Restore/pre 0.9.3 backlog

.cargo/audit.toml

@@ -0,0 +1,27 @@
+# RUSTSEC-2026-0049: CRL revocation checking bug in rustls-webpki 0.101.7.
+#
+# Background: CRL (Certificate Revocation List) checking is an optional TLS
+# feature where a client fetches a list of revoked certificates from URLs
+# embedded in the cert itself, to confirm it hasn't been invalidated since
+# issuance. This is distinct from normal certificate validation.
+#
+# The bug: when a cert lists multiple CRL distribution point URLs, only the
+# first URL is checked; the rest are silently ignored. This matters only when
+# CRL checking is enabled AND the UnknownStatusPolicy is set to Allow (meaning
+# "if I can't determine revocation status, accept the cert anyway"). With that
+# combination, a revoked certificate from a compromised CA could be accepted.
+#
+# Why this does not affect Commit-Boost: the vulnerable code path is never
+# reached because no code in this codebase enables CRL checking at all.
+# TLS is used in four places: (1) relay communication via reqwest with
+# rustls-tls uses default CA validation with no CRL configured; (2) the signer
+# server presents a TLS certificate but does not check client revocation;
+# (3) the signer client pins a single self-signed certificate via
+# add_root_certificate — CRL is irrelevant for self-signed certs; (4) the Dirk
+# remote signer uses mTLS with a custom CA but again no CRL. In all cases the
+# buggy CRL code in rustls-webpki is never invoked.
+#
+# Blocked on sigp/lighthouse upgrading past v8.0.1 without a compilation
+# regression (SseEventSource missing cfg guard in eth2 error.rs).
+[advisories]
+ignore = ["RUSTSEC-2026-0049"]

.github/workflows/release-gate.yml

@@ -0,0 +1,96 @@
+name: Release Gate
+
+on:
+  pull_request:
+    types: [closed]
+    branches: [main]
+
+jobs:
+  release-gate:
+    name: Tag and update release branches
+    runs-on: ubuntu-latest
+    # Only run when a release/ branch is merged (not just closed)
+    if: |
+      github.event.pull_request.merged == true &&
+      startsWith(github.event.pull_request.head.ref, 'release/v')
+
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+
+      - uses: actions/checkout@v4
+        with:
+          # Full history required for version comparison against existing tags
+          # and for the fast-forward push to stable/beta.
+          fetch-depth: 0
+          token: ${{ steps.app-token.outputs.token }}
+
+      - name: Extract and validate version
+        id: version
+        env:
+          BRANCH_REF: ${{ github.event.pull_request.head.ref }}
+        run: |
+          BRANCH="$BRANCH_REF"
+          NEW_VERSION="${BRANCH#release/}"
+          echo "new=${NEW_VERSION}" >> $GITHUB_OUTPUT
+
+          # Determine if this is an RC
+          if echo "$NEW_VERSION" | grep -qE '\-rc[0-9]+$'; then
+            echo "is_rc=true" >> $GITHUB_OUTPUT
+          else
+            echo "is_rc=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Validate version is strictly increasing
+        env:
+          NEW_VERSION: ${{ steps.version.outputs.new }}
+        run: |
+          # Get the latest tag; if none exist yet, skip the comparison
+          LATEST_TAG=$(git tag --list 'v*' --sort=-version:refname | head -n1)
+          if [ -z "$LATEST_TAG" ]; then
+            echo "No existing tags found — skipping version comparison"
+            exit 0
+          fi
+
+          LATEST_VERSION="${LATEST_TAG#v}"
+
+          python3 - <<EOF
+          import sys
+          from packaging.version import Version
+
+          def normalize(v):
+              # Convert vX.Y.Z-rcQ → X.Y.ZrcQ (PEP 440)
+              return v.replace("-rc", "rc")
+
+          new    = Version(normalize("$NEW_VERSION"))
+          latest = Version(normalize("$LATEST_VERSION"))
+
+          print(f"Latest tag : {latest}")
+          print(f"New version: {new}")
+
+          if new <= latest:
+              print(f"\n❌ {new} is not strictly greater than current {latest}")
+              sys.exit(1)
+
+          print(f"\n✅ Version order is valid")
+          EOF
+
+      - name: Configure git
+        run: |
+          git config user.name  "commit-boost-release-bot[bot]"
+          git config user.email "commit-boost-release-bot[bot]@users.noreply.github.com"
+
+      - name: Create and push tag
+        env:
+          VERSION: ${{ steps.version.outputs.new }}
+        run: |
+          git tag "$VERSION" HEAD
+          git push origin "$VERSION"
+          # Branch fast-forwarding happens in release.yml after all artifacts
+          # are successfully built. stable/beta are never touched if the build fails.