Update ckpool to 1.2.0 and harden container releases

[blockdyor]

Summary

This updates the backend from ckpool 1.1.1 to 1.2.0 and hardens how the multi-architecture image is built, tested, and published.

The same image changes have been running successfully in the Bassin community app with the existing Umbrel RPC/ZMQ configuration and UID/GID 1000 volume layout.

ckpool 1.2.0

The image now builds the exact upstream 1.2.0 revision (2e44101e2da2c11f499be76d16e6a26cd95cfea7) instead of 1.1.1. This is a substantial upstream update, including:

• migration from the vendored Jansson 2.14 tree to yyjson
• broad generator, connector, stratifier, JSON-handling, and validation updates
• optional Bitcoin Core mining IPC support and RPC/ZMQ fallback paths
• the upstream dropidle default changing from 3600 seconds to disabled (0)
• updated build configuration for both C and C++ sources

Cap'n Proto is intentionally not enabled in this image yet. Bassin therefore continues to use its established JSON-RPC and ZMQ interfaces without requiring a Bitcoin Core IPC socket or configuration change. IPC can be evaluated separately with an explicit compatibility and integration test matrix.

Runtime and security hardening

• pin the Debian Trixie slim multi-architecture digest
• pin and verify the exact upstream ckpool commit instead of trusting a movable tag
• combine APT operations, use --no-install-recommends, and remove package indexes
• replace runtime libzmq3-dev with the required libzmq5 shared-library package
• strip unneeded binary symbols
• run upstream make check during the image build
• run as non-root UID/GID 1000:1000 by default
• provide a writable /app/logs while retaining the command contract used by the official Bassin compose file
• include the upstream GPL license in the runtime image and correct the combined packaging/upstream license metadata
• add OCI version and pinned-upstream metadata

For amd64, compressed image layers decreased from approximately 58.3 MB to 32.0 MB in the reference build.

Portability

ckpool 1.2.0 defaults to -march=native and can select build-host-specific SHA/AVX/ARM instructions. The image explicitly uses portable -O2 C/C++ flags and disables host CPU feature selection, preventing binaries built under GitHub Actions/QEMU from failing with illegal instructions on older amd64 or arm64 Umbrel hardware.

CI and release integrity

• build and execute smoke tests for both linux/amd64 and linux/arm64 on every pull request and master push
• confirm the runtime UID/GID, executable path, and absence of libzmq3-dev
• scan both runtime images for fixed critical OS vulnerabilities with Trivy
• use architecture-scoped GitHub Actions build caches
• pin every action to an immutable commit and enable Dependabot updates
• restrict publishing to validated <ckpool-version>-<packaging-revision> tags such as v1.2.0-1
• reject attempts to overwrite an existing release image tag
• publish commit-specific image tags, SBOMs, maximal BuildKit provenance, and GitHub artifact attestations
• use least-privilege job permissions and cancel superseded non-release builds

Verification performed

The reference v1.2.0-1 build completed successfully with:

• upstream make check: 1/1 passed
• amd64 build, non-root smoke test, and critical vulnerability scan: passed
• arm64 build under QEMU, non-root smoke test, and critical vulnerability scan: passed
• multi-architecture GHCR publication: passed
• SBOM and provenance publication: passed
• GitHub attestation verification: passed
• live installation and startup in the Bassin community app using the existing Umbrel Bitcoin RPC/ZMQ integration: confirmed

Reference multi-architecture build: ghcr.io/blockdyor/docker-ckpool-solo:v1.2.0-1@sha256:ac630bfd6675cb512317f3a75edff7940dcf0378dc8aeb61ba9ac592aa6bdb87

Once an Umbrel-owned image is published, the official Bassin app can continue pinning the Umbrel GHCR digest rather than relying on an external image.