Sync zsa1 with upstream Zebra v5.2.0

.cargo/config.toml

@@ -1,89 +1,10 @@
 # Zebra cargo configuration
 
-# Flags that apply to all Zebra crates and configurations
+# TODO: Remove when ZSA is stable
 [target.'cfg(all())']
 rustflags = [
-    # Enable tx_v6 everywhere by default
     "--cfg", 'feature="tx_v6"',
-
-    # TODO: Remove when ZSA is stable
     "--cfg", "zcash_unstable=\"nu7\"",
-
-    # Zebra standard lints for Rust 1.65+
-
-    # High-risk code
-    "-Dunsafe_code",
-    "-Dnon_ascii_idents",
-
-    # Potential bugs
-    #
-    # If we deny these lints, we could be excluded from Crater builds:
-    # https://www.reddit.com/r/rust/comments/f5xpib/psa_denywarnings_is_actively_harmful/
-
-    # Compatibility
-    "-Wrust_2021_compatibility",
-    "-Wnonstandard_style",
-    "-Wfuture_incompatible",
-
-    # Async code
-    "-Wclippy::await_holding_lock",
-    "-Wclippy::await_holding_refcell_ref",
-
-    # Pointers
-    "-Wclippy::cast_ptr_alignment",
-    "-Wclippy::fn_to_numeric_cast_any",
-
-    # Integers
-    "-Wclippy::checked_conversions",
-    "-Wclippy::implicit_saturating_sub",
-    "-Wclippy::invalid_upcast_comparisons",
-    "-Wclippy::range_minus_one",
-    "-Wclippy::range_plus_one",
-    "-Wclippy::unnecessary_cast",
-
-    # Incomplete code
-    "-Wclippy::dbg_macro",
-    "-Wclippy::todo",
-
-    # Manual debugging output.
-    # Use tracing::trace!() or tracing::debug!() instead.
-    "-Wclippy::print_stdout",
-    "-Wclippy::print_stderr",
-    "-Wclippy::dbg_macro",
-
-    # Code styles we want to accept
-    "-Aclippy::try_err",
-
-    # Panics
-    "-Wclippy::fallible_impl_from",
-    "-Wclippy::unwrap_in_result",
-
-    # Documentation
-    "-Wmissing_docs",
-
-    # TODOs:
-    # Fix this lint eventually.
-    "-Aclippy::result_large_err",
-
-    # `cargo fix` might help do these fixes,
-    # or add a config.toml to sub-directories which should allow these lints,
-    # or try allowing the lint in the specific module (lib.rs doesn't seem to work in some cases)
-    #
-    # lint configs that don't work:
-    # - allowing these lints in lib.rs (command-line warn overrides allow in lib.rs?)
-    # - adding a [target.'cfg(not(test))'] rustflags config (it runs on test code anyway)
-
-    # fix code that triggers these lints,
-    # or disable the lint for that code (or for all test code)
-    #
-    #"-Wclippy::cast_lossless", # 30 non-test warnings, a few test warnings
-    #"-Wclippy::cast_possible_truncation", # 40 non-test warnings, 20 test warnings
-    #"-Wclippy::cast_possible_wrap", # 13 test warnings (fixed outside tests)
-    #"-Wclippy::cast_precision_loss", # 25 non-test warnings, 10 test warnings
-    #"-Wclippy::cast_sign_loss", # 6 non-test warnings, 15 test warnings
-
-    # fix hidden lifetime parameters
-    #"-Wrust_2018_idioms",
 ]
 
 [build]
@@ -94,12 +15,13 @@ rustdocflags = [
     # TODO: Remove when ZSA is stable
     "--cfg", "zcash_unstable=\"nu7\"",
 
-    # The -A and -W settings must be the same as the `RUSTDOCFLAGS` in:
-    # https://github.com/ZcashFoundation/zebra/blob/main/.github/workflows/docs-deploy-firebase.yml#L68
-
     # Links in public docs can point to private items.
     "-Arustdoc::private_intra_doc_links",
 ]
 
 [env]
-RUST_BACKTRACE="1"
+RUST_BACKTRACE = "1"
+
+[profile.profiling]
+inherits = "release"
+debug = true

.config/nextest.toml

@@ -30,6 +30,16 @@ filter = "not test(=trusted_chain_sync_handles_forks_correctly) and not test(=de
 # TODO: We need a better test architecture to run all non-stateful
 [profile.all-tests]
 failure-output = "immediate"
+
+# Keep going after a failure so one broken test does not hide the state of
+# everything still queued, and log only retried and failed tests: "pass" buries
+# real failures under ~1000 lines of output.
+fail-fast = false
+status-level = "retry"
+
+# Hard cap for every test in this profile, so a test that hangs instead of
+# failing cannot run until the workflow timeout and take the whole job down.
+slow-timeout = { period = "5m", terminate-after = 4 }
 default-filter = "not test(check_no_git_dependencies) and not test(=fully_synced_rpc_z_getsubtreesbyindex_snapshot_test) and not test(=lwd_rpc_test) and not test(=lwd_rpc_send_tx) and not test(=lwd_grpc_wallet) and not test(=lwd_integration) and not test(=lwd_sync_full) and not test(=lwd_sync_update) and not test(=lightwalletd_test_suite) and not test(=rpc_get_block_template) and not test(=rpc_submit_block) and not test(=get_peer_info) and not test(~generate_checkpoints_) and not test(=sync_update_mainnet) and not test(=activate_mempool_mainnet)"
 
 # --- Individual Test Profiles ---
@@ -130,15 +140,3 @@ default-filter = 'package(zebrad) and test(=lightwalletd_test_suite)'
 [profile.rpc-z-getsubtreesbyindex-snapshot]
 slow-timeout = { period = "30m", terminate-after = 2 }
 default-filter = 'package(zebrad) and test(=fully_synced_rpc_z_getsubtreesbyindex_snapshot_test)'
-
-# --- QEDIT temporary retries ---
-
-# TODO: Remove retries after investigating periodic random failures.
-# Add more tests here only after confirming similar intermittent failures.
-[[profile.default.overrides]]
-filter = '''
-test(=sync_large_checkpoints_mempool_mainnet)
-or test(=get_peer_info)
-or test(=activate_mempool_mainnet)
-'''
-retries = 3

.github/ISSUE_TEMPLATE/release.md

@@ -39,7 +39,7 @@ This step can be skipped if there is a large pending dependency upgrade. (For ex
 Here's how we make sure we got everything:
 
 - [ ] Run `cargo update` on the latest `main` branch, and keep the output
-- [ ] Until we bump the MSRV to 1.88 or higher, `home` must be downgraded manually: `cargo update home@0.5.12 --precise 0.5.11`
+- [ ] Until we bump the workspace MSRV to 1.88 or higher, `home` must be downgraded manually: `cargo update home@0.5.12 --precise 0.5.11`
 - [ ] If needed, [add duplicate dependency exceptions to deny.toml](https://github.com/ZcashFoundation/zebra/blob/main/book/src/dev/continuous-integration.md#fixing-duplicate-dependencies-in-check-denytoml-bans)
 - [ ] If needed, remove resolved duplicate dependencies from `deny.toml`
 - [ ] Open a separate PR with the changes

.github/PULL_REQUEST_TEMPLATE/release-checklist.md

@@ -25,7 +25,7 @@ This step can be skipped if there is a large pending dependency upgrade. (For ex
 Here's how we make sure we got everything:
 
 - [ ] Run `cargo update` on the latest `main` branch, and keep the output
-- [ ] Until we bump the MSRV to 1.88 or higher, `home` must be downgraded manually: `cargo update home@0.5.12 --precise 0.5.11`
+- [ ] Until we bump the workspace MSRV to 1.88 or higher, `home` must be downgraded manually: `cargo update home@0.5.12 --precise 0.5.11`
 - [ ] If needed, [add duplicate dependency exceptions to deny.toml](https://github.com/ZcashFoundation/zebra/blob/main/book/src/dev/continuous-integration.md#fixing-duplicate-dependencies-in-check-denytoml-bans)
 - [ ] If needed, remove resolved duplicate dependencies from `deny.toml`
 - [ ] Open a separate PR with the changes
@@ -131,11 +131,14 @@ Check that the release will work:
 
 ```sh
 cargo release version --verbose --execute --allow-branch '*' -p <crate> patch # [ major | minor ]
-cargo release replace --verbose --execute --allow-branch '*' -p <crate>
+# zebrad only
+cargo release replace --verbose --execute --allow-branch '*' -p zebrad
 ```
 
 - [ ] Commit and push the above version changes to the release branch.
 
+- [ ] **Major (network upgrade) releases only:** Check that `INITIAL_MIN_NETWORK_PROTOCOL_VERSION` in [`zebra-network/src/constants.rs`](https://github.com/ZcashFoundation/zebra/blob/main/zebra-network/src/constants.rs) uses the latest activated network upgrade.
+
 ## Update End of Support
 
 The end of support height is calculated from the current blockchain height:

.github/actions/setup-zebra-build/action.yml

@@ -1,20 +1,27 @@
 name: 'Setup Zebra Build Environment'
-description: 'Install protoc as system library'
+description: 'Install protoc and RocksDB as system libraries'
 runs:
   using: 'composite'
   steps:
-    - name: Install protoc on Ubuntu
+    - name: Install protoc and librocksdb-dev on Ubuntu
       if: runner.os == 'Linux'
       shell: bash
       run: |
         sudo apt-get -qq update
-        sudo apt-get -qq install -y --no-install-recommends protobuf-compiler
+        sudo apt-get -qq install -y --no-install-recommends protobuf-compiler librocksdb-dev
+        echo "ROCKSDB_LIB_DIR=/usr/lib/" >> $GITHUB_ENV
 
-    - name: Install protoc on macOS
+    - name: Install protoc and RocksDB on macOS
       if: runner.os == 'macOS'
       shell: bash
       run: |
-        brew install protobuf
+        brew install protobuf rocksdb
+        # Set ROCKSDB_LIB_DIR for both Intel and Apple Silicon Macs
+        if [ -d "/opt/homebrew/lib" ]; then
+          echo "ROCKSDB_LIB_DIR=/opt/homebrew/lib" >> $GITHUB_ENV
+        else
+          echo "ROCKSDB_LIB_DIR=/usr/local/lib" >> $GITHUB_ENV
+        fi
 
     - name: Install protoc on Windows
       if: runner.os == 'Windows'

.github/mergify.yml

@@ -16,8 +16,10 @@ defaults:
     # and it does not create a draft PR if not needed
     batch_max_wait_time: "10 minutes"
     queue_conditions:
-      # Mergify automatically applies status check, approval, and conversation rules,
-      # which are the same as the GitHub main branch protection rules
+      # Mergify can auto-mirror classic branch protection, but not GitHub
+      # Rulesets. The conditions below restate the gates we actually rely on
+      # so PRs cannot be queued past failing required checks or unresolved
+      # change-requests.
       # https://docs.mergify.com/conditions/#about-branch-protection
       - base=main
       # is not in draft
@@ -26,6 +28,14 @@ defaults:
       - label!=do-not-merge
       # has at least one approving reviewer
       - "#approved-reviews-by >= 1"
+      # no reviewer has requested changes
+      - "#changes-requested-reviews-by = 0"
+      # The three required aggregator check runs must pass. After the
+      # `changes` + paths-filter refactor (#10637), each aggregator is
+      # produced by exactly one workflow, so the names below are stable.
+      - check-success=lint
+      - check-success=unit-tests
+      - check-success=test-crates
 
 
 # Allows to define the rules that reign over our merge queues
@@ -65,3 +75,5 @@ priority_rules:
       - 'label~=^P-(Optional|Low)'
     allow_checks_interruption: true
     priority: low
+merge_protections_settings:
+  reporting_method: check-runs

.github/path-filters.yml

@@ -0,0 +1,76 @@
+# Single source of truth for "what changed files trigger what workflow."
+#
+# Consumed by dorny/paths-filter in each required-check workflow's `changes` job.
+# Each key maps 1:1 to a workflow basename; values are picomatch globs.
+#
+# Editing this file re-triggers every workflow on the next PR (the file is
+# listed in every filter), which is the desired safety property when the
+# triggering rules themselves change.
+
+lint:
+  - "**/*.rs"
+  - "**/Cargo.toml"
+  - "**/Cargo.lock"
+  - ".cargo/config.toml"
+  - "**/clippy.toml"
+  - "deny.toml"
+  - "supply-chain/**"
+  - ".github/workflows/lint.yml"
+  - ".github/path-filters.yml"
+
+unit_tests:
+  - "**/*.rs"
+  - "**/Cargo.toml"
+  - "**/Cargo.lock"
+  - ".config/nextest.toml"
+  - ".github/workflows/tests-unit.yml"
+  - ".github/path-filters.yml"
+
+test_crates:
+  - "**/*.rs"
+  - "**/Cargo.toml"
+  - "**/Cargo.lock"
+  - ".cargo/config.toml"
+  - "**/clippy.toml"
+  - ".github/workflows/test-crates.yml"
+  - ".github/path-filters.yml"
+
+test_docker:
+  - "**/*.rs"
+  - "**/Cargo.toml"
+  - "**/Cargo.lock"
+  - "docker/Dockerfile"
+  - "docker/entrypoint.sh"
+  - "docker/**/*.toml"
+  - "zebrad/tests/common/configs/**"
+  - ".github/workflows/test-docker.yml"
+  - ".github/path-filters.yml"
+
+book:
+  - "book/**"
+  - "katex-header.html"
+  - "**/*.rs"
+  - "**/Cargo.toml"
+  - "**/Cargo.lock"
+  - ".cargo/config.toml"
+  - "**/clippy.toml"
+  - ".github/workflows/book.yml"
+  - ".github/path-filters.yml"
+
+coverage:
+  - "**/*.rs"
+  - "**/Cargo.toml"
+  - "**/Cargo.lock"
+  - ".config/nextest.toml"
+  - "codecov.yml"
+  - ".github/workflows/coverage.yml"
+  - ".github/path-filters.yml"
+
+docs_check:
+  - "**/*.md"
+  - "book/**"
+  - ".lychee.toml"
+  - ".codespellrc"
+  - ".trunk/configs/.markdownlint.yaml"
+  - ".github/workflows/docs-check.yml"
+  - ".github/path-filters.yml"

.github/pull_request_template.md

@@ -42,7 +42,7 @@
 
 ### PR Checklist
 
-- [ ] The PR name is suitable for the release notes.
+- [ ] The PR title follows [conventional commits](https://www.conventionalcommits.org/) format: `type(scope): description`
 - [ ] The PR follows the [contribution guidelines](https://github.com/ZcashFoundation/zebra/blob/main/CONTRIBUTING.md).
 - [ ] This change was discussed in an issue or with the team beforehand.
 - [ ] The solution is tested.

.github/scripts/validate-checkpoints.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# validate-checkpoints.sh
+#
+# Validates checkpoint file format and structure in a single pass.
+#
+# Usage: .github/scripts/validate-checkpoints.sh <checkpoint-file>
+#
+# Exit codes:
+#   0 - valid
+#   1 - validation error (details printed to stderr)
+
+set -euo pipefail
+
+FILE="${1:?Usage: validate-checkpoints.sh <checkpoint-file>}"
+
+if [ ! -f "$FILE" ]; then
+  echo "ERROR: File not found: $FILE" >&2
+  exit 1
+fi
+
+# Single-pass validation using awk
+awk '
+  !/^[0-9]+ [0-9a-f]{64}$/ {
+    printf "ERROR: line %d: invalid format: %s\n", NR, $0 > "/dev/stderr"
+    errs++
+    next
+  }
+  NR == 1 && $1 != "0" {
+    printf "ERROR: file must start at height 0, found %s\n", $1 > "/dev/stderr"
+    errs++
+  }
+  NR > 1 && $1 <= prev_h {
+    printf "ERROR: line %d: height %d is not greater than previous %d\n", NR, $1, prev_h > "/dev/stderr"
+    errs++
+  }
+  NR > 1 && ($1 - prev_h) > 400 {
+    printf "ERROR: line %d: gap of %d blocks between %d and %d\n", NR, $1 - prev_h, prev_h, $1 > "/dev/stderr"
+    errs++
+  }
+  $1 in seen_h {
+    printf "ERROR: line %d: duplicate height %d\n", NR, $1 > "/dev/stderr"
+    errs++
+  }
+  $2 in seen_hash {
+    printf "ERROR: line %d: duplicate hash %s\n", NR, $2 > "/dev/stderr"
+    errs++
+  }
+  {
+    seen_h[$1] = 1
+    seen_hash[$2] = 1
+    prev_h = $1
+    last_h = $1
+    total++
+  }
+  END {
+    printf "Validated %d entries, last height: %d\n", total, last_h
+    if (errs > 0) {
+      printf "FAILED: %d validation errors\n", errs > "/dev/stderr"
+      exit 1
+    }
+    print "OK: All entries valid"
+  }
+' "$FILE"