On-chain builds overviewalpha
Compile Motoko inside a canister on the Internet Computer, so anyone can check which source produced a wasm.
An on-chain build runs the Motoko compiler inside a canister on the Internet Computer. You upload your source, the canister compiles it, and you get back the same wasm that moxzi build would produce on your machine. The difference is who can check it: the canister keeps a public record of what it built and from which files, and anyone can compare that record with the source and with a deployed module.
Use it when someone else needs to verify how a canister was built: a DAO voting on an upgrade, an auditor, or the users of your canister. If nobody needs to check, build locally.
Local and on-chain builds#
moxzi build | moxzi build --remote | |
|---|---|---|
| Where the compiler runs | Your machine | The compiler canister |
| Output | The same bytes | The same bytes |
| Time | Seconds | About a minute for a small program; about an hour for a large application |
| Cost | Free | Cycles, paid in ICP. A small project costs a fraction of a cent; a 15 MB project about 1.6 trillion cycles |
| Who can verify it | You | Anyone, with moxzi verify |
| Who can read your source | You | You, and the canister's controllers |
The production compiler canister is xcn6l-iqaaa-aaaai-raq6q-cai. Its module is the same compiler.wasm that ships with moxzi; Verifying a build shows how to check that.
How it works#
A compile is too much work for one Internet Computer message, so the canister splits it into thousands of steps, each a separate message. moxzi build --remote uploads your files, starts a job, and calls step until the job finishes. Then it downloads the result and writes .wasm and .did files, as a local build does. See How builds run.
When the build finishes, the canister stores a build record: a hash of every source file, a hash of the build options, the compiler version and the hash of the result. The record outlives the job, so the build can be checked later.
Privacy#
Uploaded files are stored in the canister. Its controllers can read them until you remove them. Package sources registered with the canister (mops packages) don't need to be uploaded, but your own files do. If your source must stay private, build locally, or run your own compiler canister.
Limitations#
| Limitation | What to do |
|---|---|
| One canister runs one build at a time; others wait | Deploy more compiler canisters for parallel builds |
| Each caller can upload at most 64 MiB | Remove old files, or build from registered packages |
| A build in progress doesn't survive an upgrade of the compiler canister | Run the build again. Build records and payments do survive |
Next steps#
- Your first on-chain build.
- Verifying a build.
- Trust: what an on-chain build proves and what it doesn't.