Update to Zisk v1.0.0-alpha via the argumentcomputer blake3-precompile fork

Sources move from upstream v0.17.0 to the argumentcomputer/zisk fork at
e4057c4c (blake3-precompile), which is upstream v1.0.0-alpha plus a Blake3
compression precompile, with pil2-proofman pinned at v1.0.0-alpha and the
Zisk Rust toolchain at zisk-1.0.0 (rustc 1.94.0).

Build fixes for the new versions:
- Vendored proofman-starks-lib-c build.rs acquires a file lock next to the
  pil2-stark sources; relocate it to OUT_DIR since the prebuilt pil2-stark
  is a read-only store path.
- Vendored pil2-stark-setup embeds the proofman repo-root package.json via
  include_str\!("../../package.json"); copy the file into the extracted
  crate during vendoring.
- gmp-mpfr-sys builds GMP from source and needs m4/file.
- The +zisk rustup selector seds follow the CLI split (user/dev commands).

Layout changes:
- cargo-zisk-dev (new home of check-setup and proofman-setup) is built,
  wrapped, and linked into zisk-home.
- libziskc.a moves to bin/ (emulator-asm links it via -L../../bin) and
  zisk-home ships lib-c/c/src headers, mirroring the release tarball.
- install-proving-key fetches the fork-matching key (extra Blake3f AIR)
  from argument-zisk-setup S3 and regenerates const-trees with
  cargo-zisk-dev check-setup, matching ziskup's flow.
- Dev shell exports ZISK_HOME, the env var the new binaries read.

The sha_hasher template consumes zisk-sdk/ziskos from the fork branch. The
Docker image fetches ziskup from the fork rev and gains an
install-proving-key script for the fork key alongside ziskup's upstream key
install (upstream binaries need the upstream key; fork-built SDK hosts need
the fork key).

Author: samuelburnham

docker/Dockerfile

@@ -1,27 +1,69 @@
 FROM ubuntu:24.04
 
 ENV DEBIAN_FRONTEND=noninteractive
+ENV SHELL=/bin/bash
 
 # Base Zisk dependencies
+# Source: https://0xpolygonhermez.github.io/zisk/getting_started/installation.html
+# pkg-config/libssl-dev on top of the book's list: needed to cargo-build SDK
+# host programs (openssl-sys) inside the container.
 RUN apt-get update && apt-get install -y \
     xz-utils jq curl build-essential qemu-system \
     libomp-dev libgmp-dev nlohmann-json3-dev protobuf-compiler \
     uuid-dev libgrpc++-dev libsecp256k1-dev libsodium-dev \
     libpqxx-dev nasm libopenmpi-dev openmpi-bin openmpi-common \
     libclang-dev clang gcc-riscv64-unknown-elf git \
+    pkg-config libssl-dev \
     && rm -rf /var/lib/apt/lists/*
 
 # Install Rust
 RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
 ENV PATH="/root/.cargo/bin:${PATH}"
 
-# Install ZisK via ziskup
-# Set SETUP_KEY environment variable to bypass TTY prompt
-RUN curl -fsSL https://raw.githubusercontent.com/0xPolygonHermez/zisk/main/ziskup/install.sh -o /tmp/install.sh && \
-    SETUP_KEY=proving bash /tmp/install.sh && \
-    rm /tmp/install.sh
+# Install the ziskup installer, pinned to the argumentcomputer fork rev the
+# rest of this repo tracks (the fork's ziskup honors the ZISK_VERSION/SETUP_KEY
+# env vars and key modes that zisk-shell relies on). Binaries and setup keys
+# are not installed at build time — run `ziskup` inside the container (or
+# invoke zisk-shell with --gpu/--cpu/--key) to choose them. ziskup installs
+# the ZISK_VERSION *upstream* release binaries and its matching key from the
+# upstream bucket (the fork publishes no releases).
+ARG ZISK_FORK_REV=e4057c4cd6daaa29ea54f283ff27818acc9be8b2
+ARG ZISK_VERSION=1.0.0-alpha
+ENV ZISK_VERSION=${ZISK_VERSION}
+RUN mkdir -p /root/.zisk/bin && \
+    curl -fsSL "https://raw.githubusercontent.com/argumentcomputer/zisk/${ZISK_FORK_REV}/ziskup/ziskup" \
+      -o /root/.zisk/bin/ziskup && \
+    chmod +x /root/.zisk/bin/ziskup
 ENV PATH="/root/.zisk/bin:${PATH}"
 
+# Installer for the fork-matching proving key (extra Blake3f AIR), mirroring
+# this repo's `nix run .#install-proving-key`. Use it INSTEAD of ziskup's key
+# install when the prover is built from the fork sources (e.g. an SDK host
+# linking zisk-sdk from the blake3-precompile branch); use ziskup's upstream
+# key for the upstream release binaries. Both keys land in
+# $ZISK_DIR/provingKey — the last one installed wins.
+# The tarball omits the const-tree files; check-setup (from the ziskup-installed
+# binaries, so run `ziskup` first) regenerates them.
+RUN cat > /root/.zisk/bin/install-proving-key <<'EOF' && chmod +x /root/.zisk/bin/install-proving-key
+#!/usr/bin/env bash
+set -euo pipefail
+ZISK_DIR="${ZISK_DIR:-$HOME/.zisk}"
+command -v cargo-zisk-dev >/dev/null || {
+  echo "cargo-zisk-dev not found - run 'ziskup --nokey' first" >&2
+  exit 1
+}
+KEY_FILE="zisk-provingkey-blake3-e4057c4c-cpu.tar.gz"
+echo "Downloading fork proving key to $ZISK_DIR (this may take a while)..."
+curl -fSL --retry 3 -o "/tmp/$KEY_FILE" \
+  "https://argument-zisk-setup.s3.amazonaws.com/$KEY_FILE"
+rm -rf "$ZISK_DIR/provingKey"
+tar -C "$ZISK_DIR" -xzf "/tmp/$KEY_FILE"
+rm -f "/tmp/$KEY_FILE"
+echo "Generating constant tree..."
+cargo-zisk-dev check-setup --proving-key "$ZISK_DIR/provingKey" -a
+echo "Proving key setup complete."
+EOF
+
 WORKDIR /workspace
 
 CMD ["/bin/bash"]

docker/build-image.nix

@@ -1,10 +1,10 @@
 {pkgs, ...}: let
   dockerfile = ./Dockerfile;
 in
-pkgs.writeShellScriptBin "zisk-build" ''
-  echo "Building Zisk image"
-  ${pkgs.podman}/bin/podman build \
-    -f ${dockerfile} \
-    -t localhost/cargo-zisk:latest \
-    "''${1:-$PWD}"
-''
+  pkgs.writeShellScriptBin "zisk-build" ''
+    echo "Building Zisk image"
+    ${pkgs.podman}/bin/podman build \
+      -f ${dockerfile} \
+      -t localhost/cargo-zisk:latest \
+      "''${1:-$PWD}"
+  ''

docker/zisk-shell.nix

@@ -1,37 +1,104 @@
 # Container will continue running on exit
 # Remove with `podman kill zisk-dev && podman rm zisk-dev`
 {pkgs, ...}:
-pkgs.writeShellScriptBin "zisk-shell" ''
-  set -e
+  pkgs.writeShellScriptBin "zisk-shell" ''
+    set -e
 
-  CONTAINER_NAME="''${ZISK_CONTAINER_NAME:-zisk-dev}"
-  IMAGE_NAME="''${ZISK_IMAGE:-localhost/cargo-zisk:latest}"
-  SHELL="''${ZISK_SHELL:-/bin/bash}"
+    CONTAINER_NAME="''${ZISK_CONTAINER_NAME:-zisk-dev}"
+    IMAGE_NAME="''${ZISK_IMAGE:-localhost/cargo-zisk:latest}"
+    SHELL="''${ZISK_SHELL:-/bin/bash}"
 
-  # Check if container exists
-  if ${pkgs.podman}/bin/podman container exists "$CONTAINER_NAME"; then
-    # Container exists, check if it's running
-    STATUS=$(${pkgs.podman}/bin/podman inspect -f '{{.State.Status}}' "$CONTAINER_NAME")
+    DEVICE=
+    KEY=
+    SETUP=0
 
-    if [ "$STATUS" != "running" ]; then
-      echo "Starting stopped container: $CONTAINER_NAME"
-      ${pkgs.podman}/bin/podman start "$CONTAINER_NAME"
+    usage() {
+      cat <<EOF
+    Usage: zisk-shell [OPTIONS]
+
+    Enter a shell in the Zisk container. If setup options are passed, ziskup is
+    run inside the container before the shell starts (use this to install or
+    switch CPU/GPU binaries and setup keys).
+
+    Options:
+      --gpu, --cpu        Select GPU or CPU binaries
+      --key KEY           Setup key: proving | proving-no-consttree | verify | none
+      --provingkey        Shortcut for --key proving
+      --verifykey         Shortcut for --key verify
+      --nokey             Shortcut for --key none
+      -h, --help          Show this help
+
+    Environment:
+      ZISK_CONTAINER_NAME (default: zisk-dev)
+      ZISK_IMAGE          (default: localhost/cargo-zisk:latest)
+      ZISK_SHELL          (default: /bin/bash)
+    EOF
+    }
+
+    while [ $# -gt 0 ]; do
+      case "$1" in
+        --gpu) DEVICE=gpu; SETUP=1; shift ;;
+        --cpu) DEVICE=cpu; SETUP=1; shift ;;
+        --key) KEY="$2"; SETUP=1; shift 2 ;;
+        --provingkey) KEY=proving; SETUP=1; shift ;;
+        --verifykey) KEY=verify; SETUP=1; shift ;;
+        --nokey) KEY=none; SETUP=1; shift ;;
+        -h|--help) usage; exit 0 ;;
+        *)
+          echo "zisk-shell: unknown option: $1" >&2
+          usage >&2
+          exit 1
+          ;;
+      esac
+    done
+
+    if [ -n "$KEY" ]; then
+      case "$KEY" in
+        proving|proving-no-consttree|verify|none) ;;
+        *)
+          echo "zisk-shell: invalid --key value: $KEY" >&2
+          exit 1
+          ;;
+      esac
+    fi
+
+    PODMAN=${pkgs.podman}/bin/podman
+
+    # Check if container exists
+    if "$PODMAN" container exists "$CONTAINER_NAME"; then
+      STATUS=$("$PODMAN" inspect -f '{{.State.Status}}' "$CONTAINER_NAME")
+
+      if [ "$STATUS" != "running" ]; then
+        echo "Starting stopped container: $CONTAINER_NAME"
+        "$PODMAN" start "$CONTAINER_NAME"
+      else
+        echo "Container $CONTAINER_NAME is already running"
+      fi
     else
-      echo "Container $CONTAINER_NAME is already running"
+      echo "Creating new container: $CONTAINER_NAME"
+      "$PODMAN" run -dit \
+        --name "$CONTAINER_NAME" \
+        --privileged \
+        --ulimit memlock=-1:-1 \
+        --ipc=host \
+        "$IMAGE_NAME" \
+        "$SHELL"
     fi
-  else
-    # Container doesn't exist, create it in detached mode
-    echo "Creating new container: $CONTAINER_NAME"
-    ${pkgs.podman}/bin/podman run -dit \
-      --name "$CONTAINER_NAME" \
-      --privileged \
-      --ulimit memlock=-1:-1 \
-      --ipc=host \
-      "$IMAGE_NAME" \
-      "$SHELL"
-  fi
-
-  # Enter the container using exec
-  echo "Entering container... (container will persist after exit)"
-  ${pkgs.podman}/bin/podman exec -it "$CONTAINER_NAME" "$SHELL"
-''
+
+    if [ "$SETUP" -eq 1 ]; then
+      ZISKUP_ARGS=
+      [ "$DEVICE" = "gpu" ] && ZISKUP_ARGS="$ZISKUP_ARGS --gpu"
+      [ "$DEVICE" = "cpu" ] && ZISKUP_ARGS="$ZISKUP_ARGS --cpu"
+      ENV_ARGS=
+      if [ -n "$KEY" ]; then
+        ENV_ARGS="-e SETUP_KEY=$KEY"
+      fi
+      echo "Running ziskup in container (device=''${DEVICE:-default}, key=''${KEY:-default})"
+      # shellcheck disable=SC2086
+      "$PODMAN" exec -it $ENV_ARGS "$CONTAINER_NAME" \
+        /root/.zisk/bin/ziskup $ZISKUP_ARGS
+    fi
+
+    echo "Entering container... (container will persist after exit)"
+    "$PODMAN" exec -it "$CONTAINER_NAME" "$SHELL"
+  ''

flake.nix

@@ -52,21 +52,18 @@
             builtins.elem (nixpkgs.lib.getName pkg) ["mkl"];
         };
 
+        # argumentcomputer/zisk fork: upstream v1.0.0-alpha + Blake3 compression
+        # precompile. The proving key on S3 is generated from this exact rev,
+        # so the two must move together.
         ziskSrc = pkgs.fetchgit {
-          url = "https://github.com/0xPolygonHermez/zisk";
-          rev = "v0.17.0";
-          sha256 = "sha256-ZVlMF3EUzk1kajzXwnW7+Tj1Ms9p6bFGGZPKx7v1nZo=";
-          fetchSubmodules = true;
-        };
-        ziskSrcLite = pkgs.fetchgit {
-          url = "https://github.com/0xPolygonHermez/zisk";
-          rev = "v0.17.0";
-          sha256 = "sha256-ZVlMF3EUzk1kajzXwnW7+Tj1Ms9p6bFGGZPKx7v1nZo=";
+          url = "https://github.com/argumentcomputer/zisk";
+          rev = "e4057c4cd6daaa29ea54f283ff27818acc9be8b2"; # blake3-precompile
+          sha256 = "sha256-hJyomTWYCDI7sNE/YwFMUS4U1B8lXyDDy/FHEzhoKF4=";
         };
         proofmanSrc = pkgs.fetchgit {
           url = "https://github.com/0xPolygonHermez/pil2-proofman";
-          rev = "v0.17.0";
-          sha256 = "sha256-JmFlGh+q82v/p8Eg0YO6GvwQyyS/dQW0udPGizo2H+g=";
+          rev = "v1.0.0-alpha";
+          sha256 = "sha256-QHI3AsCZzYrgpt6vUAt8uH/dYRjw+/+H+gOJjmg2E+I=";
           fetchSubmodules = true;
         };
 
@@ -85,21 +82,24 @@
           text = ''
             ZISK_DIR="''${ZISK_DIR:-$HOME/.zisk}"
             mkdir -p "$ZISK_DIR"
-            ZISK_SETUP_FILE="zisk-provingkey-0.17.0.tar.gz"
+            # Fork-matching key (extra Blake3f AIR): the upstream zisk-setup
+            # bucket key does not match this circuit. The object name carries
+            # the fork rev; the tarball omits the const-tree files, which
+            # check-setup regenerates below.
+            ZISK_SETUP_FILE="zisk-provingkey-blake3-e4057c4c-cpu.tar.gz"
             echo "Downloading proving key to $ZISK_DIR (this may take a while)..."
             rm -rf "$ZISK_DIR/provingKey"
-            curl -fL -o "/tmp/$ZISK_SETUP_FILE" \
-              "https://storage.googleapis.com/zisk-setup/$ZISK_SETUP_FILE"
+            curl -fL --retry 3 -o "/tmp/$ZISK_SETUP_FILE" \
+              "https://argument-zisk-setup.s3.amazonaws.com/$ZISK_SETUP_FILE"
             tar xf "/tmp/$ZISK_SETUP_FILE" -C "$ZISK_DIR"
             rm -f "/tmp/$ZISK_SETUP_FILE"
             echo "Generating constant tree..."
-            cargo-zisk check-setup -a
+            cargo-zisk-dev check-setup --proving-key "$ZISK_DIR/provingKey" -a
             echo "Proving key setup complete."
           '';
         };
         zisk-home = pkgs.callPackage ./pkgs/zisk-home.nix {
-          inherit cargo-zisk zisk-toolchain ziskemu craneLib proofmanSrc;
-          ziskSrc = ziskSrcLite;
+          inherit cargo-zisk zisk-toolchain ziskemu craneLib proofmanSrc ziskSrc;
         };
         rustup-shim = pkgs.callPackage ./pkgs/rustup-shim.nix {
           inherit zisk-toolchain rustToolchain;
@@ -147,6 +147,8 @@
                 secp256k1
                 nlohmann_json
                 nasm
+                m4
+                file
                 libgit2
                 mpi
                 clang
@@ -177,8 +179,10 @@
             shellHook = ''
               echo "Standard Rust: $(cargo --version)"
 
-              # Set up ZISK_DIR in $HOME
+              # Set up ZISK_DIR in $HOME (ZISK_HOME is what the zisk binaries
+              # read; it defaults to $HOME/.zisk but pin it explicitly)
               export ZISK_DIR="$HOME/.zisk"
+              export ZISK_HOME="$ZISK_DIR"
               mkdir -p "$ZISK_DIR"
 
               # Always sync binaries from Nix store to ensure updates are applied

pkgs/cargo-zisk.nix

@@ -18,9 +18,10 @@ in
       cargoExtraArgs = "-p cargo-zisk -p zisk-core -p zisk-coordinator-server -p zisk-worker";
 
       postPatch = ''
-        # Remove rustup-specific +zisk arguments (we use RUSTC env var instead)
-        sed -i 's/\["+zisk", "build"\]/["build"]/g' cli/src/commands/build.rs
-        sed -i 's/\["+zisk", "run"\]/["run"]/g' cli/src/commands/run.rs
+        # Remove rustup-specific +zisk toolchain selectors (we use the RUSTC
+        # env var instead)
+        sed -i 's/vec!\[format!("+{toolchain_name}"), "build".to_string()\]/vec!["build".to_string()]/' cli/src/commands/user/build.rs
+        sed -i 's/vec!\["+zisk".to_string(), "build".to_string()\]/vec!["build".to_string()]/' cli/src/commands/user/run.rs
         sed -i 's/\["+zisk", "build"\]/["build"]/g' ziskbuild/src/command.rs
       '';
 
@@ -32,9 +33,11 @@ in
         ];
 
       postInstall = ''
-        wrapProgram $out/bin/cargo-zisk \
-          --set RUSTC "${zisk-toolchain}/bin/rustc" \
-          --prefix LD_LIBRARY_PATH : "${common.commonArgs.LD_LIBRARY_PATH}"
+        for bin in cargo-zisk cargo-zisk-dev; do
+          wrapProgram $out/bin/$bin \
+            --set RUSTC "${zisk-toolchain}/bin/rustc" \
+            --prefix LD_LIBRARY_PATH : "${common.commonArgs.LD_LIBRARY_PATH}"
+        done
 
         for bin in riscv2zisk zisk-coordinator zisk-worker; do
           if [ -f "$out/bin/$bin" ]; then

pkgs/common.nix

@@ -7,7 +7,7 @@
   ziskSrc,
   proofmanSrc,
 }: rec {
-  version = "0.17.0";
+  version = "1.0.0-alpha";
 
   # Pre-built pil2-stark with libstarks.a (build.rs sees it exists and skips make)
   pil2Stark = pkgs.callPackage ./pil2-stark.nix {inherit proofmanSrc;};
@@ -27,6 +27,21 @@
               [ -f "$f" ] || continue
               sed -i 's@let pil2_stark_path_raw = Path::new(env!("CARGO_MANIFEST_DIR")).join("../../pil2-stark");@let pil2_stark_path_raw = std::env::var("PIL2_STARK_DIR").map(std::path::PathBuf::from).unwrap_or_else(|_| Path::new(env!("CARGO_MANIFEST_DIR")).join("../../pil2-stark"));@' "$f"
               sed -i 's@run_command("make"@run_command("true"@g' "$f"
+              # The build lock lives next to the pil2-stark sources, which is a
+              # read-only store path here; relocate it to OUT_DIR.
+              sed -i 's@let lock_path = pil2_stark_path.join(".build_lock");@let lock_path = Path::new(\&env::var("OUT_DIR").unwrap()).join(".build_lock");@' "$f"
+            done
+
+            # pil2-stark-setup embeds the proofman repo-root package.json via
+            # include_str!("../../package.json"), but vendoring extracts each
+            # crate dir in isolation. postInstall runs from the full repo
+            # checkout, so copy the file into the crate and point the include
+            # at it.
+            for d in $out/pil2-stark-setup-*; do
+              [ -d "$d" ] && [ -f package.json ] || continue
+              cp package.json "$d/"
+              sed -i 's@"/../../package.json"@"/package.json"@' \
+                "$d/src/proving_key/node_deps.rs"
             done
           '';
       });
@@ -48,6 +63,9 @@
       gnumake
       cmake
       llvmPackages.openmp
+      # gmp-mpfr-sys builds GMP from source, which needs m4 (and probes file)
+      m4
+      file
     ];
 
     buildInputs = with pkgs; [

pkgs/pil2-stark.nix

@@ -14,7 +14,7 @@
 }:
 stdenv.mkDerivation {
   pname = "pil2-stark";
-  version = "0.17.0";
+  version = "1.0.0-alpha";
 
   src = "${proofmanSrc}/pil2-stark";