Preparing for betanet launch with Nix and the Ledger Nano S

install_nix.md

Preparing for betanet launch with Nix and Ledger Nano S

This guide is for users of the Nix package manager and assumes you have a Ledger Nano S updated with the latest firmware (at this time 1.4.2).

NOTE If you are not on NixOS, skip the sections which have NixOS at the start of the heading.

NixOS Binary Cache Configuration

To hasten the build process (it could take days to build without this), add the following to /etc/nixos/configuration.nix if you are on NixOS.

  nix.binaryCaches = [ "https://cache.nixos.org" "https://nixcache.reflex-frp.org" ];
  nix.binaryCachePublicKeys = [ "ryantrinkle.com-1:JJiAKaRv9mWgpVAz8dwewnZe0AzzEAzPkagE9SP5NWI=" ];

Rebuild the configuration for this to take effect.

$ sudo nixos-rebuild switch

Ubuntu / Debian Cache Configuration

If you are using another distribution of Linux it is assumed that you have followed the guide over at nixos.org: https://nixos.org/nix/manual/#chap-installation.

Add the following to /etc/nix/nix.conf.

binary-caches = https://cache.nixos.org/ https://nixcache.reflex-frp.org/
trusted-public-keys = ryantrinkle.com-1:JJiAKaRv9mWgpVAz8dwewnZe0AzzEAzPkagE9SP5NWI=
require-sigs = false

Check if the nix-daemon is running with a pidof nix-daemon. If it is running, kill it with sudo kill -9 $(pidof nix-daemon) and restart it with nix-daemon & and continute.

Cloning and Building Zeronet

Make sure you have added your SSH public key to both gitlab and github since this is required to clone the dependencies required to start the build. Clone the repository from branch zeronet-new recursively.

$ git clone git@gitlab.com:obsidian.systems/tezos-baking-platform.git --branch zeronet-new --recursive

Start the build & make tea.

$ cd tezos-baking-platform
# On NixOS
$ nix-build
# On another distribution
$ nix-build --option extra-binary-caches https://nixcache.reflex-frp.org

Once the build completes there will be a series of build artifacts which you can see by doing ls result*/bin/* from the tezos-baking-platform including the tezos-node and client binaries.

NixOS udev Permission Configuration

In order to use the Ledger to bake it is necessary to modify the default udev permissions so that a user associated with a particular group can read the ledger device.

  # Modify <username> here to your own.
  users.extraUsers.<username> = {
    isNormalUser = true;
    uid = 1000;
    extraGroups = [ ... "ledger" ];
  };

  users.extraGroups.ledger = { gid = 1001; };

  services.udev.extraRules = ''
    SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="1b7c", MODE="0660", GROUP="ledger"
    SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="2b7c", MODE="0660", GROUP="ledger"
    SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="3b7c", MODE="0660", GROUP="ledger"
    SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="4b7c", MODE="0660", GROUP="ledger"
    SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="1807", MODE="0660", GROUP="ledger"
    SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="1808", MODE="0660", GROUP="ledger"
    SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="0000", MODE="0660", GROUP="ledger"
    SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="0001", MODE="0660", GROUP="ledger"
  '';

Rebuild the profile.

$ sudo nixos-rebuild switch

Once the profile has been switched it may be necessary to reboot (it was for me).

Installation of the Tezos Apps

Within tezos-baking-platform/ledger there are two important scripts, setup_ledger.sh and apdu.sh. The setup script is used to load the Tezos applications onto the ledger and the apdu script is used to authorize your ledger to sign baking operations when you get selected or for endorsements.

First run setup_ledger.sh which will prompt for you to download clang+llvm and gcc manually (e.g use wget ) and add them to the nix-store. These downloads are necessary due to a file size limit in Nix.

Monitor the ledger and make sure that you have entered your PIN and that you accept the prompts which ask for the installation of the applications on the ledger.

Once this completes you should have two applications installed on the ledger called Tezos Sign and Tezos Bake respectively.

Baking with the Ledger

In order to bake with the ledger the first thing that must be done is to check everything works correctly by requesting the client to list the connected ledgers. Make sure you open the Tezos Baking application on the ledger at this step.

# Make sure you are in the tezos-baking-platform dir.
$ cd tezos-baking-platform
# List connected ledgers.
$ ./result-3/bin/tezos-client list connected ledgers

If all goes well you should see a list of instructions for adding a key from your ledger to the client. For example, to import the secret key at derivation path /0'/0'.

$ ./result-3/bin/tezos-client import secret key ledger_user_ed_0_0 "ledger://<your-address>/0'/0'"

In order to bake from the ledger account you need to register the key as delegate. Make sure you open the Tezos Sign application on the Ledger at this step.

$ ./result-3/bin/tezos-client register key ledger_user_ed_0_0 as delegate

A prompt will show up on the ledger asking you to sign which you should accept in order to make this account implicit and thus be usable for baking.

Finally you should authorize the ledger to sign baking operations by using the apdu script.

# Authorize baking
$ echo 8001000011048000002c800006c18000000080000000 | ./ledger/apdu.sh

You can now check the Tezos Baking application - when blocks are baked the number will increase.

$ ./result-2/bin/tezos-baker-alpha run with local node ~/.tezos-node ledger_user_ed_0_0

In order to have enough XTZ for a roll on zeronet you may use the faucet to acquire funds as per the official documentation (alphanet faucet works with zeronet). The command to transfer funds to the corresponding ledger account is as follows (substitute the angle bracketted entries):

$ ./result-3/bin/tezos-client transfer <amount> from <account> to ledger_user_ed_0_0