Merge branch 'mirroring' into marko-container-user

.devcontainer/devcontainer.json

@@ -1,5 +1,5 @@
 {
-  "image": "dfinity/ic-build:b4086a27b58281b34b3c1a5833567256c11b2140d9504c9e819c40f483d72c6a",
+  "image": "dfinity/ic-build:f9d8505c07589b765e3897eafb7b48902ee7e2bb088fc8ac329544081bede1bf",
   "remoteUser": "ubuntu",
   "privileged": true,
   "runArgs": [

.github/workflows/ci-notify-slack.yml

@@ -23,7 +23,7 @@ jobs:
         if: steps.get-reviewers.outputs.result != '""'
         run: |
           TEAM=${{ steps.get-reviewers.outputs.result }}
-          CHANNEL=$(jq -r ".$TEAM" .github/workflows/team-channels.json)
+          CHANNEL=$(jq -r --arg team "$TEAM" '.[$team]' .github/workflows/team-channels.json)
           echo "channel=${CHANNEL}" >> $GITHUB_OUTPUT
           echo "message=${MESSAGE}" >> $GITHUB_OUTPUT
         env:

gitlab-ci/config/common.yml

@@ -22,7 +22,7 @@ default:
     expire_in: 3 days
     when: always
   image:
-    name: "registry.gitlab.com/dfinity-lab/core/docker/ic-build:b4086a27b58281b34b3c1a5833567256c11b2140d9504c9e819c40f483d72c6a"
+    name: "registry.gitlab.com/dfinity-lab/core/docker/ic-build:f9d8505c07589b765e3897eafb7b48902ee7e2bb088fc8ac329544081bede1bf"
   tags:
     - dfinity-ic
 

gitlab-ci/config/zz-generated-gitlab-ci.yaml

@@ -1979,7 +1979,7 @@ default:
     expire_in: 3 days
     when: always
   image:
-    name: registry.gitlab.com/dfinity-lab/core/docker/ic-build:b4086a27b58281b34b3c1a5833567256c11b2140d9504c9e819c40f483d72c6a
+    name: registry.gitlab.com/dfinity-lab/core/docker/ic-build:f9d8505c07589b765e3897eafb7b48902ee7e2bb088fc8ac329544081bede1bf
   interruptible: true
   retry:
     max: 2

gitlab-ci/container/TAG

@@ -1 +1 @@
-b4086a27b58281b34b3c1a5833567256c11b2140d9504c9e819c40f483d72c6a
+f9d8505c07589b765e3897eafb7b48902ee7e2bb088fc8ac329544081bede1bf

gitlab-ci/tools/build-diff.sh

@@ -83,7 +83,7 @@ else
     PATH1="${PATH1:1}"
 fi
 
-if [[ $PATH0 == *".gz" && $PATH1 == *".gz" ]]; then
+if [[ $PATH0 == *".zst" && $PATH1 == *".zst" ]]; then
     mkdir -p "$(dirname /tmp/$PATH0)"
     mkdir -p "$(dirname /tmp/$PATH1)"
 
@@ -138,21 +138,21 @@ fi
 if ! diff -u $SHA256SUMS0 $SHA256SUMS1; then
     set +x
     echo_green "Investigate with diffoscope [\xF0\x9F\x99\x8F]:\n"
-    if grep -q "img.tar.gz" $SHA256SUMS0; then
+    if grep -q "img.tar.zst" $SHA256SUMS0; then
         echo_blue "# Download IC-OS image:\n"
 
-        if grep -q "update-img.tar.gz" $SHA256SUMS0; then
-            ARTIFACT="update-img.tar.gz"
+        if grep -q "update-img.tar.zst" $SHA256SUMS0; then
+            ARTIFACT="update-img.tar.zst"
         else
-            ARTIFACT="disk-img.tar.gz"
+            ARTIFACT="disk-img.tar.zst"
         fi
 
         echo "rm -rf /tmp/$PATH0 && mkdir -p /tmp/$PATH0"
         echo "rm -rf /tmp/$PATH1 && mkdir -p /tmp/$PATH1"
         echo "curl -sfS https://download.dfinity.systems/ic/$PATH0/$ARTIFACT -o /tmp/$PATH0/$ARTIFACT"
         echo "curl -sfS https://download.dfinity.systems/ic/$PATH1/$ARTIFACT -o /tmp/$PATH1/$ARTIFACT"
 
-        if grep -q "update-img.tar.gz" $SHA256SUMS0; then
+        if grep -q "update-img.tar.zst" $SHA256SUMS0; then
             echo_blue "# Mount IC-OS boot & root image as loop devices:\n"
             echo "pushd /tmp/$PATH0"
             echo "tar -xzf $ARTIFACT"

mainnet-canisters.bzl

@@ -7,14 +7,14 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_file")
 # WASM metadata is a 2-tuple of git commit ID and WASM hash.
 CANISTER_NAME_TO_WASM_METADATA = {
     "governance": ("d1504fc4265703c5c6a73098732a4256ea8ff6bf", "f5bfed9622c2a0544aef38319e2a442677e0566025b27f4ea18c64292cf4e03d"),
-    "ledger": ("98eb213581b239c3829eee7076bea74acad9937b", "aca61e669e737133b552d0f1ddafc40299f3260daf8f57e352774b17aa82bbc1"),
+    "ledger": ("bb76748d1d225c08d88037e99ca9a066f97de496", "96f00dc30c8040992c454e285eca25ac6f14e06210417742caf7d10554a9d57f"),
     "archive": ("8d80b3b3703988645a604641f8d600d525bb5c21", "d7229caa5106454413c5382437cfb0864dedc36058611111debf94da0258998b"),
     "index": ("463296c0bc82ad5999b70245e5f125c14ba7d090", "8157f5cba913d9db25a2c54ebf823d4edcc50cce00b97a18e5d33c2f73e59c93"),
-    "root": ("d7ddd2969837fc6c9c0b86d331f7bc61e9e78bd1", "4607bb1c0742a52449a7c66f7d90681c2d876372a49a8ed474852bcdef144001"),
+    "root": ("b9a20425f94eb1433385a7ed0c59c41095c17b7b", "0c791dc6010b041112ab23935d1be8ca28e2b7ae1374c0051a1dde12262b658b"),
     "registry": ("77dafef0cca09488c9e0b9c5a0437851ec1be0ce", "6322c00849cc719a069242f6fbddc007ff7432be41c7385a17db0aad71733511"),
     "lifeline": ("35e4f2c583b0657aa730740b5c8aca18a8718b8e", "614d7d418c4eaa9984b6c3f4afe2d1e45b2f110369edcc2dc767792181742348"),
     "genesis-token": ("87f48a595b6f666fbc7fe6ad4081aa98fd113d12", "dd71862512af57e938e01810be016e17431912d9ca0ea3952bc04015eb02acc4"),
-    "cycles-minting": ("98a61b5cee32dd109a653e41d0a4ddae5c53c916", "9c4e48d0e6241fb86ade57d3b9d076660bd1ac8e704d0309ad06e5eb291968d8"),
+    "cycles-minting": ("b9a20425f94eb1433385a7ed0c59c41095c17b7b", "58ee30cb6cb074dc066b7e8dfc78d8e2b1a9e97a48e39fedbace65c547703d80"),
     "sns-wasm": ("77dafef0cca09488c9e0b9c5a0437851ec1be0ce", "ac826b139c287da4c2f2dd7f7b3d06d47840d81f0d98f7a8c710dc88666c1506"),
     "swap": ("d1504fc4265703c5c6a73098732a4256ea8ff6bf", "59ec188507b12fcb6e579db7b570a59f2a7236e80c46494a6ef228ef8acd1ef5"),
     "sns_root": ("e790c6636115482db53ca3daa2f1900202ab04cf", "12b6bba135b8bcff8a1384f15d202dd4f6e7bbbf0554994d5da4949125b6fdaa"),

rs/boundary_node/ic_boundary/src/test_utils.rs

@@ -115,7 +115,6 @@ pub fn test_subnet_record() -> SubnetRecord {
         replica_version_id: ReplicaVersion::default().into(),
         dkg_interval_length: 59,
         dkg_dealings_per_block: 1,
-        gossip_config: None,
         start_as_nns: false,
         subnet_type: SubnetType::Application.into(),
         is_halted: false,

rs/consensus/src/ecdsa/payload_verifier.rs

@@ -551,7 +551,6 @@ fn validate_new_signature_agreements(
         .values()
         .map(|c| (c.pseudo_random_id, c))
         .collect::<BTreeMap<_, _>>();
-
     for (random_id, completed) in curr_payload.signature_agreements.iter() {
         if let idkg::CompletedSignature::Unreported(response) = completed {
             if let ic_types::messages::Payload::Data(data) = &response.payload {
@@ -620,7 +619,9 @@ mod test {
     use ic_crypto_test_utils_reproducible_rng::reproducible_rng;
     use ic_interfaces_state_manager::CertifiedStateSnapshot;
     use ic_logger::replica_logger::no_op_logger;
-    use ic_management_canister_types::{MasterPublicKeyId, Payload, SignWithECDSAReply};
+    use ic_management_canister_types::{
+        MasterPublicKeyId, Payload, SchnorrAlgorithm, SignWithECDSAReply,
+    };
     use ic_test_utilities::crypto::CryptoReturningOk;
     use ic_test_utilities_types::ids::subnet_test_id;
     use ic_types::{
@@ -896,7 +897,7 @@ mod test {
             ecdsa_payload.generate_current_key(&key_id, &env, &mut rng);
         block_reader.add_transcript(*key_transcript_ref.as_ref(), key_transcript.clone());
 
-        // Add the quadruples and transcripts to block reader and payload
+        // Add the pre-signatures and transcripts to block reader and payload
         let sig_inputs = (1..4)
             .map(|i| {
                 create_sig_inputs_with_args(
@@ -1020,17 +1021,16 @@ mod test {
         let height = Height::from(0);
         let subnet_id = subnet_test_id(0);
         let crypto = &CryptoReturningOk::default();
-        let block_reader = TestEcdsaBlockReader::new();
+        let mut block_reader = TestEcdsaBlockReader::new();
 
         let mut prev_payload = empty_ecdsa_payload_with_key_ids(subnet_id, vec![key_id.clone()]);
         let pre_sig_id = prev_payload.uid_generator.next_pre_signature_id();
+        let pre_sig_id2 = prev_payload.uid_generator.next_pre_signature_id();
 
-        let signature_request_contexts =
-            BTreeMap::from_iter([fake_signature_request_context_with_pre_sig(
-                1,
-                key_id.clone(),
-                Some(pre_sig_id),
-            )]);
+        let signature_request_contexts = BTreeMap::from_iter([
+            fake_signature_request_context_with_pre_sig(1, key_id.clone(), Some(pre_sig_id)),
+            fake_completed_signature_request_context(2, key_id.clone(), pre_sig_id2),
+        ]);
         let snapshot =
             fake_state_with_signature_requests(height, signature_request_contexts.clone());
 
@@ -1070,6 +1070,40 @@ mod test {
             ))
         );
 
+        // Insert agreement for context matched with pre-signature of different scheme
+        let mut ecdsa_payload_mismatched_context =
+            empty_ecdsa_payload_with_key_ids(subnet_id, vec![key_id.clone()]);
+        let wrong_key_id = match key_id {
+            MasterPublicKeyId::Ecdsa(_) => {
+                fake_schnorr_master_public_key_id(SchnorrAlgorithm::Ed25519)
+            }
+            MasterPublicKeyId::Schnorr(_) => fake_ecdsa_master_public_key_id(),
+        };
+        // Add a pre-signature for the "wrong_key_id"
+        insert_test_sig_inputs(
+            &mut block_reader,
+            &mut ecdsa_payload_mismatched_context,
+            [(pre_sig_id2, create_sig_inputs(2, &wrong_key_id))],
+        );
+        ecdsa_payload_mismatched_context
+            .signature_agreements
+            .insert([2; 32], fake_response.clone());
+        let res = validate_new_signature_agreements(
+            crypto,
+            &block_reader,
+            snapshot.get_state(),
+            &prev_payload,
+            &ecdsa_payload_mismatched_context,
+        );
+        assert_matches!(
+            res,
+            Err(ValidationError::InvalidArtifact(
+                InvalidEcdsaPayloadReason::NewSignatureBuildInputsError(
+                    BuildSignatureInputsError::SignatureSchemeMismatch(_, _)
+                )
+            ))
+        );
+
         // Insert agreement for unknown context
         let mut ecdsa_payload_missing_context =
             empty_ecdsa_payload_with_key_ids(subnet_id, vec![key_id.clone()]);

rs/consensus/src/ecdsa/signer.rs

@@ -1089,20 +1089,29 @@ mod tests {
     fn test_send_signature_shares_incomplete_contexts(key_id: MasterPublicKeyId) {
         let mut uid_generator = EcdsaUIDGenerator::new(subnet_test_id(1), Height::new(0));
         let height = Height::from(100);
-        let (id_1, id_2, id_3) = (
+        let (id_1, id_2, id_3, id_4, id_5) = (
+            create_request_id(&mut uid_generator, height),
+            create_request_id(&mut uid_generator, height),
             create_request_id(&mut uid_generator, height),
             create_request_id(&mut uid_generator, height),
             create_request_id(&mut uid_generator, height),
         );
+        let wrong_key_id = match key_id {
+            MasterPublicKeyId::Ecdsa(_) => {
+                fake_schnorr_master_public_key_id(SchnorrAlgorithm::Ed25519)
+            }
+            MasterPublicKeyId::Schnorr(_) => fake_ecdsa_master_public_key_id(),
+        };
 
         // Set up the signature requests
-        // The block contains pre-signatures for requests 1, 2, 3
+        // The block contains pre-signatures for all requests except request 5
         let block_reader = TestEcdsaBlockReader::for_signer_test(
             height,
             vec![
                 (id_1.clone(), create_sig_inputs(1, &key_id)),
                 (id_2.clone(), create_sig_inputs(2, &key_id)),
                 (id_3.clone(), create_sig_inputs(3, &key_id)),
+                (id_4.clone(), create_sig_inputs(4, &wrong_key_id)),
             ],
         );
         let transcript_loader: TestEcdsaTranscriptLoader = Default::default();
@@ -1124,6 +1133,18 @@ mod tests {
                 ),
                 // One completed context
                 fake_signature_request_context_from_id(key_id.clone(), &id_3),
+                // One completed context matched to a pre-signature of the wrong scheme
+                fake_completed_signature_request_context(
+                    id_4.pre_signature_id.id() as u8,
+                    key_id.clone(),
+                    id_4.pre_signature_id,
+                ),
+                // One completed context matched to a pre-signature that doesn't exist
+                fake_completed_signature_request_context(
+                    id_5.pre_signature_id.id() as u8,
+                    key_id.clone(),
+                    id_5.pre_signature_id,
+                ),
             ],
         );
 

rs/consensus/src/ecdsa/test_utils.rs

@@ -137,14 +137,15 @@ pub fn fake_completed_signature_request_context(
     key_id: MasterPublicKeyId,
     pre_signature_id: PreSigId,
 ) -> (CallbackId, SignWithThresholdContext) {
-    fake_signature_request_context_from_id(
+    let (_, context) = fake_signature_request_context_from_id(
         key_id,
         &RequestId {
             pre_signature_id,
             pseudo_random_id: [id; 32],
             height: Height::from(1),
         },
-    )
+    );
+    (CallbackId::from(id as u64), context)
 }
 
 pub fn fake_signature_request_context_from_id(

rs/crypto/temp_crypto/src/lib.rs

@@ -1041,7 +1041,6 @@ impl EcdsaSubnetConfig {
                 replica_version_id: ReplicaVersion::default().into(),
                 dkg_interval_length: 59,
                 dkg_dealings_per_block: 1,
-                gossip_config: None,
                 start_as_nns: false,
                 subnet_type: SubnetType::Application.into(),
                 is_halted: false,

rs/ic_os/config/BUILD.bazel

@@ -15,8 +15,5 @@ rust_library(
     crate_name = "config",
     edition = "2021",
     proc_macro_deps = [],
-    target_compatible_with = [
-        "@platforms//os:linux",
-    ],
     deps = DEPENDENCIES,
 )

rs/ic_os/config/Cargo.toml

@@ -3,5 +3,5 @@ name = "config"
 version = "1.0.0"
 edition = "2021"
 
-[target.'cfg(target_os = "linux")'.dependencies]
+[dependencies]
 anyhow = { workspace = true }

rs/ic_os/network/BUILD.bazel

@@ -25,9 +25,6 @@ rust_library(
     crate_name = "network",
     edition = "2021",
     proc_macro_deps = [],
-    target_compatible_with = [
-        "@platforms//os:linux",
-    ],
     deps = DEPENDENCIES,
 )
 

rs/ic_os/network/Cargo.toml

@@ -3,7 +3,7 @@ name = "network"
 version = "1.0.0"
 edition = "2021"
 
-[target.'cfg(target_os = "linux")'.dependencies]
+[dependencies]
 config = { path = "../config" }
 utils = { path = "../utils" }
 anyhow = { workspace = true }

rs/ic_os/setupos-inject-configuration/src/main.rs

@@ -229,7 +229,7 @@ async fn update_deployment(path: &Path, cfg: &DeploymentConfig) -> Result<(), Er
     };
 
     if let Some(nns_url) = &cfg.nns_url {
-        deployment_json.nns.url = nns_url.clone();
+        deployment_json.nns.url = vec![nns_url.clone()];
     }
 
     if let Some(memory) = cfg.memory_gb {

rs/ic_os/utils/BUILD.bazel

@@ -23,9 +23,6 @@ rust_library(
     crate_name = "utils",
     edition = "2021",
     proc_macro_deps = [],
-    target_compatible_with = [
-        "@platforms//os:linux",
-    ],
     deps = DEPENDENCIES,
 )
 

rs/ic_os/utils/Cargo.toml

@@ -3,7 +3,7 @@ name = "utils"
 version = "1.0.0"
 edition = "2021"
 
-[target.'cfg(target_os = "linux")'.dependencies]
+[dependencies]
 anyhow = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }