Skip to content

Commit 02e6b96

Browse files
JasonVranekjclapisiurii-ssvselfuryondom-nie
authored
Restore/pre 0.9.3 backlog (#72)
* PBS: Reload the config file when it changes (Commit-Boost#409) * ssv-network: SSV-node API support (Commit-Boost#415) Co-authored-by: Joe Clapis <jclapis@outlook.com> * fix(tests): update tests for SSV API rename and PbsState signature change (Commit-Boost#427) * Fix broken CLI caused by double-parse bug (Commit-Boost#428) Co-authored-by: Joe Clapis <jclapis@outlook.com> * Support custom chain ids (Commit-Boost#429) * Update README.md (Commit-Boost#436) * Unify the CLI, PBS, and Signer Binaries into One (Commit-Boost#425) Co-authored-by: Jason Vranek <jasonvranek@gmail.com> Closes Commit-Boost#430, Commit-Boost#431, Commit-Boost#432 * add get_header auction winner log (Commit-Boost#443) * Sigp audit fixes (Commit-Boost#438) Co-authored-by: Manuel Iñaki Bilbao <manuel.bilbao@lambdaclass.com> Co-authored-by: Joe Clapis <jclapis@outlook.com> Co-authored-by: eltitanb <lorenzo@gattaca.com> Co-authored-by: ltitanb <163874448+ltitanb@users.noreply.github.com> * fix deps from cherrypicking * Create v0.9.7-rc1.yml (Commit-Boost#463) * Feature/commit boost default image (Commit-Boost#464) --------- Co-authored-by: Joe Clapis <jclapis@outlook.com> Co-authored-by: iurii-ssv <183610124+iurii-ssv@users.noreply.github.com> Co-authored-by: Sergey Yakovlev <selfuryon@pm.me> Co-authored-by: Dominik Niedbała <dominikniedbala18@gmail.com> Co-authored-by: ninaiiad <nina@gattaca.com> Co-authored-by: Manuel Iñaki Bilbao <manuel.bilbao@lambdaclass.com> Co-authored-by: eltitanb <lorenzo@gattaca.com> Co-authored-by: ltitanb <163874448+ltitanb@users.noreply.github.com>
1 parent fa81a73 commit 02e6b96

106 files changed

Lines changed: 8974 additions & 1982 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.cargo/audit.toml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# RUSTSEC-2026-0049: CRL revocation checking bug in rustls-webpki 0.101.7.
2+
#
3+
# Background: CRL (Certificate Revocation List) checking is an optional TLS
4+
# feature where a client fetches a list of revoked certificates from URLs
5+
# embedded in the cert itself, to confirm it hasn't been invalidated since
6+
# issuance. This is distinct from normal certificate validation.
7+
#
8+
# The bug: when a cert lists multiple CRL distribution point URLs, only the
9+
# first URL is checked; the rest are silently ignored. This matters only when
10+
# CRL checking is enabled AND the UnknownStatusPolicy is set to Allow (meaning
11+
# "if I can't determine revocation status, accept the cert anyway"). With that
12+
# combination, a revoked certificate from a compromised CA could be accepted.
13+
#
14+
# Why this does not affect Commit-Boost: the vulnerable code path is never
15+
# reached because no code in this codebase enables CRL checking at all.
16+
# TLS is used in four places: (1) relay communication via reqwest with
17+
# rustls-tls uses default CA validation with no CRL configured; (2) the signer
18+
# server presents a TLS certificate but does not check client revocation;
19+
# (3) the signer client pins a single self-signed certificate via
20+
# add_root_certificate — CRL is irrelevant for self-signed certs; (4) the Dirk
21+
# remote signer uses mTLS with a custom CA but again no CRL. In all cases the
22+
# buggy CRL code in rustls-webpki is never invoked.
23+
#
24+
# Blocked on sigp/lighthouse upgrading past v8.0.1 without a compilation
25+
# regression (SseEventSource missing cfg guard in eth2 error.rs).
26+
[advisories]
27+
ignore = ["RUSTSEC-2026-0049"]

‎.github/workflows/release-gate.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ on:
33
pull_request:
44
types: [closed]
55
branches: [main]
6-
paths: ['.releases/**']
6+
paths: [".releases/**"]
77

88
concurrency:
99
group: release-gate
@@ -40,7 +40,7 @@ jobs:
4040

4141
- uses: actions/setup-python@v6
4242
with:
43-
python-version: '3.x'
43+
python-version: "3.x"
4444

4545
- name: Install Python deps
4646
run: pip install pyyaml

‎.github/workflows/release.yml‎

Lines changed: 12 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ jobs:
7272
VALUE=$(python .github/workflows/release/release.py is-latest "${{ inputs.tag }}")
7373
echo "value=$VALUE" >> $GITHUB_OUTPUT
7474
75-
# Builds the x64 and arm64 binaries for Linux, for all 3 crates, via the Docker builder
75+
# Builds the x64 and arm64 binaries for Linux via the Docker builder
7676
build-binaries-linux:
7777
needs: [resolve-tag]
7878
timeout-minutes: 60
@@ -83,20 +83,14 @@ jobs:
8383
- amd64
8484
- arm64
8585
name:
86-
- commit-boost-cli
87-
- commit-boost-pbs
88-
- commit-boost-signer
86+
- commit-boost
8987
include:
9088
- target: amd64
9189
package-suffix: x86-64
9290
- target: arm64
9391
package-suffix: arm64
94-
- name: commit-boost-cli
95-
target-crate: cli
96-
- name: commit-boost-pbs
97-
target-crate: pbs
98-
- name: commit-boost-signer
99-
target-crate: signer
92+
- name: commit-boost
93+
target-crate: commit-boost
10094
runs-on: ubuntu-latest
10195
steps:
10296
- name: Checkout code
@@ -150,7 +144,7 @@ jobs:
150144
path: |
151145
${{ matrix.name }}-${{ inputs.tag }}-linux_${{ matrix.package-suffix }}.tar.gz
152146
153-
# Builds the arm64 binaries for Darwin, for all 3 crates, natively
147+
# Builds the arm64 binary for Darwin natively
154148
build-binaries-darwin:
155149
needs: [resolve-tag]
156150
timeout-minutes: 60
@@ -162,9 +156,7 @@ jobs:
162156
# - x86_64-apple-darwin
163157
- aarch64-apple-darwin
164158
name:
165-
- commit-boost-cli
166-
- commit-boost-pbs
167-
- commit-boost-signer
159+
- commit-boost
168160
include:
169161
# - target: x86_64-apple-darwin
170162
# os: macos-latest-large
@@ -237,7 +229,7 @@ jobs:
237229
packages: write
238230
strategy:
239231
matrix:
240-
crate: [pbs, signer]
232+
crate: [pbs, signer, commit-boost]
241233
runs-on: ubuntu-latest
242234
timeout-minutes: 45
243235
steps:
@@ -252,16 +244,16 @@ jobs:
252244
uses: actions/download-artifact@v4
253245
with:
254246
path: ./artifacts
255-
pattern: "commit-boost-*"
247+
pattern: "commit-boost*"
256248

257249
- name: Extract binaries
258250
run: |
259251
mkdir -p ./artifacts/bin/linux_amd64
260252
mkdir -p ./artifacts/bin/linux_arm64
261-
tar -xzf ./artifacts/commit-boost-${{ matrix.crate }}-${{ inputs.tag }}-linux_x86-64/commit-boost-${{ matrix.crate }}-${{ inputs.tag }}-linux_x86-64.tar.gz -C ./artifacts/bin
262-
mv ./artifacts/bin/commit-boost-${{ matrix.crate }} ./artifacts/bin/linux_amd64/commit-boost-${{ matrix.crate }}
263-
tar -xzf ./artifacts/commit-boost-${{ matrix.crate }}-${{ inputs.tag }}-linux_arm64/commit-boost-${{ matrix.crate }}-${{ inputs.tag }}-linux_arm64.tar.gz -C ./artifacts/bin
264-
mv ./artifacts/bin/commit-boost-${{ matrix.crate }} ./artifacts/bin/linux_arm64/commit-boost-${{ matrix.crate }}
253+
tar -xzf ./artifacts/commit-boost-${{ inputs.tag }}-linux_x86-64/commit-boost-${{ inputs.tag }}-linux_x86-64.tar.gz -C ./artifacts/bin
254+
mv ./artifacts/bin/commit-boost ./artifacts/bin/linux_amd64/commit-boost
255+
tar -xzf ./artifacts/commit-boost-${{ inputs.tag }}-linux_arm64/commit-boost-${{ inputs.tag }}-linux_arm64.tar.gz -C ./artifacts/bin
256+
mv ./artifacts/bin/commit-boost ./artifacts/bin/linux_arm64/commit-boost
265257
266258
- name: Set lowercase owner
267259
run: echo "OWNER=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_ENV

‎.gitignore‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,18 @@ targets.json
1616
.idea/
1717
logs
1818
.vscode/
19+
certs/
20+
21+
# Nix
22+
.direnv/
23+
.devenv/
24+
devenv.*
25+
devenv.lock
26+
.devenv.flake.nix
27+
.envrc
28+
29+
# Generated from testnet
30+
kurtosis-dump
1931

2032
# Python (release scripts under .github/workflows/release/)
2133
__pycache__/

0 commit comments

Comments
 (0)