Fix: Deploy to testnet script (#2705)

# Motivation Script to deploy to testnets wasn't working `./deploy.sh`. The problem was that dfx didn't know that the wasm was gzipped. Solution: rename the wasm in dfx.json More about the discussion: https://dfinity.slack.com/archives/CGA566TPV/p1686829378681289 # Changes * [Commit 1](88360aa): * Rename nns-dapp wasm in `dfx.json`. * Add new file extension to git ignore. * [Commit2](a270f06): Make build-rs.sh emit .wasm.gz instead of .wasm (tested manually, it works) * [Commit 3](f10ef1d): Update the dockerfile so that it too emits .wasm.gz (tested manually, it works) * [Commit 4](5ec7bf7): Bulk rename .wasm to .wasm.gz, but done manually checking every case as there are quite a few exceptions. E.g. external .wasm files are not renamed and jq paths ending in .wasm must not be renamed. (tested by CI; this verifies that users of the above changes within this codebase have been updated) * [Commit 5](199081a): For backwards compatibility, include a copy of all .wasm.gz assets with just the .wasm suffix. * Non-PR change: For recent releases, I have copied every .wasm in the release to the same path with suffix .wasm.gz. See the comment in the MR for details. This is to ensure that tasks such as rollback/rollforward tests have access to .wasm.gz for existing releases. This may have to be repeated to cover any more releases created between now and the PR being merged. # Tests * There should be no change in functionality; existing CI should suffice for canister functionality. * Here is a test release, to verify that both .wasm.gz and .wasm are produced: https://github.com/dfinity/nns-dapp/releases/tag/untagged-29888d6b4b9ee251e9b5 * Here are the last releases by proposal, to verify that .wasm.gz is available to rollback tests: * https://github.com/dfinity/nns-dapp/releases/tag/proposal-123011-agg * https://github.com/dfinity/nns-dapp/releases/tag/proposal-123006 * https://github.com/dfinity/nns-dapp/releases/tag/proposal-122799 --------- Co-authored-by: Max Murphy-Skvorzov <[email protected]>
dfinity · Jun 22, 2023 · 394e506 · 394e506
1 parent 93b26c3
commit 394e506
Show file tree

Hide file tree

Showing 32 changed files with 103 additions and 85 deletions.
diff --git a/.dockerignore b/.dockerignore
@@ -27,4 +27,5 @@ frontend/tsconfig.spec.json
 frontend/.env
 e2e-tests
 **/*.wasm
+**/*.wasm.gz
 /deployment-config.json
diff --git a/.github/actions/build_nns_dapp/action.yaml b/.github/actions/build_nns_dapp/action.yaml
@@ -1,8 +1,8 @@
 name: 'Release the nns-dapp'
 description: |
   Builds the artefacts for a standard nns-dapp release, including:
-          * `nns-dapp.wasm` (for all networks)
-          * `sns_aggregator.wasm` (for all networks)
+          * `nns-dapp.wasm.gz` (for all networks)
+          * `sns_aggregator.wasm.gz` (for all networks)
           * arguments for mainnet and local
           * other potentially useful files.
 inputs:

diff --git a/.github/actions/release_nns_dapp/action.yaml b/.github/actions/release_nns_dapp/action.yaml
@@ -18,9 +18,17 @@ runs:
       run: |
         set -euxo pipefail
         cd "${{ inputs.assets_dir }}"
-        daily_build_name="nns-dapp-$(git rev-parse HEAD).wasm"
-        cp nns-dapp.wasm "$daily_build_name"
-        artefacts=(nns-dapp.wasm sns_aggregator.wasm sns_aggregator_dev.wasm assets.tar.xz "$daily_build_name")
+        daily_build_name="nns-dapp-$(git rev-parse HEAD).wasm.gz"
+        cp nns-dapp.wasm.gz "$daily_build_name"
+        artefacts=(nns-dapp.wasm.gz sns_aggregator.wasm.gz sns_aggregator_dev.wasm.gz assets.tar.xz "$daily_build_name")
+        # For backwards compatibility we publish the wasms with a .wasm suffix as well:
+        for file in "${artefacts[@]}" ; do
+          [[ "${file}" == "${file%.wasm.gz}" ]]  || {
+            old_name="${file%.gz}"
+            cp "$file" "$old_name"
+            artefacts+=("$old_name")
+          }
+        done
         ls -l "${artefacts[@]}"
         for tag in $(git tag --points-at HEAD) ; do
           : Creates or updates a release for the tag

diff --git a/.github/workflows/aggregator.yaml b/.github/workflows/aggregator.yaml
@@ -42,9 +42,9 @@ jobs:
           dfx-sns-demo-healthcheck
       - name: Upgrade to the current aggregator
         run: |
-          cp out/sns_aggregator_dev.wasm sns_aggregator.wasm
+          cp out/sns_aggregator_dev.wasm.gz sns_aggregator.wasm.gz
           # Note: Pretty much any argument values will do; the canister will be reconfigured.
-          dfx canister install sns_aggregator --wasm sns_aggregator.wasm --mode reinstall --yes --upgrade-unchanged '(opt record { update_interval_ms = 1000; fast_interval_ms = 1_000_000_000; })'
+          dfx canister install sns_aggregator --wasm sns_aggregator.wasm.gz --mode reinstall --yes --upgrade-unchanged '(opt record { update_interval_ms = 1000; fast_interval_ms = 1_000_000_000; })'
           dfx canister call sns_aggregator get_canister_config
       - name: Verify that configuration is as provided
         run: scripts/sns/aggregator/test-config
@@ -96,7 +96,7 @@ jobs:
             exit 1
           }
       - name: Upgrade the aggregator to self with a slow refresh rate
-        run: dfx canister install --mode upgrade --wasm sns_aggregator.wasm --upgrade-unchanged sns_aggregator '(opt record { update_interval_ms = 1_000_000_000; fast_interval_ms = 1_000_000_000; })'
+        run: dfx canister install --mode upgrade --wasm sns_aggregator.wasm.gz --upgrade-unchanged sns_aggregator '(opt record { update_interval_ms = 1_000_000_000; fast_interval_ms = 1_000_000_000; })'
       - name: Expect the first page of data to be retained over the upgrade
         run: |
           AGGREGATOR_CANISTER_ID="$(dfx canister id sns_aggregator)"
@@ -129,7 +129,7 @@ jobs:
           git fetch --depth 1 origin tag aggregator-prod
           diff="$(git diff tags/aggregator-prod rs/sns_aggregator)"
           if test -n "${diff:-}"
-          then ./scripts/sns/aggregator/downgrade-upgrade-test -w sns_aggregator.wasm --verbose
+          then ./scripts/sns/aggregator/downgrade-upgrade-test -w sns_aggregator.wasm.gz --verbose
           else echo "Skipping test as there are no relevant code changes"
           fi
       - name: Stop replica

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -23,25 +23,25 @@ jobs:
         uses: ./.github/actions/build_nns_dapp
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Rename nns-dapp.wasm for upload
-        run: cp out/nns-dapp.wasm out/nns-dapp_local.wasm
+      - name: Rename nns-dapp.wasm.gz for upload
+        run: cp out/nns-dapp.wasm.gz out/nns-dapp_local.wasm.gz
       - name: 'Upload nns-dapp_local wasm module'
         uses: actions/upload-artifact@v3
         with:
           name: nns-dapp_local
-          path: out/nns-dapp_local.wasm
+          path: out/nns-dapp_local.wasm.gz
           retention-days: 3
       - name: 'Upload sns_aggregator wasm module'
         uses: actions/upload-artifact@v3
         with:
           name: sns_aggregator
-          path: out/sns_aggregator.wasm
+          path: out/sns_aggregator.wasm.gz
           retention-days: 3
       - name: 'Upload sns_aggregator_dev wasm module'
         uses: actions/upload-artifact@v3
         with:
           name: sns_aggregator_dev
-          path: out/sns_aggregator_dev.wasm
+          path: out/sns_aggregator_dev.wasm.gz
           retention-days: 3
   test-playwright-e2e:
     needs: build
@@ -64,8 +64,8 @@ jobs:
           # Version from 2023-06-06 with dfx v 0.14.1
           snsdemo_ref: '0e61f618018db099a01b1686535fff8eff980d1c'
           snapshot_url: https://github.com/dfinity/snsdemo/releases/download/release-2023-06-06/snsdemo_snapshot_ubuntu-22.04.tar.xz
-          nns_dapp_wasm: 'nns-dapp_local.wasm'
-          sns_aggregator_wasm: 'sns_aggregator_dev.wasm'
+          nns_dapp_wasm: 'nns-dapp_local.wasm.gz'
+          sns_aggregator_wasm: 'sns_aggregator_dev.wasm.gz'
       - name: Generate .env configuration for Playwright end-to-end tests
         run: |
           DFX_NETWORK=local ./config.sh
@@ -122,8 +122,8 @@ jobs:
           # Version from 2023-06-06 with dfx v0.14.1
           snsdemo_ref: '0e61f618018db099a01b1686535fff8eff980d1c'
           snapshot_url: https://github.com/dfinity/snsdemo/releases/download/release-2023-06-06/snsdemo_snapshot_ubuntu-22.04.tar.xz
-          nns_dapp_wasm: 'nns-dapp_local.wasm'
-          sns_aggregator_wasm: 'sns_aggregator_dev.wasm'
+          nns_dapp_wasm: 'nns-dapp_local.wasm.gz'
+          sns_aggregator_wasm: 'sns_aggregator_dev.wasm.gz'
       - name: Add go and SNS scripts to the path
         run: |
           echo "$PWD/snsdemo/bin" >> $GITHUB_PATH
@@ -178,23 +178,23 @@ jobs:
           } >&2
       - name: Check that metadata is present
         run: |
-          # dfx-wasm-metadata-add.test expects nns-dapp.wasm
-          cp nns-dapp_local.wasm nns-dapp.wasm
+          # dfx-wasm-metadata-add.test expects nns-dapp.wasm.gz
+          cp nns-dapp_local.wasm.gz nns-dapp.wasm.gz
           scripts/dfx-wasm-metadata-add.test --verbose
       - name: Basic downgrade-upgrade test
         run: |
           git fetch --depth 1 origin tag prod
           if git diff tags/prod rs/backend | grep -q .
-          then ./scripts/nns-dapp/downgrade-upgrade-test -w nns-dapp_local.wasm
+          then ./scripts/nns-dapp/downgrade-upgrade-test -w nns-dapp_local.wasm.gz
           else echo "Skipping test as there are no relevant code changes"
           fi
       - name: Release
         run: |
           for tag in $(git tag --points-at HEAD) ; do
             : Creates or updates a release for the tag
             if gh release view "$tag"
-            then gh release upload --repo dfinity/nns-dapp --clobber "$tag" nns-dapp_local.wasm || true
-            else gh release create --title "Release for tags/$tag" --draft --notes "Build artefacts from tag: $tag" "$tag" nns-dapp_local.wasm
+            then gh release upload --repo dfinity/nns-dapp --clobber "$tag" nns-dapp_local.wasm.gz || true
+            else gh release create --title "Release for tags/$tag" --draft --notes "Build artefacts from tag: $tag" "$tag" nns-dapp_local.wasm.gz
             fi
             : If the tag is for a proposal or nightly, make it public
             [[ "$tag" != proposal-* ]] && [[ "$tag" != nightly-* ]] || { echo "Making release public" ; gh release edit "$tag" --draft=false ; }
@@ -225,7 +225,7 @@ jobs:
           SCREENSHOT=1 npm run test |& tee -a firefox-wdio.log
       - name: Get the postinstall instruction count
         run: |
-          dfx canister install --upgrade-unchanged nns-dapp --wasm nns-dapp_local.wasm --mode upgrade --argument "$(cat nns-dapp-arg-local.did)"
+          dfx canister install --upgrade-unchanged nns-dapp --wasm nns-dapp_local.wasm.gz --mode upgrade --argument "$(cat nns-dapp-arg-local.did)"
           postinstall_instructions="$(scripts/backend/get_upgrade_instructions)"
           echo "Installation consumed ${postinstall_instructions} instructions."
           echo "Cycles consumed are instructions * some factor that depends on subnet.  There is no guarantee that that formula will not change."
@@ -303,7 +303,7 @@ jobs:
           path: out-local
       - name: Remove _local suffix
         if: steps.dockerfile_changed.outputs.dockerfile_changed == 'true'
-        run: mv out-local/nns-dapp_local.wasm out-local/nns-dapp.wasm
+        run: mv out-local/nns-dapp_local.wasm.gz out-local/nns-dapp.wasm.gz
       - name: Get sns_aggregator
         if: steps.dockerfile_changed.outputs.dockerfile_changed == 'true'
         uses: actions/download-artifact@v3
@@ -321,7 +321,7 @@ jobs:
         run: |
           set -x
           ls -l
-          artefacts="sns_aggregator_dev.wasm sns_aggregator.wasm nns-dapp.wasm"
+          artefacts="sns_aggregator_dev.wasm.gz sns_aggregator.wasm.gz nns-dapp.wasm.gz"
           networks=(mainnet local)
           for network in "${networks[@]}" ; do
             ls -l "out-$network"

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
@@ -177,7 +177,7 @@ jobs:
         run: |
           echo Create a fake wasm
           mkdir -p release/ci
-          touch release/ci/nns-dapp.wasm
+          touch release/ci/nns-dapp.wasm.gz
           echo Create a proposal template
           scripts/nns-dapp/release-template
           echo Check the proposal

diff --git a/.github/workflows/deploy-to-app.yaml b/.github/workflows/deploy-to-app.yaml
@@ -87,7 +87,7 @@ jobs:
           scripts/nns-dapp/split-assets
           # Note: inputs.mode is set if this workflow is run manually, using workflow_dispatch defined above.
           #       If the workflow is triggered in another way, the inputs are not defined so we need to specify a default again.
-          dfx canister install --mode "${{ inputs.mode || 'upgrade' }}" --yes --network "$DFX_NETWORK" "$CANISTER_NAME" --argument "$(cat out/nns-dapp-arg-mainnet.did)" --wasm out/nns-dapp_noassets.wasm
+          dfx canister install --mode "${{ inputs.mode || 'upgrade' }}" --yes --network "$DFX_NETWORK" "$CANISTER_NAME" --argument "$(cat out/nns-dapp-arg-mainnet.did)" --wasm out/nns-dapp_noassets.wasm.gz
           ./scripts/nns-dapp/upload-asset-tarball --network "$DFX_NETWORK" --chunk out/chunks/assets.xaa.tar.xz
           ./scripts/nns-dapp/upload-asset-tarball --network "$DFX_NETWORK" --chunk out/chunks/assets.xab.tar.xz
           ./scripts/nns-dapp/upload-asset-tarball --network "$DFX_NETWORK" --chunk out/chunks/assets.xac.tar.xz
@@ -100,7 +100,7 @@ jobs:
           jq 'del(.canisters[env.CANISTER_NAME].remote.id[env.DFX_NETWORK])' dfx.json | sponge dfx.json
           DFX_NETWORK="$DFX_NETWORK" jq 'del(.canisters.internet_identity.remote.id[env.DFX_NETWORK])' dfx.json | sponge dfx.json
           dfx-canister set-id --network "$DFX_NETWORK" --canister_name "$CANISTER_NAME" --canister_id "$SNS_AGGREGATOR_APP_SUBNET_CANISTER_ID"
-          dfx canister install --mode "${{ inputs.mode || 'upgrade' }}" --yes --network "$DFX_NETWORK" "$CANISTER_NAME" --wasm out/sns_aggregator.wasm
+          dfx canister install --mode "${{ inputs.mode || 'upgrade' }}" --yes --network "$DFX_NETWORK" "$CANISTER_NAME" --wasm out/sns_aggregator.wasm.gz
       - name: Canister info
         run: |
           # How to add a github summary: https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#example-of-adding-a-job-summary

diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
@@ -30,7 +30,7 @@ jobs:
           name: nns-dapp for ${{ matrix.BUILD_NAME }}
           path: |
             out/commit.txt
-            out/nns-dapp.wasm
+            out/nns-dapp.wasm.gz
             out/nns-dapp-arg-${{ matrix.DFX_NETWORK }}.did
             out/nns-dapp-arg-${{ matrix.DFX_NETWORK }}.bin
             out/frontend-config.sh
@@ -40,8 +40,8 @@ jobs:
         with:
           name: sns_aggregator for ${{ matrix.BUILD_NAME }}
           path: |
-            out/sns_aggregator.wasm
-            out/sns_aggregator_dev.wasm
+            out/sns_aggregator.wasm.gz
+            out/sns_aggregator_dev.wasm.gz
       - name: Release
         uses: ./.github/actions/release_nns_dapp
         with:
@@ -61,15 +61,15 @@ jobs:
           git config user.email "<>"
           : Make a note of the WASM shasum.
           NOTE="refs/notes/mainnet/wasm-sha"
-          SHA="$(sha256sum < "out/nns-dapp.wasm")"
+          SHA="$(sha256sum < "out/nns-dapp.wasm.gz")"
           git fetch origin "+${NOTE}:${NOTE}"
           if git notes --ref="wasm-sha" add -m "$SHA"
           then git push origin "${NOTE}:${NOTE}" || true
           else echo SHA already set
           fi
       - name: "Verify that the WASM module is small enough to deploy"
         run: |
-          wasm_size="$(wc -c < "out/nns-dapp.wasm")"
+          wasm_size="$(wc -c < "out/nns-dapp.wasm.gz")"
           max_size=3145728
           echo "WASM size:          $wasm_size"
           echo "Max supported size: $max_size"

diff --git a/.github/workflows/reproducible.yaml b/.github/workflows/reproducible.yaml
@@ -45,7 +45,7 @@ jobs:
         uses: actions/upload-artifact@v3
         with:
           name: nns-dapp-mainnet-wasm-${{ matrix.os }}
-          path: nns-dapp.wasm
+          path: nns-dapp.wasm.gz
           retention-days: 3
       - name: 'Upload assets'
         uses: actions/upload-artifact@v3
@@ -56,7 +56,7 @@ jobs:
       - name: 'Output the wasm hash'
         run: |
           mkdir -p hashes
-          sha256sum nns-dapp.wasm > "hashes/nns-dapp-wasm_sha256_${{ matrix.os }}_${{ matrix.time }}.txt"
+          sha256sum nns-dapp.wasm.gz > "hashes/nns-dapp-wasm_sha256_${{ matrix.os }}_${{ matrix.time }}.txt"
       - name: 'Output the assets hash'
         run: |
           sha256sum assets.tar.xz > "hashes/assets_sha256_${{ matrix.os }}_${{ matrix.time }}.txt"

diff --git a/.gitignore b/.gitignore
@@ -1,4 +1,5 @@
 **/*.wasm
+**/*.wasm.gz
 assets.tar.xz
 sourcemaps.tar.xz
 build-inputs.txt

diff --git a/Dockerfile b/Dockerfile
@@ -2,7 +2,7 @@
 #
 # docker build . -t nns-dapp
 # container_id=$(docker create nns-dapp no-op)
-# docker cp $container_id:nns-dapp.wasm nns-dapp.wasm
+# docker cp $container_id:nns-dapp.wasm.gz nns-dapp.wasm.gz
 # docker rm --volumes $container_id
 
 # Check the memory available to docker.
@@ -203,24 +203,24 @@ WORKDIR /build
 # Ensure that the code is newer than any cache.
 RUN touch --no-create rs/sns_aggregator/src/main.rs rs/sns_aggregator/src/lib.rs
 RUN RUSTFLAGS="--cfg feature=\"reconfigurable\"" ./build-sns-aggregator.sh
-RUN mv sns_aggregator.wasm sns_aggregator_dev.wasm
+RUN mv sns_aggregator.wasm.gz sns_aggregator_dev.wasm.gz
 RUN ./build-sns-aggregator.sh
 COPY ./scripts/clap.bash /build/scripts/clap.bash
 COPY ./scripts/dfx-wasm-metadata-add /build/scripts/dfx-wasm-metadata-add
 # TODO: Move this to the apt install at the beginning of this file.
 RUN apt-get update -yq && apt-get install -yqq --no-install-recommends file
 ARG COMMIT
-RUN for wasm in sns_aggregator.wasm sns_aggregator_dev.wasm ; do scripts/dfx-wasm-metadata-add --commit "$COMMIT" --canister_name sns_aggregator --verbose --wasm "$wasm" ; done
+RUN for wasm in sns_aggregator.wasm.gz sns_aggregator_dev.wasm.gz ; do scripts/dfx-wasm-metadata-add --commit "$COMMIT" --canister_name sns_aggregator --verbose --wasm "$wasm" ; done
 
 # Title: Image used to extract the final outputs from previous steps.
 FROM scratch AS scratch
 COPY --from=configurator /build/deployment-config.json /
 COPY --from=configurator /build/nns-dapp-arg* /
 # Note: The frontend/.env is kept for use with test deployments only.
 COPY --from=configurator /build/frontend/.env /frontend-config.sh
-COPY --from=build_nnsdapp /build/nns-dapp.wasm /
-COPY --from=build_nnsdapp_without_assets /build/nns-dapp.wasm /nns-dapp_noassets.wasm
+COPY --from=build_nnsdapp /build/nns-dapp.wasm.gz /
+COPY --from=build_nnsdapp_without_assets /build/nns-dapp.wasm.gz /nns-dapp_noassets.wasm.gz
 COPY --from=build_nnsdapp /build/assets.tar.xz /
 COPY --from=build_frontend /build/sourcemaps.tar.xz /
-COPY --from=build_aggregate /build/sns_aggregator.wasm /
-COPY --from=build_aggregate /build/sns_aggregator_dev.wasm /
+COPY --from=build_aggregate /build/sns_aggregator.wasm.gz /
+COPY --from=build_aggregate /build/sns_aggregator_dev.wasm.gz /
diff --git a/HOWTO.md b/HOWTO.md
@@ -176,7 +176,7 @@ is the one that will be used. So we first need to remove the canister from the
 cache and then run `dfx nns install`.
 
 **Note**: If the last step below (`dfx nns install`) gives an error because it
-can't download some canister (for example `lifeline.wasm`), you can copy that
+can't download some canister (for example `lifeline.wasm.gz`), you can copy that
 canister back from the backup directory into the cache directory and try
 again, as long as it isn't the governance canister itself.
 
@@ -241,7 +241,7 @@ If the file/directory doesn't exist at all, create it with that content.
 Then deploy `nns-dapp`:
 
 1. Build the wasm. E.g.: `DFX_NETWORK=local ./build.sh`
-2. Deploy the wasm. E.g.: `dfx canister install nns-dapp --wasm nns-dapp.wasm --upgrade-unchanged --mode reinstall -v --argument "$(cat nns-dapp-arg-local.did)"`
+2. Deploy the wasm. E.g.: `dfx canister install nns-dapp --wasm nns-dapp.wasm.gz --upgrade-unchanged --mode reinstall -v --argument "$(cat nns-dapp-arg-local.did)"`
 
 Now you can visit http://qsgjb-riaaa-aaaaa-aaaga-cai.localhost:8080/ and check
 the proposal.

diff --git a/README.md b/README.md
@@ -89,10 +89,10 @@ When you have the tools installed, you can build the container with:
   ```
 * You can verify that you have the same output as another user with:
   ```sh
-  sha256sum nns-dapp.wasm
+  sha256sum nns-dapp.wasm.gz
   ```
 
-The resulting `nns-dapp.wasm` is ready for deployment as
+The resulting `nns-dapp.wasm.gz` is ready for deployment as
 `qoctq-giaaa-aaaaa-aaaea-cai`, which is the reserved principal for this service.
 
 Our CI also performs these steps; you can compare the SHA256 with the output there, or download the artifact from [a release](https://github.com/dfinity/nns-dapp/releases?q=proposal&expanded=true).

diff --git a/build-backend.sh b/build-backend.sh
@@ -4,7 +4,7 @@ set -euo pipefail
 TOPLEVEL="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 ###############
-# backend # (output: nns-dapp.wasm)
+# backend # (output: nns-dapp.wasm.gz)
 ###############
 echo Compiling rust package
 "$TOPLEVEL/build-rs.sh" nns-dapp

diff --git a/build-rs.sh b/build-rs.sh
@@ -31,13 +31,17 @@ echo "Compiling rust package ${canister_name}"
 cargo build "${cargo_args[@]}"
 
 ####################
-# ic-cdk-optimizer # (output: ${canister_name}.wasm)
+# ic-cdk-optimizer # (output: ${canister_name}.wasm.gz)
 ####################
 echo Optimising wasm
 wasm_path="$(canister_name="$canister_name" jq -r '.canisters[env.canister_name].wasm' dfx.json)"
+[[ "$wasm_path" != "${wasm_path%.wasm.gz}" ]] || {
+  echo "ERROR: dfx.json should have a wasm path ending in .wasm.gz for $canister_name.  It's the new standard..."
+  exit 1
+} >&2
 mkdir -p "$(dirname "$wasm_path")"
-ic-cdk-optimizer "./target/wasm32-unknown-unknown/release/${canister_name}.wasm" -o "$wasm_path"
-gzip -f -n "${wasm_path}"
-mv "${wasm_path}.gz" "${wasm_path}"
+ic-cdk-optimizer "./target/wasm32-unknown-unknown/release/${canister_name}.wasm" -o "${wasm_path%.gz}"
+gzip -f -n "${wasm_path%.gz}"
+rm -f "${wasm_path%.gz}"
 ls -sh "${wasm_path}"
 sha256sum "${wasm_path}"
diff --git a/build.sh b/build.sh
@@ -14,6 +14,10 @@
 #                                                           │ ic-cdk-optimizer
 #                                                           │
 #                                                      nns-dapp.wasm
+#                                                           ▲
+#                                                           │ gzip
+#                                                           │
+#                                                      nns-dapp.wasm.gz
 
 set -euo pipefail
 

diff --git a/dfx.json b/dfx.json
@@ -16,7 +16,7 @@
     "nns-dapp": {
       "type": "custom",
       "candid": "rs/backend/nns-dapp.did",
-      "wasm": "nns-dapp.wasm",
+      "wasm": "nns-dapp.wasm.gz",
       "build": "./build.sh",
       "remote": {
         "id": {
@@ -103,7 +103,7 @@
         "./build-sns-aggregator.sh"
       ],
       "candid": "rs/sns_aggregator/sns_aggregator.did",
-      "wasm": "sns_aggregator.wasm",
+      "wasm": "sns_aggregator.wasm.gz",
       "type": "custom",
       "remote": {
         "id": {