Add program verification step

[fedgiac]

Add a just verify recipe that registers a deployed program's build on-chain, so block explorers show it as verified.

We already build reproducibly with just build-verified, but that only reproduces the artifact locally, so explorers never mark the program verified.
This adds the missing step: write the on-chain verification record and queue a remote rebuild that attests the deployed bytecode matches our public source.

How it works

Read more about verification and why we need it here: https://solana.com/docs/programs/verified-builds#how-does-it-work
This PR adds the missing verification steps, specifically 6. verifying against repositories and 7. verify against public api.

Note that this is an authenticated process: it needs the upgrade authority to register that.

Also, this is an interactive process, it requires you to confirm with y on a prompt.

Minor notes

(Unrelated.) I dropped the explicit --rpc-url since this is already handled in the test cli natively.

Testing

I ran the command and it seems to work.

Output

$ just verify FYp8R5K4B3B1Kfr7QuWzMz4TwoT7wptjYtxgCrY5sRXb ../deployer-keypair.json 28f1d9284b557e4bbeffe3a2582a4c315502a4db
cargo install solana-verify --version "$(cat .solana-verify-version.txt)" --root .cargo-root
     Ignored package `solana-verify v0.5.1` is already installed, use --force to override
warning: be sure to add `/mnt/lima-solana/repos/solana-programs/solana-program-workbench/.cargo-root/bin` to your PATH to be able to run the installed binaries
Commit hash from remote: 28f1d9284b557e4bbeffe3a2582a4c315502a4db
Skipping prompt: false
Cloning repo into: /tmp/solana-verify/862c8ffe-a539-421b-a50a-f0bd1db73722/solana-programs
Checked out commit hash: 28f1d9284b557e4bbeffe3a2582a4c315502a4db
Build path: "/tmp/solana-verify/862c8ffe-a539-421b-a50a-f0bd1db73722/solana-programs/"
Verifying program: cow_settlement
Workspace path: "/tmp/solana-verify/862c8ffe-a539-421b-a50a-f0bd1db73722/solana-programs/"
Running pre-flight validation...
Pre-flight checks passed ✅
Mounting path: /tmp/solana-verify/862c8ffe-a539-421b-a50a-f0bd1db73722/solana-programs
Workspace path: /tmp/solana-verify/862c8ffe-a539-421b-a50a-f0bd1db73722/solana-programs
Found docker image for Solana version 4.0.3
Workdir: /build
Building program at /build//programs/settlement/
Building manifest path: /build//programs/settlement/Cargo.toml
No Docker resource limits are set.
You can set the SVB_DOCKER_MEMORY_LIMIT and SVB_DOCKER_CPU_LIMIT environment variables to limit Docker resources.
For example: SVB_DOCKER_MEMORY_LIMIT=2g SVB_DOCKER_CPU_LIMIT=2.
Using container Rust toolchain: 1.93.1-x86_64-unknown-linux-gnu
   Compiling proc-macro2 v1.0.107
   Compiling unicode-ident v1.0.24
   Compiling quote v1.0.47
   Compiling five8_core v1.0.0
   Compiling solana-program-error v3.0.1
   Compiling solana-hash v4.5.0
   Compiling solana-define-syscall v5.2.0
   Compiling solana-define-syscall v4.0.1
   Compiling five8_const v1.0.0
   Compiling five8 v1.0.0
   Compiling solana-sha256-hasher v3.1.0
   Compiling sha2-const-stable v0.1.0
   Compiling solana-atomic-u64 v3.0.1
   Compiling bytemuck v1.25.2
   Compiling solana-sanitize v3.0.1
   Compiling autocfg v1.5.1
   Compiling winnow v1.0.4
   Compiling equivalent v1.0.2
   Compiling hashbrown v0.17.1
   Compiling toml_datetime v1.1.1+spec-1.1.0
   Compiling rustversion v1.0.23
   Compiling thiserror v2.0.19
   Compiling num-traits v0.2.19
   Compiling syn v3.0.3
   Compiling syn v2.0.119
   Compiling indexmap v2.14.0
   Compiling solana-msg v3.1.0
   Compiling solana-program-pack v3.1.0
   Compiling solana-program-option v3.1.0
   Compiling arrayref v0.3.9
   Compiling toml_parser v1.1.3+spec-1.1.0
   Compiling solana-instruction-error v2.4.0
   Compiling toml_edit v0.25.13+spec-1.1.0
   Compiling proc-macro-crate v3.5.0
   Compiling bytemuck_derive v1.12.0
   Compiling thiserror-impl v2.0.19
   Compiling num_enum_derive v0.7.6
   Compiling num-derive v0.4.2
   Compiling derive_more-impl v1.0.0
   Compiling solana-address v2.6.1
   Compiling solana-account-view v2.0.0
   Compiling solana-pubkey v4.2.1
   Compiling solana-address v1.1.0
   Compiling solana-instruction v3.4.1
   Compiling solana-pubkey v3.0.0
   Compiling solana-instruction-view v2.1.0
   Compiling solana-sdk-ids v3.1.0
   Compiling derive_more v1.0.0
   Compiling num_enum v0.7.6
   Compiling solana-system-interface v3.2.0
   Compiling pinocchio v0.11.2
   Compiling pinocchio-token v0.6.0
   Compiling spl-token-interface v3.0.0
   Compiling pinocchio-system v0.6.1
   Compiling cow-settlement-interface v0.3.0 (/build/interface)
   Compiling settlement v0.3.0 (/build/programs/settlement)
    Finished `release` profile [optimized] target(s) in 9.76s
Finished building program
Program Solana version: v4.0.3
Docker image Solana version: v4.0.3
224f2cfb4524b7b515d5d0d81336aaddc08b9630c7d0226910272c64ab3ccd86
Executable file found at path: "/tmp/solana-verify/862c8ffe-a539-421b-a50a-f0bd1db73722/solana-programs//target/deploy/cow_settlement.so"
Fetching on-chain program data for program ID: FYp8R5K4B3B1Kfr7QuWzMz4TwoT7wptjYtxgCrY5sRXb
Executable Program Hash from repo: 224f2cfb4524b7b515d5d0d81336aaddc08b9630c7d0226910272c64ab3ccd86
On-chain Program Hash: 224f2cfb4524b7b515d5d0d81336aaddc08b9630c7d0226910272c64ab3ccd86
Program hash matches ✅
Do you want to upload the program verification to the Solana Blockchain? (y/n) y
Uploading the program verification params to the Solana blockchain...
Using connection url: https://api.mainnet-beta.solana.com
Program uploaded successfully. Transaction ID: FTUHCLnBP79Vevkto54izL5z9kxf1iQHsUTg7ktTUA824XuxeixFniSQus3hazXyFfjnKpxGUYzXx2hT9WJNVxi
Verification request sent with request id: b413a9fc-2831-4b5d-8ef6-1c68679c805e
Verification in progress... ⏳
[00:00:00]    ✅ Process completed. (Done in 0 seconds)                                                                                                                                                Program FYp8R5K4B3B1Kfr7QuWzMz4TwoT7wptjYtxgCrY5sRXb has been verified. ✅
The provided GitHub build matches the on-chain hash.
On Chain Hash: 224f2cfb4524b7b515d5d0d81336aaddc08b9630c7d0226910272c64ab3ccd86
Executable Hash: 224f2cfb4524b7b515d5d0d81336aaddc08b9630c7d0226910272c64ab3ccd86
Repo URL: https://github.com/cowprotocol/solana-programs/tree/28f1d9284b557e4bbeffe3a2582a4c315502a4db
Check the verification status at: https://verify.osec.io/status/FYp8R5K4B3B1Kfr7QuWzMz4TwoT7wptjYtxgCrY5sRXb
Job url: https://verify.osec.io/job/b413a9fc-2831-4b5d-8ef6-1c68679c805e

See that it's now verified: https://verify.osec.io/status/FYp8R5K4B3B1Kfr7QuWzMz4TwoT7wptjYtxgCrY5sRXb

It's verified on Solscan: https://solscan.io/account/FYp8R5K4B3B1Kfr7QuWzMz4TwoT7wptjYtxgCrY5sRXb

I'd love to verify on the official Solana Explorer but, since a while, the Solana Explorer realized that inside the fleshy shell of my being lurks the soul of a bot. Maybe I should just ask Claude to check. The humans among you may be able to see whether it's verified there:
https://explorer.solana.com/address/FYp8R5K4B3B1Kfr7QuWzMz4TwoT7wptjYtxgCrY5sRXb

Worth noting that this didn't "just work", I got a few failures in between:

1. Network error, unclear reason.

   [...]
   On-chain Program Hash: 224f2cfb4524b7b515d5d0d81336aaddc08b9630c7d0226910272c64ab3ccd86
   Program hash matches ✅
   Do you want to upload the program verification to the Solana Blockchain? (y/n) y
   Uploading the program verification params to the Solana blockchain...
   Using connection url: https://api.mainnet-beta.solana.com
   Program already uploaded by the current signer. Updating the program.
   Error { request: Some(GetSignatureStatuses), kind: Reqwest(reqwest::Error { kind: Request, url: "https://api.mainnet-beta.solana.com/", source: hyper_util::client::legacy::Error(Connect, ConnectError("dns error", Custom { kind: Uncategorized, error: "failed to lookup address information: No address associated with hostname" })) }) }
   Error: Failed to send verification transaction to the blockchain.
   error: recipe `verify` failed with exit code 1
   

2. This apparently left some artifacts, and so running the command again would fail with a hard-to-debug error.

   [...]
   Program hash matches ✅
   Do you want to upload the program verification to the Solana Blockchain? (y/n) y
   Uploading the program verification params to the Solana blockchain...
   Using connection url: https://api.mainnet-beta.solana.com
   Program already uploaded by the current signer. Updating the program.
   Error { request: Some(GetSignatureStatuses), kind: Reqwest(reqwest::Error { kind: Request, url: "https://api.mainnet-beta.solana.com/", source: hyper_util::client::legacy::Error(Connect, ConnectError("dns error", Custom { kind: Uncategorized, error: "failed to lookup address information: No address associated with hostname" })) }) }
   Error: Failed to send verification transaction to the blockchain.
   error: recipe `verify` failed with exit code 1
   

3. I removed the leftover artifact to try a full test run again. Annoyingly, `solana-verify close` doesn't seem to take a `--keypair` argument, it uses the default keypair.

   $ solana config set --keypair ../deployer-keypair.json
   $ ./.cargo-root/bin/solana-verify close --program-id FYp8R5K4B3B1Kfr7QuWzMz4TwoT7wptjYtxgCrY5sRXb
   Program uploaded successfully. Transaction ID: 2ykE4PjVkopBZFxLv66ZohY3wKibXcFvpJzvLe1AStxDZE1Y1B76VkohqhTyzV3ZpPYfueHdYSMQrGrU8zssF1Mt