feat: Tsuki hardfork — migrate to DogeOS reth/revm forks

.cargo/config.toml

@@ -1,4 +1,5 @@
 [alias]
 docs = "doc --workspace --all-features --no-deps"
-[build]
-rustflags = ["--cfg", "tokio_unstable"]
+
+[net]
+git-fetch-with-cli = true

.github/assets/install_anvil.sh

@@ -0,0 +1,120 @@
+#!/usr/bin/env bash
+#
+# Install the exact `anvil` binary the L1 integration tests are pinned to.
+#
+# The rollup-node L1 sync/reorg fixtures launch an external `anvil` process and
+# refuse to run against any other build (see `crates/node/src/test_utils/fixture.rs`).
+# This script fetches the reviewed Foundry `v1.5.0` release, verifies its archive
+# against a hard-coded SHA-256 before extracting, installs only the `anvil`
+# executable, and confirms the installed version and commit.
+#
+# Usage:
+#   .github/assets/install_anvil.sh [DEST_DIR]
+#
+# DEST_DIR defaults to "$PWD/.anvil-bin". The resulting executable path is printed
+# on the final line so callers can wire it into `ANVIL_BIN`, e.g.:
+#   ANVIL_BIN="$(.github/assets/install_anvil.sh /opt/anvil | tail -n1)"
+#
+# Deliberately does NOT use foundryup or a mutable release channel: the version and
+# checksums are pinned so CI and local runs resolve the identical binary.
+set -euo pipefail
+
+# --- Pinned release --------------------------------------------------------------
+# The commit is the definitive identity. The immutable `v1.5.0` archive reports
+# version `1.5.0-v1.5.0`; a `foundryup stable` build reports `1.5.0-stable`; both
+# share this commit, so the version string is matched by prefix only.
+readonly FOUNDRY_VERSION="v1.5.0"
+readonly REQUIRED_VERSION_PREFIX="1.5.0"
+readonly REQUIRED_COMMIT="1c57854462289b2e71ee7654cd6666217ed86ffd"
+readonly BASE_URL="https://github.com/foundry-rs/foundry/releases/download/${FOUNDRY_VERSION}"
+
+# Official Linux archive digests for ${FOUNDRY_VERSION}.
+readonly SHA256_AMD64="5cd98f9092bcc28be087939491f786b2bf3ed55e492996a409e29519b8ab4dc8"
+readonly SHA256_ARM64="8138e1615568bfcca5999773830892d93a569370eb0ae4b7dd97db46e2af47f9"
+
+readonly DEST_DIR="${1:-$PWD/.anvil-bin}"
+
+err() { printf 'install_anvil: %s\n' "$*" >&2; }
+
+# --- Platform selection ----------------------------------------------------------
+os="$(uname -s)"
+if [ "${os}" != "Linux" ]; then
+    err "unsupported OS '${os}'; only Linux archives are pinned. Install Foundry ${FOUNDRY_VERSION} manually and set ANVIL_BIN."
+    exit 1
+fi
+
+arch="$(uname -m)"
+case "${arch}" in
+    x86_64 | amd64)
+        archive="foundry_${FOUNDRY_VERSION}_linux_amd64.tar.gz"
+        expected_sha="${SHA256_AMD64}"
+        ;;
+    aarch64 | arm64)
+        archive="foundry_${FOUNDRY_VERSION}_linux_arm64.tar.gz"
+        expected_sha="${SHA256_ARM64}"
+        ;;
+    *)
+        err "unsupported architecture '${arch}'; only x86_64 and aarch64 are pinned."
+        exit 1
+        ;;
+esac
+
+# --- sha256 helper ---------------------------------------------------------------
+if command -v sha256sum >/dev/null 2>&1; then
+    sha256_of() { sha256sum "$1" | awk '{print $1}'; }
+elif command -v shasum >/dev/null 2>&1; then
+    sha256_of() { shasum -a 256 "$1" | awk '{print $1}'; }
+else
+    err "neither sha256sum nor shasum is available; cannot verify the archive."
+    exit 1
+fi
+
+# --- Download --------------------------------------------------------------------
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "${tmp_dir}"' EXIT
+
+archive_path="${tmp_dir}/${archive}"
+url="${BASE_URL}/${archive}"
+err "downloading ${url}"
+curl --proto '=https' --tlsv1.2 -fsSL "${url}" -o "${archive_path}"
+
+# --- Verify checksum BEFORE extracting -------------------------------------------
+actual_sha="$(sha256_of "${archive_path}")"
+if [ "${actual_sha}" != "${expected_sha}" ]; then
+    err "checksum mismatch for ${archive}"
+    err "  expected: ${expected_sha}"
+    err "  actual:   ${actual_sha}"
+    exit 1
+fi
+err "checksum verified: ${expected_sha}"
+
+# --- Extract only the anvil executable -------------------------------------------
+mkdir -p "${DEST_DIR}"
+tar -xzf "${archive_path}" -C "${DEST_DIR}" anvil
+anvil_bin="$(cd "${DEST_DIR}" && pwd -P)/anvil"
+chmod +x "${anvil_bin}"
+
+# --- Verify the installed binary -------------------------------------------------
+version_output="$("${anvil_bin}" --version)"
+installed_version="$(printf '%s\n' "${version_output}" | sed -n 's/^anvil Version:[[:space:]]*//p' | head -n1)"
+installed_commit="$(printf '%s\n' "${version_output}" | sed -n 's/^Commit SHA:[[:space:]]*//p' | head -n1)"
+
+case "${installed_version}" in
+    "${REQUIRED_VERSION_PREFIX}"*) ;;
+    *)
+        err "installed anvil does not match the pinned release"
+        err "  expected version ${REQUIRED_VERSION_PREFIX}* commit ${REQUIRED_COMMIT}"
+        err "  found    version ${installed_version:-<none>} commit ${installed_commit:-<none>}"
+        exit 1
+        ;;
+esac
+if [ "${installed_commit}" != "${REQUIRED_COMMIT}" ]; then
+    err "installed anvil does not match the pinned release"
+    err "  expected version ${REQUIRED_VERSION_PREFIX}* commit ${REQUIRED_COMMIT}"
+    err "  found    version ${installed_version:-<none>} commit ${installed_commit:-<none>}"
+    exit 1
+fi
+
+err "installed anvil ${installed_version} (${REQUIRED_COMMIT}) at ${anvil_bin}"
+# Final stdout line: the executable path, for ANVIL_BIN wiring.
+printf '%s\n' "${anvil_bin}"

.github/assets/verify_reth_sources.jq

@@ -0,0 +1,77 @@
+# Validates a `cargo metadata` dependency graph against the canonical DogeOS
+# component, clean DogeOS Reth, DogeOS REVM, and reviewed official Reth pins.
+#
+# Arguments (exact canonical source strings):
+#   $components  DogeOS component packages (dogeos-reth repository)
+#   $reth        clean DogeOS Reth packages (DogeOS69/reth repository)
+#   $revm        DogeOS REVM packages (dogeos-revm repository)
+#   $official    reviewed official Reth transitive source (paradigmxyz/reth)
+#
+# Emits one line per violation; empty output means the graph is verified.
+
+# Reduce a source URL to its repository identity so revision pinning cannot be
+# bypassed through case, scheme, `.git`, or trailing-slash spelling variants.
+def norm_repo:
+  ascii_downcase
+  | sub("^git\\+"; "")
+  | split("?")[0]
+  | split("#")[0]
+  | sub("^(https?|ssh|git)://"; "")
+  | sub("^git@"; "")
+  | sub("^github\\.com:"; "github.com/")
+  | sub("\\.git$"; "")
+  | sub("/+$"; "");
+
+def retired_repos:
+  ["github.com/dogeos69/dogeos-reth2",
+   "github.com/dogeos69/scroll-reth",
+   "github.com/scroll-tech/reth"];
+
+[
+  # Anchor packages must each resolve exactly once from their canonical source.
+  (if [.packages[] | select(.name == "dogeos-reth-node") | .source] == [$components] then empty
+   else "anchor dogeos-reth-node must resolve exactly once from the canonical DogeOS component source" end),
+  (if [.packages[] | select(.name == "reth-node-builder") | .source] == [$reth] then empty
+   else "anchor reth-node-builder must resolve exactly once from the clean DogeOS Reth source" end),
+  (if [.packages[] | select(.name == "revm-scroll") | .source] == [$revm] then empty
+   else "revm-scroll must resolve exactly once from the canonical DogeOS REVM source" end),
+
+  (.packages[]
+   | (if .source == null then null else (.source | norm_repo) end) as $repo
+   | (
+       # Every DogeOS component package must use the canonical component
+       # source; null/path sources fail this comparison as well.
+       (if (.name | startswith("dogeos-")) and .source != $components then
+          "DogeOS component package \(.name) must use the canonical component source, found \(.source // "null/path source")"
+        else empty end),
+
+       # Every reth-* package must be a registry compatibility crate, clean
+       # DogeOS Reth, or the exact reviewed official Reth source.
+       (if (.name | test("^reth(-|$)")) then
+          (if .source == null then
+             "Reth package \(.name) must not use a null/path source"
+           elif (.source | startswith("registry+")) or .source == $reth or .source == $official then
+             empty
+           else
+             "Reth package \(.name) has an unreviewed source \(.source)"
+           end)
+        else empty end),
+
+       # Any package drawn from a guarded repository must use the exact
+       # canonical source; retired forks are rejected outright.
+       (if $repo == null then empty
+        elif retired_repos | index($repo) then
+          "package \(.name) uses the retired fork source \(.source)"
+        elif $repo == "github.com/dogeos69/dogeos-reth" and .source != $components then
+          "package \(.name) uses a noncanonical DogeOS component source \(.source)"
+        elif $repo == "github.com/dogeos69/reth" and .source != $reth then
+          "package \(.name) uses a noncanonical clean DogeOS Reth source \(.source)"
+        elif $repo == "github.com/dogeos69/dogeos-revm" and .source != $revm then
+          "package \(.name) uses a noncanonical DogeOS REVM source \(.source)"
+        elif $repo == "github.com/paradigmxyz/reth" and .source != $official then
+          "package \(.name) uses an unreviewed official Reth source \(.source)"
+        else empty end)
+     )
+  )
+]
+| .[]

.github/assets/verify_reth_sources.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env sh
+set -eu
+
+script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
+
+# Canonical reviewed sources; every guarded package family must resolve to
+# these exact strings (see verify_reth_sources.jq for the enforced rules).
+components_source="git+https://github.com/DogeOS69/dogeos-reth.git?rev=8f0b98b056111e8f497a4c6dd78ef1f776b626a5#8f0b98b056111e8f497a4c6dd78ef1f776b626a5"
+reth_source="git+https://github.com/DogeOS69/reth.git?rev=972366a0bfc11cf6a0d5dc79d5e779cd81e32232#972366a0bfc11cf6a0d5dc79d5e779cd81e32232"
+revm_source="git+https://github.com/DogeOS69/dogeos-revm.git?rev=dcf087684f255131c96c0d20f3291eef9198e990#dcf087684f255131c96c0d20f3291eef9198e990"
+official_reth_source="git+https://github.com/paradigmxyz/reth?rev=b25f32a977b489f9b84254c7811a2a5a25a81369#b25f32a977b489f9b84254c7811a2a5a25a81369"
+
+# The predicate runs against a metadata file when one is provided (used by the
+# fixtures in verify_reth_sources_test.sh); CI and local runs generate the
+# metadata from the locked workspace.
+if [ "$#" -gt 0 ]; then
+    metadata_file="$1"
+else
+    metadata_file=$(mktemp)
+    trap 'rm -f "$metadata_file"' EXIT
+    cargo metadata --locked --offline --format-version 1 > "$metadata_file"
+fi
+
+violations=$(jq -r \
+    --arg components "$components_source" \
+    --arg reth "$reth_source" \
+    --arg revm "$revm_source" \
+    --arg official "$official_reth_source" \
+    -f "$script_dir/verify_reth_sources.jq" \
+    "$metadata_file")
+
+if [ -n "$violations" ]; then
+    printf '%s\n' "dependency source verification failed:" "$violations" >&2
+    exit 1
+fi
+
+echo "dependency graph verified: qualified DogeOS component, Reth, and REVM revisions"

.github/assets/verify_reth_sources_test.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env sh
+# Fixtures for verify_reth_sources.sh: the unmodified dependency graph must
+# pass, and every mutated copy of it must be rejected. Requires a fetched
+# workspace (cargo metadata --locked --offline must succeed).
+set -eu
+
+script_dir=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
+verify="$script_dir/verify_reth_sources.sh"
+
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+
+metadata_file="$workdir/metadata.json"
+cargo metadata --locked --offline --format-version 1 > "$metadata_file"
+
+# Positive control: the checked-in graph must pass through the file entry point.
+"$verify" "$metadata_file" > /dev/null
+echo "ok: guard accepts the checked-in dependency graph"
+
+fixture="$workdir/fixture.json"
+canonical_metadata="$workdir/metadata.canonical.json"
+jq -S . "$metadata_file" > "$canonical_metadata"
+
+expect_reject() {
+    description="$1"
+    mutation="$2"
+    jq "$mutation" "$metadata_file" > "$fixture"
+    # A fixture that does not change the metadata would trivially pass the
+    # guard; treat it as a broken fixture rather than a rejection.
+    if jq -S . "$fixture" | cmp -s - "$canonical_metadata"; then
+        echo "FAIL: fixture mutation for $description left the metadata unchanged" >&2
+        exit 1
+    fi
+    if "$verify" "$fixture" > /dev/null 2>&1; then
+        echo "FAIL: guard accepted $description" >&2
+        exit 1
+    fi
+    echo "ok: guard rejects $description"
+}
+
+expect_reject "a null-source DogeOS component" \
+    '.packages |= map(if .name == "dogeos-reth-evm" then .source = null else . end)'
+
+expect_reject "a path-source DogeOS component" \
+    '.packages |= map(if .name == "dogeos-chainspec" then .source = "path+file:///tmp/dogeos-chainspec" else . end)'
+
+expect_reject "the obsolete c5198f7 DogeOS component source alongside the good anchors" \
+    '.packages += [first(.packages[] | select(.name == "dogeos-chainspec")) | .source = "git+https://github.com/DogeOS69/dogeos-reth.git?rev=c5198f722a4fcbd47e8c0a10fe8f9835a801c2d2#c5198f722a4fcbd47e8c0a10fe8f9835a801c2d2"]'
+
+expect_reject "the immediately retired 18adb117 DogeOS component source alongside the good anchors" \
+    '.packages += [first(.packages[] | select(.name == "dogeos-chainspec")) | .source = "git+https://github.com/DogeOS69/dogeos-reth.git?rev=18adb1176636b4f3bdc828a15c4622f60d2e5ec7#18adb1176636b4f3bdc828a15c4622f60d2e5ec7"]'
+
+expect_reject "the immediately retired 81c8b33e DogeOS component source alongside the good anchors" \
+    '.packages += [first(.packages[] | select(.name == "dogeos-chainspec")) | .source = "git+https://github.com/DogeOS69/dogeos-reth.git?rev=81c8b33ea958fd03173bc37094b97ddebeed1441#81c8b33ea958fd03173bc37094b97ddebeed1441"]'
+
+expect_reject "the obsolete PR #3 ae160090 clean-Reth source alongside the good anchors" \
+    '.packages += [first(.packages[] | select(.name == "reth-node-builder")) | .source = "git+https://github.com/DogeOS69/reth.git?rev=ae160090003d9b04be0521e9e4760558798cdf40#ae160090003d9b04be0521e9e4760558798cdf40"]'
+
+expect_reject "the immediately retired f851224e clean-Reth source alongside the good anchors" \
+    '.packages += [first(.packages[] | select(.name == "reth-node-builder")) | .source = "git+https://github.com/DogeOS69/reth.git?rev=f851224ee9aaf21c76a14e844cbd12d9756f5f3b#f851224ee9aaf21c76a14e844cbd12d9756f5f3b"]'
+
+expect_reject "a retired dogeos-reth2 source without the .git suffix" \
+    '.packages += [first(.packages[] | select(.name == "reth-node-builder")) | .source = "git+https://github.com/DogeOS69/dogeos-reth2?rev=0000000000000000000000000000000000000000#0000000000000000000000000000000000000000"]'
+
+expect_reject "a retired scroll-reth source with alternate casing" \
+    '.packages += [first(.packages[] | select(.name == "reth-node-builder")) | .source = "git+https://github.com/DogeOS69/Scroll-Reth.git?branch=dev#0000000000000000000000000000000000000000"]'
+
+expect_reject "a retired scroll-tech/reth source without the .git suffix" \
+    '.packages += [first(.packages[] | select(.name == "reth-node-builder")) | .source = "git+https://github.com/scroll-tech/reth?branch=scroll#0000000000000000000000000000000000000000"]'
+
+expect_reject "a duplicate lowercase-organization DogeOS REVM source" \
+    '.packages += [first(.packages[] | select(.name == "revm-scroll")) | .source = "git+https://github.com/dogeos69/dogeos-revm?rev=dcf087684f255131c96c0d20f3291eef9198e990#dcf087684f255131c96c0d20f3291eef9198e990"]'
+
+expect_reject "the immediately retired branch-form DogeOS REVM source alongside the good anchors" \
+    '.packages += [first(.packages[] | select(.name == "revm-scroll")) | .source = "git+https://github.com/DogeOS69/dogeos-revm.git?branch=dogeos#dcf087684f255131c96c0d20f3291eef9198e990"]'
+
+expect_reject "a wrong DogeOS REVM revision" \
+    '.packages |= map(if .name == "revm-scroll" then .source = "git+https://github.com/DogeOS69/dogeos-revm.git?rev=1111111111111111111111111111111111111111#1111111111111111111111111111111111111111" else . end)'
+
+# The reviewed official Reth subtree only ever entered the graph through the
+# removed Foundry/Tempo subtree, so the clean graph no longer contains a
+# paradigmxyz/reth package to mutate. Inject a wrong official-Reth source onto a
+# non-anchor, non-reth-* package so the rejection is attributed specifically to the
+# repository-level official-Reth rule rather than the reth-* naming rule.
+expect_reject "a wrong official Reth revision alongside the good anchors" \
+    '.packages += [first(.packages[] | select(.name == "alloy-node-bindings")) | .source = "git+https://github.com/paradigmxyz/reth?rev=2222222222222222222222222222222222222222#2222222222222222222222222222222222222222"]'
+
+echo "source guard fixtures passed"

.github/workflows/lint.yaml

@@ -13,6 +13,24 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  dependency-sources:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: dcarbone/install-jq-action@v3
+      - name: Configure dependency access
+        env:
+          GITHUB_TOKEN: ${{ secrets.DOGEOS_RETH_TOKEN || secrets.DOGEOS_RETH2_TOKEN || github.token }}
+        run: git config --global url."https://x-access-token:${GITHUB_TOKEN}@github.com/".insteadOf "https://github.com/"
+      - name: Fetch locked dependencies
+        run: cargo fetch --locked
+      - name: Verify Reth dependency sources
+        run: .github/assets/verify_reth_sources.sh
+      - name: Check source guard rejects noncanonical fixtures
+        run: .github/assets/verify_reth_sources_test.sh
+
   clippy:
     runs-on: ubuntu-latest
     timeout-minutes: 30

.github/workflows/release.yml

@@ -141,6 +141,8 @@ jobs:
           push: false
           platforms: ${{ env.PLATFORM }}
           tags: ${{ env.DOCKER_TAGS }}
+          secrets: |
+            github_token=${{ secrets.DOGEOS_RETH_TOKEN || secrets.DOGEOS_RETH2_TOKEN || github.token }}
           cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache
           labels: |
             org.opencontainers.image.title=rollup-node
@@ -165,6 +167,8 @@ jobs:
           push: true
           platforms: ${{ env.PLATFORM }}
           tags: ${{ env.DOCKER_TAGS }}
+          secrets: |
+            github_token=${{ secrets.DOGEOS_RETH_TOKEN || secrets.DOGEOS_RETH2_TOKEN || github.token }}
           cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache
           cache-to: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache,mode=max
           labels: |