Skip to content

fix: bake zk version.json into the binary#1359

Merged
hmzakhalid merged 5 commits into
mainfrom
fix/zk-version-manifest
Feb 26, 2026
Merged

fix: bake zk version.json into the binary#1359
hmzakhalid merged 5 commits into
mainfrom
fix/zk-version-manifest

Conversation

@hmzakhalid

@hmzakhalid hmzakhalid commented Feb 24, 2026

Copy link
Copy Markdown
Collaborator

This PR removes the runtime network fetch of versions.json from GitHub and the duplicate BB_VERSION/CIRCUITS_VERSION constants, instead embedding versions.json into the binary at compile time via include_str!. It also simplifies the API by removing the ZkConfig parameter from ZkBackend::new(), making version/checksum data an internal implementation detail locked to the CLI release.

Summary by CodeRabbit

  • Refactor

    • Moved version configuration from runtime network fetches to a compile-time embedded manifest.
    • Simplified backend initialization to use an implicit default configuration and added an explicit-config path for tests.
    • Made default backend initialization synchronous.
  • Performance

    • Reduced startup I/O by removing runtime configuration fetches.

@hmzakhalid hmzakhalid requested a review from ryardley February 24, 2026 10:56
@vercel

vercel Bot commented Feb 24, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments
Project Deployment Actions Updated (UTC)
crisp Skipped Skipped Feb 25, 2026 11:58pm
enclave-docs Skipped Skipped Feb 25, 2026 11:58pm

Request Review

@coderabbitai

coderabbitai Bot commented Feb 24, 2026

Copy link
Copy Markdown
Contributor
📝 Walkthrough

Walkthrough

This PR simplifies ZkBackend construction and switches ZK configuration to an embedded compile-time versions.json. ZkBackend::new now takes three parameters; a new with_config exists for explicit configs. with_default_dir is now synchronous. Call sites and tests updated to the new API.

Changes

Cohort / File(s) Summary
Backend API
crates/zk-prover/src/backend/mod.rs
Added with_config(...); changed new(...) to delegate to with_config with ZkConfig::default(); made with_default_dir synchronous and removed async config fetch.
Config Strategy
crates/zk-prover/src/config.rs
Replaced runtime fetching with embedded VERSIONS_JSON; removed fetch/load helpers; default config now deserializes from embedded data.
Build Script
crates/zk-prover/build.rs
Added println!("cargo:rerun-if-changed=versions.json"); to rerun build-script when versions.json changes.
Call Sites
crates/cli/src/noir.rs, crates/entrypoint/src/start/start.rs, crates/tests/tests/integration.rs
Updated ZkBackend constructor calls to the 3-arg new(...); removed async ZkConfig::fetch_or_default().await and explicit zk_config passing.
Tests & Helpers
crates/zk-prover/tests/common/helpers.rs, crates/zk-prover/tests/integration_tests.rs, crates/zk-prover/src/backend/tests.rs, crates/zk-prover/src/prover.rs
Replaced usages that passed ZkConfig into new(...) with either ZkBackend::new(...) or ZkBackend::with_config(...); switched tests to use default embedded config instead of loading versions.json.
CLI/Entrypoint Integration
crates/cli/src/noir.rs, crates/entrypoint/...
Minor call-site adjustments to accommodate new backend constructor arity and synchronous default-dir creation.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Suggested labels

ciphernode

Suggested reviewers

  • ryardley
  • cedoor

Poem

🐰 I hopped through code both day and night,
Versions baked in, no async fright.
New constructors snug and neat,
Synchronous hops make tests complete.
A carrot toast to builds so bright! 🥕

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the primary change: embedding versions.json into the binary at compile time instead of fetching it at runtime.
Docstring Coverage ✅ Passed Docstring coverage is 90.48% which is sufficient. The required threshold is 80.00%.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
  • 📝 Generate docstrings (stacked PR)
  • 📝 Generate docstrings (commit on current branch)
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch fix/zk-version-manifest

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (3)
crates/zk-prover/src/config.rs (3)

351-412: Consider gating download integration tests with #[ignore].

Both test_download_and_verify_bb and test_download_checksum_mismatch_on_corruption fetch a full bb binary tarball over the network (120 s timeout). They run by default in cargo test, which will slow CI on every PR.

🔧 Suggested annotation
+    #[ignore = "requires network access; run with `cargo test -- --ignored`"]
     #[tokio::test]
     async fn test_download_and_verify_bb() {
+    #[ignore = "requires network access; run with `cargo test -- --ignored`"]
     #[tokio::test]
     async fn test_download_checksum_mismatch_on_corruption() {

Also applies to: 414-459

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@crates/zk-prover/src/config.rs` around lines 351 - 412, The network-heavy
integration tests test_download_and_verify_bb and
test_download_checksum_mismatch_on_corruption should be gated so they don't run
by default; add the #[ignore] attribute above each async test (e.g., annotate
the #[tokio::test] functions test_download_and_verify_bb and
test_download_checksum_mismatch_on_corruption with #[ignore] so developers/CI
only run them explicitly via cargo test -- --ignored), leaving the existing
timeout and test logic unchanged.

343-349: test_default_matches_versions_json is redundant with test_zk_config_default and its name is misleading.

Both tests assert non-emptiness of required_bb_version and bb_checksums. If the intent is to verify the embedded JSON round-trips correctly, the test should re-parse VERSIONS_JSON directly and assert field equality rather than just non-emptiness.

♻️ Suggested consolidation
-    #[test]
-    fn test_default_matches_versions_json() {
-        let config = ZkConfig::default();
-        assert!(!config.required_bb_version.is_empty());
-        assert!(!config.required_circuits_version.is_empty());
-        assert!(!config.bb_checksums.is_empty());
-    }
+    #[test]
+    fn test_default_matches_versions_json() {
+        let expected: ZkConfig = serde_json::from_str(VERSIONS_JSON).unwrap();
+        let config = ZkConfig::default();
+        assert_eq!(config.required_bb_version, expected.required_bb_version);
+        assert_eq!(config.required_circuits_version, expected.required_circuits_version);
+        assert_eq!(config.bb_checksums, expected.bb_checksums);
+    }

And merge the !bb_download_url.contains("{version}") assertion from test_zk_config_default into this test to eliminate the overlap.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@crates/zk-prover/src/config.rs` around lines 343 - 349, The two tests
test_default_matches_versions_json and test_zk_config_default overlap; remove
the redundant test and consolidate its intent into a single clearer test: in the
test that exercises ZkConfig::default (or rename to test_zk_config_roundtrip),
parse VERSIONS_JSON directly (use the same deserialization used by
ZkConfig::from_versions_json), then assert that the fields equal those in
ZkConfig::default() (e.g., required_bb_version, required_circuits_version,
bb_checksums), and also include the existing assertion that bb_download_url does
not contain "{version}" (the !bb_download_url.contains("{version}") check).
Ensure the new test name reflects round-trip/consistency and remove the old
redundant test_default_matches_versions_json.

78-80: Misleading error message: the panic is runtime, not compile-time.

include_str! embeds the string at compile time, but serde_json::from_str deserialises it at runtime. If versions.json is syntactically valid JSON but missing a required ZkConfig field (e.g., after a struct field is added without updating the file), the binary will panic! on first use of ZkConfig::default(), not during compilation.

🔧 Suggested fix
-        serde_json::from_str(VERSIONS_JSON)
-            .expect("versions.json is invalid — this is a build-time bug")
+        serde_json::from_str(VERSIONS_JSON)
+            .expect("embedded versions.json failed to deserialize — update versions.json to match ZkConfig fields")

If a true compile-time check is desired, consider adding a build.rs that validates the JSON against the expected structure.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@crates/zk-prover/src/config.rs` around lines 78 - 80, The panic message on
serde_json::from_str(VERSIONS_JSON).expect(...) is misleading (it says
"build-time bug") because deserialization runs at runtime; update the expect
message to accurately state this is a runtime deserialization error (e.g.,
"versions.json is invalid — runtime deserialization error") and mention the
failing symbol VERSIONS_JSON/serde_json::from_str so future readers know where
it originates; optionally, if you want true compile-time validation, add a build
script (build.rs) that validates VERSIONS_JSON against ZkConfig before
compilation.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@crates/zk-prover/src/config.rs`:
- Around line 351-412: The network-heavy integration tests
test_download_and_verify_bb and test_download_checksum_mismatch_on_corruption
should be gated so they don't run by default; add the #[ignore] attribute above
each async test (e.g., annotate the #[tokio::test] functions
test_download_and_verify_bb and test_download_checksum_mismatch_on_corruption
with #[ignore] so developers/CI only run them explicitly via cargo test --
--ignored), leaving the existing timeout and test logic unchanged.
- Around line 343-349: The two tests test_default_matches_versions_json and
test_zk_config_default overlap; remove the redundant test and consolidate its
intent into a single clearer test: in the test that exercises ZkConfig::default
(or rename to test_zk_config_roundtrip), parse VERSIONS_JSON directly (use the
same deserialization used by ZkConfig::from_versions_json), then assert that the
fields equal those in ZkConfig::default() (e.g., required_bb_version,
required_circuits_version, bb_checksums), and also include the existing
assertion that bb_download_url does not contain "{version}" (the
!bb_download_url.contains("{version}") check). Ensure the new test name reflects
round-trip/consistency and remove the old redundant
test_default_matches_versions_json.
- Around line 78-80: The panic message on
serde_json::from_str(VERSIONS_JSON).expect(...) is misleading (it says
"build-time bug") because deserialization runs at runtime; update the expect
message to accurately state this is a runtime deserialization error (e.g.,
"versions.json is invalid — runtime deserialization error") and mention the
failing symbol VERSIONS_JSON/serde_json::from_str so future readers know where
it originates; optionally, if you want true compile-time validation, add a build
script (build.rs) that validates VERSIONS_JSON against ZkConfig before
compilation.

ℹ️ Review info

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between ff9e1e8 and cde8c76.

📒 Files selected for processing (3)
  • crates/zk-prover/src/backend/tests.rs
  • crates/zk-prover/src/config.rs
  • crates/zk-prover/src/prover.rs

@ryardley

Copy link
Copy Markdown
Contributor

this looks great. only issue for me is that tests are not passing with the new bb version being out of sync with what we have just upgraded to. (``3.0.0-nightly.20260102`)

@vercel vercel Bot temporarily deployed to Preview – enclave-docs February 25, 2026 23:58 Inactive
@vercel vercel Bot temporarily deployed to Preview – crisp February 25, 2026 23:58 Inactive

@cedoor cedoor left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@hmzakhalid hmzakhalid merged commit 2fb3133 into main Feb 26, 2026
26 checks passed
@github-actions github-actions Bot deleted the fix/zk-version-manifest branch March 6, 2026 03:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants