feat(contracts): vendor and cover the libid-circuits Honk verifiers - #40
Merged
Merged
Conversation
bb belongs to libid-circuits, which now ships each circuit's Solidity verifier beside its vk. The pin is committed digests, never a manifest that came down with the download; forge fmt is the one change to what shipped, and CI's generated-tables job regenerates and diffs so the committed bytes stay checkable. The linter skips bb's output, nothing else does. Assisted-by: Claude Fable 5.1 Signed-off-by: xgreenx <xgreenx9999@gmail.com>
The two verifiers are the first covered contracts that link a library, so COVERED, vendor-artifacts.sh and the linked_bytecode docs now say so, and circuits::deploy_honk_verifier is the one call that deploys RelationsLib and ZKTranscriptLib, links them and returns the verifier's address. The circuits pin rides into the artifacts so a consumer can name a deploy after the release its verifier came from. Assisted-by: Claude Fable 5.1 Signed-off-by: xgreenx <xgreenx9999@gmail.com>
… anvil The stand-in is gone: each Platform Verifier initializes against its circuit's verifier, the initializer's code hash is the chain's, and a wrong-length proof reads logN back so the two circuits are proven distinct, which is the check that catches a mixed-up vk. Assisted-by: Claude Fable 5.1 Signed-off-by: xgreenx <xgreenx9999@gmail.com>
xgreenx
changed the base branch from
feat/platform-verifier-coverage
to
main
September 14, 2026 18:10
The two .sol files are libid-circuits' release asset; circuits.json is the pin. Committing them made this repo a second copy of what that release already publishes, guarded by a --check that only existed because the copies did. Now the forge-build action runs the vendor script before every build, test, dry-run and publish, and each download is held to the pinned sha256 — the guarantee the copies stood in for. Locally: scripts/vendor-circuit-verifiers.sh before the first forge build. Assisted-by: Claude Fable 5.1 Signed-off-by: xgreenx <xgreenx9999@gmail.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
libid-circuits v0.4.0 ships each circuit's Solidity verifier beside its vk, so
bbleaves every downstream repo; this crate compiles, covers and deploys them.Changes
circuits.jsonpins the release version and each tarball's sha256 as literals;scripts/vendor-circuit-verifiers.shdownloads the verifiers intosolidity/contracts/circuits/, refusing a tarball whose digest is not the pin's..solfiles are gitignored, not committed: they are libid-circuits' release asset, like the forge artifacts and npm ABIs. Theforge-buildaction vendors them before every build, test, dry-run and publish; locally the script runs once beforeforge build(README).[lint] ignorefor bb's output.HonkVerifiers.t.solreadslogNoff each verifier, asserts the circuits differ and fit EIP-170, initializes X and Google against the real artifacts.COVEREDandvendor-artifacts.shlist both verifiers withRelationsLibandZKTranscriptLib.circuits::deploy_honk_verifierdeploys the libraries, links and deploys the verifier, returns its address;PlatformVerifier::circuit(),circuits::version(),bindings::circuits::HonkVerifier.Initializer's code hash equals the chain's; a test decodesProofLengthWrongWithLogNand proves the circuits distinct.Verified
forge test: 482 passed.forge lint -D notes,forge fmt --checkclean.cargo +nightly fmt --check, clippy-D warnings,cargo test --all: 14 unit + 6 anvil pass;cargo doc -D warningsclean.scripts/vendor-circuit-verifiers.sh,forge build,forge test(482),scripts/vendor-artifacts.sh(18 artifacts).Not verified / known issues
@libid/contracts(TS) lists no verifier ABI; out of scope.