stack: split test image Dockerfile

scripts/build_test_image.sh

@@ -17,7 +17,8 @@ Builds the compose/k8s test image (bakes in binaries + circuit assets).
 Options:
   --tag TAG                 Docker image tag (default: logos-blockchain-testing:local; or env IMAGE_TAG)
   --version VERSION         Circuits release tag (default: versions.env VERSION)
-  --dockerfile PATH         Dockerfile path (default: testing-framework/assets/stack/Dockerfile)
+  --dockerfile PATH         Dockerfile path (default: testing-framework/assets/stack/Dockerfile.runtime)
+  --base-tag TAG            Base image tag (default: logos-blockchain-testing:base)
   --circuits-override PATH  Relative path (within repo) to circuits dir/file to bake (default: testing-framework/assets/stack/kzgrs_test_params)
   --circuits-platform NAME  Circuits platform identifier for downloads (default: auto; linux-x86_64 or linux-aarch64)
   --bundle-tar PATH         Bundle tar containing artifacts/{nomos-*,circuits} (default: .tmp/nomos-binaries-linux-<version>.tar.gz; or env NOMOS_BINARIES_TAR)
@@ -48,8 +49,10 @@ build_test_image::load_env() {
   . "${ROOT_DIR}/versions.env"
   common::maybe_source "${ROOT_DIR}/paths.env"
 
-  DOCKERFILE_PATH_DEFAULT="${ROOT_DIR}/testing-framework/assets/stack/Dockerfile"
+  DOCKERFILE_PATH_DEFAULT="${ROOT_DIR}/testing-framework/assets/stack/Dockerfile.runtime"
+  BASE_DOCKERFILE_PATH_DEFAULT="${ROOT_DIR}/testing-framework/assets/stack/Dockerfile.base"
   IMAGE_TAG_DEFAULT="logos-blockchain-testing:local"
+  BASE_IMAGE_TAG_DEFAULT="logos-blockchain-testing:base"
 
   VERSION_DEFAULT="${VERSION:?Missing VERSION in versions.env}"
   NOMOS_NODE_REV="${NOMOS_NODE_REV:?Missing NOMOS_NODE_REV in versions.env}"
@@ -67,6 +70,8 @@ build_test_image::parse_args() {
   IMAGE_TAG="${IMAGE_TAG:-${IMAGE_TAG_DEFAULT}}"
   VERSION_OVERRIDE=""
   DOCKERFILE_PATH="${DOCKERFILE_PATH_DEFAULT}"
+  BASE_DOCKERFILE_PATH="${BASE_DOCKERFILE_PATH_DEFAULT}"
+  BASE_IMAGE_TAG="${BASE_IMAGE_TAG:-${BASE_IMAGE_TAG_DEFAULT}}"
   KZG_DIR_REL_DEFAULT="${NOMOS_KZG_DIR_REL:-testing-framework/assets/stack/kzgrs_test_params}"
   CIRCUITS_OVERRIDE="${CIRCUITS_OVERRIDE:-${KZG_DIR_REL_DEFAULT}}"
   CIRCUITS_PLATFORM="${CIRCUITS_PLATFORM:-${COMPOSE_CIRCUITS_PLATFORM:-}}"
@@ -83,6 +88,8 @@ build_test_image::parse_args() {
       --version) VERSION_OVERRIDE="${2:-}"; shift 2 ;;
       --dockerfile=*) DOCKERFILE_PATH="${1#*=}"; shift ;;
       --dockerfile) DOCKERFILE_PATH="${2:-}"; shift 2 ;;
+      --base-tag=*) BASE_IMAGE_TAG="${1#*=}"; shift ;;
+      --base-tag) BASE_IMAGE_TAG="${2:-}"; shift 2 ;;
       --circuits-override=*) CIRCUITS_OVERRIDE="${1#*=}"; shift ;;
       --circuits-override) CIRCUITS_OVERRIDE="${2:-}"; shift 2 ;;
       --circuits-platform=*) CIRCUITS_PLATFORM="${1#*=}"; shift ;;
@@ -117,6 +124,8 @@ build_test_image::print_config() {
   echo "Workspace root: ${ROOT_DIR}"
   echo "Image tag: ${IMAGE_TAG}"
   echo "Dockerfile: ${DOCKERFILE_PATH}"
+  echo "Base image tag: ${BASE_IMAGE_TAG}"
+  echo "Base Dockerfile: ${BASE_DOCKERFILE_PATH}"
   echo "Nomos node rev: ${NOMOS_NODE_REV}"
   echo "Circuits override: ${CIRCUITS_OVERRIDE:-<none>}"
   echo "Circuits version (download fallback): ${VERSION}"
@@ -176,9 +185,11 @@ build_test_image::docker_build() {
   command -v docker >/dev/null 2>&1 || build_test_image::fail "docker not found in PATH"
   [ -f "${DOCKERFILE_PATH}" ] || build_test_image::fail "Dockerfile not found: ${DOCKERFILE_PATH}"
 
-  local -a build_args=(
+  [ -f "${BASE_DOCKERFILE_PATH}" ] || build_test_image::fail "Base Dockerfile not found: ${BASE_DOCKERFILE_PATH}"
-    -f "${DOCKERFILE_PATH}"
+
-    -t "${IMAGE_TAG}"
+  local -a base_build_args=(
+    -f "${BASE_DOCKERFILE_PATH}"
+    -t "${BASE_IMAGE_TAG}"
     --build-arg "NOMOS_NODE_REV=${NOMOS_NODE_REV}"
     --build-arg "CIRCUITS_PLATFORM=${CIRCUITS_PLATFORM}"
     --build-arg "VERSION=${VERSION}"
@@ -186,13 +197,25 @@ build_test_image::docker_build() {
   )
 
   if [ -n "${CIRCUITS_OVERRIDE}" ]; then
-    build_args+=(--build-arg "CIRCUITS_OVERRIDE=${CIRCUITS_OVERRIDE}")
+    base_build_args+=(--build-arg "CIRCUITS_OVERRIDE=${CIRCUITS_OVERRIDE}")
   fi
 
   printf "Running:"
-  printf " %q" docker build "${build_args[@]}"
+  printf " %q" docker build "${base_build_args[@]}"
   echo
-  docker build "${build_args[@]}"
+  docker build "${base_build_args[@]}"
+
+  local -a final_build_args=(
+    -f "${DOCKERFILE_PATH}"
+    -t "${IMAGE_TAG}"
+    --build-arg "BASE_IMAGE=${BASE_IMAGE_TAG}"
+    "${ROOT_DIR}"
+  )
+
+  printf "Running:"
+  printf " %q" docker build "${final_build_args[@]}"
+  echo
+  docker build "${final_build_args[@]}"
 }
 
 build_test_image::main() {

scripts/push-ecr-test.sh

@@ -32,7 +32,7 @@ export DOCKER_DEFAULT_PLATFORM="${DEFAULT_DOCKER_PLATFORM}"
 export CIRCUITS_PLATFORM="${CIRCUITS_PLATFORM:-${DEFAULT_CIRCUITS_PLATFORM}}"
 export IMAGE_TAG="${REMOTE_IMAGE}"
 
-  "${ROOT_DIR}/scripts/build_test_image.sh"
+  "${ROOT_DIR}/scripts/build_test_image.sh" --dockerfile "${ROOT_DIR}/testing-framework/assets/stack/Dockerfile.testnet"
 
 if [[ "${ECR_IMAGE_REPO}" == ${PUBLIC_ECR_HOST}/* ]]; then
   aws ecr-public get-login-password --region "${AWS_REGION}" \

testing-framework/assets/stack/Dockerfile

@@ -1,215 +0,0 @@
-# syntax=docker/dockerfile:1
-# check=skip=SecretsUsedInArgOrEnv
-# Ignore warnings about sensitive information as this is test data.
-
-ARG VERSION
-ARG CIRCUITS_OVERRIDE
-ARG NOMOS_NODE_REV
-ARG CIRCUITS_PLATFORM
-
-# ===========================
-# BUILD IMAGE
-# ===========================
-
-FROM rust:1.91.0-slim-bookworm AS builder
-
-ARG VERSION
-ARG CIRCUITS_OVERRIDE
-ARG NOMOS_NODE_REV
-ARG CIRCUITS_PLATFORM
-
-LABEL maintainer="augustinas@status.im" \
-    source="https://github.com/logos-co/nomos-node" \
-    description="Nomos testnet build image"
-
-WORKDIR /workspace
-COPY . .
-
-# Reduce debug artifact size.
-ENV CARGO_PROFILE_DEV_DEBUG=0
-ENV NOMOS_NODE_REV=${NOMOS_NODE_REV}
-
-# Install dependencies needed for building RocksDB.
-RUN apt-get update && apt-get install -yq \
-    git gcc g++ clang make cmake m4 xz-utils libgmp-dev libssl-dev pkg-config ca-certificates curl wget file
-
-RUN mkdir -p /opt/circuits && \
-    select_circuits_source() { \
-        # Prefer an explicit override when it exists (file or directory). \
-        if [ -n "$CIRCUITS_OVERRIDE" ] && [ -e "/workspace/${CIRCUITS_OVERRIDE}" ]; then \
-            echo "/workspace/${CIRCUITS_OVERRIDE}"; \
-            return 0; \
-        fi; \
-        # Fall back to the workspace bundle shipped with the repo. \
-        if [ -e "/workspace/tests/kzgrs/kzgrs_test_params" ]; then \
-            echo "/workspace/tests/kzgrs/kzgrs_test_params"; \
-            return 0; \
-        fi; \
-        return 1; \
-    }; \
-    if CIRCUITS_PATH="$(select_circuits_source)"; then \
-        echo "Using prebuilt circuits bundle from ${CIRCUITS_PATH#/workspace/}"; \
-        if [ -d "$CIRCUITS_PATH" ]; then \
-            cp -R "${CIRCUITS_PATH}/." /opt/circuits; \
-        else \
-            cp "${CIRCUITS_PATH}" /opt/circuits/; \
-        fi; \
-    fi; \
-    TARGET_ARCH="$(uname -m)"; \
-    expect_arch() { \
-      case "$1" in \
-        x86_64) echo "x86-64|x86_64" ;; \
-        aarch64|arm64) echo "arm64|aarch64" ;; \
-        *) echo "$1" ;; \
-      esac; \
-    }; \
-    require_linux_execs=0; \
-    check_linux_exec() { \
-      local path="$1"; \
-      if [ ! -f "$path" ]; then \
-        return 0; \
-      fi; \
-      local info; \
-      info="$(file -b "$path" 2>/dev/null || true)"; \
-      case "$info" in \
-        *ELF*) : ;; \
-        *) \
-          echo "Circuits executable is not ELF: ${path} (${info}); forcing circuits download"; \
-          require_linux_execs=1; \
-          return 0; \
-          ;; \
-      esac; \
-      pattern="$(expect_arch "$TARGET_ARCH")"; \
-      if [ -n "$pattern" ] && ! echo "$info" | grep -Eqi "$pattern"; then \
-        echo "Circuits executable arch mismatch: ${path} (${info}); forcing circuits download"; \
-        require_linux_execs=1; \
-      fi; \
-    }; \
-    check_linux_exec /opt/circuits/zksign/witness_generator; \
-    check_linux_exec /opt/circuits/pol/witness_generator; \
-    if [ -f "/opt/circuits/prover" ]; then \
-      PROVER_INFO="$(file -b /opt/circuits/prover || true)"; \
-      case "$TARGET_ARCH" in \
-        x86_64) EXPECT_ARCH="x86-64" ;; \
-        aarch64|arm64) EXPECT_ARCH="aarch64" ;; \
-        *) EXPECT_ARCH="$TARGET_ARCH" ;; \
-      esac; \
-      if [ -n "$PROVER_INFO" ] && ! echo "$PROVER_INFO" | grep -qi "$EXPECT_ARCH"; then \
-        echo "Circuits prover architecture ($PROVER_INFO) does not match target ${TARGET_ARCH}; rebuilding rapidsnark binaries"; \
-        chmod +x scripts/build-rapidsnark.sh && \
-        RAPIDSNARK_FORCE_REBUILD=1 \
-            scripts/build-rapidsnark.sh /opt/circuits; \
-      fi; \
-    fi; \
-    if [ "$require_linux_execs" -eq 1 ] || [ ! -f "/opt/circuits/pol/verification_key.json" ]; then \
-        echo "Downloading ${VERSION} circuits bundle for ${CIRCUITS_PLATFORM}"; \
-        chmod +x scripts/setup-nomos-circuits.sh && \
-        NOMOS_CIRCUITS_PLATFORM="${CIRCUITS_PLATFORM}" \
-        NOMOS_CIRCUITS_REBUILD_RAPIDSNARK=1 \
-        RAPIDSNARK_BUILD_GMP=1 \
-            scripts/setup-nomos-circuits.sh "$VERSION" "/opt/circuits"; \
-    fi
-
-ENV NOMOS_CIRCUITS=/opt/circuits
-
-# Provide runtime binaries. Prefer prebuilt artifacts (when present) for speed;
-# otherwise build from source (or if prebuilt artifacts don't match the image
-# architecture).
-RUN set -eu; \
-    mkdir -p /workspace/artifacts; \
-    TARGET_ARCH="$(uname -m)"; \
-    expect_arch() { \
-      case "$1" in \
-        x86_64) echo "x86-64" ;; \
-        aarch64|arm64) echo "arm64" ;; \
-        *) echo "$1" ;; \
-      esac; \
-    }; \
-    have_prebuilt() { \
-      [ -f testing-framework/assets/stack/bin/nomos-node ] && \
-      [ -f testing-framework/assets/stack/bin/nomos-executor ] && \
-      [ -f testing-framework/assets/stack/bin/nomos-cli ]; \
-    }; \
-    bin_matches_arch() { \
-      BIN_INFO="$(file -b testing-framework/assets/stack/bin/nomos-node 2>/dev/null || true)"; \
-      case "$BIN_INFO" in \
-        *ELF*);; \
-        *) return 1 ;; \
-      esac; \
-      case "$TARGET_ARCH" in \
-        x86_64) PATTERN="x86-64|x86_64" ;; \
-        aarch64|arm64) PATTERN="arm64|aarch64" ;; \
-        *) PATTERN="$(expect_arch "$TARGET_ARCH")" ;; \
-      esac; \
-      [ -n "$BIN_INFO" ] && echo "$BIN_INFO" | grep -Eqi "$PATTERN"; \
-    }; \
-    if have_prebuilt && bin_matches_arch; then \
-      echo "Using prebuilt nomos binaries from testing-framework/assets/stack/bin"; \
-      cp testing-framework/assets/stack/bin/nomos-node /workspace/artifacts/nomos-node; \
-      cp testing-framework/assets/stack/bin/nomos-executor /workspace/artifacts/nomos-executor; \
-      cp testing-framework/assets/stack/bin/nomos-cli /workspace/artifacts/nomos-cli; \
-    else \
-      if have_prebuilt; then \
-        echo "Prebuilt nomos binaries do not match target architecture (${TARGET_ARCH}); rebuilding from source"; \
-      fi; \
-      echo "Prebuilt nomos binaries missing or wrong architecture; building from source (rev ${NOMOS_NODE_REV})"; \
-      git clone https://github.com/logos-co/nomos-node.git /tmp/nomos-node && \
-      cd /tmp/nomos-node && \
-      git fetch --depth 1 origin "${NOMOS_NODE_REV}" && \
-      git checkout "${NOMOS_NODE_REV}" && \
-      git reset --hard && git clean -fdx && \
-      # Enable pol-dev-mode via cfg to let POL_PROOF_DEV_MODE short-circuit proofs in tests.
-      RUSTFLAGS='--cfg feature="pol-dev-mode"' NOMOS_CIRCUITS=/opt/circuits cargo build --features "testing" \
-        -p nomos-node -p nomos-executor -p nomos-cli; \
-      cp /tmp/nomos-node/target/debug/nomos-node /workspace/artifacts/nomos-node; \
-      cp /tmp/nomos-node/target/debug/nomos-executor /workspace/artifacts/nomos-executor; \
-      cp /tmp/nomos-node/target/debug/nomos-cli /workspace/artifacts/nomos-cli; \
-      rm -rf /tmp/nomos-node/target/debug/incremental; \
-    fi
-
-# Strip local path patches so container builds use git sources.
-RUN sed -i '/^\[patch\.\"https:\/\/github.com\/logos-co\/nomos-node\"\]/,/^$/d' /workspace/Cargo.toml
-
-# Build cfgsync binaries from this workspace.
-RUN cargo build --all-features --manifest-path /workspace/testing-framework/tools/cfgsync/Cargo.toml --bins
-RUN cp /workspace/target/debug/cfgsync-server /workspace/artifacts/cfgsync-server && \
-    cp /workspace/target/debug/cfgsync-client /workspace/artifacts/cfgsync-client && \
-    rm -rf /workspace/target/debug/incremental
-
-# ===========================
-# NODE IMAGE
-# ===========================
-
-FROM ubuntu:24.04
-
-ARG VERSION
-
-LABEL maintainer="augustinas@status.im" \
-    source="https://github.com/logos-co/nomos-node" \
-    description="Nomos node image"
-
-RUN apt-get update && apt-get install -yq \
-    libstdc++6 \
-    libgmp10 \
-    libgomp1 \
-    libssl3 \
-    ca-certificates \
-    && rm -rf /var/lib/apt/lists/*
-
-COPY --from=builder /opt/circuits /opt/circuits
-
-# Provide a stable in-image location for the KZG test parameters so EKS runs do
-# not rely on hostPath volumes.
-COPY --from=builder /workspace/testing-framework/assets/stack/kzgrs_test_params/kzgrs_test_params /opt/nomos/kzg-params/kzgrs_test_params
-
-COPY --from=builder /workspace/artifacts/nomos-node /usr/bin/nomos-node
-COPY --from=builder /workspace/artifacts/nomos-executor /usr/bin/nomos-executor
-COPY --from=builder /workspace/artifacts/nomos-cli /usr/bin/nomos-cli
-COPY --from=builder /workspace/artifacts/cfgsync-server /usr/bin/cfgsync-server
-COPY --from=builder /workspace/artifacts/cfgsync-client /usr/bin/cfgsync-client
-
-ENV NOMOS_CIRCUITS=/opt/circuits
-
-EXPOSE 3000 8080 9000 60000
-
-ENTRYPOINT ["/usr/bin/nomos-node"]

testing-framework/assets/stack/Dockerfile.base

@@ -0,0 +1,88 @@
+# syntax=docker/dockerfile:1
+# check=skip=SecretsUsedInArgOrEnv
+# Ignore warnings about sensitive information as this is test data.
+
+ARG VERSION
+ARG CIRCUITS_OVERRIDE
+ARG NOMOS_NODE_REV
+ARG CIRCUITS_PLATFORM
+
+# ===========================
+# BUILD IMAGE
+# ===========================
+
+FROM rust:1.91.0-slim-bookworm AS builder
+
+ARG VERSION
+ARG CIRCUITS_OVERRIDE
+ARG NOMOS_NODE_REV
+ARG CIRCUITS_PLATFORM
+
+LABEL maintainer="augustinas@status.im" \
+    source="https://github.com/logos-co/nomos-node" \
+    description="Nomos testnet build image"
+
+WORKDIR /workspace
+COPY . .
+
+# Reduce debug artifact size.
+ENV CARGO_PROFILE_DEV_DEBUG=0
+ENV NOMOS_NODE_REV=${NOMOS_NODE_REV}
+
+# Install dependencies needed for building RocksDB and for circuit tooling.
+RUN apt-get update && apt-get install -yq \
+    git gcc g++ clang make cmake m4 xz-utils libgmp-dev libssl-dev pkg-config ca-certificates curl wget file \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN chmod +x \
+      /workspace/testing-framework/assets/stack/scripts/docker/prepare_circuits.sh \
+      /workspace/testing-framework/assets/stack/scripts/docker/prepare_binaries.sh \
+      /workspace/testing-framework/assets/stack/scripts/docker/build_cfgsync.sh \
+      /workspace/scripts/build-rapidsnark.sh \
+      /workspace/scripts/setup-nomos-circuits.sh \
+    || true
+
+RUN /workspace/testing-framework/assets/stack/scripts/docker/prepare_circuits.sh
+
+ENV NOMOS_CIRCUITS=/opt/circuits
+
+RUN /workspace/testing-framework/assets/stack/scripts/docker/prepare_binaries.sh
+
+# Strip local path patches so container builds use git sources.
+RUN sed -i '/^\[patch\."https:\/\/github.com\/logos-co\/nomos-node"\]/,/^$/d' /workspace/Cargo.toml
+
+RUN /workspace/testing-framework/assets/stack/scripts/docker/build_cfgsync.sh
+
+# ===========================
+# BASE RUNTIME IMAGE
+# ===========================
+
+FROM ubuntu:24.04 AS base
+
+LABEL maintainer="augustinas@status.im" \
+    source="https://github.com/logos-co/nomos-node" \
+    description="Nomos base runtime image (testing)"
+
+RUN apt-get update && apt-get install -yq \
+    libstdc++6 \
+    libgmp10 \
+    libgomp1 \
+    libssl3 \
+    ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /opt/circuits /opt/circuits
+
+# Provide a stable in-image location for the KZG test parameters so EKS runs do
+# not rely on hostPath volumes.
+COPY --from=builder /workspace/testing-framework/assets/stack/kzgrs_test_params/kzgrs_test_params /opt/nomos/kzg-params/kzgrs_test_params
+
+COPY --from=builder /workspace/artifacts/nomos-node /usr/bin/nomos-node
+COPY --from=builder /workspace/artifacts/nomos-executor /usr/bin/nomos-executor
+COPY --from=builder /workspace/artifacts/nomos-cli /usr/bin/nomos-cli
+COPY --from=builder /workspace/artifacts/cfgsync-server /usr/bin/cfgsync-server
+COPY --from=builder /workspace/artifacts/cfgsync-client /usr/bin/cfgsync-client
+
+ENV NOMOS_CIRCUITS=/opt/circuits
+
+EXPOSE 3000 8080 9000 60000

testing-framework/assets/stack/Dockerfile.runtime

@@ -0,0 +1,9 @@
+# syntax=docker/dockerfile:1
+
+ARG BASE_IMAGE=logos-blockchain-testing:base
+
+FROM ${BASE_IMAGE}
+
+LABEL description="Nomos runtime image for compose/k8s testing"
+
+ENTRYPOINT ["/usr/bin/nomos-node"]

testing-framework/assets/stack/Dockerfile.testnet

@@ -0,0 +1,9 @@
+# syntax=docker/dockerfile:1
+
+ARG BASE_IMAGE=logos-blockchain-testing:base
+
+FROM ${BASE_IMAGE}
+
+LABEL description="Nomos testnet image (publishable)"
+
+ENTRYPOINT ["/usr/bin/nomos-node"]

testing-framework/assets/stack/scripts/docker/build_cfgsync.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+cargo build --all-features --manifest-path /workspace/testing-framework/tools/cfgsync/Cargo.toml --bins
+
+cp /workspace/target/debug/cfgsync-server /workspace/artifacts/cfgsync-server
+cp /workspace/target/debug/cfgsync-client /workspace/artifacts/cfgsync-client
+
+rm -rf /workspace/target/debug/incremental
+

testing-framework/assets/stack/scripts/docker/prepare_binaries.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+NOMOS_NODE_REV="${NOMOS_NODE_REV:?NOMOS_NODE_REV build arg missing}"
+
+mkdir -p /workspace/artifacts
+
+TARGET_ARCH="$(uname -m)"
+
+have_prebuilt() {
+  [ -f testing-framework/assets/stack/bin/nomos-node ] && \
+  [ -f testing-framework/assets/stack/bin/nomos-executor ] && \
+  [ -f testing-framework/assets/stack/bin/nomos-cli ]
+}
+
+bin_matches_arch() {
+  local info
+  info="$(file -b testing-framework/assets/stack/bin/nomos-node 2>/dev/null || true)"
+  case "${info}" in
+    *ELF*) : ;;
+    *) return 1 ;;
+  esac
+
+  local pattern
+  case "${TARGET_ARCH}" in
+    x86_64) pattern="x86-64|x86_64" ;;
+    aarch64|arm64) pattern="arm64|aarch64" ;;
+    *) pattern="${TARGET_ARCH}" ;;
+  esac
+
+  echo "${info}" | grep -Eqi "${pattern}"
+}
+
+if have_prebuilt && bin_matches_arch; then
+  echo "Using prebuilt nomos binaries from testing-framework/assets/stack/bin"
+  cp testing-framework/assets/stack/bin/nomos-node /workspace/artifacts/nomos-node
+  cp testing-framework/assets/stack/bin/nomos-executor /workspace/artifacts/nomos-executor
+  cp testing-framework/assets/stack/bin/nomos-cli /workspace/artifacts/nomos-cli
+  exit 0
+fi
+
+if have_prebuilt; then
+  echo "Prebuilt nomos binaries do not match target architecture (${TARGET_ARCH}); rebuilding from source"
+else
+  echo "Prebuilt nomos binaries missing; building from source"
+fi
+
+echo "Building nomos binaries from source (rev ${NOMOS_NODE_REV})"
+git clone https://github.com/logos-co/nomos-node.git /tmp/nomos-node
+cd /tmp/nomos-node
+git fetch --depth 1 origin "${NOMOS_NODE_REV}"
+git checkout "${NOMOS_NODE_REV}"
+git reset --hard
+git clean -fdx
+
+# Enable pol-dev-mode via cfg to let POL_PROOF_DEV_MODE short-circuit proofs in tests.
+RUSTFLAGS='--cfg feature="pol-dev-mode"' NOMOS_CIRCUITS=/opt/circuits cargo build --features "testing" \
+  -p nomos-node -p nomos-executor -p nomos-cli
+
+cp /tmp/nomos-node/target/debug/nomos-node /workspace/artifacts/nomos-node
+cp /tmp/nomos-node/target/debug/nomos-executor /workspace/artifacts/nomos-executor
+cp /tmp/nomos-node/target/debug/nomos-cli /workspace/artifacts/nomos-cli
+
+rm -rf /tmp/nomos-node/target/debug/incremental
+

testing-framework/assets/stack/scripts/docker/prepare_circuits.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+VERSION="${VERSION:?VERSION build arg missing}"
+CIRCUITS_PLATFORM="${CIRCUITS_PLATFORM:?CIRCUITS_PLATFORM build arg missing}"
+CIRCUITS_OVERRIDE="${CIRCUITS_OVERRIDE:-}"
+
+mkdir -p /opt/circuits
+
+select_circuits_source() {
+  if [ -n "${CIRCUITS_OVERRIDE}" ] && [ -e "/workspace/${CIRCUITS_OVERRIDE}" ]; then
+    echo "/workspace/${CIRCUITS_OVERRIDE}"
+    return 0
+  fi
+  if [ -e "/workspace/tests/kzgrs/kzgrs_test_params" ]; then
+    echo "/workspace/tests/kzgrs/kzgrs_test_params"
+    return 0
+  fi
+  return 1
+}
+
+if CIRCUITS_PATH="$(select_circuits_source)"; then
+  echo "Using prebuilt circuits bundle from ${CIRCUITS_PATH#/workspace/}"
+  if [ -d "${CIRCUITS_PATH}" ]; then
+    cp -R "${CIRCUITS_PATH}/." /opt/circuits
+  else
+    cp "${CIRCUITS_PATH}" /opt/circuits/
+  fi
+fi
+
+TARGET_ARCH="$(uname -m)"
+
+expect_arch_pattern() {
+  case "$1" in
+    x86_64) echo "x86-64|x86_64" ;;
+    aarch64|arm64) echo "arm64|aarch64" ;;
+    *) echo "$1" ;;
+  esac
+}
+
+require_linux_execs=0
+
+check_linux_exec() {
+  local path="$1"
+  if [ ! -f "${path}" ]; then
+    return 0
+  fi
+  local info
+  info="$(file -b "${path}" 2>/dev/null || true)"
+  case "${info}" in
+    *ELF*) : ;;
+    *)
+      echo "Circuits executable is not ELF: ${path} (${info}); forcing circuits download"
+      require_linux_execs=1
+      return 0
+      ;;
+  esac
+
+  local pattern
+  pattern="$(expect_arch_pattern "${TARGET_ARCH}")"
+  if [ -n "${pattern}" ] && ! echo "${info}" | grep -Eqi "${pattern}"; then
+    echo "Circuits executable arch mismatch: ${path} (${info}); forcing circuits download"
+    require_linux_execs=1
+  fi
+}
+
+check_linux_exec /opt/circuits/zksign/witness_generator
+check_linux_exec /opt/circuits/pol/witness_generator
+
+if [ -f "/opt/circuits/prover" ]; then
+  PROVER_INFO="$(file -b /opt/circuits/prover || true)"
+  case "${TARGET_ARCH}" in
+    x86_64) EXPECT_ARCH="x86-64" ;;
+    aarch64|arm64) EXPECT_ARCH="aarch64" ;;
+    *) EXPECT_ARCH="${TARGET_ARCH}" ;;
+  esac
+  if [ -n "${PROVER_INFO}" ] && ! echo "${PROVER_INFO}" | grep -qi "${EXPECT_ARCH}"; then
+    echo "Circuits prover architecture (${PROVER_INFO}) does not match target ${TARGET_ARCH}; rebuilding rapidsnark binaries"
+    RAPIDSNARK_FORCE_REBUILD=1 \
+      scripts/build-rapidsnark.sh /opt/circuits
+  fi
+fi
+
+if [ "${require_linux_execs}" -eq 1 ] || [ ! -f "/opt/circuits/pol/verification_key.json" ]; then
+  echo "Downloading ${VERSION} circuits bundle for ${CIRCUITS_PLATFORM}"
+  NOMOS_CIRCUITS_PLATFORM="${CIRCUITS_PLATFORM}" \
+  NOMOS_CIRCUITS_REBUILD_RAPIDSNARK=1 \
+  RAPIDSNARK_BUILD_GMP=1 \
+    scripts/setup-nomos-circuits.sh "${VERSION}" "/opt/circuits"
+fi
+