Skip to content

test(DON'T MERGE): develop-v2.1.0 - #661

Draft
shuklaayush wants to merge 48 commits into
mainfrom
develop-v2.1.0
Draft

test(DON'T MERGE): develop-v2.1.0#661
shuklaayush wants to merge 48 commits into
mainfrom
develop-v2.1.0

Conversation

@shuklaayush

Copy link
Copy Markdown
Collaborator

No description provided.

gdmlcjs and others added 5 commits July 14, 2026 09:25
…vm-1.94.0 toolchain

Squash of the develop-v2.1.0-rv64 work rebased onto develop-v2.0.0-rc.1:
- openvm deps -> develop-v2.1.0-rv64 (e6803a8c), stark-backend pinned at 260062e9
- guest: no_std + rv64 target riscv64im-unknown-openvm-elf (target_os = "openvm"),
  getrandom-unsupported feature, cfg gates per openvm AGENTS.md
- build: prebuilt openvm-1.94.0 toolchain (auto-installed in run.sh, cached in CI)
- remove aot feature; rv32im -> riscv crate renames

rc.1 features are preserved: #606 input-gen helper, #609 prove-root mode +
Sdk::builder pk loading + root.pk keygen (`--proof-cache` is a todo!() until the
rv64 SDK gains prove_unwrapped_with_stark_proof). The #607 unsafe from_xy API
and #610 vk are v2.0.0-line specific; vk needs regeneration for the rv64 guest.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@socket-security

socket-security Bot commented Jul 14, 2026

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: cargo hyper-util is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?cargo/reqwest@0.12.28cargo/reqwest@0.13.4cargo/hyper-util@0.1.20

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/hyper-util@0.1.20. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: cargo openssl is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?cargo/reqwest@0.12.28cargo/openssl@0.10.81

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/openssl@0.10.81. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: cargo writeable is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?cargo/url@2.5.8cargo/writeable@0.6.3

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/writeable@0.6.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: cargo zerocopy is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: ?cargo/reqwest@0.12.28cargo/alloy-trie@0.9.4cargo/criterion@0.8.2cargo/alloy-eips@1.8.3cargo/alloy-primitives@1.6.0cargo/alloy-json-rpc@2.0.5cargo/alloy-rpc-types@2.0.5cargo/alloy-eips@2.0.5cargo/alloy-rpc-client@2.0.5cargo/alloy-consensus@2.0.5cargo/alloy-provider@2.0.5cargo/alloy@2.0.5cargo/reqwest@0.13.4cargo/revm@40.0.3cargo/reth-primitives-traits@0.4.1cargo/ark-bls12-381@0.5.0cargo/ark-bn254@0.5.0cargo/ark-ec@0.5.0cargo/ark-ff@0.5.0cargo/aurora-engine-modexp@1.2.0cargo/alloy-trie@0.8.1cargo/metrics@0.23.1cargo/revm@27.1.0cargo/bls12_381@0.8.0cargo/zerocopy@0.8.54

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore cargo/zerocopy@0.8.54. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

shuklaayush and others added 21 commits July 21, 2026 13:48
* chore: drop openvm-guest-mem in favour of openvm-mem

`openvm-mem`, added upstream in openvm-org/openvm#feat/openvm-mem-intrinsics,
defines strong `memcpy`/`memset`/`memmove`/`memcmp`/`bcmp` for the guest.
Ours defined `memcmp`/`bcmp` too, so linking both fails:

    rust-lld: error: duplicate symbol: bcmp
    rust-lld: error: duplicate symbol: memcmp

The upstream implementation subsumes this crate. It is also faster,
because it does not require the two pointers to share an alignment —
instructions executed comparing 256 equal bytes:

    a%8  b%8   openvm-guest-mem   openvm-mem
      0    0                236          231
      3    3                306          231
      0    3               1798          231

This crate byte-walks whenever `a % 8 != b % 8`, which is common for
hashes and RLP node references read at arbitrary offsets.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* chore: remove empty guest dependency table

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
The digest comparison during decoding ran a byte at a time, five instructions per byte, because
a slice comparison of unknown length becomes a `memcmp` call. Fixing the length to 32 at the
three sites where one side is a full digest lets it compile to four word loads per side and an
XOR chain instead. Shorter references keep the byte loop, which is still the cheaper form for
them.
* perf(kzg): execute test vectors instead of proving each one

test_multiple_valid_verify_kzg proved all 54 vectors end-to-end,
rebuilding the guest and regenerating the app proving key per vector
(~24 min in CI). The guest asserts the verification result, so pure
execution carries the same pass/fail signal per vector; the proving
pipeline stays covered by test_single_valid_verify_kzg.

Build and compile the guest once per test, run each vector through
sdk.execute, and assert invalid vectors fail via execution error. This
makes test_multiple_invalid_verify_kzg cheap enough to un-ignore, so
all 68 invalid vectors now run in CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(kzg): add label-gated prove-all test for full circuit coverage

Executing the vectors covers guest logic but not the circuits: trace
generation and proving can fail on operand edge cases that execute
fine. Add test_prove_multiple_valid_verify_kzg, which proves all 54
valid vectors with a shared prover (keygen once). Proving costs ~25s
per vector on the 64-core runner, so the test is ignored by default
and CI runs it on pushes to main and on PRs with the
run-kzg-prove-all label.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore(kzg): rename proving label to run-full-proving

Crate-agnostic name so the same label can gate ignored proving tests
in other workflows.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* chore(kzg): rename proving label to run-kzg-proving

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* ci(kzg): trigger label runs through a label-overrides workflow

Adding the run-kzg-proving label invokes tests-kzg.yml via
workflow_call, starting only the prove-all job. Other label additions
no longer re-run the workflow, and the fast test job is skipped on
label events.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(kzg): clarify ignored proving test

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
@shuklaayush shuklaayush added the run-kzg-proving Run the ignored full KZG proving test on this PR label Aug 11, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

run-kzg-proving Run the ignored full KZG proving test on this PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants