{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"codeGuideFiles":[],"seo":{"title":"Verify Rakurai Scheduler Binary","description":"Learn how to work with Staking API for managing deposits, withdrawals, and stake pool information."},"dynamicMarkdocComponents":[],"metadata":{"type":"markdown"},"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"verify-rakurai-scheduler-binary"},"children":["Verify Rakurai Scheduler Binary"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Rakurai scheduler binary comes with ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://docs.github.com/en/actions/concepts/security/artifact-attestations"},"children":["GitHub artifact attestation"]},", providing cryptographic proof of its build provenance and integrity. This document describes how to verify the binary's attestations (provenance and SBOM) and checksum to ensure authenticity and integrity."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Contents"]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"#1.-github-artifact-attestations"},"children":["1. GitHub Artifact Attestations"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"#2.-supply-chain-levels-for-software-artifacts-slsa-compliance"},"children":["2. Supply-chain Levels for Software Artifacts (SLSA) Compliance"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"#3.-verify-rakurai-scheduler-binary-attestation-with-the-github-cli"},"children":["3. Verify Rakurai scheduler binary attestation with the GitHub CLI"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"#4.-verify-sbom-attestation-with-the-github-cli"},"children":["4. Verify SBOM attestation with the GitHub CLI"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"#5.-verify-rakurai-scheduler-binary-checksum"},"children":["5. Verify Rakurai scheduler binary checksum"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"#6.-scheduler-i/o-isolation-test"},"children":["6. Scheduler I/O Isolation Test"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"#7.-tx-in/out-localnet-test"},"children":["7. TX In/Out Localnet Test"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"#8.-scheduler-static-checks"},"children":["8. Scheduler Static Checks"]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"1.-github-artifact-attestations"},"children":["1. GitHub Artifact Attestations"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Artifact attestations enable the creation of unfalsifiable provenance and integrity guarantees for software. In turn, software consumers can verify where and how the software was built. GitHub's artifact attestations create cryptographically signed claims that establish build provenance and include the following information:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A link to the workflow associated with the artifact"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The repository, organization, environment, commit SHA, and triggering event for the artifact"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For more information, see ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://docs.github.com/en/actions/concepts/security/artifact-attestations"},"children":["Artifact attestations"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"2.-supply-chain-levels-for-software-artifacts-slsa-compliance"},"children":["2. Supply-chain Levels for Software Artifacts (SLSA) Compliance"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["GitHub artifact attestations are SLSA compliant. The SLSA framework is an industry standard used to evaluate supply chain security. This gives you confidence that binary hasn’t been tampered with after the build and can be securely traced back to its source."," ","For more information, see ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://slsa.dev/"},"children":["SLSA"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"3.-verify-rakurai-scheduler-binary-attestation-with-the-github-cli"},"children":["3. Verify Rakurai scheduler binary attestation with the GitHub CLI"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Rakurai generates an attestation for every release. The following steps show how to verify it using the GitHub CLI."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"3.1.-prerequisites"},"children":["3.1. Prerequisites"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://github.com/cli/cli#installation"},"children":["GitHub CLI"]}," installed"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"3.2.-verification"},"children":["3.2. Verification"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To verify the Rakurai scheduler binary, use the following GitHub CLI command."]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Note"]},": This command assumes you are in an online environment. If you are in an offline or air-gapped environment, see ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://docs.github.com/en/actions/how-tos/secure-your-work/use-artifact-attestations/verify-attestations-offline"},"children":["Verifying attestations offline"]},"."]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"gh attestation verify PATH/TO/RAKURAI/SCHEDULER/BINARY -R rakurai-io/rakurai-validator\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"3.3.-results"},"children":["3.3. Results"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Check the command output to determine the result. If verification is successful, you will see a message like ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["✓ Verification succeeded!"]},". If verification fails, you will see an error message such as ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["✗ Loading attestations from GitHub API failed"]},"."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"3.3.1.-successful-verification"},"children":["3.3.1. Successful verification"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["You’ll see the enforced policy, a checkmark, and one or more matched attestations summarizing the build and signer. Example:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"$ gh attestation verify ./PATH/TO/BINARY -R rakurai-io/rakurai-validator\nLoaded digest sha256:<ARTIFACT_DIGEST> for file://...\nLoaded <N> attestations from GitHub API\n\nPolicy criteria enforced:\n- Predicate type: https://slsa.dev/provenance/v1\n- Source repository owner: https://github.com/rakurai-io\n- Source repository: https://github.com/rakurai-io/rakurai-validator\n- Subject Alternative Name: ^https://github.com/rakurai-io/rakurai-validator/\n- OIDC issuer: https://token.actions.githubusercontent.com\n\n✓ Verification succeeded!\n\nMatched attestations:\n- Attestation #<NUMBER>\n- Build repo: rakurai-io/rakurai-validator\n- Build workflow: .github/workflows/<WORKFLOW_FILE>@refs/tags/<TAG>\n- Signer repo: rakurai-io/rakurai-validator\n- Signer workflow: .github/workflows/<WORKFLOW_FILE>@refs/tags/<TAG>\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":4,"id":"3.3.2.-failed-verification"},"children":["3.3.2. Failed verification"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A failure result means no attestation could be found (HTTP 404), and the binary’s authenticity could not be confirmed. Example:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"$ gh attestation verify ./PATH/TO/BINARY -R rakurai-io/rakurai-validator\nLoaded digest sha256:<artifact-digest> for file://...\n✗ Loading attestations from GitHub API failed\n\nError: HTTP 404: Not Found\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"4.-verify-sbom-attestation-with-the-github-cli"},"children":["4. Verify SBOM attestation with the GitHub CLI"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The scheduler binary is accompanied by a Software Bill of Materials (SBOM) and attested using GitHub SBOM attestation. The following steps show how to verify it using the GitHub CLI."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"4.1.-prerequisites"},"children":["4.1. Prerequisites"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://github.com/cli/cli#installation"},"children":["GitHub CLI"]}," installed"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"4.2.-verification"},"children":["4.2. Verification"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To verify the Rakurai scheduler SBOM attestation, use the following GitHub CLI command."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"gh attestation verify PATH/TO/RAKURAI/SCHEDULER/BINARY -R rakurai-io/rakurai-validator --predicate-type https://spdx.dev/Document/v2.3\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To view more information on the attestation, reference the --format json flag."]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"gh attestation verify PATH/TO/RAKURAI/SCHEDULER/BINARY -R rakurai-io/rakurai-validator --predicate-type https://spdx.dev/Document/v2.3 --format json --jq '.[].verificationResult.statement.predicate'\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"5.-verify-rakurai-scheduler-binary-checksum"},"children":["5. Verify Rakurai scheduler binary checksum"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A signed checksum of the scheduler binary is included alongside the release under ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["attestations/"]}," in the release tarball. After extracting the archive, the layout is:"]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"text","header":{"controls":{"copy":{}}},"source":"librak_scheduler_<version>.so\nattestations/rakurai_scheduler.sha512\nattestations/rakurai_scheduler.sha512.asc\nattestations/rakurai-scheduler-sbom.json\n","lang":"text"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Run the verification steps from the extract root (the directory that contains the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":[".so"]},")."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"5.1.-verification"},"children":["5.1. Verification"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Copy the scheduler signing key, available in the ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"https://rakurai.io/faqs"},"children":["FAQs"]}," and save it to ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["public-key.asc"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Import the public key"]}]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"gpg --import public-key.asc\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify the checksum signature"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"gpg --verify attestations/rakurai_scheduler.sha512.asc attestations/rakurai_scheduler.sha512\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the output shows ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Good signature"]},", the checksum is authentic."," ","If the output shows ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["BAD signature"]},", the checksum is invalid."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Verify binary matches checksum"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"sha512sum -c attestations/rakurai_scheduler.sha512\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If the output shows ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["OK"]},", the binary matches checksum."," ","If he output shows ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["FAILED"]},", the binary does not match the checksum."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"6.-scheduler-i/o-isolation-test"},"children":["6. Scheduler I/O Isolation Test"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The Scheduler I/O Isolation test setup is a test harness for the Rakurai scheduler that verifies the scheduler does not perform any file I/O or network I/O syscalls. The test applies seccomp filters to disable these syscalls before running the scheduler. If the scheduler attempts to perform file or network operations, the process will be terminated, proving that the scheduler operates without requiring these capabilities. The test also verifies that transactions flow correctly through the scheduler by tracking sent and received transaction signatures, ensuring the scheduler functions properly even with these syscall restrictions in place. This test runs automatically in the release CI/CD pipeline, ensuring that all published scheduler binaries are verified to operate safely under I/O restrictions."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Run the test"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"cd ./dev-bins/\ncargo build --release -p scheduler-test-setup\nexport LD_LIBRARY_PATH=$LD_LIBRARY_PATH:../target/release\n./target/release/scheduler-test-setup\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"7.-tx-in/out-localnet-test"},"children":["7. TX In/Out Localnet Test"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A dedicated test is available for clients to run locally and also on demand in the GitHub Actions. This test spawns a localnet validator and matches input transaction hashes with output transaction hashes and confirms there is no injection or censoring of transactions inside the scheduler. See ",{"$$mdtype":"Tag","name":"a","attributes":{"href":"/docs/services/rakurai_jito_private/rakurai_docs/validators/tx_io_check_readme"},"children":["TX In/Out check"]}," for more details."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Run the test"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"./tx_io_integrity_test.sh\n","lang":"bash"},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"8.-scheduler-static-checks"},"children":["8. Scheduler Static Checks"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Static checks inspect the scheduler shared library for symbols related to process spawning or loading binaries into a running process (",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["exec*"]}," and Rust ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["process::Command"]},"). These checks run locally and in GitHub Actions as part of the CI/CD pipeline."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Run checks"]}]},{"$$mdtype":"Tag","name":"CodeBlock","attributes":{"data-language":"bash","header":{"controls":{"copy":{}}},"source":"./scheduler_static_checks.sh PATH/TO/RAKURAI/SCHEDULER/BINARY\n","lang":"bash"},"children":[]}]},"headings":[{"value":"Verify Rakurai Scheduler Binary","id":"verify-rakurai-scheduler-binary","depth":1},{"value":"1. GitHub Artifact Attestations","id":"1.-github-artifact-attestations","depth":2},{"value":"2. Supply-chain Levels for Software Artifacts (SLSA) Compliance","id":"2.-supply-chain-levels-for-software-artifacts-slsa-compliance","depth":2},{"value":"3. Verify Rakurai scheduler binary attestation with the GitHub CLI","id":"3.-verify-rakurai-scheduler-binary-attestation-with-the-github-cli","depth":2},{"value":"3.1. Prerequisites","id":"3.1.-prerequisites","depth":3},{"value":"3.2. Verification","id":"3.2.-verification","depth":3},{"value":"3.3. Results","id":"3.3.-results","depth":3},{"value":"3.3.1. Successful verification","id":"3.3.1.-successful-verification","depth":4},{"value":"3.3.2. Failed verification","id":"3.3.2.-failed-verification","depth":4},{"value":"4. Verify SBOM attestation with the GitHub CLI","id":"4.-verify-sbom-attestation-with-the-github-cli","depth":2},{"value":"4.1. Prerequisites","id":"4.1.-prerequisites","depth":3},{"value":"4.2. Verification","id":"4.2.-verification","depth":3},{"value":"5. Verify Rakurai scheduler binary checksum","id":"5.-verify-rakurai-scheduler-binary-checksum","depth":2},{"value":"5.1. Verification","id":"5.1.-verification","depth":3},{"value":"6. Scheduler I/O Isolation Test","id":"6.-scheduler-i/o-isolation-test","depth":2},{"value":"7. TX In/Out Localnet Test","id":"7.-tx-in/out-localnet-test","depth":2},{"value":"8. Scheduler Static Checks","id":"8.-scheduler-static-checks","depth":2}],"frontmatter":{"seo":{"title":"Verify Rakurai Scheduler Binary"}},"lastModified":"2026-10-08T13:03:51.000Z"},"slug":"/docs/services/rakurai_jito_private/rakurai_docs/validators/verify_rakurai_binary","userData":{"isAuthenticated":false,"teams":["anonymous"]}}