How to combine Anchor verifiable builds with OtterSec Solana verify CLI

Question

I’ve been using anchor build --verifiable to build and deploy Solana on-chain programs, as explained in the Anchor documentation.

Recently, it seems that using Solana Verify CLI from OtterSec (https://github.com/Ellipsis-Labs/solana-verifiable-build/) has become the de facto standard. Many on-chain explorers now use OtterSec's API to report whether a program build is verifiable.

I can’t find any information on whether it’s possible to take a build made with Anchor’s --verifiable option and combine it with the OtterSec verification, allowing it to be uploaded to their system and provided via their API. The only mention of this topic I found was in the verifiable build README where Anchor is mentioned, but my attempts to make it work with my project have failed.

Has anyone successfully combined these two approaches?

Answer 1

With the help of @swaroop-maddu, I learned that the build is executed on OtterSec's end using parameters passed within.

When I run anchor --verifiable, solana-verify produces the same hash. If the build parameters are uploaded to the OtterSec API, their backend may mark it as verified."

solana-verify build
solana-verify get-executable-hash target/deploy/validator_bonds.so
   36db4d1b8602d2daff2c1d22317fdc81bbb69771274d2cadfbcfb4ff4578baa6

anchor build --verifiable
solana-verify get-executable-hash target/verifiable/validator_bonds.so
   36db4d1b8602d2daff2c1d22317fdc81bbb69771274d2cadfbcfb4ff4578baa6

Then an issue which I was not able to tackle was a fact we use build.rs to provide commit id to be placed within security.txt.

• https://github.com/marinade-finance/validator-bonds/blob/contract-v2.1.0/programs/validator-bonds/build.rs
• https://github.com/marinade-finance/validator-bonds/blob/contract-v2.1.0/programs/validator-bonds/src/lib.rs#L27-L28

That way one needs to provide the parameters to solana-verify to be able to interpret that in the same way as the anchor verifiable docker container is capable.

COMMIT_HASH=`git rev-parse --short HEAD`
anchor build --verifiable --env "GIT_REV=${COMMIT_HASH}"
--env 'GIT_REV_NAME=${VERSION}'

The final deployment command to make the solana-verify working was

solana-verify verify-from-repo https://github.com/marinade-finance/validator-bonds \
  --library-name validator_bonds --commit-hash ${COMMIT_HASH} \
  --program-id vBoNdEvzMrSai7is21XgVYik65mqtaKXuSdMBJ1xkW4 \
  -- --config env.GIT_REV=\'${COMMIT_HASH}\' --config env.GIT_REV_NAME=\'${VERSION}\'