Establish Monzero Phase 0 and inactive assets baselinemonzero-phase0-assets-prototype-20260815

2 files changed, 137 insertions, 0 deletions

diff --git a/utils/release/package-linux.sh b/utils/release/package-linux.sh
new file mode 100755
index 000000000..bcc659e57
--- /dev/null
+++ b/utils/release/package-linux.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "Usage: $0 <build-bin-dir> <output-dir> <version>" >&2
+  echo "Set ALLOW_DIRTY=1 only for an explicitly marked development artifact." >&2
+  exit 2
+}
+
+[[ $# -eq 3 ]] || usage
+
+source_root=$(git rev-parse --show-toplevel)
+build_bin=$(realpath "$1")
+output_dir=$(realpath -m "$2")
+version=$3
+
+[[ $version =~ ^[0-9A-Za-z][0-9A-Za-z._-]*$ ]] || { echo "Invalid version label" >&2; exit 2; }
+[[ -x "$build_bin/monzerod" ]] || { echo "Missing executable: $build_bin/monzerod" >&2; exit 2; }
+[[ -x "$build_bin/monzero-wallet-cli" ]] || { echo "Missing executable: $build_bin/monzero-wallet-cli" >&2; exit 2; }
+
+source_commit=$(git -C "$source_root" rev-parse HEAD)
+source_epoch=${SOURCE_DATE_EPOCH:-$(git -C "$source_root" show -s --format=%ct "$source_commit")}
+[[ $source_epoch =~ ^[0-9]+$ ]] || { echo "SOURCE_DATE_EPOCH must be an integer" >&2; exit 2; }
+
+dirty=false
+if [[ -n $(git -C "$source_root" status --porcelain --untracked-files=normal) ]]; then
+  dirty=true
+  [[ ${ALLOW_DIRTY:-0} == 1 ]] || {
+    echo "Refusing to package a dirty source tree. Commit the reviewed baseline first." >&2
+    exit 1
+  }
+  version="${version}-development-dirty"
+fi
+
+package_name="monzero-${version}-linux-x86_64"
+mkdir -p "$output_dir"
+work_dir=$(mktemp -d "${TMPDIR:-/tmp}/monzero-package.XXXXXX")
+trap 'rm -rf -- "$work_dir"' EXIT
+package_dir="$work_dir/$package_name"
+mkdir -p "$package_dir"
+
+install -m 0755 "$build_bin/monzerod" "$package_dir/monzerod"
+install -m 0755 "$build_bin/monzero-wallet-cli" "$package_dir/monzero-wallet-cli"
+for optional in monzero-wallet-rpc monzero-gen-ssl-cert; do
+  [[ -x "$build_bin/$optional" ]] && install -m 0755 "$build_bin/$optional" "$package_dir/$optional"
+done
+
+install -m 0755 "$source_root/start-monzerod.sh" "$package_dir/start-monzerod.sh"
+install -m 0755 "$source_root/start-monzero-wallet-cli.sh" "$package_dir/start-monzero-wallet-cli.sh"
+install -m 0755 "$source_root/start-monzero-miner.sh" "$package_dir/start-monzero-miner.sh"
+install -m 0755 "$source_root/stop-monzero-miner.sh" "$package_dir/stop-monzero-miner.sh"
+install -m 0644 "$source_root/LICENSE" "$package_dir/LICENSE"
+install -m 0644 "$source_root/MONZERO_CHAIN_SPEC.md" "$package_dir/MONZERO_CHAIN_SPEC.md"
+install -m 0644 "$source_root/docs/RELEASE_CHECKLIST.md" "$package_dir/RELEASE_CHECKLIST.md"
+
+{
+  echo "package=$package_name"
+  echo "source_commit=$source_commit"
+  echo "source_date_epoch=$source_epoch"
+  echo "source_tree_dirty=$dirty"
+  echo "binary_build_reproducibility=unverified"
+  echo "assets_consensus_enabled=false"
+  echo "native_ticker=XMZ"
+} > "$package_dir/BUILD-MANIFEST.txt"
+
+(
+  cd "$package_dir"
+  find . -maxdepth 1 -type f ! -name SHA256SUMS -printf '%P\n' \
+    | LC_ALL=C sort \
+    | xargs -r sha256sum > SHA256SUMS
+  sha256sum -c SHA256SUMS
+)
+
+archive="$output_dir/$package_name.tar.gz"
+tar --sort=name \
+  --mtime="@$source_epoch" \
+  --owner=0 --group=0 --numeric-owner \
+  --pax-option=delete=atime,delete=ctime \
+  -C "$work_dir" -cf - "$package_name" \
+  | gzip -n -9 > "$archive"
+sha256sum "$archive" > "$archive.sha256"
+
+echo "$archive"
+echo "$archive.sha256"
diff --git a/utils/release/verify-package.sh b/utils/release/verify-package.sh
new file mode 100755
index 000000000..22ccab4c8
--- /dev/null
+++ b/utils/release/verify-package.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+[[ $# -eq 1 ]] || { echo "Usage: $0 <monzero-linux.tar.gz>" >&2; exit 2; }
+archive=$(realpath "$1")
+[[ -f "$archive" ]] || { echo "Archive not found: $archive" >&2; exit 2; }
+
+work_dir=$(mktemp -d "${TMPDIR:-/tmp}/monzero-verify.XXXXXX")
+trap 'rm -rf -- "$work_dir"' EXIT
+tar -xzf "$archive" -C "$work_dir"
+
+mapfile -t roots < <(find "$work_dir" -mindepth 1 -maxdepth 1 -type d)
+[[ ${#roots[@]} -eq 1 ]] || { echo "Archive must contain exactly one root directory" >&2; exit 1; }
+root=${roots[0]}
+
+[[ -x "$root/monzerod" && -x "$root/monzero-wallet-cli" ]] || {
+  echo "Required Monzero executables are missing" >&2
+  exit 1
+}
+[[ -f "$root/BUILD-MANIFEST.txt" && -f "$root/SHA256SUMS" ]] || {
+  echo "Build or checksum manifest is missing" >&2
+  exit 1
+}
+
+if find "$root" -type l -print -quit | grep -q .; then
+  echo "Package contains symbolic links" >&2
+  exit 1
+fi
+
+(
+  cd "$root"
+  sha256sum -c SHA256SUMS
+)
+
+binary_report=$(file "$root/monzerod" "$root/monzero-wallet-cli")
+echo "$binary_report"
+if [[ ${RELEASE_STRICT:-0} == 1 ]]; then
+  if grep -Eq 'dynamically linked|not stripped|with debug_info' <<< "$binary_report"; then
+    echo "Strict release verification rejects dynamic, unstripped, or debug binaries" >&2
+    exit 1
+  fi
+  grep -qx 'source_tree_dirty=false' "$root/BUILD-MANIFEST.txt" || {
+    echo "Strict release verification rejects a dirty source manifest" >&2
+    exit 1
+  }
+  grep -qx 'binary_build_reproducibility=verified' "$root/BUILD-MANIFEST.txt" || {
+    echo "Strict release verification requires independently verified binary reproducibility" >&2
+    exit 1
+  }
+fi
+"$root/monzerod" --version
+"$root/monzero-wallet-cli" --version
+echo "Package verification passed: $archive"