feat: add the circuit verification key registry crate and tools

.github/workflows/ci.yml

@@ -590,7 +590,7 @@ jobs:
         uses: ./.github/workflows/actions/publish-rust-crates
         with:
           dry_run: "true"
-          packages: mithril-stm, mithril-build-script, mithril-common, mithril-aggregator-client, mithril-aggregator-discovery, mithril-cardano-node-internal-database, mithril-client, mithril-merkle-tree
+          packages: mithril-stm, mithril-build-script, mithril-common, mithril-circuit-key-registry, mithril-aggregator-client, mithril-aggregator-discovery, mithril-cardano-node-internal-database, mithril-client, mithril-merkle-tree
 
   publish-npm-test:
     strategy:
@@ -869,7 +869,7 @@ jobs:
           # the same name (we only want to document those anyway)
           cargo doc --no-deps --lib -p mithril-stm -p mithril-common \
                     -p mithril-cardano-node-chain -p mithril-cardano-node-internal-database \
-                    -p mithril-aggregator-client -p mithril-aggregator-discovery -p mithril-build-script -p mithril-cli-helper \
+                    -p mithril-aggregator-client -p mithril-aggregator-discovery -p mithril-build-script -p mithril-circuit-key-registry -p mithril-cli-helper \
                     -p mithril-dmq -p mithril-doc -p mithril-doc-derive -p mithril-era -p mithril-file-archiver \
                     -p mithril-merkle-tree -p mithril-metric -p mithril-persistence -p mithril-resource-pool \
                     -p mithril-ticker -p mithril-signed-entity-lock -p mithril-signed-entity-preloader \

.github/workflows/manual-publish-crates.yml

@@ -17,6 +17,7 @@ on:
           - all
           - mithril-stm
           - mithril-common
+          - mithril-circuit-key-registry
           - mithril-client
           - mithril-aggregator-client
           - mithril-aggregator-discovery
@@ -36,7 +37,7 @@ jobs:
         id: prepare
         run: |
           if [[ ${{ inputs.package }} == 'all' ]]; then
-            echo "packages=mithril-stm, mithril-build-script, mithril-common, mithril-aggregator-client, mithril-aggregator-discovery, mithril-cardano-node-internal-database, mithril-client" >> $GITHUB_OUTPUT
+            echo "packages=mithril-stm, mithril-build-script, mithril-common, mithril-circuit-key-registry, mithril-aggregator-client, mithril-aggregator-discovery, mithril-cardano-node-internal-database, mithril-client" >> $GITHUB_OUTPUT
           else
             echo "packages=${{ inputs.package }}" >> $GITHUB_OUTPUT
           fi

.github/workflows/nightly-dispatcher.yml

@@ -43,7 +43,7 @@ jobs:
           dry_run: "true"
           dry_run_verify: "true"
           publish_args: "--features rustls"
-          packages: mithril-stm, mithril-build-script, mithril-common, mithril-aggregator-client, mithril-aggregator-discovery, mithril-cardano-node-internal-database, mithril-client, mithril-merkle-tree
+          packages: mithril-stm, mithril-build-script, mithril-common, mithril-circuit-key-registry, mithril-aggregator-client, mithril-aggregator-discovery, mithril-cardano-node-internal-database, mithril-client, mithril-merkle-tree
 
   clippy-check-all-crates:
     runs-on: ubuntu-24.04

.github/workflows/pre-release.yml

@@ -332,7 +332,7 @@ jobs:
         uses: ./.github/workflows/actions/publish-rust-crates
         with:
           dry_run: "true"
-          packages: mithril-stm, mithril-build-script, mithril-common, mithril-aggregator-client, mithril-aggregator-discovery, mithril-cardano-node-internal-database, mithril-client, mithril-merkle-tree
+          packages: mithril-stm, mithril-build-script, mithril-common, mithril-circuit-key-registry, mithril-aggregator-client, mithril-aggregator-discovery, mithril-cardano-node-internal-database, mithril-client, mithril-merkle-tree
 
   publish-next-wasm-package:
     if: github.event_name == 'push'

.github/workflows/release.yml

@@ -248,7 +248,7 @@ jobs:
         uses: ./.github/workflows/actions/publish-rust-crates
         with:
           dry_run: "false"
-          packages: mithril-stm, mithril-build-script, mithril-common, mithril-aggregator-client, mithril-aggregator-discovery, mithril-cardano-node-internal-database, mithril-client, mithril-merkle-tree
+          packages: mithril-stm, mithril-build-script, mithril-common, mithril-circuit-key-registry, mithril-aggregator-client, mithril-aggregator-discovery, mithril-cardano-node-internal-database, mithril-client, mithril-merkle-tree
           api_token: ${{ secrets.CRATES_IO_API_TOKEN }}
 
   promote-wasm-package-to-latest:

.github/workflows/test-rust.yml

@@ -19,7 +19,7 @@ jobs:
             test-args: --features full,unstable --workspace
             cargo-profile: ci-tests
           - os: ubuntu-24.04
-            test-args: --features future_snark,rustls -p mithril-stm -p mithril-common -p mithril-aggregator -p mithril-signer -p mithril-relay
+            test-args: --features future_snark,rustls -p mithril-stm -p mithril-common -p mithril-circuit-key-registry -p mithril-aggregator -p mithril-signer -p mithril-relay
             artifact-suffix: -future-snark
             # Default to the fast profile; the `prepare` step upgrades to `slow-cargo-profile`
             # only when the slow SNARK tests are actually in scope for this run (so we don't pay

.prettierignore

@@ -6,6 +6,7 @@ mithril-explorer/out/
 mithril-explorer/.next/
 mithril-explorer/explorer/
 mithril-infra/assets/docker/cardano/
+mithril-infra/configuration/*/circuit-verification-key-registry.json
 mithril-test-lab/cardano-devnet/artifacts/
 mithril-test-lab/mithril-end-to-end/monitor/config/grafana/provisioning/dashboards/*.json
 mithril-test-lab/mithril-aggregator-fake/default_data/

CHANGELOG.md

@@ -22,6 +22,9 @@ As a minor extension, we have adopted a slightly different versioning convention
     - Existing archives must be regenerated by the Mithril aggregator to ensure byte stability.
   - Preliminary support for uploading immutable files to IPFS with the Mithril aggregator and downloading them from IPFS with the Mithril client library and CLI.
   - Preliminary support for the circuit verification key registry, a genesis-signed whitelist (with revocations) of the circuit verification keys trusted for SNARK certificates.
+    - The registry lives in the new `mithril-circuit-key-registry` crate, holding one entry per circuit verification key, either allowed over an epoch range or revoked for every epoch.
+    - The registry is retrieved over HTTP and the last verified registry is kept when a refresh fails.
+    - New `circuit-key-registry export`, `whitelist`, `expire`, `revoke` and `sign` commands in the Mithril aggregator to manage the genesis-signed registry of a Mithril network.
 
 - **REMOVED** support for `Gzip` compression/decompression in the Mithril aggregator and client:
   - The aggregator no longer produces or supports `Gzip` compression for snapshot-related artifacts: immutable files and ancillaries.

Cargo.toml

@@ -15,6 +15,7 @@ members = [
     "internal/mithril-aggregator-client",
     "internal/mithril-aggregator-discovery",
     "internal/mithril-build-script",
+    "internal/mithril-circuit-key-registry",
     "internal/mithril-cli-helper",
     "internal/mithril-dmq",
     "internal/mithril-doc",

Makefile

@@ -4,6 +4,7 @@ COMPONENTS = demo/protocol-demo \
 			 internal/mithril-aggregator-client \
 			 internal/mithril-aggregator-discovery \
 			 internal/mithril-build-script \
+			 internal/mithril-circuit-key-registry \
 			 internal/mithril-cli-helper \
 			 internal/mithril-dmq \
 			 internal/mithril-doc \

README.md

@@ -90,6 +90,8 @@ This repository consists of the following parts:
 
   - [**Mithril cardano-node-internal-database**](./internal/cardano-node/mithril-cardano-node-internal-database): mechanisms to read the files of a **Cardano node** internal database and compute digests from them, used by **Mithril network** nodes and client library.
 
+  - [**Mithril circuit key registry**](./internal/mithril-circuit-key-registry): the genesis-signed **registry** of the circuit verification keys trusted for **SNARK certificates**, used by **Mithril network** nodes and client library.
+
   - [**Mithril cli helper**](./internal/mithril-cli-helper): **CLI** tools for **Mithril** binaries.
 
   - [**Mithril DMQ node**](./internal/mithril-dmq): mechanisms to publish and consume messages of a **Decentralized Message Queue network** through a DMQ node, used by Mithril network nodes.