# Build go-tkmchain with Shield6

Compile the node, payout prover and provider CLI from source on Ubuntu Linux.
These commands use source tag **v1.21.86**, commit
`a14521ed3f5589f47f9b29e24ee68465573c17df`.

[Download this guide as Markdown](build-go-tkmchain-shield6.md) · [Shield6 setup](shield6-setup.html) · [Console wallet](shield6-console.html)

## 1. Install build tools

Install the native compiler and supporting tools:

```bash
sudo apt-get update
sudo apt-get install -y build-essential cmake pkg-config git curl \
  ca-certificates python3 gzip tar zip
```

Install [Go](https://go.dev/doc/install) and
[Rust/rustup](https://rustup.rs/) using their official instructions.
This source requires **Go 1.26.6**; a Go installation that supports
automatic toolchain selection can download the required version when
`GOTOOLCHAIN=auto` is set. Release CI uses **Rust 1.89.0**.

Use a build checkout separate from any running node. Compilation needs
additional disk space for Go, Cargo and native dependency caches, as well
as RAM beyond the final executable sizes. Full release validation needs
more capacity than an incremental build.

```bash
df -h .
free -h
```

## 2. Get the source

```bash
mkdir -p "$HOME/src"
git clone --branch v1.21.86 --single-branch \
  https://gitea.com/71engrm/go-tkmchain.git "$HOME/src/go-tkmchain"
cd "$HOME/src/go-tkmchain"
git rev-parse HEAD

export PATH="$HOME/.cargo/bin:$PATH"
GOTOOLCHAIN=auto go version
rustup toolchain install 1.89.0 --profile minimal
rustup run 1.89.0 cargo --version
```

The commit printed by `git rev-parse HEAD` should match the commit above.
For a different source version, use its reviewed tag or commit and matching
parameter metadata. Avoid mixing files from different revisions.

If an existing checkout is already used by a running node, create a separate
worktree instead of building over its executables:

```bash
git -C "$HOME/src/go-tkmchain" worktree add --detach \
  "$HOME/src/go-tkmchain-shield6-build" v1.21.86
cd "$HOME/src/go-tkmchain-shield6-build"
```

Use an unused directory for the clone or worktree. Reuse an existing build
checkout when repeating a build of the same revision.

## 3. Compile the Shield6 executables

From the build checkout, run:

```bash
GOTOOLCHAIN=auto GOMAXPROCS=2 GOFLAGS='-p=1' \
  CARGO_BUILD_JOBS=1 RAYON_NUM_THREADS=1 RUSTUP_TOOLCHAIN=1.89.0 \
  make production-gtkm production-prover shield6-provider GO_BUILD_P=1
```

The Makefile builds native RandomX and the shared Rust privacy library as
dependencies. The production node uses `CGO_ENABLED=1` with the build tags
`randomx,cgo,shield3`. The prover and provider use `shield3`. This historical
tag also enables the native privacy support used by Shield6; no separate
`shield6` tag is required.

`GO_BUILD_P` and `GOFLAGS` limit Go compilation. The first RandomX CMake build
can still use the host's available CPU cores.

The output is:

```text
build/bin/gtkm
build/bin/shielded-payout-prover
build/bin/shield6-provider
```

`gtkm` includes the node, interactive wallet and `gtkm wallet shield6`
commands. `shielded-payout-prover` provides the pool's signing and proving
service. `shield6-provider` provides non-interactive onboarding and payment
commands for exchanges and services.

Check the binaries without starting a node or signing a transaction:

```bash
./build/bin/gtkm version
./build/bin/gtkm wallet interactive --help
./build/bin/shield6-provider --help
./build/bin/shielded-payout-prover --help
sha256sum build/bin/gtkm build/bin/shielded-payout-prover \
  build/bin/shield6-provider
```

For all repository executables, use the broader `make all` target.

## 4. Install authenticated production parameters

Building the executables does not install the Shield6 proving artifacts.
From the same source checkout, install the mainnet files using the pinned
metadata:

```bash
python3 scripts/shield6-release-parameters.py \
  --output "$HOME/.tkmchain/shield6-parameters"

export TKM_SHIELD6_RECIPIENT_PARAMETERS="$HOME/.tkmchain/shield6-parameters"

./build/bin/shield6-provider parameters \
  --parameters "$TKM_SHIELD6_RECIPIENT_PARAMETERS"
```

The downloader checks file sizes and SHA-256 hashes, reuses verified existing
files, and rejects mismatches. Both recipient and registration parameter
sets are required:

```text
recipient.r1cs
recipient.pk
recipient.vk
manifest.json
recipient-provenance.json
registration.r1cs
registration.pk
registration.vk
registration-manifest.json
registration-provenance.json
```

The public files total about 648 MB uncompressed. First loading and proof
construction also need RAM and can take minutes on a small host. Keep
`TKM_SHIELD6_RECIPIENT_PARAMETERS` set in the shell that launches the wallet.
The payout prover uses its configured `shield6ParametersDir`.

Use the production parameters matching the source and network pins.
Generating a new setup does not produce replacement mainnet keys.
The error **Install authenticated Shield6 registration parameters first**
means the wallet cannot load the matching registration artifacts from its
parameter directory. See [setup troubleshooting](shield6-setup.html#troubleshooting-setup).

## 5. Validate the build

Run the targeted crypto, consensus and provider checks on the build host:

```bash
GOTOOLCHAIN=auto GOMAXPROCS=2 go test -p=1 -tags shield3 \
  ./zk/shielded6 ./core ./eth ./core/txpool/legacypool ./params \
  -run 'Shield6|ShieldedV6|CLSAG|ConfidentialLedger|ActivationRemainsUnset' \
  -count=1 -timeout=10m

GOTOOLCHAIN=auto GOMAXPROCS=2 go test -p=1 -tags shield3 \
  ./shield6provider ./internal/shield6providercli \
  -count=1 -timeout=10m
```

These checks cover part of the release validation. The
[release workflow](https://gitea.com/71engrm/go-tkmchain/src/tag/v1.21.86/.gitea/workflows/release.yml)
also defines full proof-bearing end-to-end and TCP/reorg checks, including
the generated recipient network fixture. Source contributions must pass
the repository's `AGENTS.md` checklist, including the full non-short test suite.

## 6. Use the wallet with your local node

Follow the [Shield6 setup guide](shield6-setup.html) to run and synchronize
the node with the matching mainnet configuration. Keep the existing
encrypted stamped keyfiles and account data when upgrading.

From the build checkout, open the wallet against your local node:

```bash
export TKM_SHIELD6_RECIPIENT_PARAMETERS="$HOME/.tkmchain/shield6-parameters"
./build/bin/gtkm wallet interactive \
  --datadir "$HOME/.tkmchain" --language en
```

Use the data directory associated with that node's IPC socket. Compilation
alone does not activate a network fork, register receipt keys or migrate an
account. Install reviewed binaries as a separate deployment step and preserve
the existing network configuration, keys and payout journals.

[Register and send from the console](shield6-console.html) · [Exchange integration](shield6-providers.html) · [Developer documentation](developers.html)

## Set up a new server

Continue with the [new-server setup guide](setup-new-server-tkmnet.html) to create the host's Tor identity, configure the existing trusted username peers, and start the node with automatic peer refresh. The [bootstrap kit is on Gitea](https://gitea.com/71engrm/new-server-tkmnet).