TKTKMChain

Build go-tkmchain with Shield6

Compile the node, payout prover and provider CLI from source on Ubuntu Linux. These commands use source tag v1.21.86, commit a14521ed3f5589f47f9b29e24ee68465573c17df.

Download this guide as Markdown · Shield6 setup · Console wallet

1. Install build tools

Install the native compiler and supporting tools:

sudo apt-get update
sudo apt-get install -y build-essential cmake pkg-config git curl \
  ca-certificates python3 gzip tar zip

Install Go and Rust/rustup using their official instructions. This source requires Go 1.26.6; a Go installation that supports automatic toolchain selection can download the required version when GOTOOLCHAIN=auto is set. Release CI uses Rust 1.89.0.

Use a build checkout separate from any running node. Compilation needs additional disk space for Go, Cargo and native dependency caches, as well as RAM beyond the final executable sizes. Full release validation needs more capacity than an incremental build.

df -h .
free -h

2. Get the source

mkdir -p "$HOME/src"
git clone --branch v1.21.86 --single-branch \
  https://gitea.com/71engrm/go-tkmchain.git "$HOME/src/go-tkmchain"
cd "$HOME/src/go-tkmchain"
git rev-parse HEAD

export PATH="$HOME/.cargo/bin:$PATH"
GOTOOLCHAIN=auto go version
rustup toolchain install 1.89.0 --profile minimal
rustup run 1.89.0 cargo --version

The commit printed by git rev-parse HEAD should match the commit above. For a different source version, use its reviewed tag or commit and matching parameter metadata. Avoid mixing files from different revisions.

If an existing checkout is already used by a running node, create a separate worktree instead of building over its executables:

git -C "$HOME/src/go-tkmchain" worktree add --detach \
  "$HOME/src/go-tkmchain-shield6-build" v1.21.86
cd "$HOME/src/go-tkmchain-shield6-build"

Use an unused directory for the clone or worktree. Reuse an existing build checkout when repeating a build of the same revision.

3. Compile the Shield6 executables

From the build checkout, run:

GOTOOLCHAIN=auto GOMAXPROCS=2 GOFLAGS='-p=1' \
  CARGO_BUILD_JOBS=1 RAYON_NUM_THREADS=1 RUSTUP_TOOLCHAIN=1.89.0 \
  make production-gtkm production-prover shield6-provider GO_BUILD_P=1

The Makefile builds native RandomX and the shared Rust privacy library as dependencies. The production node uses CGO_ENABLED=1 with the build tags randomx,cgo,shield3. The prover and provider use shield3. This historical tag also enables the native privacy support used by Shield6; no separate shield6 tag is required.

GO_BUILD_P and GOFLAGS limit Go compilation. The first RandomX CMake build can still use the host's available CPU cores.

The output is:

build/bin/gtkm
build/bin/shielded-payout-prover
build/bin/shield6-provider

gtkm includes the node, interactive wallet and gtkm wallet shield6 commands. shielded-payout-prover provides the pool's signing and proving service. shield6-provider provides non-interactive onboarding and payment commands for exchanges and services.

Check the binaries without starting a node or signing a transaction:

./build/bin/gtkm version
./build/bin/gtkm wallet interactive --help
./build/bin/shield6-provider --help
./build/bin/shielded-payout-prover --help
sha256sum build/bin/gtkm build/bin/shielded-payout-prover \
  build/bin/shield6-provider

For all repository executables, use the broader make all target.

4. Install authenticated production parameters

Building the executables does not install the Shield6 proving artifacts. From the same source checkout, install the mainnet files using the pinned metadata:

python3 scripts/shield6-release-parameters.py \
  --output "$HOME/.tkmchain/shield6-parameters"

export TKM_SHIELD6_RECIPIENT_PARAMETERS="$HOME/.tkmchain/shield6-parameters"

./build/bin/shield6-provider parameters \
  --parameters "$TKM_SHIELD6_RECIPIENT_PARAMETERS"

The downloader checks file sizes and SHA-256 hashes, reuses verified existing files, and rejects mismatches. Both recipient and registration parameter sets are required:

recipient.r1cs
recipient.pk
recipient.vk
manifest.json
recipient-provenance.json
registration.r1cs
registration.pk
registration.vk
registration-manifest.json
registration-provenance.json

The public files total about 648 MB uncompressed. First loading and proof construction also need RAM and can take minutes on a small host. Keep TKM_SHIELD6_RECIPIENT_PARAMETERS set in the shell that launches the wallet. The payout prover uses its configured shield6ParametersDir.

Use the production parameters matching the source and network pins. Generating a new setup does not produce replacement mainnet keys. The error Install authenticated Shield6 registration parameters first means the wallet cannot load the matching registration artifacts from its parameter directory. See setup troubleshooting.

5. Validate the build

Run the targeted crypto, consensus and provider checks on the build host:

GOTOOLCHAIN=auto GOMAXPROCS=2 go test -p=1 -tags shield3 \
  ./zk/shielded6 ./core ./eth ./core/txpool/legacypool ./params \
  -run 'Shield6|ShieldedV6|CLSAG|ConfidentialLedger|ActivationRemainsUnset' \
  -count=1 -timeout=10m

GOTOOLCHAIN=auto GOMAXPROCS=2 go test -p=1 -tags shield3 \
  ./shield6provider ./internal/shield6providercli \
  -count=1 -timeout=10m

These checks cover part of the release validation. The release workflow also defines full proof-bearing end-to-end and TCP/reorg checks, including the generated recipient network fixture. Source contributions must pass the repository's AGENTS.md checklist, including the full non-short test suite.

6. Use the wallet with your local node

Follow the Shield6 setup guide to run and synchronize the node with the matching mainnet configuration. Keep the existing encrypted stamped keyfiles and account data when upgrading.

From the build checkout, open the wallet against your local node:

export TKM_SHIELD6_RECIPIENT_PARAMETERS="$HOME/.tkmchain/shield6-parameters"
./build/bin/gtkm wallet interactive \
  --datadir "$HOME/.tkmchain" --language en

Use the data directory associated with that node's IPC socket. Compilation alone does not activate a network fork, register receipt keys or migrate an account. Install reviewed binaries as a separate deployment step and preserve the existing network configuration, keys and payout journals.

Register and send from the console · Exchange integration · Developer documentation

Set up a new server

Continue with the new-server setup guide to create the host's Tor identity, configure the existing trusted username peers, and start the node with automatic peer refresh. The bootstrap kit is on Gitea.