Feat voting cluster authority sigs

.buildkite/scripts/build-stable.sh

@@ -26,9 +26,9 @@ local_cluster_partitions=$(
 {
   "name": "local-cluster",
   "command": "ci/docker-run-default-image.sh ci/stable/run-local-cluster-partially.sh",
-  "timeout_in_minutes": 30,
+  "timeout_in_minutes": 15,
   "agent": "$agent",
-  "parallelism": 5,
+  "parallelism": 10,
   "retry": 3
 }
 EOF

.github/scripts/add-team-to-ghsa.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -euof pipefail
+
+team_to_add_slug="security-incident-response"
+github_org="anza-xyz"
+github_repo="agave"
+
+# Note: This will get all the GHSAs even if there are more than the per_page value
+# from gh api --help
+# --paginate    Make additional HTTP requests to fetch all pages of results
+ghsa_json=$(gh api \
+    -H "Accept: application/vnd.github+json" \
+    -H "X-GitHub-Api-Version: 2022-11-28"   \
+    /repos/$github_org/$github_repo/security-advisories?per_page=100 --paginate )
+
+# Get a list of GHSAs that don't have the $team_to_add_slug in collaborating_teams
+ghsa_without_team=$( jq -r '[ .[] | select(all(.collaborating_teams.[]; .slug != "'"$team_to_add_slug"'")) | .ghsa_id ] | sort | .[] ' <<< "$ghsa_json" )
+if [[ -z $ghsa_without_team ]]; then
+    echo "All GHSAs already have $team_to_add_slug. Exiting..."
+    exit 0
+fi
+
+# Iterate through the teams
+while IFS= read -r ghsa_id; do
+    # PATCH updates the value. If we just set -f "collaborating_teams[]=$team_to_add_slug" it
+    # will overwrite any existing collaborating_teams. So we get the list of teams that are already
+    # added to this GHSA and format them as parameters for gh api like:
+    #    -f collaborating_teams[]=ghsa-testing-1
+    original_collaborating_team_slugs=$( jq -r '[ .[] | select(.ghsa_id == "'"$ghsa_id"'") | .collaborating_teams ] | "-f collaborating_teams[]=" + .[][].slug ' <<< "$ghsa_json" )
+
+    # Update the team list
+    # shellcheck disable=SC2086
+    gh api \
+        --method PATCH \
+        -H "Accept: application/vnd.github+json" \
+        -H "X-GitHub-Api-Version: 2022-11-28" \
+        "/repos/$github_org/$github_repo/security-advisories/$ghsa_id" \
+        -f "collaborating_teams[]=$team_to_add_slug" $original_collaborating_team_slugs \
+        > /dev/null 2>&1
+done <<< "$ghsa_without_team"

.github/scripts/downstream-project-spl-common.sh

@@ -27,3 +27,10 @@ fi
 
 # anza migration stopgap. can be removed when agave is fully recommended for public usage.
 sed -i 's/solana-geyser-plugin-interface/agave-geyser-plugin-interface/g' ./Cargo.toml
+
+# should be removed when spl bump their curve25519-dalek
+sed -i "s/^curve25519-dalek =.*/curve25519-dalek = \"4.1.3\"/" token/confidential-transfer/proof-generation/Cargo.toml
+
+# fix curve25519-dalek
+
+sed -i '/\[patch.crates-io\]/a curve25519-dalek = { git = "https://github.com/anza-xyz/curve25519-dalek.git", rev = "b500cdc2a920cd5bff9e2dd974d7b97349d61464" }' ./Cargo.toml

.github/scripts/downstream-project-spl-install-deps.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
 set -e
 
-sudo apt update
-sudo apt install libudev-dev binutils-dev libunwind-dev protobuf-compiler -y
+sudo apt-get update
+sudo apt-get install libudev-dev binutils-dev libunwind-dev protobuf-compiler -y

.github/scripts/install-all-deps.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+set -e
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+os_name="$1"
+
+# shellcheck source=.github/scripts/install-openssl.sh
+source "$here/install-openssl.sh" "$os_name"
+# shellcheck source=.github/scripts/install-proto.sh
+source "$here/install-proto.sh" "$os_name"

.github/scripts/install-openssl.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -e
+
+os_name="$1"
+
+case "$os_name" in
+"Windows")
+  choco install openssl --version 3.3.2 --install-arguments="'/DIR=C:\OpenSSL'" -y
+  export OPENSSL_LIB_DIR="C:\OpenSSL\lib\VC\x64\MT"
+  export OPENSSL_INCLUDE_DIR="C:\OpenSSL\include"
+  ;;
+"macOS") ;;
+"Linux") ;;
+*)
+  echo "Unknown Operating System"
+  ;;
+esac

.github/scripts/cargo-clippy-before-script.sh → .github/scripts/install-proto.sh

@@ -6,8 +6,6 @@ os_name="$1"
 
 case "$os_name" in
 "Windows")
-  vcpkg install openssl:x64-windows-static-md
-  vcpkg integrate install
   choco install protoc
   export PROTOC='C:\ProgramData\chocolatey\lib\protoc\tools\bin\protoc.exe'
   ;;

.github/workflows/add-team-to-ghsa.yml

@@ -0,0 +1,22 @@
+name: Add Security Team to GHSAs
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 * * * *"
+
+jobs:
+  add-team-to-ghsa:
+    if: github.repository == 'anza-xyz/agave'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          ref: master
+      - name: Run script
+        shell: bash
+        env:
+          GH_TOKEN: ${{ secrets.GHSA_ADD_SECURITY_INCIDENT_RESPONSE }}
+        run: |
+          .github/scripts/add-team-to-ghsa.sh

.github/workflows/benchmark.yml

@@ -0,0 +1,99 @@
+name: Benchmark
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  benchmark:
+    if: github.repository == 'anza-xyz/agave'
+    name: benchmark
+    runs-on: benchmark
+    strategy:
+      fail-fast: false
+      matrix:
+        # before adding your benchmark. please check these steps:
+        # 1. generate a file that includes your benchmark result. it should looks like
+        #
+        #     ```
+        #     test bench_accounts_delta_hash                         ... bench:  48,035,858 ns/iter (+/- 2,118,806)
+        #     ```
+        #
+        # 2. run `DRY_RUN=1 ./ci/upload-benchmark.sh <YOUR_BENCHMARK_RESULT_FILE_PATH>` to ensure the datapoints are correct
+        #    it should looks similar to this:
+        #
+        #    ```
+        #    datapoint: ,commit=xxxx,test_suite=xxxx,name=bench_accounts_delta_hash median=48035858,deviation=2118806i
+        #    ```
+        #
+        #    you only need to check `name`, `median` and `deviation`
+        #
+        test:
+          - {
+              name: "solana-sdk",
+              commands: ["cargo +$rust_nightly bench -p solana-sdk"],
+            }
+          - {
+              name: "solana-runtime",
+              commands: ["cargo +$rust_nightly bench -p solana-runtime"],
+            }
+          - {
+              name: "solana-gossip",
+              commands: ["cargo +$rust_nightly bench -p solana-gossip"],
+            }
+          - {
+              name: "solana-poh",
+              commands: ["cargo +$rust_nightly bench -p solana-poh"],
+            }
+          - {
+              name: "solana-core",
+              commands: ["cargo +$rust_nightly bench -p solana-core"],
+            }
+          - {
+              name: "sbf",
+              before_command: "make -C programs/sbf all",
+              commands:
+                [
+                  "cargo +$rust_nightly bench --manifest-path programs/sbf/Cargo.toml --features=sbf_c",
+                ],
+            }
+          # spliting solana-accounts-db because it includes criterion bench
+          - {
+              name: "solana-accounts-db",
+              commands:
+                [
+                  "cargo +$rust_nightly bench -p solana-accounts-db --bench accounts_index",
+                  "cargo +$rust_nightly bench -p solana-accounts-db --bench accounts",
+                  "cargo +$rust_nightly bench -p solana-accounts-db --bench append_vec",
+                  "cargo +$rust_nightly bench -p solana-accounts-db --bench bench_accounts_file -- --output-format bencher",
+                  "cargo +$rust_nightly bench -p solana-accounts-db --bench bench_hashing -- --output-format bencher",
+                  "cargo +$rust_nightly bench -p solana-accounts-db --bench bench_serde -- --output-format bencher",
+                ],
+            }
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Before Command
+        if: ${{ matrix.test.before_command != '' }}
+        run: |
+          ${{ matrix.test.before_command }}
+
+      - name: Command
+        run: |
+          source ci/rust-version.sh nightly
+          echo '${{ toJson(matrix.test.commands) }}' | jq -r '.[]' | while read command; do
+            eval $command | tee -a benchmark
+          done
+
+      - name: Upload Result
+        run: |
+          TEST_SUITE="${{ matrix.test.name }}" \
+          COMMIT_HASH="$(git rev-parse HEAD)" \
+          INFLUX_HOST="${{ secrets.BENCHMARK_INFLUX_HOST }}" \
+          INFLUX_DB="${{ secrets.BENCHMARK_INFLUX_DB }}" \
+          INFLUX_USER="${{ secrets.BENCHMARK_INFLUX_USER }}" \
+          INFLUX_PASSWORD="${{ secrets.BENCHMARK_INFLUX_PASSWORD }}" \
+          INFLUX_MEASUREMENT="${{ secrets.BENCHMARK_INFLUX_MEASUREMENT }}" \
+          ./ci/upload-benchmark.sh benchmark

.github/workflows/cargo.yml

@@ -27,6 +27,7 @@ env:
 
 jobs:
   clippy-nightly:
+    if: github.repository == 'anza-xyz/agave'
     strategy:
       matrix:
         os:
@@ -36,15 +37,20 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: mozilla-actions/[email protected].4
+      - uses: mozilla-actions/[email protected].5
         with:
           version: "v0.8.1"
 
-      - shell: bash
-        run: .github/scripts/cargo-clippy-before-script.sh ${{ runner.os }}
+      # took the workaround from https://github.com/sfackler/rust-openssl/issues/2149
+      - name: Set Perl environment variables
+        if: runner.os == 'Windows'
+        run: |
+          echo "PERL=$((where.exe perl)[0])" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+          echo "OPENSSL_SRC_PERL=$((where.exe perl)[0])" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
 
       - shell: bash
         run: |
+          source .github/scripts/install-all-deps.sh ${{ runner.os }}
           source ci/rust-version.sh nightly
           rustup component add clippy --toolchain "$rust_nightly"
           scripts/cargo-clippy-nightly.sh

.github/workflows/client-targets.yml

@@ -20,6 +20,7 @@ env:
 
 jobs:
   android:
+    if: github.repository == 'anza-xyz/agave'
     strategy:
       matrix:
         os:
@@ -44,6 +45,7 @@ jobs:
         run: ./cargo stable ndk --target ${{ matrix.target }} build -p solana-client
 
   ios:
+    if: github.repository == 'anza-xyz/agave'
     strategy:
       matrix:
         os:

.github/workflows/crate-check.yml

@@ -14,6 +14,7 @@ on:
 
 jobs:
   check:
+    if: github.repository == 'anza-xyz/agave'
     runs-on: ubuntu-20.04
     steps:
       - uses: actions/checkout@v4

.github/workflows/docs.yml

@@ -14,6 +14,7 @@ on:
 
 jobs:
   check:
+    if: github.repository == 'anza-xyz/agave'
     outputs:
       continue: ${{ steps.check.outputs.need_to_build }}
     runs-on: ubuntu-20.04

.github/workflows/downstream-project-anchor.yml

@@ -41,15 +41,16 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        version: ["v0.29.0", "v0.30.0"]
+        version: ["master"]
+    if: false # Re-enable once new major versions for spl-token-2022 and spl-pod are out
     steps:
       - uses: actions/checkout@v4
 
       - shell: bash
         run: |
           .github/scripts/purge-ubuntu-runner.sh
 
-      - uses: mozilla-actions/[email protected].4
+      - uses: mozilla-actions/[email protected].5
         with:
           version: "v0.8.1"
 

.github/workflows/downstream-project-spl-nightly.yml

@@ -6,13 +6,7 @@ on:
 
 jobs:
   main:
-    # As this is a cron job, it is better to avoid running it for all the forks.
-    # They are unlike to benefit from these executions, and they could easily
-    # eat up all the minutes GitHub allocation to free accounts.
-    if: >
-      github.event_name != 'schedule'
-      || github.repository == 'solana-labs/solana'
-
+    if: github.repository == 'anza-xyz/agave'
     strategy:
       fail-fast: false
       matrix: