFFIX} \
+                      ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.binary }}:${VERSION}-amd64${VERSION_SUFFIX};

.github/workflows/kurtosis-eip8025.yml

@@ -0,0 +1,139 @@
+# Test that the EIP-8025 Kurtosis testnet starts and the proof engine integrates
+# correctly with real zkboost-server backends.
+name: kurtosis eip8025
+
+on:
+  push:
+    branches:
+      - unstable
+  pull_request:
+  merge_group:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  run-eip8025-testnet:
+    runs-on: ${{ github.repository == 'sigp/lighthouse' && 'warp-ubuntu-latest-x64-8x' || 'ubuntu-latest' }}
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Kurtosis
+        run: |
+          echo "deb [trusted=yes] https://sdk.kurtosis.com/kurtosis-cli-release-artifacts/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
+          sudo apt update
+          sudo apt install -y kurtosis-cli
+          kurtosis analytics disable
+
+      - name: Install yq
+        run: |
+          sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
+          sudo chmod +x /usr/local/bin/yq
+
+      - name: Start EIP-8025 zkboost testnet
+        run: ./start_eip8025_testnet.sh -e eip8025-zkboost -n network_params_eip8025_zkboost.yaml
+        working-directory: scripts/local_testnet
+
+      - name: Wait for chain liveness
+        run: |
+          BEACON_URL=$(kurtosis port print eip8025-zkboost cl-1-lighthouse-reth http)
+          echo "Polling $BEACON_URL for head slot > 10..."
+          for i in $(seq 1 20); do
+            SLOT=$(curl -sf "$BEACON_URL/eth/v1/beacon/headers/head" \
+              | jq -r '.data.header.message.slot' 2>/dev/null || echo 0)
+            echo "  attempt $i: head slot = $SLOT"
+            if [ "$SLOT" -gt 10 ]; then
+              echo "Chain is live at slot $SLOT"
+              break
+            fi
+            if [ "$i" -eq 20 ]; then
+              echo "Timed out waiting for head slot > 10"
+              exit 1
+            fi
+            sleep 30
+          done
+
+      - name: Inspect beacon node state
+        run: |
+          set -euo pipefail
+          ENCLAVE=eip8025-zkboost
+          SERVICES=(cl-1-lighthouse-reth cl-2-lighthouse-reth cl-3-lighthouse-reth cl-4-lighthouse-reth)
+          FAILED=0
+
+          for SVC in "${SERVICES[@]}"; do
+            URL=$(kurtosis port print "$ENCLAVE" "$SVC" http)
+            echo "=== $SVC ($URL) ==="
+
+            # Syncing status — must not be syncing
+            SYNCING=$(curl -sf "$URL/eth/v1/node/syncing" | jq -r '.data.is_syncing')
+            echo "  is_syncing: $SYNCING"
+            if [ "$SYNCING" != "false" ]; then
+              echo "  FAIL: $SVC is still syncing"
+              FAILED=1
+            fi
+
+            # Peer count — must have at least one connected peer
+            PEERS=$(curl -sf "$URL/eth/v1/node/peer_count" | jq -r '.data.connected')
+            echo "  connected peers: $PEERS"
+            if [ "${PEERS:-0}" -lt 1 ]; then
+              echo "  FAIL: $SVC has no connected peers"
+              FAILED=1
+            fi
+
+            # Head slot — must be non-zero
+            SLOT=$(curl -sf "$URL/eth/v1/beacon/headers/head" | jq -r '.data.header.message.slot')
+            echo "  head slot: $SLOT"
+            if [ "${SLOT:-0}" -lt 1 ]; then
+              echo "  FAIL: $SVC head slot is 0"
+              FAILED=1
+            fi
+
+            # Finality checkpoints — informational, log the finalized epoch
+            FINALIZED=$(curl -sf "$URL/eth/v1/beacon/states/head/finality_checkpoints" \
+              | jq -r '.data.finalized.epoch')
+            echo "  finalized epoch: $FINALIZED"
+          done
+
+          exit "$FAILED"
+
+      - name: Check zkboost sidecars are running and generating proofs
+        run: |
+          ENCLAVE=eip8025-zkboost
+
+          # Both zkboost services must be in RUNNING state
+          kurtosis enclave inspect "$ENCLAVE" | grep -E "zkboost-[12].*RUNNING" \
+            || { echo "FAIL: one or more zkboost services not in RUNNING state"; exit 1; }
+
+          # Each zkboost sidecar must have generated at least one proof.
+          # Check via the Prometheus metrics endpoint (zkboost_prove_total) rather than
+          # log scraping — kurtosis service logs may not be available in all CI environments.
+          for SVC in zkboost-1 zkboost-2; do
+            URL=$(kurtosis port print "$ENCLAVE" "$SVC" http)
+            COUNT=$(curl -sf "$URL/metrics" \
+              | awk '/^zkboost_prove_total\{/ {sum += $2} END {print int(sum)}')
+            echo "$SVC: $COUNT proofs generated"
+            if [ "${COUNT:-0}" -lt 1 ]; then
+              echo "FAIL: $SVC has not generated any proofs"
+              exit 1
+            fi
+          done
+
+      - name: Stop testnet and collect logs
+        if: always()
+        run: |
+          mkdir -p scripts/local_testnet/logs
+          ENCLAVE=eip8025-zkboost
+          for SVC in cl-1-lighthouse-reth cl-2-lighthouse-reth cl-3-lighthouse-reth cl-4-lighthouse-reth \
+                     zkboost-1 zkboost-2; do
+            kurtosis service logs "$ENCLAVE" "$SVC" > "scripts/local_testnet/logs/${SVC}.log" 2>&1 || true
+          done
+          kurtosis enclave rm -f "$ENCLAVE" || true
+
+      - name: Upload logs artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: logs-kurtosis-eip8025
+          path: scripts/local_testnet/logs
+          retention-days: 3

.github/workflows/local-testnet.yml

@@ -38,7 +38,7 @@ jobs:
 
       - name: Install Kurtosis
         run: |
-          echo "deb [trusted=yes] https://apt.fury.io/kurtosis-tech/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
+          echo "deb [trusted=yes] https://sdk.kurtosis.com/kurtosis-cli-release-artifacts/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
           sudo apt update
           sudo apt install -y kurtosis-cli
           kurtosis analytics disable
@@ -106,7 +106,7 @@ jobs:
 
       - name: Install Kurtosis
         run: |
-          echo "deb [trusted=yes] https://apt.fury.io/kurtosis-tech/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
+          echo "deb [trusted=yes] https://sdk.kurtosis.com/kurtosis-cli-release-artifacts/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
           sudo apt update
           sudo apt install -y kurtosis-cli
           kurtosis analytics disable
@@ -142,7 +142,7 @@ jobs:
 
       - name: Install Kurtosis
         run: |
-          echo "deb [trusted=yes] https://apt.fury.io/kurtosis-tech/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
+          echo "deb [trusted=yes] https://sdk.kurtosis.com/kurtosis-cli-release-artifacts/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
           sudo apt update
           sudo apt install -y kurtosis-cli
           kurtosis analytics disable
@@ -185,7 +185,7 @@ jobs:
 
       - name: Install Kurtosis
         run: |
-          echo "deb [trusted=yes] https://apt.fury.io/kurtosis-tech/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
+          echo "deb [trusted=yes] https://sdk.kurtosis.com/kurtosis-cli-release-artifacts/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
           sudo apt update
           sudo apt install -y kurtosis-cli
           kurtosis analytics disable
@@ -227,7 +227,7 @@ jobs:
 
       - name: Install Kurtosis
         run: |
-          echo "deb [trusted=yes] https://apt.fury.io/kurtosis-tech/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
+          echo "deb [trusted=yes] https://sdk.kurtosis.com/kurtosis-cli-release-artifacts/ /" | sudo tee /etc/apt/sources.list.d/kurtosis.list
           sudo apt update
           sudo apt install -y kurtosis-cli
           kurtosis analytics disable