Merge Savanna Contract Updates into EOS

.cicd/defaults.json

@@ -1,10 +1,10 @@
 {
-   "leap-dev":{
-      "target":"5",
+   "antelope-spring-dev":{
+      "target":"main",
       "prerelease":false
    },
    "cdt":{
-      "target":"3",
+      "target":"main",
       "prerelease":false
    }
 }

.github/workflows/build.yaml

@@ -8,12 +8,12 @@ on:
   pull_request:
   workflow_dispatch:
     inputs:
-      override-leap-dev:
-        description: Override leap-dev target
+      override-antelope-spring-dev:
+        description: Override antelope-spring-dev target
         type: string
-      override-leap-dev-prerelease:
+      override-antelope-spring-dev-prerelease:
         type: choice
-        description: Override leap-dev prelease
+        description: Override antelope-spring-dev prelease
         options:
         - default
         - true
@@ -38,22 +38,22 @@ jobs:
     name: Build & Test
     runs-on: ubuntu-22.04
     steps:
-      - name: Setup leap-dev & cdt versions
+      - name: Setup antelope-spring-dev & cdt versions
         id: versions
         env:
           GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
         run: |
           DEFAULTS_JSON=$(curl -sSfL $(gh api https://api.github.com/repos/${{github.repository}}/contents/.cicd/defaults.json?ref=${{github.sha}} --jq .download_url))
-          echo leap-dev-target=$(echo "$DEFAULTS_JSON" | jq -r '."leap-dev".target') >> $GITHUB_OUTPUT
-          echo leap-dev-prerelease=$(echo "$DEFAULTS_JSON" | jq -r '."leap-dev".prerelease') >> $GITHUB_OUTPUT
+          echo antelope-spring-dev-target=$(echo "$DEFAULTS_JSON" | jq -r '."antelope-spring-dev".target') >> $GITHUB_OUTPUT
+          echo antelope-spring-dev-prerelease=$(echo "$DEFAULTS_JSON" | jq -r '."antelope-spring-dev".prerelease') >> $GITHUB_OUTPUT
           echo cdt-target=$(echo "$DEFAULTS_JSON" | jq -r '.cdt.target') >> $GITHUB_OUTPUT
           echo cdt-prerelease=$(echo "$DEFAULTS_JSON" | jq -r '.cdt.prerelease') >> $GITHUB_OUTPUT
 
-          if [[ "${{inputs.override-leap-dev}}" != "" ]]; then
-            echo leap-dev-target=${{inputs.override-leap-dev}} >> $GITHUB_OUTPUT
+          if [[ "${{inputs.override-antelope-spring-dev}}" != "" ]]; then
+            echo antelope-spring-dev-target=${{inputs.override-antelope-spring-dev}} >> $GITHUB_OUTPUT
           fi
-          if [[ "${{inputs.override-leap-dev-prerelease}}" == +(true|false) ]]; then
-            echo leap-dev-prerelease=${{inputs.override-leap-dev-prerelease}} >> $GITHUB_OUTPUT
+          if [[ "${{inputs.override-antelope-spring-dev-prerelease}}" == +(true|false) ]]; then
+            echo antelope-spring-dev-prerelease=${{inputs.override-antelope-spring-dev-prerelease}} >> $GITHUB_OUTPUT
           fi
           if [[ "${{inputs.override-cdt}}" != "" ]]; then
             echo cdt-target=${{inputs.override-cdt}} >> $GITHUB_OUTPUT
@@ -70,20 +70,19 @@ jobs:
           target: '${{steps.versions.outputs.cdt-target}}'
           prereleases: ${{fromJSON(steps.versions.outputs.cdt-prerelease)}}
           artifact-name: cdt_ubuntu_package_amd64
-          token: ${{github.token}}
-      - name: Download leap-dev
+      - name: Download antelope-spring-dev
         uses: AntelopeIO/asset-artifact-download-action@v3
         with:
           owner: AntelopeIO
-          repo: leap
-          file: 'leap-dev.*ubuntu22\.04_amd64.deb'
-          target: '${{steps.versions.outputs.leap-dev-target}}'
-          prereleases: ${{fromJSON(steps.versions.outputs.leap-dev-prerelease)}}
-          artifact-name: leap-dev-ubuntu22-amd64
-          container-package: experimental-binaries
-          token: ${{github.token}}
+          repo: spring
+          file: 'antelope-spring-dev.*ubuntu22\.04_amd64.deb'
+          target: '${{steps.versions.outputs.antelope-spring-dev-target}}'
+          prereleases: ${{fromJSON(steps.versions.outputs.antelope-spring-dev-prerelease)}}
+          artifact-name: antelope-spring-dev-ubuntu22-amd64
+          container-package: antelope-spring-experimental-binaries
       - name: Install packages
         run: |
+          sudo apt-get update && sudo apt-get upgrade -y
           sudo apt install ./*.deb
           sudo apt-get install cmake
           rm ./*.deb
@@ -92,7 +91,7 @@ jobs:
           path: src
       - name: Build & Test
         run: |
-          cmake -S src -B build -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTS=On -DSYSTEM_ENABLE_LEAP_VERSION_CHECK=Off -DSYSTEM_ENABLE_CDT_VERSION_CHECK=Off
+          cmake -S src -B build -DCMAKE_BUILD_TYPE=Release -DBUILD_TESTS=On -DSYSTEM_ENABLE_SPRING_VERSION_CHECK=Off -DSYSTEM_ENABLE_CDT_VERSION_CHECK=Off
           cmake --build build -- -j $(nproc)
           tar zcf build.tar.gz build
           ctest --test-dir build/tests --output-on-failure -j $(nproc)

CMakeLists.txt

@@ -3,7 +3,7 @@ cmake_minimum_required(VERSION 3.5)
 project(eosio_contracts)
 
 set(VERSION_MAJOR 3)
-set(VERSION_MINOR 6)
+set(VERSION_MINOR 7)
 set(VERSION_PATCH 0)
 set(VERSION_SUFFIX dev)
 
@@ -25,8 +25,8 @@ option(SYSTEM_CONFIGURABLE_WASM_LIMITS
 option(SYSTEM_BLOCKCHAIN_PARAMETERS
        "Enables use of the host functions activated by the BLOCKCHAIN_PARAMETERS protocol feature" ON)
 
-option(SYSTEM_ENABLE_LEAP_VERSION_CHECK
-      "Enables a configure-time check that the version of Leap's tester library is compatible with this project's unit tests" ON)
+option(SYSTEM_ENABLE_SPRING_VERSION_CHECK
+      "Enables a configure-time check that the version of Spring's tester library is compatible with this project's unit tests" ON)
 
 option(SYSTEM_ENABLE_CDT_VERSION_CHECK
       "Enables a configure-time check that the version of CDT is compatible with this project's contracts" ON)
@@ -45,13 +45,6 @@ ExternalProject_Add(
   INSTALL_COMMAND ""
   BUILD_ALWAYS 1)
 
-if(APPLE)
-  set(OPENSSL_ROOT "/usr/local/opt/openssl")
-elseif(UNIX)
-  set(OPENSSL_ROOT "/usr/include/openssl")
-endif()
-set(SECP256K1_ROOT "/usr/local")
-
 option(BUILD_TESTS "Build unit tests" OFF)
 
 if(BUILD_TESTS)

build.sh

@@ -4,7 +4,7 @@ set -eo pipefail
 function usage() {
   printf "Usage: $0 OPTION...
   -c DIR      Path to CDT installation/build directory. (Optional if using CDT installled at standard system location.)
-  -l DIR      Path to Leap build directory. Optional, but must be specified to build tests.
+  -l DIR      Path to Spring build directory. Optional, but must be specified to build tests.
   -h          Print this help menu.
   \\n" "$0" 1>&2
   exit 1
@@ -19,7 +19,7 @@ if [ $# -ne 0 ]; then
         CDT_INSTALL_DIR=$(realpath $OPTARG)
       ;;
       l )
-        LEAP_BUILD_DIR=$(realpath $OPTARG)
+        SPRING_BUILD_DIR=$(realpath $OPTARG)
         BUILD_TESTS=ON
       ;;
       h )
@@ -40,19 +40,19 @@ if [ $# -ne 0 ]; then
   done
 fi
 
-LEAP_DIR_CMAKE_OPTION=''
+SPRING_DIR_CMAKE_OPTION=''
 
 if [[ "${BUILD_TESTS}" == "ON" ]]; then
-  if [[ ! -f "$LEAP_BUILD_DIR/lib/cmake/leap/leap-config.cmake" ]]; then
-    echo "Invalid path to Leap build directory: $LEAP_BUILD_DIR"
-    echo "Leap build directory is required to build tests. If you do not wish to build tests, leave off the -l option."
+  if [[ ! -f "$SPRING_BUILD_DIR/lib/cmake/spring/spring-config.cmake" ]]; then
+    echo "Invalid path to Spring build directory: $SPRING_BUILD_DIR"
+    echo "Spring build directory is required to build tests. If you do not wish to build tests, leave off the -l option."
     echo "Cannot proceed. Exiting..."
     exit 1;
   fi
 
-  echo "Using Leap build directory at: $LEAP_BUILD_DIR"
+  echo "Using Spring build directory at: $SPRING_BUILD_DIR"
   echo ""
-  LEAP_DIR_CMAKE_OPTION="-Dleap_DIR=${LEAP_BUILD_DIR}/lib/cmake/leap"
+  SPRING_DIR_CMAKE_OPTION="-Dspring_DIR=${SPRING_BUILD_DIR}/lib/cmake/spring"
 fi
 
 CDT_DIR_CMAKE_OPTION=''
@@ -67,7 +67,7 @@ else
     echo "Cannot proceed. Exiting..."
     exit 1;
   fi
-  
+
   echo "Using CDT installation/build at: $CDT_INSTALL_DIR"
   echo ""
   CDT_DIR_CMAKE_OPTION="-Dcdt_DIR=${CDT_INSTALL_DIR}/lib/cmake/cdt"
@@ -79,6 +79,6 @@ NC='\033[0m'
 CPU_CORES=$(getconf _NPROCESSORS_ONLN)
 mkdir -p build
 pushd build &> /dev/null
-cmake -DBUILD_TESTS=${BUILD_TESTS} ${LEAP_DIR_CMAKE_OPTION} ${CDT_DIR_CMAKE_OPTION} ../
+cmake -DBUILD_TESTS=${BUILD_TESTS} ${SPRING_DIR_CMAKE_OPTION} ${CDT_DIR_CMAKE_OPTION} ../
 make -j $CPU_CORES
 popd &> /dev/null

contracts/CMakeLists.txt

@@ -8,10 +8,10 @@ option(SYSTEM_CONFIGURABLE_WASM_LIMITS
 option(SYSTEM_BLOCKCHAIN_PARAMETERS
        "Enables use of the host functions activated by the BLOCKCHAIN_PARAMETERS protocol feature" ON)
 
-find_package(cdt REQUIRED)
+find_package(cdt)
 
-set(CDT_VERSION_MIN "3.0")
-set(CDT_VERSION_SOFT_MAX "3.0")
+set(CDT_VERSION_MIN "4.1")
+set(CDT_VERSION_SOFT_MAX "4.1")
 # set(CDT_VERSION_HARD_MAX "")
 
 # Check the version of CDT
@@ -31,7 +31,7 @@ if(SYSTEM_ENABLE_CDT_VERSION_CHECK)
       FATAL_ERROR
         "Found CDT version ${CDT_VERSION} but it does not satisfy version requirements: ${VERSION_MATCH_ERROR_MSG}\nPlease use CDT version ${CDT_VERSION_SOFT_MAX}.x"
     )
-  endif()
+  endif(VERSION_OUTPUT STREQUAL "MATCH")
 endif()
 
 set(ICON_BASE_URL "https://raw.githubusercontent.com/eosnetworkfoundation/eos-system-contracts/main/contracts/icons")

contracts/eosio.bios/include/eosio.bios/eosio.bios.hpp

@@ -5,6 +5,7 @@
 #include <eosio/eosio.hpp>
 #include <eosio/fixed_bytes.hpp>
 #include <eosio/privileged.hpp>
+#include <eosio/instant_finality.hpp>
 #include <eosio/producer_schedule.hpp>
 
 namespace eosiobios {
@@ -66,6 +67,38 @@ namespace eosiobios {
                                      (schedule_version)(new_producers))
    };
 
+   /**
+    * finalizer_authority
+    *
+    * The public bls key and proof of possession of private key signature,
+    * and vote weight of a finalizer.
+    */
+   constexpr size_t max_finalizers = 64*1024;
+   constexpr size_t max_finalizer_description_size = 256;
+
+   struct finalizer_authority {
+      std::string   description;
+      uint64_t      weight = 0;  // weight that this finalizer's vote has for meeting threshold
+      std::string   public_key;  // public key of the finalizer in base64 format
+      std::string   pop;         // proof of possession of private key in base64 format
+
+      // explicit serialization macro is not necessary, used here only to improve compilation time
+      EOSLIB_SERIALIZE(finalizer_authority, (description)(weight)(public_key)(pop))
+   };
+
+   /**
+    * finalizer_policy
+    *
+    * List of finalizer authorties along with the threshold
+    */
+   struct finalizer_policy {
+      uint64_t                         threshold = 0; // quorum threshold
+      std::vector<finalizer_authority> finalizers;
+
+      // explicit serialization macro is not necessary, used here only to improve compilation time
+      EOSLIB_SERIALIZE(finalizer_policy, (threshold)(finalizers));
+   };
+
    /**
     * The `eosio.bios` is the first sample of system contract provided by `block.one` through the EOSIO platform. It is a minimalist system contract because it only supplies the actions that are absolutely critical to bootstrap a chain and nothing more. This allows for a chain agnostic approach to bootstrapping a chain.
     * 
@@ -190,6 +223,15 @@ namespace eosiobios {
          [[eosio::action]]
          void onerror( ignore<uint128_t> sender_id, ignore<std::vector<char>> sent_trx );
 
+         /**
+          * Propose new finalizer policy that, unless superseded by a later
+          * finalizer policy, will eventually become the active finalizer policy.
+          *
+          * @param finalizer_policy - proposed finalizer policy
+          */
+         [[eosio::action]]
+         void setfinalizer( const finalizer_policy& finalizer_policy );
+
          /**
           * Set privilege action allows to set privilege status for an account (turn it on/off).
           * @param account - the account to set the privileged status for.

contracts/eosio.bios/src/eosio.bios.cpp

@@ -1,4 +1,7 @@
 #include <eosio.bios/eosio.bios.hpp>
+#include <eosio/crypto_bls_ext.hpp>
+
+#include <unordered_set>
 
 namespace eosiobios {
 
@@ -17,6 +20,70 @@ void bios::setabi( name account, const std::vector<char>& abi ) {
    }
 }
 
+void bios::setfinalizer( const finalizer_policy& finalizer_policy ) {
+   // exensive checks are performed to make sure setfinalizer host function
+   // will never fail
+
+   require_auth( get_self() );
+
+   check(finalizer_policy.finalizers.size() <= max_finalizers, "number of finalizers exceeds the maximum allowed");
+   check(finalizer_policy.finalizers.size() > 0, "require at least one finalizer");
+
+   eosio::finalizer_policy fin_policy;
+   fin_policy.threshold = finalizer_policy.threshold;
+   fin_policy.finalizers.reserve(finalizer_policy.finalizers.size());
+
+   const std::string pk_prefix = "PUB_BLS";
+   const std::string sig_prefix = "SIG_BLS";
+
+   // use raw affine format (bls_g1 is std::array<char, 96>) for uniqueness check
+   struct g1_hash {
+      std::size_t operator()(const eosio::bls_g1& g1) const {
+         std::hash<const char*> hash_func;
+         return hash_func(g1.data());
+      }
+   };
+   struct g1_equal {
+      bool operator()(const eosio::bls_g1& lhs, const eosio::bls_g1& rhs) const {
+         return std::memcmp(lhs.data(), rhs.data(), lhs.size()) == 0;
+      }
+   };
+   std::unordered_set<eosio::bls_g1, g1_hash, g1_equal> unique_finalizer_keys;
+
+   uint64_t weight_sum = 0;
+
+   for (const auto& f: finalizer_policy.finalizers) {
+      check(f.description.size() <= max_finalizer_description_size, "Finalizer description greater than max allowed size");
+
+      // basic key format checks
+      check(f.public_key.substr(0, pk_prefix.length()) == pk_prefix, "public key shoud start with PUB_BLS");
+      check(f.pop.substr(0, sig_prefix.length()) == sig_prefix, "proof of possession signature should start with SIG_BLS");
+
+      // check overflow
+      check(std::numeric_limits<uint64_t>::max() - weight_sum >= f.weight, "sum of weights causes uint64_t overflow");
+      weight_sum += f.weight;
+
+      // decode_bls_public_key_to_g1 will fail ("check" function fails)
+      // if the key is invalid
+      const auto pk = eosio::decode_bls_public_key_to_g1(f.public_key);
+      // duplicate key check
+      check(unique_finalizer_keys.insert(pk).second, "duplicate public key");
+
+      const auto signature = eosio::decode_bls_signature_to_g2(f.pop);
+
+      // proof of possession of private key check
+      check(eosio::bls_pop_verify(pk, signature), "proof of possession failed");
+
+      std::vector<char> pk_vector(pk.begin(), pk.end());
+      fin_policy.finalizers.emplace_back(eosio::finalizer_authority{f.description, f.weight, std::move(pk_vector)});
+   }
+
+   check( weight_sum >= finalizer_policy.threshold && finalizer_policy.threshold > weight_sum / 2,
+          "Finalizer policy threshold must be greater than half of the sum of the weights, and less than or equal to the sum of the weights");
+
+   set_finalizers(std::move(fin_policy));
+}
+
 void bios::onerror( ignore<uint128_t>, ignore<std::vector<char>> ) {
    check( false, "the onerror action cannot be called directly" );
 }

contracts/eosio.fees/CMakeLists.txt

@@ -8,4 +8,4 @@ set_target_properties(eosio.fees
    PROPERTIES
    RUNTIME_OUTPUT_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}")
 
-target_compile_options( eosio.fees PUBLIC )
+target_compile_options( eosio.fees PUBLIC )

contracts/eosio.fees/include/eosio.fees/eosio.fees.hpp

@@ -32,4 +32,4 @@ namespace eosio {
          void noop();
    };
 
-}
+}

contracts/eosio.fees/src/eosio.fees.cpp

@@ -18,4 +18,4 @@ void fees::noop()
    require_auth( get_self() );
 }
 
-} /// namespace eosio
+} /// namespace eosio

contracts/eosio.system/CMakeLists.txt

@@ -4,6 +4,7 @@ add_contract(
   ${CMAKE_CURRENT_SOURCE_DIR}/src/eosio.system.cpp
   ${CMAKE_CURRENT_SOURCE_DIR}/src/delegate_bandwidth.cpp
   ${CMAKE_CURRENT_SOURCE_DIR}/src/exchange_state.cpp
+  ${CMAKE_CURRENT_SOURCE_DIR}/src/finalizer_key.cpp
   ${CMAKE_CURRENT_SOURCE_DIR}/src/name_bidding.cpp
   ${CMAKE_CURRENT_SOURCE_DIR}/src/native.cpp
   ${CMAKE_CURRENT_SOURCE_DIR}/src/producer_pay.cpp