9109adce96
4 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Aere Network
|
94438cd8f1 |
A package-built node has now imported chain 2800 from block 0 to the live tip, with zero anchor rejections
Reaching the tip needed two historical facts encoded, and the second one was not in the original hypothesis. First, the disarmed window: 36 anchor heights (13,267,824 to 13,268,944) whose blocks carry an attached certificate but no digest, and whose signer indices are not strictly increasing, produced while anchoring was disarmed fleet-wide to unblock the chain after an incident. Encoded as a named list of historical windows with fixed bounds in code, after the precedent of the base-fee lapse windows: inside, the header is accepted as written; outside, nothing changes. Second, the recovery, found by measuring rather than guessing. After the emergency re-arm the fleet ran for a stretch with a lowered seal threshold, so proposers legitimately wrote shorter certificates. Its extent was measured by reading 25,252 anchor heights one at a time, with NO binary search, because the property is not monotone: only about 15 percent of heights are affected and the largest gap between two affected heights is 44, so a binary search would have returned an answer that looks exactly like a good one. Result: 13,268,976 to 13,890,544, thresholds measured at 1 or 2, never 0. The second window relaxes the seal COUNT only. Digest binding and index ordering stay enforced and every seal is still verified. Widening the disarmed window to cover both would have been easier and would have thrown away certificate binding on 19,425 anchor heights, which is the one property the anchor exists for. Negative control in four directions, because an exception can fail both ways: the window predicate forced always-false turns 10 tests red; forced always-true turns 39 red, of which 22 are pre-existing strictness tests, making the exception swallowing the chain visible; the historical threshold emptied turns 7 red; pinned at 1 turns 8 red. Restored: 641 tests, 0 failures, counted from XML. Patch verified on a pristine upstream checkout, alone and in series, and the resulting tree compiles. |
||
|
Aere Network
|
67e3c26e1c |
Patch 0003 regenerated with the schedule-boundary fix: a package-built node now crosses the first real anchor
The published patch carried a one-block boundary defect: the seal rule asks the index-to-address map at the parent height (H-1) while the registry schedule binds inclusively from H, so at the very first anchor the schedule was empty and the lookup fell back to a head map that is empty on a node synced from genesis. A valid certificate was rejected. Fixed in both lookup paths: when the schedule has an entry at exactly blockNumber+1, answer from that entry's verified bound registry. The boundary stays exactly one block. Proven by import, not by assertion: the package-built node was stuck at 13,013,999 with 6,646 rejections; with the fix it crossed 13,014,000 in 42 seconds and imported 253,729 further blocks through the anchor era with zero rejections. Tests: new PqParentHeightAlignmentTest 3/3, consensus:common 391/0, consensus:qbft 217/0. Negative control measured: disarm the condition and the measuring test goes red; restore it and it is green. Patch verified to apply cleanly on a pristine upstream checkout, alone and in series with 0001/0004/0005; file list is the previous 75 plus the new test, and every untouched section is byte-identical to the old patch. The anchor/ source copy in this package was brought to the same state so the two cannot diverge. Honest limit, recorded in IMPORT-PROOF-STARE: further along, at 13,267,729, the node stops again for a DIFFERENT reason. Blocks in a band there carry an attached certificate whose vanityData is the ordinary client string rather than the digest, at heights a single static interval treats as anchor heights. The best-supported reading is that the fleet ran a different anchoring configuration in that window (these values are not consensus-bound), so the package needs a HISTORICAL anchoring schedule, not one value. Stated rather than implied. |
||
|
Liviu
|
820ae134f7 |
Carry the Apache 4(b) and 4(d) notices the anchor was missing
Caught by our own licence gate the minute the anchor went up, which is the only reason this is a same-day correction rather than something a reader finds first. Two separate requirements, both real: - section 4(b): the twenty upstream files this overlay modifies must carry a prominent notice that we changed them. They did not. They do now, placed after the upstream copyright header rather than over it, because 4(c) requires that header to survive untouched. It does: eighteen still read "Copyright ConsenSys AG.", two "Copyright contributors to Besu." - section 4(d): NOTICE must carry the attribution notices of the work this derives from. It named Hyperledger Besu only, while the files themselves carry three distinct notices. All three are now reproduced. Naming one of three was a smaller truth than the files tell. The patch is regenerated from the corrected files and re-verified end to end, not assumed: git apply --check and git apply both 0 on a pristine d2032017 checkout, the resulting tree byte-identical to anchor/ (75 files compared, 0 differences), and 605 tests with 0 failures across consensus:common and consensus:qbft. |
||
|
Liviu
|
56a02656aa |
Add the post-quantum certificate anchor for QBFT
This is the code that puts a post-quantum validator certificate under the block hash. It is the thing this project exists to do, and it is published so that the claim can be checked rather than believed. What it is. In QBFT the block hash is computed over a re-encoding of the decoded extraData with the seals removed, so anything the decoder does not know about is dropped before hashing. Appending a certificate as a new element gives you a certificate that is stored, gossiped, and entirely absent from the hash. The design that works instead puts a 32-byte digest of the certificate into vanityData, which is already under keccak. anchor/README.md sets out the four designs that died before this one and why. Scope, stated in the README and repeated here because it matters: consensus on chain 2800 is classical secp256k1 ECDSA. This binds a post-quantum certificate to the block hash. It does not make consensus post-quantum and is never described as such. What is here: the anchor, the validation rules, the wiring, and the tests, including the negative controls. Applied to upstream d2032017bb, the pinned base named in anchor/BASE.txt. One build file changes, by one line, and the README says which and why. No cryptography is implemented here; Falcon verification calls Bouncy Castle. What is not here: no keys, no fleet configuration, and nothing about what is armed on any running network. Measured before publishing, on upstream d2032017bb with this overlay applied: consensus:common and consensus:qbft, 605 tests, 0 failures, identical to the same tree before this work, class by class. Three things were found while preparing it, and all three are fixed here: - the code spoke Romanian in 134 comment lines and 43 strings, 37 of them on production paths, which is to say in the messages a node prints when it refuses to start. An auditor given the code to check the guards could not read the guards. - ten test classes carried internal issue numbers in their names. They now say what they test. - the suite was green partly by ordering luck. One class cleared its system properties but not the configuration PqAnchorProducer remembers, so it left the anchor armed for whichever class ran next. Renaming the classes changed the order and four tests began failing on a guard that was firing correctly. Fixed where it leaks, with the negative control measured: remove the line and the pair goes red, restore it and it goes green. |