Merge branch 'develop' into feat/save-mempool-caches

obycode · web-flow · commit 11697391d833 · 2025-04-03T19:23:47.000-04:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -102,22 +102,6 @@ jobs:
       signer_docker_tag: ${{ needs.check-release.outputs.signer_docker_tag }}
       is_node_release: ${{ needs.check-release.outputs.is_node_release }}
       is_signer_release: ${{ needs.check-release.outputs.is_signer_release }}
-    secrets: inherit
-
-  ## Build and push Debian image built from source
-  ##
-  ## Runs when:
-  ##  - it is not a node or signer-only release run
-  docker-image:
-    if: |
-      needs.check-release.outputs.is_node_release != 'true' ||
-      needs.check-release.outputs.is_signer_release != 'true'
-    name: Docker Image (Source)
-    uses: ./.github/workflows/image-build-source.yml
-    needs:
-      - rustfmt
-      - check-release
-    secrets: inherit
 
   ## Create a reusable cache for tests
   ##
diff --git a/.github/workflows/github-release.yml b/.github/workflows/github-release.yml
@@ -29,9 +29,6 @@ on:
         description: "True if it is a signer release"
         required: true
         type: string
-    secrets:
-      GH_TOKEN:
-        required: true
 
 concurrency:
   group: github-release-${{ github.head_ref || github.ref }}
@@ -41,6 +38,21 @@ concurrency:
 run-name: ${{ inputs.node_tag || inputs.signer_tag }}
 
 jobs:
+  ## This job's sole purpose is trigger a secondary approval outside of the matrix jobs below. 
+  ##   - If this job isn't approved to run, then the subsequent jobs will also not run - for this reason, we always exit 0
+  ##   - `andon-cord` requires the repo environment "Build Release", which will trigger a secondary approval step before running this workflow.  
+  andon-cord:
+    if: |
+      inputs.node_tag != '' ||
+      inputs.signer_tag != ''
+    name: Andon Cord
+    runs-on: ubuntu-latest
+    environment: "Build Release"
+    steps:
+      - name: Check Approval
+        id: check
+        run: |
+          exit 0
   ## Build arch dependent binaries from source
   ##
   ## Runs when the following is true:
@@ -51,7 +63,8 @@ jobs:
       inputs.signer_tag != ''
     name: Build Binaries
     runs-on: ubuntu-latest
-    environment: "Build Release"
+    needs:
+      - andon-cord
     strategy:
       ## Run a maximum of 10 builds concurrently, using the matrix defined in inputs.arch
       max-parallel: 10
@@ -94,7 +107,10 @@ jobs:
     name: Create Release
     runs-on: ubuntu-latest
     needs:
+      - andon-cord
       - build-binaries
+    permissions:
+      contents: write
     steps:
       ## Creates releases
       - name: Create Release
@@ -106,8 +122,7 @@ jobs:
           signer_docker_tag: ${{ inputs.signer_docker_tag }}
           is_node_release: ${{ inputs.is_node_release }}
           is_signer_release: ${{ inputs.is_signer_release }}
-          GH_TOKEN: ${{ secrets.GH_TOKEN }}
-
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   ## Builds arch dependent Docker images from binaries
   ##
@@ -121,6 +136,7 @@ jobs:
     name: Docker Image (Binary)
     runs-on: ubuntu-latest
     needs:
+      - andon-cord
       - build-binaries
       - create-release
     strategy:
@@ -153,12 +169,15 @@ jobs:
     name: Create Downstream PR (${{ github.ref_name }})
     runs-on: ubuntu-latest
     needs:
+      - andon-cord
       - build-binaries
       - create-release
       - docker-image
+    permissions:
+      pull-requests: write
     steps:
       - name: Open Downstream PR
         id: create-pr
         uses: stacks-network/actions/stacks-core/release/downstream-pr@main
         with:
-          token: ${{ secrets.GH_TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/image-build-source.yml b/.github/workflows/image-build-source.yml
@@ -21,6 +21,8 @@ jobs:
   image:
     name: Build Image
     runs-on: ubuntu-latest
+    ## Requires the repo environment "Push to Docker", which will trigger a secondary approval step before running this workflow.
+    environment: "Push to Docker"
     steps:
       ## Setup Docker for the builds
       - name: Docker setup
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/contrib/tools/block-replay.sh b/contrib/tools/block-replay.sh
@@ -195,7 +195,7 @@ start_replay() {
             starting_block=0 # for the block counter, start at this block
             ## use these values if `--testing` arg is provided (only replay 1_000 blocks) Note:  2.5 epoch is at 153106
             ${TESTING} && total_blocks=153000
-            ${TESTING} && starting_block=15200
+            ${TESTING} && starting_block=152000
             ;;
     esac
     local block_diff=$((total_blocks - starting_block)) ## how many blocks are being replayed
diff --git a/libsigner/Cargo.toml b/libsigner/Cargo.toml
@@ -21,13 +21,8 @@ hashbrown = { workspace = true }
 lazy_static = "1.4.0"
 libc = "0.2"
 libstackerdb = { path = "../libstackerdb" }
-prometheus = { version = "0.9", optional = true }
 serde = "1"
-serde_derive = "1"
-serde_stacker = "0.1"
 slog = { version = "2.5.2", features = [ "max_level_trace" ] }
-slog-term = "2.6.0"
-slog-json = { version = "2.3.0", optional = true }
 stacks-common = { path = "../stacks-common" }
 stackslib = { path = "../stackslib"}
 thiserror = { workspace = true }
@@ -42,15 +37,8 @@ rand = { workspace = true }
 version = "1.0"
 features = ["arbitrary_precision", "unbounded_depth"]
 
-[dependencies.secp256k1]
-version = "0.24.3"
-features = ["serde", "recovery"]
-
 [target.'cfg(all(any(target_arch = "x86_64", target_arch = "x86", target_arch = "aarch64"), not(any(target_os="windows"))))'.dependencies]
 sha2 = { version = "0.10", features = ["asm"] }
 
 [target.'cfg(any(not(any(target_arch = "x86_64", target_arch = "x86", target_arch = "aarch64")), any(target_os = "windows")))'.dependencies]
 sha2 = { version = "0.10" }
-
-[features]
-monitoring_prom = ["prometheus"]
diff --git a/libstackerdb/Cargo.toml b/libstackerdb/Cargo.toml
@@ -17,8 +17,6 @@ path = "./src/libstackerdb.rs"
 
 [dependencies]
 serde = "1"
-serde_derive = "1"
-serde_stacker = "0.1"
 stacks-common = { path = "../stacks-common" }
 clarity = { path = "../clarity" }
 
diff --git a/pox-locking/src/pox_2.rs b/pox-locking/src/pox_2.rs
@@ -173,8 +173,8 @@ pub fn parse_pox_increase(result: &Value) -> std::result::Result<(PrincipalData,
 ///
 /// # Errors
 /// - Returns Error::PoxExtendNotLocked if this function was called on an account
-///     which isn't locked. This *should* have been checked by the PoX v2 contract,
-///     so this should surface in a panic.
+///   which isn't locked. This *should* have been checked by the PoX v2 contract,
+///   so this should surface in a panic.
 pub fn pox_lock_increase_v2(
     db: &mut ClarityDatabase,
     principal: &PrincipalData,
@@ -226,8 +226,8 @@ pub fn pox_lock_increase_v2(
 ///
 /// # Errors
 /// - Returns Error::PoxExtendNotLocked if this function was called on an account
-///     which isn't locked. This *should* have been checked by the PoX v2 contract,
-///     so this should surface in a panic.
+///   which isn't locked. This *should* have been checked by the PoX v2 contract,
+///   so this should surface in a panic.
 pub fn pox_lock_extend_v2(
     db: &mut ClarityDatabase,
     principal: &PrincipalData,
diff --git a/pox-locking/src/pox_3.rs b/pox-locking/src/pox_3.rs
@@ -96,8 +96,8 @@ pub fn pox_lock_v3(
 ///
 /// # Errors
 /// - Returns Error::PoxExtendNotLocked if this function was called on an account
-///     which isn't locked. This *should* have been checked by the PoX v3 contract,
-///     so this should surface in a panic.
+///   which isn't locked. This *should* have been checked by the PoX v3 contract,
+///   so this should surface in a panic.
 pub fn pox_lock_extend_v3(
     db: &mut ClarityDatabase,
     principal: &PrincipalData,
@@ -132,8 +132,8 @@ pub fn pox_lock_extend_v3(
 ///
 /// # Errors
 /// - Returns Error::PoxExtendNotLocked if this function was called on an account
-///     which isn't locked. This *should* have been checked by the PoX v3 contract,
-///     so this should surface in a panic.
+///   which isn't locked. This *should* have been checked by the PoX v3 contract,
+///   so this should surface in a panic.
 pub fn pox_lock_increase_v3(
     db: &mut ClarityDatabase,
     principal: &PrincipalData,
diff --git a/pox-locking/src/pox_4.rs b/pox-locking/src/pox_4.rs
@@ -69,8 +69,8 @@ pub fn pox_lock_v4(
 ///
 /// # Errors
 /// - Returns Error::PoxExtendNotLocked if this function was called on an account
-///     which isn't locked. This *should* have been checked by the PoX v4 contract,
-///     so this should surface in a panic.
+///   which isn't locked. This *should* have been checked by the PoX v4 contract,
+///   so this should surface in a panic.
 pub fn pox_lock_extend_v4(
     db: &mut ClarityDatabase,
     principal: &PrincipalData,
@@ -105,8 +105,8 @@ pub fn pox_lock_extend_v4(
 ///
 /// # Errors
 /// - Returns Error::PoxExtendNotLocked if this function was called on an account
-///     which isn't locked. This *should* have been checked by the PoX v4 contract,
-///     so this should surface in a panic.
+///   which isn't locked. This *should* have been checked by the PoX v4 contract,
+///   so this should surface in a panic.
 pub fn pox_lock_increase_v4(
     db: &mut ClarityDatabase,
     principal: &PrincipalData,
diff --git a/stacks-common/src/deps_common/bitcoin/blockdata/block.rs b/stacks-common/src/deps_common/bitcoin/blockdata/block.rs
@@ -101,7 +101,7 @@ impl BlockHeader {
 
     /// Computes the target value in float format from Uint256 format.
     pub fn compact_target_from_u256(value: &Uint256) -> u32 {
-        let mut size = (value.bits() + 7) / 8;
+        let mut size = value.bits().div_ceil(8);
         let mut compact = if size <= 3 {
             (value.low_u64() << (8 * (3 - size))) as u32
         } else {
diff --git a/stacks-common/src/deps_common/bitcoin/util/hash.rs b/stacks-common/src/deps_common/bitcoin/util/hash.rs
@@ -436,7 +436,7 @@ pub fn bitcoin_merkle_root(data: Vec<Sha256dHash>) -> Sha256dHash {
         return data[0];
     }
     // Recursion
-    let iterations = (data.len() + 1) / 2;
+    let iterations = data.len().div_ceil(2);
     let mut next = Vec::with_capacity(iterations);
     for idx in 0..iterations {
         let idx1 = 2 * idx;
diff --git a/stacks-common/src/util/secp256k1/native.rs b/stacks-common/src/util/secp256k1/native.rs
@@ -94,10 +94,7 @@ impl MessageSignature {
         let mut sig_bytes = [0u8; 64];
         sig_bytes[..64].copy_from_slice(&self.0[1..=64]);
 
-        match LibSecp256k1RecoverableSignature::from_compact(&sig_bytes, recid) {
-            Ok(sig) => Some(sig),
-            Err(_) => None,
-        }
+        LibSecp256k1RecoverableSignature::from_compact(&sig_bytes, recid).ok()
     }
 
     /// Convert from VRS to RSV
diff --git a/stacks-signer/Cargo.toml b/stacks-signer/Cargo.toml
@@ -31,8 +31,6 @@ prometheus = { version = "0.9", optional = true }
 rand_core = "0.6"
 reqwest = { version = "0.11.22", default-features = false, features = ["blocking", "json", "rustls-tls"] }
 serde = "1"
-serde_derive = "1"
-serde_stacker = "0.1"
 slog = { version = "2.5.2", features = [ "max_level_trace" ] }
 slog-json = { version = "2.3.0", optional = true }
 slog-term = "2.6.0"
@@ -62,5 +60,5 @@ features = ["serde", "recovery"]
 
 [features]
 default = []
-monitoring_prom = ["libsigner/monitoring_prom", "prometheus", "tiny_http"]
+monitoring_prom = ["prometheus", "tiny_http"]
 testing = []
diff --git a/stackslib/Cargo.toml b/stackslib/Cargo.toml
diff --git a/stackslib/src/config/chain_data.rs b/stackslib/src/config/chain_data.rs
diff --git a/stackslib/src/net/mod.rs b/stackslib/src/net/mod.rs
diff --git a/stackslib/src/net/tests/convergence.rs b/stackslib/src/net/tests/convergence.rs
diff --git a/testnet/stacks-node/Cargo.toml b/testnet/stacks-node/Cargo.toml
