Merge remote-tracking branch 'origin/main' into pr-465

Author: JasonVranek

.cargo/audit.toml

@@ -0,0 +1,27 @@
+# RUSTSEC-2026-0049: CRL revocation checking bug in rustls-webpki 0.101.7.
+#
+# Background: CRL (Certificate Revocation List) checking is an optional TLS
+# feature where a client fetches a list of revoked certificates from URLs
+# embedded in the cert itself, to confirm it hasn't been invalidated since
+# issuance. This is distinct from normal certificate validation.
+#
+# The bug: when a cert lists multiple CRL distribution point URLs, only the
+# first URL is checked; the rest are silently ignored. This matters only when
+# CRL checking is enabled AND the UnknownStatusPolicy is set to Allow (meaning
+# "if I can't determine revocation status, accept the cert anyway"). With that
+# combination, a revoked certificate from a compromised CA could be accepted.
+#
+# Why this does not affect Commit-Boost: the vulnerable code path is never
+# reached because no code in this codebase enables CRL checking at all.
+# TLS is used in four places: (1) relay communication via reqwest with
+# rustls-tls uses default CA validation with no CRL configured; (2) the signer
+# server presents a TLS certificate but does not check client revocation;
+# (3) the signer client pins a single self-signed certificate via
+# add_root_certificate — CRL is irrelevant for self-signed certs; (4) the Dirk
+# remote signer uses mTLS with a custom CA but again no CRL. In all cases the
+# buggy CRL code in rustls-webpki is never invoked.
+#
+# Blocked on sigp/lighthouse upgrading past v8.0.1 without a compilation
+# regression (SseEventSource missing cfg guard in eth2 error.rs).
+[advisories]
+ignore = ["RUSTSEC-2026-0049"]

.github/workflows/release.yml

@@ -1,3 +1,4 @@
+
 name: Draft Release
 
 on:
@@ -72,7 +73,7 @@ jobs:
           VALUE=$(python .github/workflows/release/release.py is-latest "${{ inputs.tag }}")
           echo "value=$VALUE" >> $GITHUB_OUTPUT
 
-  # Builds the x64 and arm64 binaries for Linux, for all 3 crates, via the Docker builder
+  # Builds the x64 and arm64 binaries for Linux via the Docker builder
   build-binaries-linux:
     needs: [resolve-tag]
     timeout-minutes: 60
@@ -83,20 +84,14 @@ jobs:
           - amd64
           - arm64
         name:
-          - commit-boost-cli
-          - commit-boost-pbs
-          - commit-boost-signer
+          - commit-boost
         include:
           - target: amd64
             package-suffix: x86-64
           - target: arm64
             package-suffix: arm64
-          - name: commit-boost-cli
-            target-crate: cli
-          - name: commit-boost-pbs
-            target-crate: pbs
-          - name: commit-boost-signer
-            target-crate: signer
+          - name: commit-boost
+            target-crate: commit-boost
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
@@ -150,7 +145,7 @@ jobs:
           path: |
             ${{ matrix.name }}-${{ inputs.tag }}-linux_${{ matrix.package-suffix }}.tar.gz
 
-  # Builds the arm64 binaries for Darwin, for all 3 crates, natively
+  # Builds the arm64 binary for Darwin natively
   build-binaries-darwin:
     needs: [resolve-tag]
     timeout-minutes: 60
@@ -162,9 +157,7 @@ jobs:
           # - x86_64-apple-darwin
           - aarch64-apple-darwin
         name:
-          - commit-boost-cli
-          - commit-boost-pbs
-          - commit-boost-signer
+          - commit-boost
         include:
           # - target: x86_64-apple-darwin
           #   os: macos-latest-large
@@ -237,7 +230,7 @@ jobs:
       packages: write
     strategy:
       matrix:
-        crate: [pbs, signer]
+        crate: [pbs, signer, commit-boost]
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
@@ -252,16 +245,16 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           path: ./artifacts
-          pattern: "commit-boost-*"
+          pattern: "commit-boost*"
 
       - name: Extract binaries
         run: |
           mkdir -p ./artifacts/bin/linux_amd64
           mkdir -p ./artifacts/bin/linux_arm64
-          tar -xzf ./artifacts/commit-boost-${{ matrix.crate }}-${{ inputs.tag }}-linux_x86-64/commit-boost-${{ matrix.crate }}-${{ inputs.tag }}-linux_x86-64.tar.gz -C ./artifacts/bin
-          mv ./artifacts/bin/commit-boost-${{ matrix.crate }} ./artifacts/bin/linux_amd64/commit-boost-${{ matrix.crate }}
-          tar -xzf ./artifacts/commit-boost-${{ matrix.crate }}-${{ inputs.tag }}-linux_arm64/commit-boost-${{ matrix.crate }}-${{ inputs.tag }}-linux_arm64.tar.gz -C ./artifacts/bin
-          mv ./artifacts/bin/commit-boost-${{ matrix.crate }} ./artifacts/bin/linux_arm64/commit-boost-${{ matrix.crate }}
+          tar -xzf ./artifacts/commit-boost-${{ inputs.tag }}-linux_x86-64/commit-boost-${{ inputs.tag }}-linux_x86-64.tar.gz -C ./artifacts/bin
+          mv ./artifacts/bin/commit-boost ./artifacts/bin/linux_amd64/commit-boost
+          tar -xzf ./artifacts/commit-boost-${{ inputs.tag }}-linux_arm64/commit-boost-${{ inputs.tag }}-linux_arm64.tar.gz -C ./artifacts/bin
+          mv ./artifacts/bin/commit-boost ./artifacts/bin/linux_arm64/commit-boost
 
       - name: Set lowercase owner
         run: echo "OWNER=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV

.gitignore

@@ -16,8 +16,19 @@ targets.json
 .idea/
 logs
 .vscode/
+certs/
 
 # Python (release scripts under .github/workflows/release/)
 __pycache__/
 *.pyc
 .pytest_cache/
+# Nix
+.direnv/
+.devenv/
+devenv.*
+devenv.lock
+.devenv.flake.nix
+.envrc
+
+# Generated from testnet
+kurtosis-dump

.releases/README.md

@@ -73,7 +73,7 @@ Example verification flow:
 export REPO=Commit-Boost/commit-boost-client
 export VERSION=vX.Y.Z
 export ARCH=linux_x86-64
-export BIN=commit-boost-pbs
+export BIN=commit-boost
 
 curl -L \
   -o "$BIN-$VERSION-$ARCH.tar.gz" \
@@ -87,7 +87,7 @@ cosign verify-blob \
   "$BIN-$VERSION-$ARCH.tar.gz" \
   --bundle "$BIN-$VERSION-$ARCH.tar.gz.sigstore.json" \
   --certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
-  --certificate-identity="https://github.com/Commit-Boost/commit-boost-client/.github/workflows/release.yml@refs/heads/main"
+  --certificate-identity="https://github.com/$REPO/.github/workflows/release.yml@refs/heads/main"
 ```
 
 To verify assets from a fork, replace `REPO` with the fork path, for example: