pub enum Certificate {
    V0(V0Certificate),
}

/// A Dac V0 certificate.
#[derive(Debug, HasEncoding, NomReader, BinWriter)]
pub struct V0Certificate {
    /// The preimage hash of the root [`V0HashPage`].
    ///
    /// [`V0HashPage`]: crate::dac::pages::V0HashPage
    pub root_hash: PreimageHash,
    /// Aggregated signature of the DAC committee.
    pub aggregated_signature: BlsSignature,
    /// Data_encoding.Bit_set.t is actually a Z.t
    pub witnesses: Zarith,
}

If you have followed our previous blog posts, you know there is a fourth field version. This one is not present in the previous struct which is sent to Smart Rollups because it is captured by the Certificate enum. This previous struct is defined inside the Kernel-SDK

fn get_dac_committee() -> Result> {
    // Assume that we have 3 DAC committee Members PK stored as raw bytes of CompressedPK.
    // In the future, we probably want to have a bigger DAC committee.

    // Current PK of member-1 of Community DAC. Public key hash is "tz4EXupF2QRtHyrHW7Cy7y1jtW48NhgcZvXP"
    let pk_0 = PublicKeyBls::from_base58_check(
        "BLpk1nEyxfm3tzJ6Xx6S2UVgMonQ3KFBjKWEZ2TgJg89S7Mykb5dPsT8w7zeg1iUAVXgUqZqybX7",
    )
    .map_err(|_err| Error::FromBase58CheckError)?;

    //Current PK of member-2 of Community DAC. Public key hash is "tz4RnqbpM3PiFGWgAAr2xZGAQKeRM5nqYppq"
    let pk_1 = PublicKeyBls::from_base58_check(
        "BLpk1nHoWTSPMiG1W8qpimTSqrosAxc1L33Hyb9xHgXeVSZkzg26BxMunwajX2zekW8KuuT8Y4LP",
    )
    .map_err(|_err| Error::FromBase58CheckError)?;

    //Current PK of TT member of Community DAC. Public key hash is "tz4CdFt1ktHZz3mfLtmt8e1YwbSvioL7aQEs"
    let pk_2 = PublicKeyBls::from_base58_check(
        "BLpk1rNLTcT3Z6Y8ndq3Dw5XBiJSHuVsMSkn6nczbdt29WG3ksHRw14vy4KqwfMiedmmVYEYC2Nw",
    )
    .map_err(|_err| Error::FromBase58CheckError)?;

    Ok(vec![pk_0, pk_1, pk_2])
}

You will have to use the Certificate.verify function to validate the received DAC Certificate against the public keys you set before.

let committee_members_pks = get_dac_committee()?;

// We require at least 2/3 members to have signed the certificate
let min_required_dac_sigs = 2;

certificate.verify(&committee_members_pks, min_required_dac_sigs)
  .map_err(Error::from)?;
    

First one: reveal_to_store The kernel SDK exposes the reveal_to_store function that we are going to call right after verifying the DAC Certificate:

// We require at least 2/3 members to have signed the certificate
let min_required_dac_sigs = 2;

certificate.verify(&committee_members_pks, min_required_dac_sigs)
  .map_err(Error::from)?;
let path: RefPath = RefPath::assert_from(b"/reveal/image");
certificate
    .reveal_to_store(host, &path)
    .map_err(Error::from)?;

Now, we need to call the store_read_all function to finally get the bytes of the provided DAC Certificate!

// We require at least 2/3 members to have signed the certificate
let min_required_dac_sigs = 2;

certificate.verify(&committee_members_pks, min_required_dac_sigs)
  .map_err(Error::from)?;
let path: RefPath = RefPath::assert_from(b"/reveal/image");
certificate
    .reveal_to_store(host, &path)
    .map_err(Error::from)?;
let bytes = host.store_read_all(&path).map_err(Error::from)?;
let tweet = Tweet {
    author: post_image.author,
    content: TweetContent::Image(bytes),
    likes: 0,
};

Using verify, reveal_to_store and store_read_all, and also processing, all that in a single run will push the tick limit near the upper limit of 10MB images in DAC messages (as explained in the documentation). We recommend you to split up the DAC messages processing into several kernel runs for safety.

As explained previously, for your Smart Rollup to have access to the data corresponding to the DAC Certificates, you must run your own DAC Observer, sharing the reveal data directory with the Smart Rollup.

# Configure your DAC Observer
# ${REVEAL_DATA_DIR} is the shared folder between DAC Observer and your Smart Rollup.
$ octez-dac-node \
configure as observer with coordinator \
https://dac-ghost-coordinator.gcp.marigold.dev \
and committee member rpc addresses \
https://dac-ghost-member1.gcp.marigold.dev \
https://dac-ghost-member2.gcp.marigold.dev \
34.111.118.121 \
--data-dir ${OBSERVER_DIR} --reveal-data-dir ${REVEAL_DATA_DIR}

Warning:

                   DAC is in an experimental release phase.

           We encourage the community to develop rollups using DAC in
           Testnets and lower environments. Mainnet is NOT recommended.

DAC node configuration written in ${OBSERVER_DIR}/config.json

# Launch your DAC Observer
$ octez-dac-node -d ${OCTEZ_CLIENT_DIR} -E ${GHOSTNET_RPC} run --data-dir ${OBSERVER_DIR}

Oct 11 09:47:58.426: Starting the DAC node
Oct 11 09:47:58.430: The DAC node is running in mode Observer
Oct 11 09:47:58.449: DAC Node RPC server is started
Oct 11 09:47:58.449: The DAC node is listening to 127.0.0.1:10832
Oct 11 09:47:58.449: Started tracking layer 1's node
Oct 11 09:47:58.723: Resolved plugin for protocol PtNairobiyss
Oct 11 09:47:58.723: The DAC node is ready
Oct 11 09:47:58.723: Subscribed to root hashes stream
Oct 11 09:47:58.723: Started tracking layer 1's node
Oct 11 09:47:58.861: Head of layer 1's node updated to
Oct 11 09:47:58.861:   BLrGxHNDrDq1bCNNThgxhLrTQxY9renAmfijvwCJDCvEyYVzHw5 at level 4158498

- POST /preimage to post data and get corresponding root_hash
- GET /serialized_certificates/{root_hash} to get related DAC Certificate.

Let’s create a handleLoadedImage function which takes a valid hexadecimal value as a parameter.
This function will call the /preimage endpoint of Ghostnet Community DAC Coordinator to provide the data and get the corresponding root_hash which will be needed to get the DAC Certificate and send this last one to your Smart Rollup.

async handleLoadedImage(hexaString: string) {

    console.log("Posting Hexa image to DAC: ", hexaString);
    const preimageUrl = "https://dac-ghost-coordinator.gcp.marigold.dev/v0/preimage";
    const preimageResponse = await fetch(preimageUrl, {
      method: "POST", // or 'PUT'
      headers: {
        "Content-Type": "application/json",
      },
      body: JSON.stringify(hexaString),
    })

    const root_hash = await preimageResponse.json();
   [...]
  };
  

We did the choice to do that inside the same function, if you have followed, we need to call the second endpoint GET /serialized_certificates/{root_hash}:

[...]
    const root_hash = await preimageResponse.json();

    // After quick calculation
    // With the actual resources of the DAC
    // We need to wait around 30s/1MB of data
    // Before retrieving the certificate
    await new Promise(resolve => setTimeout(resolve, hexaString.length / 2_000_000 * 30000));

    console.log("Successfully posted image, root_hash is: ", root_hash);
    console.log("Retrieving serialized_certificate from root_hash: ", root_hash);

    const serializedCertificateUrl = "https://dac-ghost-coordinator.gcp.marigold.dev/v0/serialized_certificates/" + root_hash;
    const serializedCertificateResponse = await fetch(serializedCertificateUrl);
    const serializedCertificate = await serializedCertificateResponse.json();

    console.log("Successfully retrieved serialized_certificate: ", serializedCertificate);

    return serializedCertificate;
};

We can finally send the message (with the format expected by our Smart Rollup, which I am not going to detail here because it is not the purpose of this blog post) by using Tezos.contract.smartRollupAddMessages from Taquito.