ARCHIVE/rippled
1
0
Fork 0
mirror of https://github.com/XRPLF/rippled.git synced 2026-09-26 15:10:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge develop

Browse Source
This commit is contained in:
Sergey Kuznetsov
2026-09-10 15:56:44 +01:00
parent 646c7ed494 9403736199
commit 97b272be23
186 changed files with 13052 additions and 1453 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.cspell.config.yaml
View File

@@ -374,7 +374,6 @@ words:
- venv
- vfalco
- vinnie
- vkeylet
- wasmi
- wasmparser
- Werror
@@ -398,3 +397,4 @@ words:
- xxhasher
- zstdio
- CGNAT
- ungated

58
.github/actions/release-info/action.yml vendored
View File

@@ -7,10 +7,10 @@ outputs:
value: ${{ steps.version.outputs.version }}
channel:
description: "The release channel this build belongs to."
value: ${{ steps.channel.outputs.channel }}
value: ${{ steps.release_info.outputs.channel }}
pkg_release:
description: "The package release number: 1 for a tag, the run number otherwise."
value: ${{ steps.pkg_release.outputs.pkg_release }}
description: "The package release number: 1 for a tag, <run number>.<commit date>git<short commit hash> otherwise."
value: ${{ steps.release_info.outputs.pkg_release }}
runs:
using: composite
@@ -39,52 +39,6 @@ runs:
echo "version=${version}" | tee -a "${GITHUB_OUTPUT}"
# Only a tag says how mature a build is: a push is a develop build whatever
# its version, and a non-public codebase keeps its packages to itself.
- name: Determine release channel
id: channel
shell: bash
env:
IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
REF_NAME: ${{ github.ref_name }}
VISIBILITY: ${{ github.event.repository.visibility }}
run: |
pre_release=""
if [[ "${REF_NAME}" == *-* ]]; then
pre_release="${REF_NAME#*-}"
fi
if [[ "${VISIBILITY}" != "public" ]]; then
channel=private
elif [[ "${IS_TAG}" != "true" ]]; then
channel=develop
elif [[ -z "${pre_release}" ]]; then
channel=stable
elif [[ "${pre_release}" =~ ^rc[0-9]+(\+.*)?$ ]]; then
channel=rc
elif [[ "${pre_release}" =~ ^b(0|[1-9][0-9]*)(\+.*)?$ ]]; then
channel=beta
else
echo "Unsupported pre-release in tag '${REF_NAME}'. Use bN or rcN." >&2
exit 1
fi
echo "channel=${channel}" | tee -a "${GITHUB_OUTPUT}"
# A tag is packaged once, so its release number is fixed at 1. Develop builds
# repeat the same version, so the run number is what makes each push an
# upgrade rather than a reinstall.
- name: Determine package release
id: pkg_release
shell: bash
env:
IS_TAG: ${{ startsWith(github.ref, 'refs/tags/') }}
RUN_NUMBER: ${{ github.run_number }}
run: |
if [[ "${IS_TAG}" == "true" ]]; then
pkg_release=1
else
pkg_release="${RUN_NUMBER}"
fi
echo "pkg_release=${pkg_release}" | tee -a "${GITHUB_OUTPUT}"
- name: Determine release channel and package release
id: release_info
uses: XRPLF/actions/release-info@7cc0e4a8d9d0b838f92c48d312856b190341bbba

9
.github/actions/setup-nix-env/action.yml vendored
View File

@@ -40,10 +40,11 @@ runs:
# Unlike the Linux nix images, macOS needs no SSL_CERT_FILE: it has its
# own trust store, and pinning would break TLS to hosts relying on it.
# Workspace-local, so `cleanup-workspace` clears it, but not the
# `.conan2` prepare-runner hands the system toolchain: that Conan is a
# different version, and the two would migrate each other's cache.
echo "CONAN_HOME=${{ github.workspace }}/.conan2-nix" >>"${GITHUB_ENV}"
# In RUNNER_TEMP, which the runner empties per job, like the `.conan2`
# prepare-runner hands the system toolchain - but under its own name:
# that Conan is a different version, and the two would migrate each
# other's cache.
echo "CONAN_HOME=${RUNNER_TEMP}/.conan2-nix" >>"${GITHUB_ENV}"
# Config, profiles and remote, exactly as the dev shell sets them up on
# entry; the `setup-conan` action is skipped for this toolchain.

4
.github/pull_request_template.md vendored
View File

@@ -18,7 +18,7 @@ If too broad, please consider splitting into multiple PRs.
If there is a relevant task or issue, please link it here.
-->
### Context of Change
## Context of Change
<!--
Please include the context of a change.
@@ -29,7 +29,7 @@ If a refactor, how is this better than the previous implementation?
If there is a spec or design document for this feature, please link it here.
-->
### API Impact
## API Impact
<!--
Please check [x] relevant options, delete irrelevant ones.

6
.github/scripts/strategy-matrix/linux.json vendored
View File

@@ -1,5 +1,5 @@
{
"image_tag": "sha-473fe44",
"image_tag": "sha-060957e",
"configs": {
"ubuntu": [
{
@@ -74,7 +74,7 @@
"extra_cmake_args": "-Dvalidator_keys=ON",
"package": {
"type": "deb",
"image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-45e4b88"
"image": "ghcr.io/xrplf/xrpld/packaging-debian:sha-49cdc10"
}
}
],
@@ -88,7 +88,7 @@
"extra_cmake_args": "-Dvalidator_keys=ON",
"package": {
"type": "rpm",
"image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-45e4b88"
"image": "ghcr.io/xrplf/xrpld/packaging-rhel:sha-49cdc10"
}
}
]

8
.github/workflows/build-nix-images.yml vendored
View File

@@ -5,15 +5,13 @@ on:
branches:
- develop
paths:
- ".github/workflows/build-nix-images.yml"
- "flake.nix"
- "flake.lock"
- "rust-toolchain.toml"
- "nix/**"
- "!nix/docker/README.md"
- "!nix/devshell.nix"
- "!nix/check-tools/*.txt"
- "bin/check-tools.sh"
- "!nix/check-tools/**"
- "bin/default-loader-path.sh"
- "bin/install-sanitizer-libs.sh"
pull_request:
@@ -25,7 +23,7 @@ on:
- "nix/**"
- "!nix/docker/README.md"
- "!nix/devshell.nix"
- "!nix/check-tools/*.txt"
- "!nix/check-tools/**"
- "bin/check-tools.sh"
- "bin/default-loader-path.sh"
- "bin/install-sanitizer-libs.sh"
@@ -60,7 +58,7 @@ jobs:
base_image: debian:bookworm
- name: rhel
base_image: registry.access.redhat.com/ubi9/ubi:latest
uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
with:
image_name: xrpld/nix-${{ matrix.distro.name }}
dockerfile: nix/docker/Dockerfile

12
.github/workflows/build-packaging-images.yml vendored
View File

@@ -6,13 +6,13 @@ on:
- develop
paths:
- ".github/workflows/build-packaging-images.yml"
- "package/Dockerfile"
- "package/install-packaging-tools.sh"
- "bin/install-packaging-tools.sh"
- "package/docker/**"
pull_request:
paths:
- ".github/workflows/build-packaging-images.yml"
- "package/Dockerfile"
- "package/install-packaging-tools.sh"
- "bin/install-packaging-tools.sh"
- "package/docker/**"
workflow_dispatch:
concurrency:
@@ -41,9 +41,9 @@ jobs:
# AlmaLinux rather than UBI, which does not ship rpm-sign.
- name: rhel
base_image: almalinux:10
uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
with:
image_name: xrpld/packaging-${{ matrix.distro.name }}
dockerfile: package/Dockerfile
dockerfile: package/docker/Dockerfile
base_image: ${{ matrix.distro.base_image }}
push: ${{ github.event_name == 'push' }}

2
.github/workflows/build-pre-commit-image.yml vendored
View File

@@ -30,7 +30,7 @@ jobs:
permissions:
contents: read
packages: write
uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@65d5a0bd72be4ecea95cff0673a6e0672ab5243a
uses: XRPLF/actions/.github/workflows/build-multiarch-image.yml@034e87065fcd0100214cf0672923bd38d193cf78
with:
image_name: xrpld/pre-commit
dockerfile: bin/pre-commit/Dockerfile

2
.github/workflows/cargo-audit.yml vendored
View File

@@ -34,7 +34,7 @@ permissions:
jobs:
audit:
runs-on: ubuntu-latest
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
permissions:
contents: read
# Needed to open an issue on scheduled failures.

2
.github/workflows/check-tools.yml vendored
View File

@@ -79,7 +79,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare runner
uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
with:
enable_ccache: false

2
.github/workflows/pre-commit.yml vendored
View File

@@ -14,7 +14,7 @@ on:
jobs:
# Call the workflow in the XRPLF/actions repo that runs the pre-commit hooks.
run-hooks:
uses: XRPLF/actions/.github/workflows/pre-commit.yml@f1952595d212e86169935135efc66294b4574131
uses: XRPLF/actions/.github/workflows/pre-commit.yml@279ec358f4a1be4088be3e024b07916fa97c75b6
with:
runs_on: ubuntu-latest
container: '{ "image": "ghcr.io/xrplf/xrpld/pre-commit:sha-473fe44" }'

6
.github/workflows/publish-docs.yml vendored
View File

@@ -41,13 +41,13 @@ env:
jobs:
build:
runs-on: ubuntu-latest
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare runner
uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
with:
enable_ccache: false
@@ -91,4 +91,4 @@ jobs:
steps:
- name: Deploy to GitHub Pages
id: deploy
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

2
.github/workflows/reusable-build-test-config.yml vendored
View File

@@ -129,7 +129,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare runner
uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
with:
enable_ccache: ${{ inputs.ccache_enabled }}

4
.github/workflows/reusable-clang-tidy.yml vendored
View File

@@ -34,7 +34,7 @@ jobs:
needs: [determine-files]
if: ${{ needs.determine-files.outputs.cpp_changed_files != '' || needs.determine-files.outputs.need_full_run == 'true' }}
runs-on: ["self-hosted", "Linux", "X64", "heavy"]
container: "ghcr.io/xrplf/xrpld/nix-debian:sha-473fe44"
container: "ghcr.io/xrplf/xrpld/nix-debian:sha-060957e"
permissions:
contents: read
issues: write
@@ -43,7 +43,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare runner
uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
with:
enable_ccache: false

206
.github/workflows/reusable-package.yml vendored
View File

@@ -1,11 +1,14 @@
# Build Linux packages from the pre-built xrpld and validator-keys artifacts:
# Build, verify and publish Linux packages from the pre-built xrpld and
# validator-keys artifacts, in three stages:
#
# - one job per config that carries a "package" map in linux.json
# - that map names the container image and the format it builds there
# - with 'publish: true' a job also uploads what it built
# (see package/publish_pkg.py)
# - 'package' builds and signs one format per config that carries a "package"
# map in linux.json; that map names the container image and the format
# - 'test-install' installs what was built on a range of distros and runs the
# binaries there, so a package that cannot be installed never reaches Nexus
# - 'publish' uploads with the image's publish_pkg.py, doing a --dry-run
# unless 'publish: true'
#
# Only linux/amd64 is supported; the runner is hardcoded in the job below.
# Only linux/amd64 is supported; the runner is hardcoded in the jobs below.
name: Package
on:
@@ -39,6 +42,7 @@ defaults:
env:
BUILD_DIR: build
PACKAGE_DIR: packages
jobs:
generate-matrix:
@@ -70,12 +74,17 @@ jobs:
contents: read
runs-on: ["self-hosted", "Linux", "X64", "heavy"]
container: ${{ matrix.image }}
timeout-minutes: 30
timeout-minutes: 10
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare runner
uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
with:
enable_ccache: false
- name: Download pre-built xrpld binary
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
@@ -107,33 +116,194 @@ jobs:
--pkg-release "${PKG_RELEASE}" \
--channel "${CHANNEL}"
# Before the upload, so the artifact and the published package are the
# same bytes. DEBs are not signed, so the key is never set on that job.
# Before the upload, so the artifact, the tested package and the published
# package are the same bytes.
- name: Sign RPM
if: ${{ inputs.publish && matrix.package_type == 'rpm' }}
env:
PKG_SIGNING_KEY: ${{ secrets.signing_key }}
run: ./package/sign_rpm.py --package-dir "${BUILD_DIR}"
# Split from the debug symbols, which are an order of magnitude larger, so
# that test-install downloads only what it installs.
- name: Upload package artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ${{ matrix.xrpld_artifact_name }}-pkg
path: |
${{ env.BUILD_DIR }}/debbuild/*.deb
${{ env.BUILD_DIR }}/debbuild/*.ddeb
${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/*.rpm
${{ env.BUILD_DIR }}/debbuild/xrpld_*.deb
${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/xrpld-[0-9]*.rpm
if-no-files-found: error
- name: Upload debug symbol artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ${{ matrix.xrpld_artifact_name }}-pkg-debug
path: |
${{ env.BUILD_DIR }}/debbuild/xrpld-dbgsym_*.deb
${{ env.BUILD_DIR }}/debbuild/xrpld-dbgsym_*.ddeb
${{ env.BUILD_DIR }}/rpmbuild/RPMS/**/xrpld-debuginfo-*.rpm
if-no-files-found: error
# Every distro family the packages target, oldest release first, so both ends
# of the dependency range they declare are exercised.
test-install:
needs: [package]
strategy:
fail-fast: false
matrix:
include:
- package_type: deb
image: debian:11
- package_type: deb
image: debian:12
- package_type: deb
image: debian:13
- package_type: deb
image: ubuntu:20.04
- package_type: deb
image: ubuntu:22.04
- package_type: deb
image: ubuntu:24.04
- package_type: deb
image: ubuntu:26.04
- package_type: rpm
image: almalinux:9
- package_type: rpm
image: almalinux:10
- package_type: rpm
image: rockylinux/rockylinux:9
- package_type: rpm
image: rockylinux/rockylinux:10
- package_type: rpm
image: registry.access.redhat.com/ubi9/ubi
- package_type: rpm
image: registry.access.redhat.com/ubi10/ubi
name: "install ${{ matrix.package_type }} on ${{ matrix.image }}"
permissions:
contents: read
runs-on: ubuntu-latest
container: ${{ matrix.image }}
timeout-minutes: 5
steps:
# Both formats land in one directory; the step below picks its own by
# extension, so this stays independent of the artifact names.
- name: Download package artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: "*-pkg"
merge-multiple: true
path: ${{ env.PACKAGE_DIR }}
- name: Find the package
id: find
env:
PACKAGE_TYPE: ${{ matrix.package_type }}
run: |
package="$(find "${PACKAGE_DIR}" -type f -name "*.${PACKAGE_TYPE}" -print -quit)"
test -n "${package}" || {
echo "no .${PACKAGE_TYPE} found in ${PACKAGE_DIR}" >&2
exit 1
}
echo "package=${package}" >>"${GITHUB_OUTPUT}"
# Debian 11 went end-of-life on 2026-08-31
# (https://www.debian.org/News/2026/20260831) and its packages are
# already partly gone from deb.debian.org, so switch to the
# snapshot.debian.org entries the image ships commented out in its
# sources.list: they are pinned to the snapshot the image was built
# from, so they serve every version it needs and never go away.
# Snapshots keep their original, long-passed Valid-Until, hence the
# disabled check; the retries absorb snapshot.debian.org's throttling.
- name: Switch Debian 11 to snapshot.debian.org
if: ${{ matrix.image == 'debian:11' }}
run: |
sed -i 's|^deb |# deb |; s|^# deb http://snapshot|deb http://snapshot|' /etc/apt/sources.list
printf '%s\n' \
'Acquire::Check-Valid-Until "false";' \
'Acquire::Retries "3";' \
>/etc/apt/apt.conf.d/99snapshot
- name: Install the DEB
if: ${{ matrix.package_type == 'deb' }}
env:
DEBIAN_FRONTEND: noninteractive
PACKAGE: ${{ steps.find.outputs.package }}
run: |
# Stock Debian and Ubuntu images carry no package lists, so apt has
# nothing to resolve the systemd dependency from until it fetches them.
apt-get update -qq
apt-get install -y "./${PACKAGE}"
- name: Install the RPM
if: ${{ matrix.package_type == 'rpm' }}
env:
PACKAGE: ${{ steps.find.outputs.package }}
run: dnf install -y "./${PACKAGE}"
- name: Run xrpld
run: xrpld --version
- name: Run validator-keys
run: validator-keys --version
- name: Run rippled, the legacy compatibility symlink
run: rippled --version
- name: Check the service account
run: id xrpld
- name: Check the state directory
run: test -d /var/lib/xrpld
- name: Check the log directory
run: test -d /var/log/xrpld
publish:
needs: [generate-matrix, package, test-install]
strategy:
fail-fast: false
matrix: ${{ fromJson(needs.generate-matrix.outputs.matrix) }}
name: "publish ${{ matrix.xrpld_artifact_name }}"
permissions:
contents: read
runs-on: ["self-hosted", "Linux", "X64", "heavy"]
container: ${{ matrix.image }}
timeout-minutes: 30
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare runner
uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
with:
enable_ccache: false
# Both artifacts, so the debug symbols are published alongside the package.
- name: Download package artifacts
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
pattern: ${{ matrix.xrpld_artifact_name }}-pkg*
merge-multiple: true
path: ${{ env.PACKAGE_DIR }}
- name: Determine release info
id: release_info
uses: ./.github/actions/release-info
- name: Publish package
if: ${{ inputs.publish }}
env:
CHANNEL: ${{ steps.release_info.outputs.channel }}
DRY_RUN_OPTION: ${{ !inputs.publish && '--dry-run' || '' }}
NEXUS_URL: ${{ inputs.nexus_url }}
NEXUS_USERNAME: ${{ secrets.remote_username }}
NEXUS_PASSWORD: ${{ secrets.remote_password }}
NEXUS_USERNAME: ${{ inputs.publish && secrets.remote_username || '' }}
NEXUS_PASSWORD: ${{ inputs.publish && secrets.remote_password || '' }}
run: |
./package/publish_pkg.py \
publish_pkg.py \
--channel "${CHANNEL}" \
--package-dir "${BUILD_DIR}" \
--nexus-url "${NEXUS_URL}"
--package-dir "${PACKAGE_DIR}" \
--nexus-url "${NEXUS_URL}" \
${DRY_RUN_OPTION}

14
.github/workflows/reusable-rust.yml vendored
View File

@@ -1,8 +1,9 @@
# Clippy, coverage and documentation for the Rust crates in crates/. Each runs
# as an independent job on a GitHub-hosted runner, but inside the same container
# image used to build the crates in the C++/Corrosion path, so the toolchain
# (and therefore the lints, coverage instrumentation and the cargo cache) matches
# what production builds use.
# (and therefore the lints and the cargo cache) matches what production builds
# use. Coverage is the exception: it needs the nightly rustc that honours
# #[coverage(off)], which the image carries alongside the pinned stable.
#
# Rust unit tests are deliberately NOT run here. They run as part of the C++
# build (reusable-build-test-config.yml), which already compiles the crates on a
@@ -27,7 +28,7 @@ permissions:
jobs:
clippy:
runs-on: ubuntu-latest
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -40,11 +41,14 @@ jobs:
coverage:
runs-on: ubuntu-latest
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Use the nightly Rust toolchain
run: rust-nightly path >>"${GITHUB_PATH}"
- name: Use cargo artifacts cache
uses: ./.github/actions/cargo-cache
@@ -66,7 +70,7 @@ jobs:
doc:
runs-on: ubuntu-latest
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
steps:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

7
.github/workflows/reusable-upload-recipe.yml vendored
View File

@@ -40,7 +40,7 @@ defaults:
jobs:
upload:
runs-on: ubuntu-latest
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-473fe44
container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-060957e
env:
REMOTE_NAME: ${{ inputs.remote_name }}
CONAN_LOGIN_USERNAME_XRPLF: ${{ secrets.remote_username }}
@@ -49,6 +49,11 @@ jobs:
- name: Checkout repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare runner
uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
with:
enable_ccache: false
- name: Determine release info
id: release_info
uses: ./.github/actions/release-info

2
.github/workflows/upload-conan-deps.yml vendored
View File

@@ -68,7 +68,7 @@ jobs:
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Prepare runner
uses: XRPLF/actions/prepare-runner@7bf7ceca5932114abdd0d43493c3c30c5a654e13
uses: XRPLF/actions/prepare-runner@b3e255d74d785d053e4903da8ac90983cd7d9e82
with:
enable_ccache: false

9
.gitignore vendored
View File

@@ -72,11 +72,16 @@ DerivedData
/.zed/
# AI tools.
# Shared/committable AI agent config (AGENTS.md, CLAUDE.md, GEMINI.md, .claude/settings.json,
# tool-specific rules files, etc.) should be checked in — see CONTRIBUTING.md. Only the
# personal/local variants below are ignored.
/.agent
/.agents
/.augment
/.claude
/CLAUDE.md
/.claude/settings.local.json
AGENTS.override.md
CLAUDE.local.md
GEMINI.local.md
# Python
__pycache__

5
.pre-commit-config.yaml
View File

@@ -70,6 +70,11 @@ repos:
language: system
types: [rust]
pass_filenames: false # rustfmt formats the whole workspace
- id: check-coverage-attrs
name: check Rust coverage attributes
entry: ./bin/pre-commit/check_rust_coverage_attrs.py
language: python
files: ^crates/.*\.rs$
- repo: https://github.com/BlankSpruce/gersemi-pre-commit
rev: e98930bdc210d3387007f9252d8c1694ea7e410f # frozen: 0.27.7

42
AGENTS.md Normal file
View File

@@ -0,0 +1,42 @@
# AGENTS.md
This file provides guidance to AI coding agents (Claude Code, and other AGENTS.md-compatible tools) when working with code in this repository.
## Build
Required on Linux/macOS: use the Nix devshell, which sets up the compiler, Conan, ccache, and (optionally) Rust automatically.
```bash
nix develop
```
For alternate devshell variants (specific compiler, no-compiler, coverage), see [docs/build/nix.md](./docs/build/nix.md). For the manual build steps, CMake options, and protocol codegen commands, see [BUILD.md](./BUILD.md) (`## Steps`, `## Options`, `## Code generation`).
Rust crate tests (independent of the CMake build): `cargo test --manifest-path crates/Cargo.toml --workspace` (CI uses `cargo nextest`).
## Testing
Unit tests are a custom framework built into the `xrpld` binary itself (not Boost.Test/GTest/Catch); see [CONTRIBUTING.md](./CONTRIBUTING.md#unit-tests) for the basic invocation. Notes not covered there:
- A suite's `--unittest` name is built from the arguments to its `BEAST_DEFINE_TESTSUITE`/`BEAST_DEFINE_TESTSUITE_PRIO` macro (usually at the bottom of the test file), in reverse order and joined with `.`: `BEAST_DEFINE_TESTSUITE(Credentials, app, xrpl)` → `xrpl.app.Credentials`.
- `--unittest-arg` does nothing — don't use it.
- Tests that run offline in under a minute should be automatic `--unittest` suites; anything else is a manual/integration test.
- New tests should be written using `gtest` under `src/tests/` unless that isn't possible, in which case fall back to the legacy Beast framework under `src/test/`. `tests/` (top-level) holds integration tests exercised against `libxrpl`/`xrpld`.
## Lint/Format
See [CONTRIBUTING.md](./CONTRIBUTING.md#pre-commit-hooks) for `pre-commit` setup and [CONTRIBUTING.md](./CONTRIBUTING.md#clang-tidy) for `clang-tidy` (opt-in, needs local `clang-tidy` and generated headers).
## Code Style
New file placement and header levelization: see [CONTRIBUTING.md](./CONTRIBUTING.md#before-making-a-pull-request). Braces, whitespace, member order, and other conventions: see [docs/CodingStyle.md](./docs/CodingStyle.md). `XRPL_ASSERT`/`UNREACHABLE` contracts: see [CONTRIBUTING.md](./CONTRIBUTING.md#contracts-and-instrumentation). Commit messages: see [CONTRIBUTING.md](./CONTRIBUTING.md#good-commit-messages).
## Architecture
Paths below reflect the current layout; update this section if modularization moves a subsystem to a different directory.
- `include/xrpl/` + `src/libxrpl/` — the core protocol library: ledger, shamap, consensus, crypto, json, resource, nodestore, rdb, peerfinder, and `tx/` (transaction application: `Transactor.cpp`, `applySteps.cpp`, invariants, payment paths). `tx/transactors/` has one file per transaction type, grouped by subsystem: `escrow/`, `vault/`, `lending/`, `sponsor/`, `nft/`, `token/` (MPT), `payment_channel/`, `permissioned_domain/`, `dex/`, `oracle/`, `did/`, `credentials/`, `bridge/`, `check/`, `delegate/`, `account/`, `system/`. Any change to transaction-processing behavior must be gated behind an Amendment.
- `src/xrpld/` — the server application built on top of `libxrpl`: `app`, `core`, `overlay` (P2P networking), `peerfinder`, `perflog`, `rpc`, `shamap`. `main` builds an `ApplicationImp` implementing `Application`; most components hold a reference to it (`app_`), giving broad cross-component access — expect to trace call chains through `Application&`.
- `src/test/` — unit tests mirroring the subsystems above, plus `jtx/` (the transaction-building test DSL — e.g. `jtx/escrow.h`, `jtx/vault.h`, `jtx/sponsor.h`, `jtx/permissioned_dex.h`) and `unit_test/` (the custom test framework itself, derived from Beast).
- `src/tests/` — unit tests for `libxrpl` written in `gtest`, gradually replacing the `src/test` equivalents.
- `crates/` — a Rust workspace (only built with `-Dxrpld -Drust=ON`) bridged into C++ via `cxxbridge`/the `cxx` crate; currently just a `hello_world` interop scaffold. Requires the Rust toolchain pinned in `rust-toolchain.toml` (the Nix devshell provides it automatically).

68
API-CHANGELOG.md
View File

@@ -22,17 +22,47 @@ API version 2 is available in `xrpld` version 2.0.0 and later. See [API-VERSION-
This version is supported by all `xrpld` versions. For WebSocket and HTTP JSON-RPC requests, it is currently the default API version used when no `api_version` is specified.
## Unreleased
## XRP Ledger server version 3.4.0
This section contains changes targeting a future version.
Version 3.4.0 is not yet released. These changes are available in the 3.4.0 beta releases.
### Additions
### Additions in 3.4.0
- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`.
When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present.
- `ledger`: `nftoken_id`, `nftoken_ids`, and `offer_id` are now included in transaction metadata when transactions are expanded (`expand`, or admin-only `full`), matching the `tx`, `account_tx`, and `subscribe` (`transactions` stream) responses. ([#5706](https://github.com/XRPLF/rippled/pull/5706))
### Bugfixes in 3.4.0
- `sign`, `sign_for`, `submit`: `signature_target` now returns `invalidParams` unless it names `CounterpartySignature` or `SponsorSignature`. It previously accepted any inner object field, such as `Book` or `NFToken`, and signed into it.
- `sign`, `sign_for`, `submit`, `submit_multisigned`: With `fixCleanup3_4_0` enabled, a signature in `CounterpartySignature` or `SponsorSignature` covers a different prefix than the transaction's own signature, so a signature can no longer be moved from one of those roles into another. Clients that build these signatures themselves must use the new prefixes: `CPT` and `CPM` (single- and multi-signing) for `CounterpartySignature`, and `SPN` and `SPM` for `SponsorSignature`.
- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
- `vault_info`: Errors now identify what the request got wrong instead of reporting every failure as the unregistered token `malformedRequest`, and the `error`, `error_code` and `error_message` fields now agree with each other. An invalid `vault_id` or `seq` returns `invalidParams`, an invalid `owner` returns `actMalformed`, and a request that mixes `vault_id` with `owner`/`seq` or supplies neither returns `invalidParams` with a message naming the accepted combinations. [#8015](https://github.com/XRPLF/rippled/pull/8015)
- `vault_info`: A well-formed all-zero `vault_id` now returns `entryNotFound` instead of being rejected as malformed, and `entryNotFound` responses now include `error_code` and `error_message`. Clients that request `ripplerpc` 3.0 or above therefore receive HTTP 400 with that error rather than HTTP 200. [#8015](https://github.com/XRPLF/rippled/pull/8015)
- `vault_info`: `vault_id` and `owner` must now be strings, matching how `ledger_entry` reads the same fields. An object or an array in either field previously produced an internal error, and a number was silently converted to its decimal text; `vault_id` now returns `invalidParams` and `owner` returns `actMalformed`. [#8015](https://github.com/XRPLF/rippled/pull/8015)
- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
- `ledger`: `delivered_amount` is now included in the metadata of successful `AccountDelete` transactions when transactions are expanded (`expand`, or admin-only `full`). Previously it was only added for `Payment` and `CheckCash`, which made `ledger` inconsistent with `tx` and `account_tx`. [#5706](https://github.com/XRPLF/rippled/pull/5706)
## XRP Ledger server version 3.3.0
[Version 3.3.0](https://github.com/XRPLF/rippled/releases/tag/3.3.0) was released on Aug 6, 2026.
### Additions in 3.3.0
- `account_tx`: Added an optional `delegate` request object to filter delegated transactions. The object requires `delegate_filter`, which must be either `actor` for transactions owned by the requested account but signed by another account, or `authorizer` for transactions signed by the requested account on behalf of another account. The optional `counter_party` account narrows the results to a specific signer/delegate for `actor` or a specific owner/delegator for `authorizer`. Malformed `delegate`, `delegate_filter`, and `counter_party` values return standard invalid field errors, and invalid account IDs return `actMalformed`. When paginating delegate-filtered queries, a marker from a delegate-filtered query includes a `delegate` flag and is only valid for follow-up requests that also supply `delegate` (mixing marker conventions returns `invalidParams`). Because filtering is applied after the ledger scan, a page may contain fewer results than `limit` (possibly zero) while still returning a marker, so callers must continue until no marker is present. ([#6126](https://github.com/XRPLF/rippled/pull/6126))
## XRP Ledger server version 3.2.1
[Version 3.2.1](https://github.com/XRPLF/rippled/releases/tag/3.2.1) was released on Aug 1, 2026.
This release contains bug fixes only and no API changes.
## XRP Ledger server version 3.2.0
[Version 3.2.0](https://github.com/XRPLF/rippled/releases/tag/3.2.0) was released on Jun 16, 2026.
### Additions in 3.2.0
- `ledger_entry`, `account_objects`: The `Delegate` ledger entry now includes an optional `DestinationNode` field, which stores the index into the authorized account's owner directory. This field is present on entries created after bidirectional directory tracking was introduced and may appear in RPC responses for those entries. ([#6681](https://github.com/XRPLF/rippled/pull/6681))
- `server_definitions`: Added the following new sections to the response ([#6321](https://github.com/XRPLF/rippled/pull/6321)):
- `TRANSACTION_FORMATS`: Describes the fields and their optionality for each transaction type, including common fields shared across all transactions.
- `LEDGER_ENTRY_FORMATS`: Describes the fields and their optionality for each ledger entry type, including common fields shared across all ledger entries.
@@ -40,9 +70,8 @@ This section contains changes targeting a future version.
- `LEDGER_ENTRY_FLAGS`: Maps ledger entry type names to their flags and flag values.
- `ACCOUNT_SET_FLAGS`: Maps AccountSet flag names (asf flags) to their numeric values.
### Bugfixes
### Bugfixes in 3.2.0
- `get_aggregate_price`: Duplicate entries in the `oracles` request array are now ignored. [#6586](https://github.com/XRPLF/rippled/pull/6586)
- Peer Crawler: The `port` field in `overlay.active[]` now consistently returns an integer instead of a string for outbound peers. [#6318](https://github.com/XRPLF/rippled/pull/6318)
- `ping`: The `ip` field is no longer returned as an empty string for proxied connections without a forwarded-for header. It is now omitted, consistent with the behavior for identified connections. [#6730](https://github.com/XRPLF/rippled/pull/6730)
- gRPC `GetLedgerDiff`: Fixed error message that incorrectly said "base ledger not validated" when the desired ledger was not validated. [#6730](https://github.com/XRPLF/rippled/pull/6730)
@@ -54,11 +83,24 @@ This section contains changes targeting a future version.
- `submit`: The `fail_hard` field now returns an error if the value is not a boolean. [#6529](https://github.com/XRPLF/rippled/pull/6529)
- `subscribe`: The `taker` field in the `books` array now returns `actMalformed` instead of `badIssuer` if the value is not a valid account. [#6529](https://github.com/XRPLF/rippled/pull/6529)
- Fixed a bug in `Forwarded` HTTP header parsing where the extracted IP address could be incorrect when no comma or semicolon delimiter follows the address. This could cause the server to misidentify a client's IP address when operating behind a reverse proxy. [#6529](https://github.com/XRPLF/rippled/pull/6529)
- `vault_info`: Errors now identify what the request got wrong instead of reporting every failure as the unregistered token `malformedRequest`, and the `error`, `error_code` and `error_message` fields now agree with each other. An invalid `vault_id` or `seq` returns `invalidParams`, an invalid `owner` returns `actMalformed`, and a request that mixes `vault_id` with `owner`/`seq` or supplies neither returns `invalidParams` with a message naming the accepted combinations. [#8015](https://github.com/XRPLF/rippled/pull/8015)
- `vault_info`: A well-formed all-zero `vault_id` now returns `entryNotFound` instead of being rejected as malformed, and `entryNotFound` responses now include `error_code` and `error_message`. Clients that request `ripplerpc` 3.0 or above therefore receive HTTP 400 with that error rather than HTTP 200. [#8015](https://github.com/XRPLF/rippled/pull/8015)
- `vault_info`: `vault_id` and `owner` must now be strings, matching how `ledger_entry` reads the same fields. An object or an array in either field previously produced an internal error, and a number was silently converted to its decimal text; `vault_id` now returns `invalidParams` and `owner` returns `actMalformed`. [#8015](https://github.com/XRPLF/rippled/pull/8015)
- `gateway_balances`: The `account` and `ident` fields now return an `invalidParams` error if the value is not a string, instead of an `internal` error. [#7655](https://github.com/XRPLF/rippled/pull/7655)
- `account_lines`: The `peer` field now returns an error if the value is not a string. [#7728](https://github.com/XRPLF/rippled/pull/7728)
## XRP Ledger server version 3.1.3
[Version 3.1.3](https://github.com/XRPLF/rippled/releases/tag/3.1.3) was released on May 8, 2026.
This release contains bug fixes only and no API changes.
## XRP Ledger server version 3.1.2
[Version 3.1.2](https://github.com/XRPLF/rippled/releases/tag/3.1.2) was released on Mar 12, 2026.
This release contains bug fixes only and no API changes.
## XRP Ledger server version 3.1.1
[Version 3.1.1](https://github.com/XRPLF/rippled/releases/tag/3.1.1) was released on Feb 23, 2026.
This release contains bug fixes only and no API changes.
## XRP Ledger server version 3.1.0

1
CLAUDE.md Symbolic link
View File

@@ -0,0 +1 @@
AGENTS.md

13
CONTRIBUTING.md
View File

@@ -59,6 +59,17 @@ to an existing XLS. Neither change will be released (in an amendment's
case, marked as `Supported::yes`) until the corresponding XLS's status
is `Final`.
## AI coding agents
[`AGENTS.md`](./AGENTS.md) (and its `CLAUDE.md` symlink, for Claude Code) holds shared, checked-in guidance for AI coding agents working in this repository — build/test/lint commands and architecture notes. Additional `AGENTS.md` files may exist in subdirectories to give agents context specific to that part of the codebase; whenever you add one, also add a `CLAUDE.md` symlink pointing to it (`ln -s AGENTS.md CLAUDE.md`) so Claude Code picks it up too.
If you want to give an agent personal instructions that shouldn't be shared with other contributors (e.g. your own workflow preferences), those are gitignored, not checked in:
- `CLAUDE.local.md` — read by Claude Code alongside `CLAUDE.md`.
- `AGENTS.override.md` — read by AGENTS.md-compatible tools that support a personal override file layered on top of `AGENTS.md`.
Likewise, `.claude/settings.local.json` is for personal, untracked Claude Code settings, while `.claude/settings.json` is shared.
## Before making a pull request
(Or marking a draft pull request as ready.)
@@ -82,7 +93,7 @@ If you create new source files, they must be organized as follows:
under `include/xrpl`, and source (`.cpp`) files must go under
`src/libxrpl`.
- All other non-test files must go under `src/xrpld`.
- All test source files must go under `src/test`.
- New test source files should use `gtest` and go under `src/tests`, unless that isn't possible, in which case they should use our legacy test framework and go under `src/test`.
- All benchmark source files must go under `src/benchmarks`.
The source must be formatted according to the style guide below. The easiest

1
bin/check-tools.sh
View File

@@ -158,6 +158,7 @@ if [ "${os}" = "linux" ] || [ "${os}" = "macos" ]; then
check cargo-nextest cargo nextest --version
check clippy-driver
check rust-analyzer
check rust-nightly rust-nightly run rustc --version
check rustc
check rustfmt
fi

6
package/install-packaging-tools.sh → bin/install-packaging-tools.sh
View File

@@ -25,7 +25,9 @@ esac
# Packaging runs in a vanilla distro image, so the tooling comes from the distro's
# archive rather than from nixpkgs:
#
# - debhelper and dpkg-dev build the DEB
# - debhelper and dpkg-dev build the DEB, and lintian checks it
# - binutils gives debian/rules the readelf its glibc-floor check runs; it
# already arrives via dpkg-dev, but that tool is called directly
# - rpm-build builds the RPM, with systemd-rpm-macros and redhat-rpm-config
# supplying the systemd and find-debuginfo macros the spec uses
# - rpm-sign and gnupg2 sign the built RPM
@@ -37,11 +39,13 @@ function install() {
debian | ubuntu)
apt-get update -y
apt-get install -y --no-install-recommends \
binutils \
ca-certificates \
debhelper \
debhelper-compat \
dpkg-dev \
git \
lintian \
python3
;;

149
bin/pre-commit/check_rust_coverage_attrs.py Executable file
View File

@@ -0,0 +1,149 @@
#!/usr/bin/env python3
"""
Check that Rust unit tests stay out of the coverage report.
cargo-llvm-cov instruments the test code along with everything else, so a test
module that is not excluded counts its own body as covered and inflates the
reported number. Excluding it takes two attributes:
* every `#[cfg(test)]` module carries
`#[cfg_attr(coverage_nightly, coverage(off))]`;
* every crate root (lib.rs, main.rs) carries
`#![cfg_attr(coverage_nightly, feature(coverage_attribute))]`, which the
attribute above needs in order to compile.
Both are inert outside the coverage job: cargo-llvm-cov defines
`coverage_nightly` only when it runs on a nightly toolchain.
The crate-root gate is checked even in a crate that has no tests yet, because
that is what lets the first test module added later carry the attribute without
a build failure. Missing it is a hard error, so it cannot go unnoticed; a
missing `coverage(off)` fails open, which is why this check exists.
Matching is on exact attribute text, which works because `cargo fmt` runs over
the whole workspace in the hook ahead of this one: rustfmt puts every attribute
on its own line and normalizes what is inside it, turning `#[cfg( test )]`
and `#[cfg(test,)]` alike into `#[cfg(test)]`. So there is nothing here that
parses Rust. The price is that a cfg this file does not spell out literally --
`all(test, ...)`, `any(test, ...)`, `not(test)` -- is reported rather than
classified, on the grounds that guessing at coverage semantics is how a check
like this ends up quietly wrong.
Usage: ./bin/pre-commit/check_rust_coverage_attrs.py <file1> <file2> ...
Exit status is non-zero if any violation is found.
"""
import re
import sys
from dataclasses import dataclass
from pathlib import Path
CRATE_ROOTS = {"lib.rs", "main.rs"}
FEATURE_ATTR = "#![cfg_attr(coverage_nightly, feature(coverage_attribute))]"
COVERAGE_OFF_ATTR = "#[cfg_attr(coverage_nightly, coverage(off))]"
CFG_TEST_ATTR = "#[cfg(test)]"
# Any other cfg that mentions `test`. String literals are blanked before this
# runs, so `feature = "test"` does not read as the `test` cfg.
RE_CFG_MENTIONS_TEST = re.compile(r"^#\[cfg\(.*\btest\b.*\)\]$")
RE_STRING = re.compile(r'"(?:[^"\\]|\\.)*"')
RE_MOD = re.compile(r"^(?:pub(?:\([^)]*\))?\s+)?mod\s+([A-Za-z_]\w*)")
@dataclass(frozen=True)
class Finding:
line: int
label: str
message: str
def _check_module(attrs: list[str], line: int, name: str) -> list[Finding]:
"""Findings for one module, given the attributes attached to it."""
if COVERAGE_OFF_ATTR in attrs:
return [] # excluded from coverage; which cfg gates it does not matter
if CFG_TEST_ATTR in attrs:
return [
Finding(
line,
"missing-coverage-off",
f"`mod {name}` is #[cfg(test)] but not excluded from coverage; "
f"add {COVERAGE_OFF_ATTR}",
)
]
unclassified = [
attr for attr in attrs if RE_CFG_MENTIONS_TEST.match(RE_STRING.sub('""', attr))
]
if unclassified:
return [
Finding(
line,
"unclassified-cfg",
f"`mod {name}` is gated on {unclassified[0]}, which this check "
f"cannot tell apart from a module that ships in the library; "
f"add {COVERAGE_OFF_ATTR} if it is test-only, or teach this "
f"check the cfg if it is not",
)
]
return []
def _check_test_modules(lines: list[str]) -> list[Finding]:
"""Findings for every test module that is not excluded from coverage."""
findings: list[Finding] = []
attrs: list[str] = []
attrs_line = 0
for number, raw in enumerate(lines, start=1):
stripped = raw.strip()
# Blank lines and comments are allowed between an attribute and its item.
if not stripped or stripped.startswith("//"):
continue
if stripped.startswith("#["):
if not attrs:
attrs_line = number
attrs.append(stripped)
continue
module = RE_MOD.match(stripped)
if module is not None and attrs:
findings += _check_module(attrs, attrs_line, module.group(1))
attrs = []
return findings
def _check_crate_root(name: str, lines: list[str]) -> list[Finding]:
"""A finding if a crate root is missing the coverage_attribute feature gate."""
if name not in CRATE_ROOTS:
return []
if any(line.strip() == FEATURE_ATTR for line in lines):
return []
return [
Finding(
1,
"missing-feature-gate",
f"crate root is missing {FEATURE_ATTR}",
)
]
def check_source(name: str, text: str) -> list[Finding]:
"""Findings for one file's contents; `name` is its base name (lib.rs, ...)."""
lines = text.splitlines()
return _check_crate_root(name, lines) + _check_test_modules(lines)
def check_file(path: Path) -> list[Finding]:
return check_source(path.name, path.read_text(encoding="utf-8"))
def main() -> int:
total = 0
for path in (Path(name) for name in sys.argv[1:]):
for finding in check_file(path):
total += 1
print(f"{path}:{finding.line}: {finding.label}: {finding.message}")
return 1 if total else 0
if __name__ == "__main__":
sys.exit(main())

3
crates/Cargo.toml
View File

@@ -14,6 +14,9 @@ cxx = { version = "1.0.199", features = ["c++20"] }
[workspace.package]
edition = "2024"
[workspace.lints.rust]
unexpected_cfgs = { level = "warn", check-cfg = [ 'cfg(coverage)', 'cfg(coverage_nightly)' ] }
[profile.release]
opt-level = 3
overflow-checks = true

3
crates/xrpl-host-functions-macros/Cargo.toml
View File

@@ -16,3 +16,6 @@ proc-macro2 = "1"
# the library build graph.
[dev-dependencies]
xrpl-host-functions.path = "../xrpl-host-functions"
[lints]
workspace = true

3
crates/xrpl-host-functions/Cargo.toml
View File

@@ -18,3 +18,6 @@ xrpl-host-functions-macros.path = "../xrpl-host-functions-macros"
[features]
default = []
wasmi_glue = []
[lints]
workspace = true

3
crates/xrpl-wasm-testkit/Cargo.toml
View File

@@ -10,3 +10,6 @@ crate-type = ["staticlib", "rlib"]
cxx.workspace = true
wat = "1"
xrpl-host-functions = { path = "../xrpl-host-functions" }
[lints]
workspace = true

3
crates/xrpl-wasm-vm-ffi/Cargo.toml
View File

@@ -10,3 +10,6 @@ crate-type = ["staticlib", "rlib"]
cxx.workspace = true
xrpl-host-functions = { path = "../xrpl-host-functions" }
xrpl-wasm-vm = { path = "../xrpl-wasm-vm" }
[lints]
workspace = true

2
docs/install.md
View File

@@ -13,7 +13,7 @@ To build from source instead, see [BUILD.md](../BUILD.md).
Packages are published to four channels:
- `stable` - the latest production release
- `stable` - production releases
- `rc` - release candidates
- `beta` - beta builds
- `develop` - every push to the [`develop` branch](https://github.com/XRPLF/rippled/tree/develop)

5
include/xrpl/core/HashRouter.h
View File

@@ -34,7 +34,10 @@ enum class HashRouterFlags : std::uint16_t {
PRIVATE4 = 0x0800,
// Used in EscrowFinish.cpp
PRIVATE5 = 0x1000,
PRIVATE6 = 0x2000
PRIVATE6 = 0x2000,
// Used in apply.cpp
PRIVATE7 = 0x4000,
PRIVATE8 = 0x8000
};
constexpr HashRouterFlags

16
include/xrpl/ledger/helpers/AccountRootHelpers.h
View File

@@ -15,7 +15,6 @@
#include <cstdint>
#include <expected>
#include <optional>
#include <set>
#include <vector>
namespace xrpl {
@@ -353,14 +352,14 @@ pseudoAccountAddress(ReadView const& view, uint256 const& pseudoOwnerKey);
*
* The list is constructed during initialization and is const after that.
* Pseudo-account designator fields MUST be maintained by including the
* SField::sMD_PseudoAccount flag in the SField definition.
* SField::kSmdPseudoAccount flag in the SField definition.
*/
[[nodiscard]] std::vector<SField const*> const&
getPseudoAccountFields();
/**
* Returns true if and only if sleAcct is a pseudo-account or specific
* pseudo-accounts in pseudoFieldFilter.
* Returns true if and only if sleAcct is a pseudo-account of any kind
* (i.e. carries at least one field flagged with SField::kSmdPseudoAccount).
*
* Returns false if sleAcct is:
* - NOT a pseudo-account OR
@@ -368,18 +367,15 @@ getPseudoAccountFields();
* - null pointer
*/
[[nodiscard]] bool
isPseudoAccount(SLE::const_pointer sleAcct, std::set<SField const*> const& pseudoFieldFilter = {});
isPseudoAccount(SLE::const_pointer sleAcct);
/**
* Convenience overload that reads the account from the view.
*/
[[nodiscard]] inline bool
isPseudoAccount(
ReadView const& view,
AccountID const& accountId,
std::set<SField const*> const& pseudoFieldFilter = {})
isPseudoAccount(ReadView const& view, AccountID const& accountId)
{
return isPseudoAccount(view.read(keylet::account(accountId)), pseudoFieldFilter);
return isPseudoAccount(view.read(keylet::account(accountId)));
}
/**

27
include/xrpl/ledger/helpers/CredentialHelpers.h
View File

@@ -14,7 +14,6 @@
#include <xrpl/protocol/STVector256.h>
#include <xrpl/protocol/TER.h>
#include <cstdint>
#include <memory>
#include <set>
#include <utility>
@@ -34,32 +33,6 @@ checkExpired(SLE const& sleCredential, NetClock::time_point const& closed);
[[nodiscard]] TER
deleteSLE(ApplyView& view, SLE::ref sleCredential, beast::Journal j);
/**
* @brief Remove credentials pinned to a pseudo-account's owner directory.
*
* Cleans up credentials that were linked to a pseudo-account (Vault, LoanBroker,
* AMM), which such an account can neither accept nor delete. Only credentials
* are removed; every other object is left in place. The walk visits at most
* @p maxNodesToDelete directory entries and charges the ones it leaves alone
* against that budget too, so a directory holding other objects yields fewer
* than @p maxNodesToDelete deletions. On reaching the bound the result is
* `tecINCOMPLETE` and the caller must propagate it so a later transaction
* resumes.
*
* @param view Mutable ledger view.
* @param pseudoAcct The pseudo-account whose directory is cleaned.
* @param maxNodesToDelete Upper bound on directory entries processed in one call.
* @param j Journal for diagnostics.
* @return tesSUCCESS once no credentials remain, tecINCOMPLETE if the bound was
* reached, or a deletion error.
*/
[[nodiscard]] TER
deletePseudoAccountCredentials(
ApplyView& view,
AccountID const& pseudoAcct,
std::uint16_t maxNodesToDelete,
beast::Journal j);
// Amendment and parameters checks for sfCredentialIDs field
NotTEC
checkFields(STTx const& tx, Rules const& rules, beast::Journal j);

9
include/xrpl/ledger/helpers/RippleStateHelpers.h
View File

@@ -239,8 +239,13 @@ canTransfer(ReadView const& view, Issue const& issue, AccountID const& from, Acc
//------------------------------------------------------------------------------
/**
* Any transactors that call addEmptyHolding() in doApply must call
* canAddHolding() in preflight with the same View and Asset
* XRP and the issuer itself are always tesSUCCESS. Otherwise, after
* fixCleanup3_4_0, an existing trust line returns tecDUPLICATE without
* consulting issuer freeze or DefaultRipple; both still apply on the create
* path (DefaultRipple off is terNO_RIPPLE). canAddHolding() ignores existing
* holdings, so transactors that may create a holding in doApply should gate
* their preclaim call on it: after the amendment only when no holding
* exists, before it always.
*/
[[nodiscard]] TER
addEmptyHolding(

20
include/xrpl/ledger/helpers/TokenHelpers.h
View File

@@ -38,6 +38,12 @@ enum class FreezeHandling { IgnoreFreeze, ZeroIfFrozen };
*/
enum class AuthHandling { IgnoreAuth, ZeroIfUnauthorized };
/**
* Controls whether the recipient owner-reserve check is enforced when
* auto-creating a trustline or MPToken during AMMWithdraw or AMMClawback.
*/
enum class ReserveHandling : bool { EnforceReserve, IgnoreReserve };
/**
* Controls whether to include the account's full spendable balance
*/
@@ -294,6 +300,14 @@ accountFunds(
AuthHandling authHandling,
beast::Journal j);
/**
* Returns the transfer fee as Rate based on the type of token
* @param view The ledger view
* @param asset The asset being transferred
*/
[[nodiscard]] Rate
transferRate(ReadView const& view, Asset const& asset);
/**
* Returns the transfer fee as Rate based on the type of token
* @param view The ledger view
@@ -311,6 +325,12 @@ transferRate(ReadView const& view, STAmount const& amount);
[[nodiscard]] TER
canAddHolding(ReadView const& view, Asset const& asset);
/**
* True if the account already holds this asset (or is the issuer / XRP).
*/
[[nodiscard]] bool
holdingExists(ReadView const& view, AccountID const& account, Asset const& asset);
[[nodiscard]] TER
addEmptyHolding(
ApplyViewContext ctx,

60
include/xrpl/ledger/helpers/VaultHelpers.h
View File

@@ -10,6 +10,7 @@
#include <xrpl/protocol/TER.h>
#include <cstdint>
#include <expected>
#include <optional>
namespace xrpl {
@@ -44,6 +45,32 @@ assetsToSharesDeposit(SLE::const_ref vault, SLE::const_ref issuance, STAmount co
[[nodiscard]] std::optional<STAmount>
sharesToAssetsDeposit(SLE::const_ref vault, SLE::const_ref issuance, STAmount const& shares);
/**
* Adjusts a requested asset change (`delta`) to match the decimal scale of the
* updated total vault assets. This ensures `sfAssetsTotal`, `sfAssetsAvailable`,
* and the actual asset transfer change by the exact same representable amount.
*
* Rounding strategy:
* - Debits (withdrawals): Rounds down `|delta|` on the new scale to prevent
* paying out more than requested.
* - Credits (deposits): Floors the resulting total asset balance and returns the
* difference from the current total. This prevents crediting the vault with
* more assets than the user deposited.
*
* Key rules:
* - The returned magnitude never exceeds `|delta|`.
* - Returns `tecPRECISION_LOSS` if the change is smaller than 1 ULP of the target scale
* (prevents share operations when totals cannot change).
* - For integer assets (XRP, MPT), rounding is a no-op.
*
* @param vault The vault ledger entry.
* @param delta The requested signed change to sfAssetsTotal.
* @return The rounded, positive magnitude, or `tecPRECISION_LOSS` if the
* change is below representable precision.
*/
[[nodiscard]] std::expected<STAmount, TER>
clampToAssetsTotalScale(SLE::const_ref vault, STAmount const& delta);
/**
* Controls whether to truncate shares instead of rounding.
*/
@@ -59,33 +86,30 @@ enum class TruncateShares : bool { No = false, Yes = true };
enum class WaiveUnrealizedLoss : bool { No = false, Yes = true };
/**
* Returns the effective total of assets backing outstanding shares for the
* purposes of a withdrawal, i.e. sfAssetsTotal, discounted by sfLossUnrealized
* unless waived. This is the numerator used by both withdraw conversion
* helpers (assetsToSharesWithdraw and sharesToAssetsWithdraw) to compute the
* share/asset exchange rate.
* Returns the assets backing outstanding shares for a withdrawal:
* sfAssetsTotal minus sfLossUnrealized, or sfAssetsTotal alone when the
* unrealized loss is waived. Used by assetsToSharesWithdraw and
* sharesToAssetsWithdraw as the numerator of the share/asset exchange rate.
*
* @param vault The vault SLE.
* @param waive Whether to waive (i.e. not subtract) the vault's unrealized
* loss.
* @param waive Whether to skip subtracting the unrealized loss.
*/
[[nodiscard]] Number
assetsTotalForWithdrawal(SLE::const_ref vault, WaiveUnrealizedLoss waive);
/**
* Returns whether debiting `amount` from `total` — the current value of a
* vault's sfAssetsTotal or sfAssetsAvailable field — would canonicalize back
* to the exact same STAmount value it started at. This happens when a
* genuinely non-zero debit is dust relative to a `total` large enough to
* exceed STAmount's significant-digit precision: the shares still move, but
* the stored total doesn't change, which otherwise trips the ValidVault
* invariant after the fact instead of failing cleanly upfront.
* Returns true if debiting `amount` from `total` (the current value of a
* vault's sfAssetsTotal or sfAssetsAvailable) would canonicalize to the
* same STAmount value. This happens when `amount` is non-zero but too small
* to change the stored total at STAmount's precision. Shares would still
* move, so the ValidVault invariant would fail after apply; callers use
* this to reject the transaction upfront instead.
*
* @param asset The vault's underlying asset, used to canonicalize both sides
* the same way the ledger will when the field is stored.
* @param asset The vault's underlying asset, used to canonicalize both
* sides the same way the ledger will when the field is stored.
* @param total The field's current value.
* @param amount The amount to debit. A value of zero always returns false;
* that case is rejected separately and unconditionally.
* @param amount The amount to debit. Zero always returns false; that case
* is rejected separately.
*/
[[nodiscard]] bool
debitIsNonZeroDust(Asset const& asset, Number const& total, Number const& amount);

20
include/xrpl/protocol/HashPrefix.h
View File

@@ -92,6 +92,26 @@ enum class HashPrefix : std::uint32_t {
* Batch
*/
Batch = detail::makeHashPrefix('B', 'C', 'H'),
/**
* inner transaction to sign as the counterparty
*/
CounterpartyTxSign = detail::makeHashPrefix('C', 'P', 'T'),
/**
* inner transaction to multi-sign as the counterparty
*/
CounterpartyTxMultiSign = detail::makeHashPrefix('C', 'P', 'M'),
/**
* inner transaction to sign as the sponsor
*/
SponsorTxSign = detail::makeHashPrefix('S', 'P', 'N'),
/**
* inner transaction to multi-sign as the sponsor
*/
SponsorTxMultiSign = detail::makeHashPrefix('S', 'P', 'M'),
};
template <class Hasher>

14
include/xrpl/protocol/MPTAmount.h
View File

@@ -9,6 +9,7 @@
#include <cstdint>
#include <limits>
#include <optional>
#include <ostream>
#include <stdexcept>
#include <string>
@@ -174,4 +175,17 @@ mulRatio(MPTAmount const& amt, std::uint32_t num, std::uint32_t den, bool roundU
return MPTAmount(r.convert_to<MPTAmount::value_type>());
}
inline std::optional<MPTAmount>
tryMulRatio(MPTAmount const& amt, std::uint32_t num, std::uint32_t den, bool roundUp)
{
try
{
return mulRatio(amt, num, den, roundUp);
}
catch (std::overflow_error const&)
{
return std::nullopt;
}
}
} // namespace xrpl

19
include/xrpl/protocol/NFTSyntheticSerializer.h
View File

@@ -1,19 +0,0 @@
#pragma once
#include <xrpl/json/json_forwards.h>
#include <xrpl/protocol/STTx.h>
#include <xrpl/protocol/TxMeta.h>
#include <memory>
namespace xrpl::rpc {
/**
* Adds common synthetic fields to transaction-related JSON responses
*/
/** @{ */
void
insertNFTSyntheticInJson(json::Value&, std::shared_ptr<STTx const> const&, TxMeta const&);
/** @} */
} // namespace xrpl::rpc

31
include/xrpl/protocol/Protocol.h
View File

@@ -12,6 +12,7 @@
#include <chrono>
#include <cstddef>
#include <cstdint>
#include <limits>
namespace xrpl {
@@ -348,13 +349,24 @@ enum class VaultPhase : std::uint8_t {
Redemption,
};
/**
* Minimum gap between a closed-ended loan's final scheduled payment and the
* vault's RedemptionDate. LoanSet rejects a schedule whose final payment is
* fewer than this many seconds before RedemptionDate.
*/
constexpr std::uint32_t kLoanRedemptionBuffer = std::chrono::seconds{60}.count();
/**
* Bounds on the length of a closed-ended vault's Investment phase
* (RedemptionDate - SubscriptionDate). At vault creation the gap must satisfy
* kMinInvestmentPeriod <= gap < kMaxInvestmentPeriod.
*
* 180s is enough to originate a loan that uses the minimum payment interval
* and kLoanRedemptionBuffer after StartDate, which is strictly after
* SubscriptionDate. The interval and buffer need not be equal; only their
* sum plus one second must fit in this floor.
*/
constexpr std::uint32_t kMinInvestmentPeriod =
std::chrono::seconds{std::chrono::minutes{1}}.count();
constexpr std::uint32_t kMinInvestmentPeriod = std::chrono::seconds{180}.count();
// This is 946708560 seconds which 30 x 365.2425 days (the average length of a Gregorian year).
constexpr std::uint32_t kMaxInvestmentPeriod = std::chrono::seconds{std::chrono::years{30}}.count();
@@ -406,16 +418,6 @@ using TxID = uint256;
*/
constexpr std::uint16_t kMaxDeletableAmmTrustLines = 512;
/**
* The maximum number of owner-directory entries to walk when clearing
* credentials pinned to a pseudo-account, in a single transaction.
*
* The walk stops after this many entries whether or not each one turns out to
* be a credential, so a directory that also holds other objects yields fewer
* deletions per transaction.
*/
constexpr std::uint16_t kMaxDeletablePseudoAccountCredentials = 512;
/**
* The maximum length of a URI inside an Oracle
*/
@@ -553,6 +555,11 @@ constexpr std::size_t kEcClawbackProofLength = SECP256K1_COMPACT_CLAWBACK_PROOF_
*/
constexpr std::uint32_t kConfidentialFeeMultiplier = 9;
/**
* Maximum value a confidential MPT key epoch may reach.
*/
constexpr std::uint32_t kMaxKeyEpoch = std::numeric_limits<std::uint32_t>::max();
/**
* Compressed EC point prefix for even y-coordinate
*/

42
include/xrpl/protocol/STTx.h
View File

@@ -5,6 +5,7 @@
#include <xrpl/basics/base_uint.h>
#include <xrpl/json/json_value.h>
#include <xrpl/protocol/AccountID.h>
#include <xrpl/protocol/HashPrefix.h>
#include <xrpl/protocol/PublicKey.h>
#include <xrpl/protocol/Rules.h>
#include <xrpl/protocol/SField.h>
@@ -13,6 +14,7 @@
#include <xrpl/protocol/SecretKey.h>
#include <xrpl/protocol/SeqProxy.h>
#include <xrpl/protocol/Serializer.h>
#include <xrpl/protocol/Sign.h>
#include <xrpl/protocol/TxFormats.h>
#include <boost/container/flat_set.hpp>
@@ -105,14 +107,36 @@ public:
[[nodiscard]] json::Value
getJson(JsonOptions options, bool binary) const;
/**
* Sign the transaction as its account.
*
* @param publicKey The public key for signing.
* @param secretKey The secret key for signing.
*/
void
sign(PublicKey const& publicKey, SecretKey const& secretKey);
/**
* Sign the transaction in one of its signature fields.
*
* The signature is bound to the role that made it, so it cannot be moved
* into another role.
*
* @param publicKey The public key for signing.
* @param secretKey The secret key for signing.
* @param role The role signing the transaction.
* @param rules The current ledger rules.
*/
void
sign(
PublicKey const& publicKey,
SecretKey const& secretKey,
std::optional<std::reference_wrapper<SField const>> signatureTarget = {});
SignatureRole role,
Rules const& rules);
/**
* Check the signature.
*
* @param rules The current ledger rules.
* @return `true` if valid signature. If invalid, the error message string.
*/
@@ -120,7 +144,7 @@ public:
checkSign(Rules const& rules) const;
[[nodiscard]] std::expected<void, std::string>
checkBatchSign(Rules const& rules) const;
checkBatchSign() const;
// SQL Functions with metadata.
static std::string const&
@@ -162,28 +186,28 @@ public:
private:
/**
* Check the signature.
*
* @param rules The current ledger rules.
* @param sigObject Reference to object that contains the signature fields.
* Will be *this more often than not.
* @param role The role that made the signature in sigObject. Determines
* the signing prefix, which binds the signature to that role.
* @return `true` if valid signature. If invalid, the error message string.
*/
[[nodiscard]] std::expected<void, std::string>
checkSign(Rules const& rules, STObject const& sigObject) const;
checkSign(Rules const& rules, STObject const& sigObject, SignatureRole role) const;
[[nodiscard]] std::expected<void, std::string>
checkSingleSign(STObject const& sigObject) const;
checkSingleSign(STObject const& sigObject, HashPrefix prefix) const;
[[nodiscard]] std::expected<void, std::string>
checkMultiSign(Rules const& rules, STObject const& sigObject) const;
checkMultiSign(STObject const& sigObject, HashPrefix prefix) const;
[[nodiscard]] std::expected<void, std::string>
checkBatchSingleSign(STObject const& batchSigner, std::vector<uint256> const& txIds) const;
[[nodiscard]] std::expected<void, std::string>
checkBatchMultiSign(
STObject const& batchSigner,
Rules const& rules,
std::vector<uint256> const& txIds) const;
checkBatchMultiSign(STObject const& batchSigner, std::vector<uint256> const& txIds) const;
void
buildBatchTxns();

59
include/xrpl/protocol/Sign.h
View File

@@ -4,13 +4,65 @@
#include <xrpl/protocol/HashPrefix.h>
#include <xrpl/protocol/KeyType.h>
#include <xrpl/protocol/PublicKey.h>
#include <xrpl/protocol/Rules.h>
#include <xrpl/protocol/SField.h>
#include <xrpl/protocol/STObject.h>
#include <xrpl/protocol/SecretKey.h>
#include <xrpl/protocol/Serializer.h>
#include <optional>
namespace xrpl {
/**
* The signature slots on a transaction.
*
* Each role signs different bytes, so a signature cannot be moved from the
* role that made it into another role. See signingPrefix.
*/
enum class SignatureRole {
/**
* The transaction's own signature, in sfTxnSignature or sfSigners.
*/
Transaction,
/**
* The counterparty's signature, in sfCounterpartySignature.
*/
Counterparty,
/**
* The sponsor's signature, in sfSponsorSignature.
*/
Sponsor
};
/**
* The field that holds this role's signature.
*
* @return The signature field, or nullptr for SignatureRole::Transaction,
* whose signature lives at the top level of the transaction.
*/
[[nodiscard]] SField const*
signatureField(SignatureRole role);
/**
* The role that signs into the given field.
*
* @return The role, or an unseated optional if the field does not hold a
* transaction signature.
*/
[[nodiscard]] std::optional<SignatureRole>
signatureRole(SField const& sigField);
/**
* The hash prefix that binds a transaction signature to the role that made it.
*
* @param role The role making the signature.
* @param multiSigning Whether the signature is a multi-signature.
* @param rules The current ledger rules.
*/
[[nodiscard]] HashPrefix
signingPrefix(SignatureRole role, bool multiSigning, Rules const& rules);
/**
* Sign an STObject
*
@@ -49,9 +101,12 @@ verify(
/**
* Return a Serializer suitable for computing a multisigning TxnSignature.
*
* @param prefix Prefix to insert before the serialized object. Get it from
* signingPrefix, so that the signature is bound to the role making it.
*/
Serializer
buildMultiSigningData(STObject const& obj, AccountID const& signingID);
buildMultiSigningData(STObject const& obj, AccountID const& signingID, HashPrefix prefix);
/**
* Break the multi-signing hash computation into 2 parts for optimization.
@@ -67,7 +122,7 @@ buildMultiSigningData(STObject const& obj, AccountID const& signingID);
* signer's unique data.
*/
Serializer
startMultiSigningData(STObject const& obj);
startMultiSigningData(STObject const& obj, HashPrefix prefix);
inline void
finishMultiSigningData(AccountID const& signingID, Serializer& s)

7
include/xrpl/protocol/detail/features.macro
View File

@@ -15,11 +15,14 @@
// Add new amendments to the top of this list.
// Keep it sorted in reverse chronological order.
XRPL_FIX (Cleanup3_4_0, Supported::Yes, VoteBehavior::DefaultNo)
XRPL_FEATURE(SmartEscrow, Supported::No, VoteBehavior::DefaultNo)
XRPL_FEATURE(LendingProtocolV1_2, Supported::No, VoteBehavior::DefaultNo)
XRPL_FIX (Cleanup3_5_0, Supported::Yes, VoteBehavior::DefaultNo)
XRPL_FEATURE(ConfidentialMPTKeyRotation, Supported::No, VoteBehavior::DefaultNo)
XRPL_FIX (Cleanup3_4_0, Supported::Yes, VoteBehavior::DefaultNo)
XRPL_FEATURE(Sponsor, Supported::Yes, VoteBehavior::DefaultNo)
XRPL_FEATURE(BatchV1_1, Supported::Yes, VoteBehavior::DefaultNo)
XRPL_FEATURE(LendingProtocolV1_1, Supported::No, VoteBehavior::DefaultNo)
XRPL_FEATURE(LendingProtocolV1_1, Supported::Yes, VoteBehavior::DefaultNo)
XRPL_FEATURE(ConfidentialTransfer, Supported::Yes, VoteBehavior::DefaultNo)
XRPL_FIX (Cleanup3_3_0, Supported::Yes, VoteBehavior::DefaultNo)
XRPL_FIX (Cleanup3_2_0, Supported::Yes, VoteBehavior::DefaultNo)

2
include/xrpl/protocol/detail/ledger_entries.macro
View File

@@ -415,6 +415,8 @@ LEDGER_ENTRY(ltMPTOKEN_ISSUANCE, 0x007e, MPTokenIssuance, mpt_issuance, ({
{sfReferenceHolding, SoeOptional},
{sfIssuerEncryptionKey, SoeOptional},
{sfAuditorEncryptionKey, SoeOptional},
{sfIssuerKeyEpoch, SoeOptional},
{sfAuditorKeyEpoch, SoeOptional},
{sfConfidentialOutstandingAmount, SoeDefault},
}))

14
include/xrpl/protocol/detail/sfields.macro
View File

@@ -119,11 +119,15 @@ TYPED_SFIELD(sfRemainingOwnerCount, UINT32, 73)
TYPED_SFIELD(sfSponsorFlags, UINT32, 74)
TYPED_SFIELD(sfSubscriptionDate, UINT32, 75)
TYPED_SFIELD(sfRedemptionDate, UINT32, 76)
TYPED_SFIELD(sfGasLimit, UINT32, 77)
TYPED_SFIELD(sfBytecodeSizeLimit, UINT32, 78)
TYPED_SFIELD(sfGasPrice, UINT32, 79)
TYPED_SFIELD(sfGas, UINT32, 80)
TYPED_SFIELD(sfGasUsed, UINT32, 81)
TYPED_SFIELD(sfIssuerKeyEpoch, UINT32, 77)
TYPED_SFIELD(sfAuditorKeyEpoch, UINT32, 78)
TYPED_SFIELD(sfIssuerKeyMirrorEpoch, UINT32, 79)
TYPED_SFIELD(sfAuditorKeyMirrorEpoch, UINT32, 80)
TYPED_SFIELD(sfGasLimit, UINT32, 81)
TYPED_SFIELD(sfBytecodeSizeLimit, UINT32, 82)
TYPED_SFIELD(sfGasPrice, UINT32, 83)
TYPED_SFIELD(sfGas, UINT32, 84)
TYPED_SFIELD(sfGasUsed, UINT32, 85)
// 64-bit integers (common)
TYPED_SFIELD(sfIndexNext, UINT64, 1)

2
include/xrpl/protocol/detail/transactions.macro
View File

@@ -72,7 +72,7 @@ TRANSACTION(ttESCROW_CREATE, 1, EscrowCreate, ({.delegable = Delegation::Delegab
{sfCancelAfter, SoeOptional},
{sfFinishAfter, SoeOptional},
{sfBytecode, SoeOptional},
{sfData, SoeOptional},
{sfData, SoeOptional},
}))
/** This transaction type completes an existing escrow. */

70
include/xrpl/protocol_autogen/ledger_entries/MPTokenIssuance.h
View File

@@ -351,6 +351,54 @@ public:
return this->sle_->isFieldPresent(sfAuditorEncryptionKey);
}
/**
* @brief Get sfIssuerKeyEpoch (SoeOptional)
* @return The field value, or std::nullopt if not present.
*/
[[nodiscard]]
protocol_autogen::Optional<SF_UINT32::type::value_type>
getIssuerKeyEpoch() const
{
if (hasIssuerKeyEpoch())
return this->sle_->at(sfIssuerKeyEpoch);
return std::nullopt;
}
/**
* @brief Check if sfIssuerKeyEpoch is present.
* @return True if the field is present, false otherwise.
*/
[[nodiscard]]
bool
hasIssuerKeyEpoch() const
{
return this->sle_->isFieldPresent(sfIssuerKeyEpoch);
}
/**
* @brief Get sfAuditorKeyEpoch (SoeOptional)
* @return The field value, or std::nullopt if not present.
*/
[[nodiscard]]
protocol_autogen::Optional<SF_UINT32::type::value_type>
getAuditorKeyEpoch() const
{
if (hasAuditorKeyEpoch())
return this->sle_->at(sfAuditorKeyEpoch);
return std::nullopt;
}
/**
* @brief Check if sfAuditorKeyEpoch is present.
* @return True if the field is present, false otherwise.
*/
[[nodiscard]]
bool
hasAuditorKeyEpoch() const
{
return this->sle_->isFieldPresent(sfAuditorKeyEpoch);
}
/**
* @brief Get sfConfidentialOutstandingAmount (SoeDefault)
* @return The field value, or std::nullopt if not present.
@@ -600,6 +648,28 @@ public:
return *this;
}
/**
* @brief Set sfIssuerKeyEpoch (SoeOptional)
* @return Reference to this builder for method chaining.
*/
MPTokenIssuanceBuilder&
setIssuerKeyEpoch(std::decay_t<typename SF_UINT32::type::value_type> const& value)
{
object_[sfIssuerKeyEpoch] = value;
return *this;
}
/**
* @brief Set sfAuditorKeyEpoch (SoeOptional)
* @return Reference to this builder for method chaining.
*/
MPTokenIssuanceBuilder&
setAuditorKeyEpoch(std::decay_t<typename SF_UINT32::type::value_type> const& value)
{
object_[sfAuditorKeyEpoch] = value;
return *this;
}
/**
* @brief Set sfConfidentialOutstandingAmount (SoeDefault)
* @return Reference to this builder for method chaining.

10
include/xrpl/tx/Transactor.h
View File

@@ -259,6 +259,13 @@ public:
static XRPAmount
calculateBaseFee(ReadView const& view, STTx const& tx, std::uint32_t extraBaseFeeMultiplier);
// Exposed for invariant checks (e.g. ValidVault) that need to know which
// ledger entry actually pays a transaction's fee, distinguishing an
// ordinary sender, a delegate, and pre-funded vs. co-signed fee
// sponsorship.
static FeePayer
getFeePayer(ReadView const& view, STTx const& tx);
/* Do NOT define an invokePreflight function in a derived class.
Instead, define:
@@ -525,9 +532,6 @@ private:
std::pair<TER, XRPAmount>
reset(XRPAmount fee);
static FeePayer
getFeePayer(ReadView const& view, STTx const& tx);
TER
consumeSeqProxy(SLE::pointer const& sleAccount);
TER

14
include/xrpl/tx/invariants/LoanBrokerInvariant.h
View File

@@ -19,6 +19,11 @@ namespace xrpl {
* 1. If `LoanBroker.OwnerCount = 0` the `DirectoryNode` will have at most one
* node (the root), which will only hold entries for `RippleState` or
* `MPToken` objects.
* 2. Under featureLendingProtocolV1_1, an `ltLOAN_BROKER` may only be deleted
* by a `ttLOAN_BROKER_DELETE` transaction, and only when its pre-state
* `OwnerCount` is zero and its pre-state `DebtTotal` rounds to zero at the
* vault's `AssetsTotal` scale, as `LoanBrokerDelete::preclaim` requires.
* 3. At most one `ltLOAN_BROKER` may be deleted in a single transaction.
*
*/
class ValidLoanBroker
@@ -36,6 +41,15 @@ class ValidLoanBroker
// pseudo-accounts. Key is the brokerID / index. It will be used to find the
// LoanBroker object if brokerBefore and brokerAfter are nullptr
std::map<uint256, BrokerInfo> brokers_;
// The broker whose ledger entry was deleted by this transaction, if any.
// Only ttLOAN_BROKER_DELETE removes a broker, and it removes exactly one.
// This is the pre-transaction state, which is what LoanBrokerDelete::preclaim
// reads when it decides whether the broker may be deleted, so the deletion invariants inspect
// the same DebtTotal and OwnerCount that the transactor did.
SLE::const_pointer deletedBroker_ = nullptr;
// Set if visitEntry observes more than one ltLOAN_BROKER deletion in the
// same transaction. Enforced as its own invariant in finalize.
bool multipleBrokerDeletions_ = false;
// Collect all the modified trust lines. Their high and low accounts will be
// loaded to look for LoanBroker pseudo-accounts.
std::vector<SLE::const_pointer> lines_;

29
include/xrpl/tx/invariants/LoanInvariant.h
View File

@@ -15,9 +15,33 @@ namespace xrpl {
/**
* @brief Invariants: Loans are internally consistent
*
* 1. If `Loan.PaymentRemaining = 0` then `Loan.PrincipalOutstanding = 0`
* 1. If `Loan.PaymentRemaining = 0` then `Loan.PrincipalOutstanding = 0`.
* 2. A newly-created Loan against a closed-ended vault must satisfy
* `StartDate + PaymentInterval * PaymentRemaining < Vault.RedemptionDate`.
* 3. An `ltLOAN` may only be created by a `ttLOAN_SET` transaction.
* 4. Prior to `featureLendingProtocolV1_1`, the `lsfLoanOverpayment` flag on a
* Loan must not change. From `featureLendingProtocolV1_1` onward the same
* rule is enforced by `NoModifiedUnmodifiableFields`.
* 5. Under `featureLendingProtocolV1_1`:
* a. An `ltLOAN` may only be deleted by a `ttLOAN_DELETE` transaction.
* b. If `Loan.PaymentRemaining = 0` then `Loan.NextPaymentDueDate = 0`.
* c. The `lsfLoanImpaired` flag may only change through a `ttLOAN_MANAGE`
* or `ttLOAN_PAY` transaction.
* d. The `lsfLoanDefault` flag may only change through a `ttLOAN_MANAGE`
* transaction. Combined with `NoModifiedUnmodifiableFields`, which
* rejects any clearing of `lsfLoanDefault`, this makes the flag
* write-once: `ttLOAN_MANAGE` may set it, and no transaction may
* clear it.
* e. Interest due, computed as `TotalValueOutstanding -
* PrincipalOutstanding - ManagementFeeOutstanding`, must not be
* negative.
* f. A Loan must reference a live `ltLOAN_BROKER`, and that broker must
* reference a live `ltVAULT`.
* g. Post-conditions for the Loan paid down by a successful `ttLOAN_PAY`:
* `PaymentRemaining > 0` after: `PrincipalOutstanding` and
* `PaymentRemaining` strictly decrease; `NextPaymentDueDate`
* advances by N * `PaymentInterval`, N > 0.
* `PaymentRemaining == 0` after: pinned by checks 1 and 5b.
*
*/
class ValidLoan
@@ -25,6 +49,9 @@ class ValidLoan
// Pair is <before, after>. After is used for most of the checks, except
// those that check changed values.
std::vector<std::pair<SLE::const_pointer, SLE::const_pointer>> loans_;
// Loans removed from the ledger, in the same <before, after> form as loans_.
// Note that `after` holds the erased entry, so it is not null.
std::vector<std::pair<SLE::const_pointer, SLE::const_pointer>> deletedLoans_;
public:
void

7
include/xrpl/tx/invariants/MPTInvariant.h
View File

@@ -215,6 +215,13 @@ class ValidMPTTransfer
// Deleted MPToken
// MPToken key: true if MPTAuthorized is set
hash_map<uint256, bool> deletedAuthorized_;
// Every touched AccountRoot (not only pseudos):
// AccountID -> whether it was a pseudo-account BEFORE this transaction
// applied. Needed because a transaction may erase a pseudo-account and
// move MPT out of it in the same transaction; by finalize() time the
// view no longer shows it as a pseudo-account (or as existing at all).
// False entries freeze the pre-tx classification for touched non-pseudos.
hash_map<AccountID, bool> pseudoAccountsBefore_;
public:
/**

64
include/xrpl/tx/invariants/VaultInvariant.h
View File

@@ -48,7 +48,10 @@ namespace xrpl {
* vault phase is Investment
*
* Immutability of VaultKind, SubscriptionDate and RedemptionDate is enforced
* by NoModifiedUnmodifiableFields (see InvariantCheck.cpp).
* by NoModifiedUnmodifiableFields (see InvariantCheck.cpp). From
* featureLendingProtocolV1_1 onwards, immutability of the vault's Asset,
* pseudo-account and ShareMPTID is likewise enforced by
* NoModifiedUnmodifiableFields; prior to that amendment it is checked here.
*/
class ValidVault
{
@@ -128,20 +131,57 @@ private:
deltaAssets(AccountID const& id) const;
/**
* @brief Return the vault-asset delta for the transaction's sending
* account, adjusted for the fee.
* @brief Return the AccountRoot whose XRP balance actually absorbed a
* transaction's fee, if any.
*
* Calls @c deltaAssets for @c tx[sfAccount] and, for non-delegated XRP
* transactions, adds the consumed fee back so the invariant sees the net
* asset movement rather than the fee-reduced balance change.
* Mirrors @c Transactor::getFeePayer, but resolves to @c std::nullopt for
* a pre-funded sponsorship: that fee is drawn from the @c ltSponsorship
* object's @c sfFeeAmount, never from the sponsor's own AccountRoot, so
* there is no balance to add back there.
*
* @param tx The transaction being applied.
* @param fee Fee charged by this transaction.
* @param view Read-only view of the ledger after the transaction.
* @param tx The transaction being applied.
* @return The fee-paying AccountRoot's id, or @c std::nullopt when the
* fee was not drawn from any AccountRoot balance.
*/
[[nodiscard]] static std::optional<AccountID>
feePayerAccountRoot(ReadView const& view, STTx const& tx);
/**
* @brief Return the vault-asset delta for a party inspected as a
* withdrawal/deposit counterparty, adjusted for the fee.
*
* Calls @c deltaAssets for @p id and, for XRP transactions, adds the
* consumed fee back only when @p id is the AccountRoot that actually
* paid it (per @c feePayerAccountRoot) -- so the invariant sees the net
* asset movement rather than a fee-reduced balance change, regardless of
* whether @p id is the sender, a distinct destination, a delegate, or a
* co-signed fee sponsor. Post-@c fixCleanup3_4_0, any resulting
* economically-zero delta is always normalized to absence.
*
* Pre-@c fixCleanup3_4_0 this replicates the legacy behaviour exactly:
* only @c tx[sfAccount] could ever receive a fee correction (and only
* when it was itself, per @c STTx::getFeePayerID, the fee payer). After
* that sender-only correction a zero delta is collapsed to absence; if
* the correction does not apply, a present-zero delta is kept as-is.
*
* @param view Read-only view of the ledger after the transaction.
* @param id Account being inspected as sender or destination.
* @param tx The transaction being applied.
* @param fee Fee charged by this transaction.
* @param fix340Enabled Whether @c fixCleanup3_4_0 is enabled, as already
* determined once by @c finalize.
* @return The fee-adjusted delta, or @c std::nullopt if the net delta is
* zero or the account entry was not touched.
* zero (always post-amendment; pre-amendment only after the
* sender-only fee correction) or the entry was not touched.
*/
[[nodiscard]] std::optional<DeltaInfo>
deltaAssetsTxAccount(STTx const& tx, XRPAmount fee) const;
deltaAssetsForParty(
ReadView const& view,
AccountID const& id,
STTx const& tx,
XRPAmount fee,
bool fix340Enabled) const;
/**
* @brief Return the vault-share balance-change delta for an account.
@@ -171,8 +211,8 @@ private:
*
* For a closed-ended vault, a loan may only be originated while the vault is in the Investment
* phase (strictly past @c SubscriptionDate and before @c RedemptionDate). Open-ended vaults (@c
* NoPhase) are unaffected. The complementary maturity bound (final payment strictly precedes @c
* RedemptionDate) is enforced by @c ValidLoan.
* NoPhase) are unaffected. The complementary maturity bound (final payment precedes @c
* RedemptionDate by at least @c kLoanRedemptionBuffer) is enforced by @c ValidLoan.
*/
[[nodiscard]] bool
finalizeLoanSet(ReadView const& view, beast::Journal const& j) const;

12
include/xrpl/tx/transactors/dex/AMMWithdraw.h
View File

@@ -109,6 +109,11 @@ public:
* @param lpTokens current LPT balance
* @param lpTokensWithdraw amount of tokens to withdraw
* @param tfee trading fee in basis points
* @param freezeHandling whether a frozen balance is reported as zero
* @param authHandling whether an unauthorized MPT balance is reported as
* zero
* @param reserveHandling whether the recipient owner-reserve check is
* enforced when a trustline or MPToken has to be auto-created
* @param withdrawAll if withdrawing all lptokens
* @param priorBalance balance before fees
* @return
@@ -128,6 +133,7 @@ public:
std::uint16_t tfee,
FreezeHandling freezeHandling,
AuthHandling authHandling,
ReserveHandling reserveHandling,
WithdrawAll withdrawAll,
XRPAmount const& priorBalance,
beast::Journal const& journal);
@@ -150,6 +156,11 @@ public:
* @param lpTokensAMMBalance current AMM LPT balance
* @param lpTokensWithdraw amount of lptokens to withdraw
* @param tfee trading fee in basis points
* @param freezeHandling whether a frozen balance is reported as zero
* @param authHandling whether an unauthorized MPT balance is reported as
* zero
* @param reserveHandling whether the recipient owner-reserve check is
* enforced when a trustline or MPToken has to be auto-created
* @param withdrawAll if withdraw all lptokens
* @param priorBalance balance before fees
* @return
@@ -169,6 +180,7 @@ public:
std::uint16_t tfee,
FreezeHandling freezeHandling,
AuthHandling authHandling,
ReserveHandling reserveHandling,
WithdrawAll withdrawAll,
XRPAmount const& priorBalance,
beast::Journal const& journal);

5
nix/check-tools/macos.txt
View File

@@ -131,6 +131,9 @@ Rust toolchain:
✅ rust-analyzer
rust-analyzer 1.97.1 (8bab26f4 2026-07-14)
/nix/store/j6apc5pmd0giy15da9p650r8zklslmvi-rust-analyzer-preview-1.97.1-aarch64-apple-darwin/bin/rust-analyzer
✅ rust-nightly
rustc 1.99.0-nightly (87e5904f5 2026-07-20)
/nix/store/fqpjz4l0nsnji8b2pz57mnj0akbp6hcl-rust-nightly/bin/rust-nightly
✅ rustc
rustc 1.97.1 (8bab26f4f 2026-07-14)
/nix/store/bnfk1sl4s9angb0vj1cj9a5y5zvqinwy-rust-minimal-1.97.1/bin/rustc
@@ -140,4 +143,4 @@ Rust toolchain:
Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
✅ All 44 checked tools are present and runnable.
✅ All 45 checked tools are present and runnable.

5
nix/check-tools/nix-ubuntu-amd64.txt
View File

@@ -131,6 +131,9 @@ Rust toolchain:
✅ rust-analyzer
rust-analyzer 1.97.1 (8bab26f 2026-07-14)
/nix/store/lr3m97p3hx1k22a7c44pb0wa7rbayhfi-rust-analyzer-preview-1.97.1-x86_64-unknown-linux-gnu/bin/rust-analyzer
✅ rust-nightly
rustc 1.99.0-nightly (87e5904f5 2026-07-20)
/nix/store/j7kf7a5h4xypzp6x1skg4dsdx2k4fwb3-rust-nightly/bin/rust-nightly
✅ rustc
rustc 1.97.1 (8bab26f4f 2026-07-14)
/nix/store/40d3mzka7r1ps71l0yv2fs6616nbw85m-rust-minimal-1.97.1/bin/rustc
@@ -168,4 +171,4 @@ Mold:
Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
✅ All 52 checked tools are present and runnable.
✅ All 53 checked tools are present and runnable.

5
nix/check-tools/nix-ubuntu-arm64.txt
View File

@@ -131,6 +131,9 @@ Rust toolchain:
✅ rust-analyzer
rust-analyzer 1.97.1 (8bab26f 2026-07-14)
/nix/store/262830dlw2517lnagfx7i7agqgl4fmsd-rust-analyzer-preview-1.97.1-aarch64-unknown-linux-gnu/bin/rust-analyzer
✅ rust-nightly
rustc 1.99.0-nightly (87e5904f5 2026-07-20)
/nix/store/c59pxk1yikdlf129qwyg4fplmxcrha0k-rust-nightly/bin/rust-nightly
✅ rustc
rustc 1.97.1 (8bab26f4f 2026-07-14)
/nix/store/a6p27cg6b8szfixfyvkssx6l0c345zw8-rust-minimal-1.97.1/bin/rustc
@@ -168,4 +171,4 @@ Mold:
Skipping git-over-HTTPS check (CHECK_TOOLS_SKIP_CLONE is set).
✅ All 52 checked tools are present and runnable.
✅ All 53 checked tools are present and runnable.

2
nix/docker/Dockerfile
View File

@@ -10,6 +10,8 @@ RUN mkdir -p ~/.config/nix && \
COPY nix/ci-env.nix /tmp/build/nix/ci-env.nix
COPY nix/linux.nix /tmp/build/nix/linux.nix
COPY nix/packages.nix /tmp/build/nix/packages.nix
COPY nix/rust-nightly.sh /tmp/build/nix/rust-nightly.sh
COPY nix/rust.nix /tmp/build/nix/rust.nix
COPY nix/utils.nix /tmp/build/nix/utils.nix
COPY flake.nix /tmp/build/
COPY flake.lock /tmp/build/

89
nix/packages.nix
View File

@@ -16,23 +16,7 @@ let
exec ${pkgs.python3}/bin/python3 ${llvmPackages.clang-unwrapped}/bin/run-clang-tidy "$@"
'';
# rust-overlay's toolchain propagates the *default* stdenv.cc onto the PATH (so
# cargo has a linker). That default may be different from the clang we pin here,
# so it shadows our clang and the build can silently use a different compiler
# version. Drop that cc from every propagation channel instead of pinning a
# replacement: the toolchain then carries no compiler and cargo just uses the
# active shell's stdenv cc. Must cover all channels — rust-overlay uses both
# propagatedBuildInputs and depsHostHostPropagated.
rustToolchainBase = pkgs.rust-bin.fromRustupToolchainFile ../rust-toolchain.toml;
rustToolchain =
let
defaultCc = pkgs.stdenv.cc; # default compiler from nixpkgs stdenv
withoutDefaultCc = builtins.filter (dep: (dep.outPath or "") != defaultCc.outPath);
in
rustToolchainBase.overrideAttrs (old: {
propagatedBuildInputs = withoutDefaultCc (old.propagatedBuildInputs or [ ]);
depsHostHostPropagated = withoutDefaultCc (old.depsHostHostPropagated or [ ]);
});
rust = import ./rust.nix { inherit pkgs; };
# Nix wraps its toolchain so that binaries are exposed only under unsuffixed
# names (gcc, g++, clang-tidy, ...). Several tools probe for a
@@ -108,41 +92,38 @@ in
mkGcov
;
commonPackages = with pkgs; [
clangToolLinks
runClangTidyLink
ccache
clangbuildanalyzer
clangTools
cmake
conan
curlMinimal # needed for codecov/codecov-action
doxygen
file # needed for cpack in Clio
gcovr
gh
git
git-cliff
git-lfs
gnumake
gnupg # needed for signing commits & codecov/codecov-action
graphviz
less # needed for git diff
mold
nettools # provides netstat, used to debug failures in CI
ninja
patchelf
perl # needed for openssl
pkg-config
pre-commit
python3
runClangTidy
vim
zip
# Rust packages
cargo-audit
cargo-llvm-cov
cargo-nextest
rustToolchain
];
commonPackages =
(with pkgs; [
clangToolLinks
runClangTidyLink
ccache
clangbuildanalyzer
clangTools
cmake
conan
curlMinimal # needed for codecov/codecov-action
doxygen
file # needed for cpack in Clio
gcovr
gh
git
git-cliff
git-lfs
gnumake
gnupg # needed for signing commits & codecov/codecov-action
graphviz
less # needed for git diff
mold
nettools # provides netstat, used to debug failures in CI
ninja
patchelf
perl # needed for openssl
pkg-config
pre-commit
python3
runClangTidy
vim
zip
])
++ rust.packages;
}

23
nix/rust-nightly.sh Normal file
View File

@@ -0,0 +1,23 @@
#!@runtimeShell@
# Reaches the nightly Rust toolchain, which is deliberately kept off PATH.
# Packaged by nix/rust.nix, which explains why.
set -euo pipefail
usage() {
echo "usage: rust-nightly (path | run <command>...)" >&2
exit 2
}
case "${1-}" in
path) printf '%s\n' "@rustNightlyBin@" ;;
run)
shift
if [[ $# -eq 0 ]]; then
usage
fi
export PATH="@rustNightlyBin@:${PATH}"
exec "$@"
;;
*) usage ;;
esac

84
nix/rust.nix Normal file
View File

@@ -0,0 +1,84 @@
# The Rust half of the tool set shared by the CI environment and the dev shell:
# the stable toolchain pinned by rust-toolchain.toml, the nightly the Rust
# coverage job needs, and the cargo plugins. Consumed by packages.nix.
{ pkgs }:
let
# rust-overlay's toolchain propagates the *default* stdenv.cc onto the PATH (so
# cargo has a linker). That default may be different from the clang we pin
# elsewhere, so it shadows our clang and the build can silently use a different
# compiler version. Drop that cc from every propagation channel instead of
# pinning a replacement: the toolchain then carries no compiler and cargo just
# uses the active shell's stdenv cc.
#
# The channel list is every list mkDerivation propagates to a dependent's
# environment (including the two legacy aliases). rust-overlay currently only
# uses propagatedBuildInputs and depsHostHostPropagated, but covering all of
# them means an upstream switch to another channel cannot quietly put the
# compiler back on PATH.
dropDefaultCc =
toolchain:
let
defaultCc = pkgs.stdenv.cc; # default compiler from nixpkgs stdenv
withoutDefaultCc = builtins.filter (dep: (dep.outPath or "") != defaultCc.outPath);
in
toolchain.overrideAttrs (
old:
pkgs.lib.genAttrs [
"depsBuildBuildPropagated"
"propagatedNativeBuildInputs" # alias of depsBuildHostPropagated
"depsBuildTargetPropagated"
"depsHostHostPropagated"
"propagatedBuildInputs" # alias of depsHostTargetPropagated
"depsTargetTargetPropagated"
] (channel: withoutDefaultCc (old.${channel} or [ ]))
);
rustToolchain = dropDefaultCc (pkgs.rust-bin.fromRustupToolchainFile ../rust-toolchain.toml);
# cargo-llvm-cov honours the #[coverage(off)] that keeps unit tests out of the
# coverage report only under a nightly rustc, and looks for llvm-profdata and
# llvm-cov in that same toolchain's sysroot — hence llvm-tools-preview.
#
# Not every nightly ships every component, so `nightly.latest` breaks on the
# days llvm-tools-preview is absent; selectLatestNightlyWith walks back to the
# newest one that has it. The result is the newest such nightly *known to the
# locked rust-overlay*, which means updating flake.lock moves the compiler that
# produces the coverage numbers — and with it the rustc version recorded in
# nix/check-tools/*.txt, so those snapshots need regenerating alongside.
rustNightly = dropDefaultCc (
pkgs.rust-bin.selectLatestNightlyWith (
toolchain: toolchain.minimal.override { extensions = [ "llvm-tools-preview" ]; }
)
);
# A second toolchain cannot go on PATH: its cargo and rustc would collide with
# the pinned stable's in the ci-env buildEnv, which resolves collisions by
# picking one silently. Reaching the nightly only through this wrapper keeps it
# in the image closure (the Docker build copies the whole closure, not just
# what is linked into /bin) while leaving it inactive everywhere that does not
# ask for it.
#
# The script's `path` subcommand exists for scopes wider than one command — a
# CI job appending to $GITHUB_PATH, so that the cargo cache action's own
# `rustc -vV` probe, which runs in a step of its own, agrees with the toolchain
# the build will use.
rustNightlyScript = pkgs.replaceVarsWith {
name = "rust-nightly";
src = ./rust-nightly.sh;
dir = "bin";
isExecutable = true;
replacements = {
inherit (pkgs) runtimeShell;
rustNightlyBin = "${rustNightly}/bin";
};
};
in
{
packages = [
pkgs.cargo-audit
pkgs.cargo-llvm-cov
pkgs.cargo-nextest
rustNightlyScript
rustToolchain
];
}

7
package/Dockerfile
View File

@@ -1,7 +0,0 @@
ARG BASE_IMAGE=debian:bookworm
FROM ${BASE_IMAGE}
COPY package/install-packaging-tools.sh /tmp/install-packaging-tools.sh
RUN /tmp/install-packaging-tools.sh

108
package/README.md
View File

@@ -10,10 +10,12 @@ a build configured with `-Dvalidator_keys=ON`.
package/
build_pkg.py Staging and build script (called by the CMake `package` target and CI)
sign_rpm.py Signs the built RPMs (called by CI when publishing)
publish_pkg.py Uploads built packages to the XRPLF Nexus repositories (called by CI)
docker/
Dockerfile Packaging image, built by `build-packaging-images.yml`; installs its tooling with `bin/install-packaging-tools.sh`
publish_pkg.py Uploads built packages to the XRPLF Nexus repositories (called by CI, and shipped in that image)
rpm/
xrpld.spec RPM spec
debian/ Debian control files (control, rules, copyright, xrpld.docs, xrpld.links, source/format)
debian/ Debian control files (control, rules, copyright, xrpld.docs, xrpld.links, xrpld.lintian-overrides, source/format)
shared/
xrpld.service systemd unit file (used by both RPM and DEB)
xrpld.sysusers sysusers.d config (used by both RPM and DEB)
@@ -32,10 +34,10 @@ image and both CI and local builds pick it up — and names the format that imag
builds in `type`, which CI passes to `build_pkg.py` as `--package-type`; the two
have to stay in step.
| Package type | Image (`configs.<distro>[].package.image` in `linux.json`) | Tools required |
| ------------ | ---------------------------------------------------------- | --------------------------------------------------- |
| RPM | `ghcr.io/xrplf/xrpld/packaging-rhel:sha-<sha>` | `rpmbuild`, `rpmsign` |
| DEB | `ghcr.io/xrplf/xrpld/packaging-debian:sha-<sha>` | `dpkg-buildpackage`, debhelper with compat level 13 |
| Package type | Image (`configs.<distro>[].package.image` in `linux.json`) | Tools required |
| ------------ | ---------------------------------------------------------- | -------------------------------------------------------------- |
| RPM | `ghcr.io/xrplf/xrpld/packaging-rhel:sha-<sha>` | `rpmbuild`, `rpmsign` |
| DEB | `ghcr.io/xrplf/xrpld/packaging-debian:sha-<sha>` | `dpkg-buildpackage`, debhelper with compat level 13, `lintian` |
To print the full packaging matrix (artifact names and images) for the current
`linux.json`:
@@ -49,13 +51,19 @@ To print the full packaging matrix (artifact names and images) for the current
### Via CI
Caller workflows (`on-pr.yml`, `on-tag.yml`, `on-trigger.yml`) call
`reusable-package.yml`. That workflow generates its own packaging matrix from
the configs that carry a `package` map (via `generate.py --packaging`) and fans
out one job per distro. Each job downloads the pre-built `xrpld` and
`validator-keys` binary artifacts and runs in that distro's container, building
the format `package.type` declares. The packaging script derives the package
version from the downloaded binary's `xrpld --version` output; no CMake
configure or build step is needed inside the packaging job.
`reusable-package.yml`, which runs in three stages:
1. `package` fans out one job per config carrying a `package` map, building and
signing in that config's container, and uploading `<config>-pkg` alongside
`<config>-pkg-debug` for the much larger debug symbols.
2. `test-install` installs `<config>-pkg` in the container of every distro the
packages target and runs the binaries there, so one that cannot be installed
never reaches Nexus.
3. `publish` uploads both artifacts, or lists what it would upload.
The packaging script derives the package version from the downloaded binary's
`xrpld --version` output; no CMake configure or build step is needed inside the
packaging job.
The binaries come from the `debian` and `rhel` build configs themselves — the
ones carrying the `package` map — which pass `-Dvalidator_keys=ON` so that the
@@ -92,8 +100,7 @@ docker run --rm \
--pkg-release "${PKG_RELEASE}" \
--channel UNRELEASED
# Output:
# build/debbuild/*.deb (DEB + dbgsym; Debian names both .deb)
# Output (the deb image writes build/debbuild/*.deb instead):
# build/rpmbuild/RPMS/x86_64/*.rpm
```
@@ -147,15 +154,21 @@ Versions sort in row order, so moving to a more mature channel never downgrades.
The action decides the package release number on the same split: a tag's version
is unique, so its packages are release 1, while develop repeats the same version
and takes `github.run_number` so each push supersedes the last. Both reach the
packaging scripts as arguments, so neither script derives anything itself.
and takes `<run number>.<commit date>git<commit hash>`, e.g.
`857.20260826gitb6a8995` — the leading run number keeps each push superseding
the last, and the date and hash say which commit a package on
`packages.xrplf.org` came from. Both reach the packaging scripts as arguments,
so neither script derives anything itself.
Publishing is the last step of each packaging job, uploading from the container
that built the packages. It runs when the caller passes `publish: true`:
`on-trigger.yml` for develop pushes in `XRPLF/rippled`, `on-tag.yml` for tags in
any `XRPLF` repository, `on-pr.yml` never. Both authenticate with the
Publishing is its own job, gated behind `test-install`, uploading from the same
image that built the packages with the `publish_pkg.py` shipped in it — the
same copy other repositories run. Without `publish: true` the job is a
`--dry-run`, listing the uploads it would make without needing credentials, so
any run that builds packages also exercises the upload routing. `on-trigger.yml`
passes `publish: true` for develop pushes in `XRPLF/rippled` and `on-tag.yml`
for tags in any `XRPLF` repository, both authenticating with the
`NEXUS_REMOTE_USERNAME` / `NEXUS_REMOTE_PASSWORD` secrets already used for the
Conan remote.
Conan remote; `on-pr.yml` never publishes.
Nexus owns the repository metadata; nothing here indexes anything. Worth knowing:
@@ -176,6 +189,12 @@ Nexus owns the repository metadata; nothing here indexes anything. Worth knowing
- The `develop` repositories gain a package per push, so they need a cleanup
policy to stay bounded; tagged channels publish each version once.
### Publishing from other repositories
`publish_pkg.py` knows nothing about `xrpld`, so the packaging image
installs it at `/usr/local/bin/publish_pkg.py` for other XRPLF repositories that
build their packages elsewhere.
## How `build_pkg.py` works
`build_pkg.py` derives the `xrpld` software version from
@@ -188,6 +207,9 @@ the final release. If that normalized package version still contains `-`,
packaging fails because RPM forbids `-` in `Version`, and Debian uses `-` as
the upstream/revision separator.
> [!NOTE]
> Debug and sanitizer builds are not packaged yet.
`pkg_version` is the normalized package metadata version derived inside
`build_pkg.py` from the binary-reported `xrpld` version (`-` pre-release
separator converted to `~`). It is not a separate user input.
@@ -265,37 +287,45 @@ service restart.
2. Stages the binaries, configs, `README.md`, `LICENSE.md`, and
`validator-keys-LICENSE`.
3. Copies `package/debian/` control files into `debbuild/source/debian/`.
4. Copies shared service/sysusers/tmpfiles into `debian/` where `dh_installsystemd`, `dh_installsysusers`, and `dh_installtmpfiles` pick them up automatically.
4. Copies shared service/sysusers/tmpfiles/logrotate into `debian/` where `dh_installsystemd`, `dh_installsysusers`, `dh_installtmpfiles` and `dh_installlogrotate` pick them up automatically.
5. Generates a minimal `debian/changelog` using `${pkg_version}-${PKG_RELEASE}`,
where `pkg_version` is derived from the binary-reported `xrpld` version.
6. Runs `dpkg-buildpackage -b --no-sign -d` (`-d` skips the build-dependency check, since the binary is already built). `debian/rules` uses manual `install` commands.
It also rewrites the `libc6` bound to `LIBC_MIN` in `debian/rules`, the glibc
the Nix toolchain builds against. `dpkg-shlibdeps` would otherwise derive it
from the build host's symbols file — on trixie that yields `libc6 (>= 2.34)`
because of `sysconf`, locking out distros the binaries run on. A check fails
the build if either binary outgrows `LIBC_MIN`.
7. Output: `debbuild/*.deb`, the binary package and the `-dbgsym` package.
Debian gives dbgsym packages a `.deb` extension; only Ubuntu uses `.ddeb`.
## Post-build verification
```bash
# DEB
dpkg-deb -c debbuild/*.deb | grep -E 'systemd|sysusers|tmpfiles'
# DEB (one invocation per package: the dbgsym package is a .deb too)
for deb in debbuild/*.deb; do dpkg-deb -c "${deb}"; done | grep -E 'systemd|sysusers|tmpfiles'
lintian -I debbuild/*.deb
# RPM
rpm -qlp rpmbuild/RPMS/x86_64/*.rpm
# Optional, and not in the packaging image: apt-get install -y lintian
lintian -I debbuild/*.deb
```
`lintian` still reports `embedded-library zlib`, `no-manual-page` and
`initial-upload-closes-no-bugs`; only the `/usr/local` tags are overridden.
## Reproducibility
`build_pkg.py` sets `SOURCE_DATE_EPOCH` from the latest git commit time and
exports it; the RPM spec clamps file modification times to it via
`%build_mtime_policy`. The remaining variables
below further improve reproducibility but are _not_ set by the script — export
them yourself if needed:
Both formats build reproducibly as they are: the same binaries at the same
commit give byte-identical packages on a rebuild, and nothing has to be
exported by hand.
```bash
export TZ=UTC
export LC_ALL=C.UTF-8
export GZIP=-n
export DEB_BUILD_OPTIONS="noautodbgsym reproducible=+fixfilepath"
```
`build_pkg.py` sets `SOURCE_DATE_EPOCH` from the latest git commit time.
`dpkg-buildpackage` honours it on its own; the RPM spec sets three macros:
- `%clamp_mtime_to_source_date_epoch` — file modification times, from
`SOURCE_DATE_EPOCH`.
- `%use_source_date_epoch_as_buildtime` — the `BUILDTIME` header, from the
same.
- `%_buildhost` — pinned, so the builder's hostname stays out of the header.

16
package/build_pkg.py
View File

@@ -19,7 +19,7 @@ from pathlib import Path
# This script lives in the repository it packages.
SRC_DIR = Path(__file__).resolve().parents[1]
PRE_RELEASE = re.compile(r"^(b0|b[1-9][0-9]*|rc[0-9]+)(\+.*)?$")
PRE_RELEASE = re.compile(r"^(b|rc)(0|[1-9][0-9]*)(\+.*)?$")
# Files both packaging systems consume, staged under the same names.
STAGED_FROM_BUILD = ("xrpld", "validator-keys", "validator-keys-LICENSE")
@@ -133,6 +133,14 @@ def stage_common(build_dir: Path, dest: Path) -> None:
shutil.copy2(build_dir / name, dest / name)
for source, name in STAGED_FROM_SRC.items():
shutil.copy2(SRC_DIR / source, dest / name)
def stage_units(dest: Path) -> None:
"""Copy the systemd, sysusers, tmpfiles and logrotate files into dest.
Each format wants them somewhere else: rpmbuild reads them from SOURCES,
debhelper from debian/.
"""
for name in STAGED_UNITS:
shutil.copy2(SRC_DIR / "package" / "shared" / name, dest / name)
@@ -146,6 +154,7 @@ def build_rpm(build_dir: Path, *, version: str, pkg_release: str) -> None:
spec = topdir / "SPECS" / "xrpld.spec"
shutil.copy2(SRC_DIR / "package" / "rpm" / "xrpld.spec", spec)
stage_common(build_dir, topdir / "SOURCES")
stage_units(topdir / "SOURCES")
run(
"rpmbuild",
@@ -178,8 +187,7 @@ def build_deb(
shutil.copytree(SRC_DIR / "package" / "debian", staging / "debian")
# debhelper picks these up from debian/ automatically.
for name in STAGED_UNITS:
shutil.copy2(staging / name, staging / "debian" / name)
stage_units(staging / "debian")
date = datetime.fromtimestamp(epoch, timezone.utc).strftime(
"%a, %d %b %Y %H:%M:%S %z"
@@ -193,8 +201,6 @@ def build_deb(
""")
(staging / "debian" / "changelog").write_text(changelog)
(staging / "debian" / "rules").chmod(0o755)
run("dpkg-buildpackage", "-b", "--no-sign", "-d", cwd=staging)

3
package/debian/control
View File

@@ -4,6 +4,7 @@ Priority: optional
Maintainer: XRPL Foundation <contact@xrplf.org>
Rules-Requires-Root: no
Build-Depends:
binutils,
debhelper-compat (= 13)
Standards-Version: 4.7.0
Homepage: https://github.com/XRPLF/rippled
@@ -11,8 +12,6 @@ Vcs-Git: https://github.com/XRPLF/rippled.git
Vcs-Browser: https://github.com/XRPLF/rippled
Package: xrpld
Section: net
Priority: optional
Architecture: any
Depends:
${shlibs:Depends},

75
package/debian/copyright
View File

@@ -1,5 +1,5 @@
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: rippled
Upstream-Name: xrpld
Source: https://github.com/XRPLF/rippled
Files: *
@@ -15,7 +15,7 @@ Copyright: 2016, Ripple Labs Inc.
2009-2010, Satoshi Nakamoto
2011, The Bitcoin developers
2003-2005, Tom Wu
License: ISC
License: ISC and BSL-1.0 and MIT and Tom-Wu
Comment: Built from https://github.com/ripple/validator-keys-tool at the commit
pinned in cmake/XrplValidatorKeys.cmake. Besides ISC-licensed code it
incorporates work under the Boost Software License 1.0 (ASIO), the MIT/X11
@@ -35,3 +35,74 @@ License: ISC
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
License: BSL-1.0
Boost Software License - Version 1.0 - August 17th, 2003
.
Permission is hereby granted, free of charge, to any person or organization
obtaining a copy of the software and accompanying documentation covered by
this license (the "Software") to use, reproduce, display, distribute,
execute, and transmit the Software, and to prepare derivative works of the
Software, and to permit third-parties to whom the Software is furnished to
do so, all subject to the following:
.
The copyright notices in the Software and this entire statement, including
the above license grant, this restriction and the following disclaimer,
must be included in all copies of the Software, in whole or in part, and
all derivative works of the Software, unless such copies or derivative
works are solely in the form of machine-executable object code generated by
a source language processor.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
License: MIT
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the "Software"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
.
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.
License: Tom-Wu
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
.
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
.
THE SOFTWARE IS PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND,
EXPRESS, IMPLIED OR OTHERWISE, INCLUDING WITHOUT LIMITATION, ANY
WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
.
IN NO EVENT SHALL TOM WU BE LIABLE FOR ANY SPECIAL, INCIDENTAL,
INDIRECT OR CONSEQUENTIAL DAMAGES OF ANY KIND, OR ANY DAMAGES WHATSOEVER
RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER OR NOT ADVISED OF
THE POSSIBILITY OF DAMAGE, AND ON ANY THEORY OF LIABILITY, ARISING OUT
OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.
In addition, the following condition applies:
.
All redistributions must retain an intact copy of this copyright notice
and disclaimer.

26
package/debian/rules Normal file → Executable file
View File

@@ -2,6 +2,12 @@
export DH_VERBOSE = 1
# The glibc the Nix toolchain builds against, and so the real floor for the
# binaries. dpkg-shlibdeps would instead derive libc6 (>= 2.34) from the build
# host's symbols file, where sysconf carries that minver, locking out distros
# the binaries actually run on.
LIBC_MIN = 2.31
%:
dh $@
@@ -11,6 +17,8 @@ override_dh_auto_configure override_dh_auto_build override_dh_auto_test:
override_dh_installsystemd:
dh_installsystemd --no-stop-on-upgrade xrpld.service
# The tmpfiles snippet sets ownership to the xrpld user, so the sysusers snippet
# has to be emitted first: run it early and make its own sequence slot a no-op.
execute_before_dh_installtmpfiles:
dh_installsysusers
@@ -22,5 +30,23 @@ override_dh_install:
install -D -m 0644 xrpld.cfg debian/xrpld/etc/xrpld/xrpld.cfg
install -D -m 0644 validators.txt debian/xrpld/etc/xrpld/validators.txt
override_dh_shlibdeps:
dh_shlibdeps
# Guards against the toolchain moving past LIBC_MIN and the packages then
# claiming a floor they do not meet.
for binary in xrpld validator-keys; do \
needed=$$(readelf --dyn-syms --wide $$binary \
| grep -o 'GLIBC_[0-9.]*' | sed 's/GLIBC_//' | sort -uV | tail -1); \
if [ -z "$$needed" ]; then \
echo "$$binary: no GLIBC_ symbol versions read, cannot check LIBC_MIN" >&2; \
exit 1; \
fi; \
if dpkg --compare-versions "$$needed" gt "$(LIBC_MIN)"; then \
echo "$$binary needs glibc $$needed, above LIBC_MIN $(LIBC_MIN)" >&2; \
exit 1; \
fi; \
done
sed -i 's/libc6 (>= [0-9.]*)/libc6 (>= $(LIBC_MIN))/' debian/xrpld.substvars
override_dh_dwz:
@:

1
package/debian/xrpld.docs
View File

@@ -1,2 +1,3 @@
README.md
LICENSE.md
validator-keys-LICENSE

3
package/debian/xrpld.links
View File

@@ -1,2 +1,3 @@
# Legacy compat symlinks (remove next major release)
# Legacy compatibility for pre-FHS package layouts.
# TODO: remove after rippled fully deprecated.
usr/bin/xrpld usr/local/bin/rippled

6
package/debian/xrpld.lintian-overrides Normal file
View File

@@ -0,0 +1,6 @@
# The /usr/local/bin/rippled symlink is deliberate compatibility for pre-FHS
# layouts, so the Policy 9.1.2 tags it raises are expected.
# TODO: remove alongside debian/xrpld.links after rippled fully deprecated.
xrpld: dir-in-usr-local [usr/local/bin/]
xrpld: file-in-usr-local [usr/local/bin/rippled]
xrpld: file-in-unusual-dir [usr/local/bin/rippled]

10
package/docker/Dockerfile Normal file
View File

@@ -0,0 +1,10 @@
ARG BASE_IMAGE=debian:trixie
FROM ${BASE_IMAGE}
# Bind-mounted rather than copied in, so the installer never lands in a layer.
RUN --mount=type=bind,source=bin/install-packaging-tools.sh,target=/install-packaging-tools.sh \
/install-packaging-tools.sh
# See ../README.md, "Publishing from other repositories".
COPY package/docker/publish_pkg.py /usr/local/bin/publish_pkg.py

18
package/publish_pkg.py → package/docker/publish_pkg.py
View File

@@ -1,5 +1,8 @@
#!/usr/bin/env python3
"""Publish the packages built by build_pkg.py to the XRPLF repositories on Nexus.
"""Publish built DEB and RPM packages to the XRPLF repositories on Nexus.
Knows nothing about what it uploads beyond the channel, so it publishes whatever
built the packages; see package/README.md, "Publishing from other repositories".
RPMs are uploaded to the hosted repository, but yum clients install from the
'rpm-<channel>' group repository in front of it, which serves signed metadata.
@@ -26,6 +29,9 @@ STALL_TIMEOUT = 300
ATTEMPTS = 4
RETRY_DELAY = 5
# 429 is Nexus asking to slow down, not a rejection, so it retries like a 5xx.
RETRYABLE_STATUSES = (429,)
def build_opener() -> urllib.request.OpenerDirector:
"""An opener with no redirect handler, so a 3xx raises instead of being followed.
@@ -44,9 +50,9 @@ def build_opener() -> urllib.request.OpenerDirector:
def upload(url: str, method: str, headers: dict[str, str], package: Path) -> None:
"""Send one package, retrying only what is worth retrying.
A 4xx is a deterministic rejection, so it is reported at once rather than
re-sending the whole body three more times. Nexus explains what it rejected
in the response body, so that body is always surfaced.
A 4xx other than 429 is a deterministic rejection, so it is reported at once
rather than re-sending the whole body three more times. Nexus explains what
it rejected in the response body, so that body is always surfaced.
"""
opener = build_opener()
@@ -64,7 +70,7 @@ def upload(url: str, method: str, headers: dict[str, str], package: Path) -> Non
except urllib.error.HTTPError as error:
detail = error.read().decode(errors="replace").strip()
reason = f"HTTP {error.code}: {detail}"
retryable = error.code >= 500
retryable = error.code >= 500 or error.code in RETRYABLE_STATUSES
except (urllib.error.URLError, OSError) as error:
reason = str(error)
retryable = True
@@ -118,6 +124,8 @@ def main() -> None:
token = base64.b64encode(f"{username}:{password}".encode()).decode()
auth = {"Authorization": f"Basic {token}"}
# Deliberately not shared with sign_rpm.py: this script ships standalone in
# the packaging image for other repositories to run.
packages = sorted(
path
for path in package_dir.rglob("*")

23
package/rpm/xrpld.spec
View File

@@ -17,6 +17,11 @@ URL: https://github.com/XRPLF/rippled
ExclusiveArch: x86_64 aarch64
BuildRequires: systemd-rpm-macros
# These have to precede %%debug_package: it opens the debuginfo subpackage, and
# any tag after it is silently dropped from the main package.
%{?systemd_requires}
%{?sysusers_requires_compat}
%undefine _debugsource_packages
%debug_package
# Level 3 rather than the el9 default of 19: it shrinks the multi-gigabyte
@@ -25,10 +30,13 @@ BuildRequires: systemd-rpm-macros
%global _binary_payload w3.zstdio
%global _find_debuginfo_dwz_opts %{nil}
%build_mtime_policy clamp_to_source_date_epoch
# Reproducibility: the first two take their value from the SOURCE_DATE_EPOCH
# build_pkg.py exports. Without these the header records the wall clock and the
# build container's hostname, so two builds of the same commit differ.
%global clamp_mtime_to_source_date_epoch 1
%global use_source_date_epoch_as_buildtime 1
%global _buildhost xrplf.org
%{?systemd_requires}
%{?sysusers_requires_compat}
%description
xrpld is the reference implementation of the XRP Ledger protocol. It
@@ -53,7 +61,7 @@ install -Dm0644 %{_sourcedir}/validators.txt %{buildroot}%{_sysconfdir}/%{
install -Dm0644 %{_sourcedir}/xrpld.service %{buildroot}%{_unitdir}/xrpld.service
install -Dm0644 %{_sourcedir}/xrpld.sysusers %{buildroot}%{_sysusersdir}/xrpld.conf
install -Dm0644 %{_sourcedir}/xrpld.tmpfiles %{buildroot}%{_tmpfilesdir}/xrpld.conf
install -Dm0644 /dev/null %{buildroot}%{_presetdir}/50-xrpld.preset
install -d %{buildroot}%{_presetdir}
cat >%{buildroot}%{_presetdir}/50-xrpld.preset <<'EOF'
enable xrpld.service
EOF
@@ -76,7 +84,7 @@ ln -s %{_bindir}/%{name} %{buildroot}/usr/local/bin/rippled
%sysusers_create_package %{name} %{_sourcedir}/xrpld.sysusers
%post
systemd-tmpfiles --create %{_tmpfilesdir}/xrpld.conf || :
%tmpfiles_create_package %{name} %{_sourcedir}/xrpld.tmpfiles
%systemd_post xrpld.service
%preun
@@ -86,11 +94,12 @@ systemd-tmpfiles --create %{_tmpfilesdir}/xrpld.conf || :
%systemd_postun xrpld.service
%files
%attr(0755,root,root) %dir %{_docdir}/%{name}
%license %{_docdir}/%{name}/LICENSE.md
%license %{_docdir}/%{name}/validator-keys-LICENSE
%doc %{_docdir}/%{name}/README.md
%dir %{_sysconfdir}/%{name}
%attr(0755,root,root) %dir %{_sysconfdir}/%{name}
%{_bindir}/%{name}
%{_bindir}/validator-keys
@@ -101,7 +110,7 @@ systemd-tmpfiles --create %{_tmpfilesdir}/xrpld.conf || :
%{_unitdir}/xrpld.service
%{_presetdir}/50-xrpld.preset
%attr(0644,root,root) %{_presetdir}/50-xrpld.preset
%{_sysusersdir}/xrpld.conf
%{_tmpfilesdir}/xrpld.conf
%ghost %dir /var/lib/xrpld

2
package/shared/xrpld.service
View File

@@ -17,6 +17,8 @@ ProtectHome=true
PrivateTmp=true
User=xrpld
Group=xrpld
# xrpld.tmpfiles creates these at install and boot; these recreate them on
# every start, so a removed directory does not stop the service.
StateDirectory=xrpld
StateDirectoryMode=0750
LogsDirectory=xrpld

2
package/sign_rpm.py
View File

@@ -107,6 +107,8 @@ def main() -> None:
args = parser.parse_args()
package_dir: Path = args.package_dir
# Deliberately not shared with publish_pkg.py, which ships standalone in the
# packaging image.
rpms = sorted(path for path in package_dir.rglob("*.rpm") if path.is_file())
# Signing nothing would otherwise look like a successful signing.
assert rpms, f"no RPMs found in {package_dir}"

15
src/libxrpl/ledger/View.cpp
View File

@@ -543,12 +543,19 @@ doWithdraw(
{
auto const dstSle = ctx.view.read(keylet::account(dstAcct));
// Create trust line or MPToken for the receiving account
// Create a trust line or MPToken for a self-destination only when there
// is a payout to credit. Post-fixCleanup3_4_0, a zero-value withdraw
// (e.g. share redemption from a fully impaired vault) must not insert
// an empty holding: that records a one-sided zero delta and can also
// create+delete MPTokens in the same transaction.
if (dstAcct == senderAcct)
{
if (auto const ter = addEmptyHolding(ctx, senderAcct, priorBalance, amount.asset(), j);
!isTesSuccess(ter) && ter != tecDUPLICATE)
return ter;
if (amount > beast::kZero || !ctx.view.rules().enabled(fixCleanup3_4_0))
{
if (auto const ter = addEmptyHolding(ctx, senderAcct, priorBalance, amount.asset(), j);
!isTesSuccess(ter) && ter != tecDUPLICATE)
return ter;
}
}
else
{

14
src/libxrpl/ledger/helpers/AMMHelpers.cpp
View File

@@ -11,7 +11,6 @@
#include <xrpl/ledger/ReadView.h>
#include <xrpl/ledger/Sandbox.h>
#include <xrpl/ledger/View.h>
#include <xrpl/ledger/helpers/CredentialHelpers.h>
#include <xrpl/ledger/helpers/MPTokenHelpers.h>
#include <xrpl/ledger/helpers/RippleStateHelpers.h>
#include <xrpl/ledger/helpers/TokenHelpers.h>
@@ -691,12 +690,6 @@ deleteAMMTrustLines(
return {deleteAMMTrustLine(sb, sleItem, ammAccountID, j), SkipEntry::No};
}
// A credential naming the pseudo-account as subject can't be
// accepted or deleted by it and would otherwise permanently pin the
// AMM. Clean it up here, inside the same bounded walk, so the
// pinned AMM can still be deleted.
if (sb.rules().enabled(fixCleanup3_4_0) && nodeType == ltCREDENTIAL)
return {credentials::deleteSLE(sb, sleItem, j), SkipEntry::No};
// LCOV_EXCL_START
JLOG(j.error()) << "deleteAMMObjects: deleting non-trustline or non-MPT " << nodeType;
return {tecINTERNAL, SkipEntry::No};
@@ -774,8 +767,6 @@ deleteAMMAccount(Sandbox& sb, Asset const& asset, Asset const& asset2, beast::Jo
// LCOV_EXCL_STOP
}
// deleteAMMTrustLines also removes any credentials pinned to the AMM
// pseudo-account, within its bounded walk.
if (auto const ter = deleteAMMTrustLines(sb, ammAccountID, kMaxDeletableAmmTrustLines, j);
!isTesSuccess(ter))
return ter;
@@ -917,11 +908,6 @@ isOnlyLiquidityProvider(ReadView const& view, Issue const& ammIssue, AccountID c
++nMPT;
continue;
}
// A credential naming the pseudo-account as subject can be pinned
// to its owner directory. Ignore it here; deleteAMMTrustLines
// removes it when the AMM is deleted.
if (view.rules().enabled(fixCleanup3_4_0) && entryType == ltCREDENTIAL)
continue;
if (entryType != ltRIPPLE_STATE)
return std::unexpected<TER>(tecINTERNAL); // LCOV_EXCL_LINE
auto const lowLimit = sle->getFieldAmount(sfLowLimit);

17
src/libxrpl/ledger/helpers/AccountRootHelpers.cpp
View File

@@ -28,7 +28,6 @@
#include <limits>
#include <memory>
#include <optional>
#include <set>
#include <stdexcept>
#include <vector>
@@ -515,8 +514,8 @@ pseudoAccountAddress(ReadView const& view, uint256 const& pseudoOwnerKey)
}
// Pseudo-account designator fields MUST be maintained by including the
// SField::sMD_PseudoAccount flag in the SField definition. (Don't forget to
// "| SField::sMD_Default"!) The fields do NOT need to be amendment-gated,
// SField::kSmdPseudoAccount flag in the SField definition. (Don't forget to
// "| SField::kSmdDefault"!) The fields do NOT need to be amendment-gated,
// since a non-active amendment will not set any field, by definition.
// Specific properties of a pseudo-account are NOT checked here, that's what
// InvariantCheck is for.
@@ -547,18 +546,14 @@ getPseudoAccountFields()
}
[[nodiscard]] bool
isPseudoAccount(SLE::const_pointer sleAcct, std::set<SField const*> const& pseudoFieldFilter)
isPseudoAccount(SLE::const_pointer sleAcct)
{
auto const& fields = getPseudoAccountFields();
// Intentionally use defensive coding here because it's cheap and makes the
// semantics of true return value clean.
return sleAcct && sleAcct->getType() == ltACCOUNT_ROOT &&
std::count_if(
fields.begin(), fields.end(), [&sleAcct, &pseudoFieldFilter](SField const* sf) -> bool {
return sleAcct->isFieldPresent(*sf) &&
(pseudoFieldFilter.empty() || pseudoFieldFilter.contains(sf));
}) > 0;
std::ranges::any_of(getPseudoAccountFields(), [&sleAcct](SField const* sf) {
return sleAcct->isFieldPresent(*sf);
});
}
std::expected<SLE::pointer, TER>

32
src/libxrpl/ledger/helpers/CredentialHelpers.cpp
View File

@@ -5,10 +5,8 @@
#include <xrpl/basics/base_uint.h>
#include <xrpl/basics/chrono.h>
#include <xrpl/beast/utility/Journal.h>
#include <xrpl/beast/utility/instrumentation.h>
#include <xrpl/ledger/ApplyView.h>
#include <xrpl/ledger/ReadView.h>
#include <xrpl/ledger/View.h>
#include <xrpl/ledger/helpers/AccountRootHelpers.h>
#include <xrpl/protocol/AccountID.h>
#include <xrpl/protocol/Feature.h>
@@ -129,36 +127,6 @@ deleteSLE(ApplyView& view, SLE::ref sleCredential, beast::Journal j)
return tesSUCCESS;
}
TER
deletePseudoAccountCredentials(
ApplyView& view,
AccountID const& pseudoAcct,
std::uint16_t maxNodesToDelete,
beast::Journal j)
{
XRPL_ASSERT(
isPseudoAccount(view.read(keylet::account(pseudoAcct))),
"xrpl::credentials::deletePseudoAccountCredentials : is a pseudo-account");
// Delete the credentials linked into the pseudo-account's owner directory,
// visiting at most maxNodesToDelete entries. Any other object is left in
// place; the caller's own checks decide whether the remaining directory
// blocks deletion. If the bound is reached, cleanupOnAccountDelete returns
// tecINCOMPLETE and the caller propagates it so a later transaction resumes.
return cleanupOnAccountDelete(
view,
keylet::ownerDir(pseudoAcct),
[&view, &j](LedgerEntryType nodeType, uint256 const&, SLE::pointer& sleItem)
-> std::pair<TER, SkipEntry> {
if (nodeType == ltCREDENTIAL)
return {deleteSLE(view, sleItem, j), SkipEntry::No};
return {tesSUCCESS, SkipEntry::Yes};
},
j,
maxNodesToDelete);
}
NotTEC
checkFields(STTx const& tx, Rules const& rules, beast::Journal j)
{

5
src/libxrpl/ledger/helpers/MPTokenHelpers.cpp
View File

@@ -184,6 +184,8 @@ addEmptyHolding(
auto const mpt = ctx.view.peek(keylet::mptokenIssuance(mptID));
if (!mpt)
return tefINTERNAL; // LCOV_EXCL_LINE
// Unlike IOU addEmptyHolding (post-fixCleanup3_4_0), a locked issuance is
// still rejected before the "MPToken already exists" short circuit.
if (mpt->isFlag(lsfMPTLocked))
return tefINTERNAL; // LCOV_EXCL_LINE
if (ctx.view.peek(keylet::mptoken(mptID, accountID)))
@@ -384,8 +386,7 @@ requireAuth(
// They are implicitly authorized for any MPT they hold, including vault shares whose
// underlying asset would otherwise require auth.
auto const isPseudoAccountExempt = [&] {
return (featureSAVEnabled || featureMPTV2Enabled) &&
isPseudoAccount(view, account, {&sfVaultID, &sfLoanBrokerID, &sfAMMID});
return (featureSAVEnabled || featureMPTV2Enabled) && isPseudoAccount(view, account);
};
auto const mptID = keylet::mptokenIssuance(mptIssue.getMptID());

21
src/libxrpl/ledger/helpers/RippleStateHelpers.cpp
View File

@@ -652,21 +652,32 @@ addEmptyHolding(
auto const& issuerId = issue.getIssuer();
auto const& currency = issue.currency;
if (isGlobalFrozen(ctx.view, issuerId))
return tecFROZEN; // LCOV_EXCL_LINE
auto const& srcId = issuerId;
auto const& dstId = accountID;
auto const high = srcId > dstId;
auto const index = keylet::trustLine(srcId, dstId, currency);
// Post-fixCleanup3_4_0: an existing line is a no-op. Issuer freeze and
// DefaultRipple only matter when this function has to create a line.
bool const fix340Enabled = ctx.view.rules().enabled(fixCleanup3_4_0);
if (fix340Enabled && ctx.view.exists(index))
return tecDUPLICATE;
if (isGlobalFrozen(ctx.view, issuerId))
return tecFROZEN; // LCOV_EXCL_LINE
auto const sleSrc = ctx.view.peek(keylet::account(srcId));
auto const sleDst = ctx.view.peek(keylet::account(dstId));
if (!sleDst || !sleSrc)
return tefINTERNAL; // LCOV_EXCL_LINE
// Create path: DefaultRipple is still required. terNO_RIPPLE is
// intentional so VaultWithdraw / CoverWithdraw fail in preclaim via
// canAddHolding (retryable, no fee) rather than claiming a tec* fee
// in doApply. Transactor::operator() will not apply and will not
// convert it to tefINTERNAL.
if (!sleSrc->isFlag(lsfDefaultRipple))
return tecINTERNAL; // LCOV_EXCL_LINE
return fix340Enabled ? TER{terNO_RIPPLE} : tecINTERNAL;
// If the line already exists, don't create it again.
if (ctx.view.read(index))
if (!fix340Enabled && ctx.view.exists(index))
return tecDUPLICATE;
// A reserve sponsor only covers tx.Account's own objects.

36
src/libxrpl/ledger/helpers/TokenHelpers.cpp
View File

@@ -535,13 +535,19 @@ accountFunds(
}
Rate
transferRate(ReadView const& view, STAmount const& amount)
transferRate(ReadView const& view, Asset const& asset)
{
return amount.asset().visit(
return asset.visit(
[&](Issue const& issue) { return transferRate(view, issue.getIssuer()); },
[&](MPTIssue const& issue) { return transferRate(view, issue.getMptID()); });
}
Rate
transferRate(ReadView const& view, STAmount const& amount)
{
return transferRate(view, amount.asset());
}
//------------------------------------------------------------------------------
//
// Holding operations
@@ -577,6 +583,32 @@ canAddHolding(ReadView const& view, Asset const& asset)
asset.value());
}
[[nodiscard]] bool
holdingExists(ReadView const& view, AccountID const& account, Issue const& issue)
{
if (issue.native() || account == issue.getIssuer())
return true;
return view.exists(keylet::trustLine(account, issue));
}
[[nodiscard]] bool
holdingExists(ReadView const& view, AccountID const& account, MPTIssue const& mptIssue)
{
if (account == mptIssue.getIssuer())
return true;
return view.exists(keylet::mptoken(mptIssue.getMptID(), account));
}
[[nodiscard]] bool
holdingExists(ReadView const& view, AccountID const& account, Asset const& asset)
{
return std::visit(
[&]<ValidIssueType TIss>(TIss const& issue) -> bool {
return holdingExists(view, account, issue);
},
asset.value());
}
TER
addEmptyHolding(
ApplyViewContext ctx,

61
src/libxrpl/ledger/helpers/VaultHelpers.cpp
View File

@@ -1,6 +1,7 @@
#include <xrpl/ledger/helpers/VaultHelpers.h>
#include <xrpl/basics/Number.h>
#include <xrpl/beast/utility/Zero.h>
#include <xrpl/beast/utility/instrumentation.h>
#include <xrpl/ledger/ReadView.h>
#include <xrpl/ledger/View.h>
@@ -17,6 +18,7 @@
#include <xrpl/protocol/TER.h>
#include <cstdint>
#include <expected>
#include <optional>
#include <utility>
@@ -69,6 +71,65 @@ sharesToAssetsDeposit(SLE::const_ref vault, SLE::const_ref issuance, STAmount co
return assets;
}
[[nodiscard]] std::expected<STAmount, TER>
clampToAssetsTotalScale(SLE::const_ref vault, STAmount const& delta)
{
XRPL_ASSERT(
delta.asset() == vault->at(sfAsset),
"xrpl::clampToAssetsTotalScale : delta and vault asset match");
Asset const asset = vault->at(sfAsset);
STAmount magnitude = delta.negative() ? -delta : delta;
if (asset.integral())
{
return magnitude;
}
Number const assetsTotal = vault->at(sfAssetsTotal);
// Calculate the scale after applying the delta using ToNearest rounding.
// This aligns the delta with scale checks used by vault invariants.
int const postScale = [&] {
NumberRoundModeGuard const rg(Number::RoundingMode::ToNearest);
return scale(assetsTotal + delta, asset);
}();
STAmount actualDelta;
if (delta.negative())
{
// For withdrawals (debits), floor the magnitude to the target scale
// to ensure exact grid alignment without paying out extra assets.
actualDelta = roundToScale(magnitude, postScale, Number::RoundingMode::Downward);
}
else
{
// For deposits (credits), derive actualDelta from the floored posterior total.
// This prevents grid alignment issues from crediting the vault more than deposited.
//
// Sum using Downward rounding so intermediate precision doesn't round up
// and exceed the original requested amount.
Number const posterior = [&] {
NumberRoundModeGuard const rg(Number::RoundingMode::Downward);
return assetsTotal + magnitude;
}();
Number const roundedPosterior =
roundToAsset(asset, posterior, postScale, Number::RoundingMode::Downward);
actualDelta = STAmount{asset, roundedPosterior - assetsTotal};
}
XRPL_ASSERT(
abs(actualDelta) <= abs(delta),
"xrpl::clampToAssetsTotalScale : actual delta smaller or equal to calculated delta");
// Reject changes below scale precision (1 ULP) to prevent share balance changes
// without corresponding asset movements.
if (actualDelta <= beast::kZero)
return std::unexpected(tecPRECISION_LOSS);
return actualDelta;
}
[[nodiscard]] Number
assetsTotalForWithdrawal(SLE::const_ref vault, WaiveUnrealizedLoss waive)
{

2
src/libxrpl/protocol/BuildInfo.cpp
View File

@@ -23,7 +23,7 @@ namespace {
//------------------------------------------------------------------------------
// clang-format off
// NOLINTNEXTLINE(readability-identifier-naming)
char const* const versionString = "3.4.0-b2"
char const* const versionString = "3.4.0-rc1"
// clang-format on
;

27
src/libxrpl/protocol/Indexes.cpp
View File

@@ -123,6 +123,10 @@ getBookBase(Book const& book)
{
XRPL_ASSERT(isConsistent(book), "xrpl::getBookBase : input is consistent");
constexpr std::uint8_t kIssueToMPTTag = 0x01;
constexpr std::uint8_t kMPTToIssueTag = 0x02;
constexpr std::uint8_t kMPTToMPTTag = 0x03;
auto getIndexHash = [&book]<typename... Args>(Args... args) {
if (book.domain)
return indexHash(std::forward<Args>(args)..., *book.domain);
@@ -136,19 +140,36 @@ getBookBase(Book const& book)
return getIndexHash(
LedgerNameSpace::BookDir, in.currency, out.currency, in.account, out.account);
}
// The three MPT-involving branches are new under MPTokensV2 and
// each gets a 1-byte discriminator to prevent preimage collisions
// between branches: the (Issue,MPT) and (MPT,Issue) preimages
// are both 64 bytes of raw concatenation, so without a
// per-branch tag chosen Currency / MPTID / AccountID values can
// align byte-for-byte and produce the same BookDir keylet for
// two distinct markets. (Issue,Issue) is left untagged to
// preserve existing mainnet order-book keylets.
else if constexpr (std::is_same_v<TIn, Issue> && std::is_same_v<TOut, MPTIssue>)
{
return getIndexHash(
LedgerNameSpace::BookDir, in.currency, out.getMptID(), in.account);
LedgerNameSpace::BookDir,
kIssueToMPTTag,
in.currency,
out.getMptID(),
in.account);
}
else if constexpr (std::is_same_v<TIn, MPTIssue> && std::is_same_v<TOut, Issue>)
{
return getIndexHash(
LedgerNameSpace::BookDir, in.getMptID(), out.currency, out.account);
LedgerNameSpace::BookDir,
kMPTToIssueTag,
in.getMptID(),
out.currency,
out.account);
}
else
{
return getIndexHash(LedgerNameSpace::BookDir, in.getMptID(), out.getMptID());
return getIndexHash(
LedgerNameSpace::BookDir, kMPTToMPTTag, in.getMptID(), out.getMptID());
}
},
book.in.value(),

24
src/libxrpl/protocol/NFTSyntheticSerializer.cpp
View File

@@ -1,24 +0,0 @@
#include <xrpl/protocol/NFTSyntheticSerializer.h>
#include <xrpl/json/json_value.h>
#include <xrpl/protocol/NFTokenID.h>
#include <xrpl/protocol/NFTokenOfferID.h>
#include <xrpl/protocol/STTx.h>
#include <xrpl/protocol/TxMeta.h>
#include <xrpl/protocol/jss.h>
#include <memory>
namespace xrpl::rpc {
void
insertNFTSyntheticInJson(
json::Value& response,
std::shared_ptr<STTx const> const& transaction,
TxMeta const& transactionMeta)
{
insertNFTokenID(response[jss::meta], transaction, transactionMeta);
insertNFTokenOfferID(response[jss::meta], transaction, transactionMeta);
}
} // namespace xrpl::rpc

76
src/libxrpl/protocol/STTx.cpp
View File

@@ -168,10 +168,10 @@ STTx::getMentionedAccounts() const
}
static Blob
getSigningData(STTx const& that)
getSigningData(STTx const& that, HashPrefix prefix)
{
Serializer s;
s.add32(HashPrefix::TxSign);
s.add32(prefix);
that.addWithoutSigningFields(s);
return s.getData();
}
@@ -212,30 +212,42 @@ STTx::getSeqProxy() const
return SeqProxy::rawTicket(*ticketSeq);
}
void
STTx::sign(PublicKey const& publicKey, SecretKey const& secretKey)
{
// The account's own signature always covers the plain transaction prefix;
// see signingPrefix for the role signatures that do not.
auto const data = getSigningData(*this, HashPrefix::TxSign);
setFieldVL(sfTxnSignature, xrpl::sign(publicKey, secretKey, makeSlice(data)));
tid_ = getHash(HashPrefix::TransactionId);
}
void
STTx::sign(
PublicKey const& publicKey,
SecretKey const& secretKey,
std::optional<std::reference_wrapper<SField const>> signatureTarget)
SignatureRole role,
Rules const& rules)
{
auto const data = getSigningData(*this);
auto const data = getSigningData(*this, signingPrefix(role, false, rules));
auto const sig = xrpl::sign(publicKey, secretKey, makeSlice(data));
if (signatureTarget)
if (auto const target = signatureField(role))
{
auto& target = peekFieldObject(*signatureTarget);
target.setFieldVL(sfTxnSignature, sig);
peekFieldObject(*target).setFieldVL(sfTxnSignature, sig);
}
else
{
setFieldVL(sfTxnSignature, sig);
}
tid_ = getHash(HashPrefix::TransactionId);
}
std::expected<void, std::string>
STTx::checkSign(Rules const& rules, STObject const& sigObject) const
STTx::checkSign(Rules const& rules, STObject const& sigObject, SignatureRole role) const
{
try
{
@@ -244,8 +256,10 @@ STTx::checkSign(Rules const& rules, STObject const& sigObject) const
// multi-signing. Otherwise we're single-signing.
Blob const& signingPubKey = sigObject.getFieldVL(sfSigningPubKey);
return signingPubKey.empty() ? checkMultiSign(rules, sigObject)
: checkSingleSign(sigObject);
bool const multiSigning = signingPubKey.empty();
auto const prefix = signingPrefix(role, multiSigning, rules);
return multiSigning ? checkMultiSign(sigObject, prefix)
: checkSingleSign(sigObject, prefix);
}
catch (...)
{
@@ -256,20 +270,20 @@ STTx::checkSign(Rules const& rules, STObject const& sigObject) const
std::expected<void, std::string>
STTx::checkSign(Rules const& rules) const
{
if (auto const ret = checkSign(rules, *this); !ret)
if (auto const ret = checkSign(rules, *this, SignatureRole::Transaction); !ret)
return ret;
if (isFieldPresent(sfCounterpartySignature))
{
auto const counterSig = getFieldObject(sfCounterpartySignature);
if (auto const ret = checkSign(rules, counterSig); !ret)
if (auto const ret = checkSign(rules, counterSig, SignatureRole::Counterparty); !ret)
return std::unexpected("Counterparty: " + ret.error());
}
if (isFieldPresent(sfSponsorSignature))
{
auto const sponsorSignatureObj = getFieldObject(sfSponsorSignature);
if (auto const ret = checkSign(rules, sponsorSignatureObj); !ret)
if (auto const ret = checkSign(rules, sponsorSignatureObj, SignatureRole::Sponsor); !ret)
return std::unexpected("Sponsor: " + ret.error());
}
@@ -277,14 +291,14 @@ STTx::checkSign(Rules const& rules) const
// of signature checking.
if (isFieldPresent(sfBatchSigners))
{
if (auto const ret = checkBatchSign(rules); !ret)
if (auto const ret = checkBatchSign(); !ret)
return ret;
}
return {};
}
std::expected<void, std::string>
STTx::checkBatchSign(Rules const& rules) const
STTx::checkBatchSign() const
{
try
{
@@ -318,7 +332,7 @@ STTx::checkBatchSign(Rules const& rules) const
for (auto const& signer : signers)
{
Blob const& signingPubKey = signer.getFieldVL(sfSigningPubKey);
auto const result = signingPubKey.empty() ? checkBatchMultiSign(signer, rules, txIds)
auto const result = signingPubKey.empty() ? checkBatchMultiSign(signer, txIds)
: checkBatchSingleSign(signer, txIds);
if (!result)
@@ -447,9 +461,9 @@ singleSignHelper(STObject const& sigObject, Slice const& data)
}
std::expected<void, std::string>
STTx::checkSingleSign(STObject const& sigObject) const
STTx::checkSingleSign(STObject const& sigObject, HashPrefix prefix) const
{
auto const data = getSigningData(*this);
auto const data = getSigningData(*this, prefix);
return singleSignHelper(sigObject, makeSlice(data));
}
@@ -467,8 +481,7 @@ std::expected<void, std::string>
multiSignHelper(
STObject const& sigObject,
std::optional<AccountID> txnAccountID,
std::function<Serializer(AccountID const&)> makeMsg,
Rules const& rules)
std::function<Serializer(AccountID const&)> makeMsg)
{
// Make sure the MultiSigners are present. Otherwise they are not
// attempting multi-signing and we just have a bad SigningPubKey.
@@ -541,10 +554,7 @@ multiSignHelper(
}
std::expected<void, std::string>
STTx::checkBatchMultiSign(
STObject const& batchSigner,
Rules const& rules,
std::vector<uint256> const& txIds) const
STTx::checkBatchMultiSign(STObject const& batchSigner, std::vector<uint256> const& txIds) const
{
XRPL_ASSERT(getTxnType() == ttBATCH, "STTx::checkBatchMultiSign : batch transaction");
// We can ease the computational load inside the loop a bit by
@@ -555,18 +565,15 @@ STTx::checkBatchMultiSign(
serializeBatch(dataStart, getAccountID(sfAccount), getSeqProxy().value(), getFlags(), txIds);
dataStart.addBitString(batchSignerAccount);
return multiSignHelper(
batchSigner,
batchSignerAccount,
[&dataStart](AccountID const& accountID) -> Serializer {
batchSigner, batchSignerAccount, [&dataStart](AccountID const& accountID) -> Serializer {
Serializer s = dataStart;
finishMultiSigningData(accountID, s);
return s;
},
rules);
});
}
std::expected<void, std::string>
STTx::checkMultiSign(Rules const& rules, STObject const& sigObject) const
STTx::checkMultiSign(STObject const& sigObject, HashPrefix prefix) const
{
// Used inside the loop in multiSignHelper to enforce that
// the account owner may not multisign for themselves.
@@ -578,16 +585,13 @@ STTx::checkMultiSign(Rules const& rules, STObject const& sigObject) const
// We can ease the computational load inside the loop a bit by
// pre-constructing part of the data that we hash. Fill a Serializer
// with the stuff that stays constant from signature to signature.
Serializer dataStart = startMultiSigningData(*this);
Serializer dataStart = startMultiSigningData(*this, prefix);
return multiSignHelper(
sigObject,
txnAccountID,
[&dataStart](AccountID const& accountID) -> Serializer {
sigObject, txnAccountID, [&dataStart](AccountID const& accountID) -> Serializer {
Serializer s = dataStart;
finishMultiSigningData(accountID, s);
return s;
},
rules);
});
}
void

68
src/libxrpl/protocol/Sign.cpp
View File

@@ -1,17 +1,77 @@
#include <xrpl/protocol/Sign.h>
#include <xrpl/beast/utility/instrumentation.h>
#include <xrpl/protocol/AccountID.h>
#include <xrpl/protocol/Feature.h>
#include <xrpl/protocol/HashPrefix.h>
#include <xrpl/protocol/KeyType.h>
#include <xrpl/protocol/PublicKey.h>
#include <xrpl/protocol/Rules.h>
#include <xrpl/protocol/SField.h>
#include <xrpl/protocol/STExchange.h>
#include <xrpl/protocol/STObject.h>
#include <xrpl/protocol/SecretKey.h>
#include <xrpl/protocol/Serializer.h>
#include <optional>
namespace xrpl {
SField const*
signatureField(SignatureRole role)
{
switch (role)
{
case SignatureRole::Transaction:
return nullptr;
case SignatureRole::Counterparty:
return &sfCounterpartySignature;
case SignatureRole::Sponsor:
return &sfSponsorSignature;
}
UNREACHABLE("xrpl::signatureField : unknown SignatureRole");
return nullptr;
}
std::optional<SignatureRole>
signatureRole(SField const& sigField)
{
if (sigField == sfCounterpartySignature)
return SignatureRole::Counterparty;
if (sigField == sfSponsorSignature)
return SignatureRole::Sponsor;
return std::nullopt;
}
// Signature validity depends on fixCleanup3_4_0: a role signature covers
// different bytes before and after the amendment activates. checkValidity
// caches its verdict per transaction ID, so it keeps two separate cache slots
// for role-signature transactions (kSfSiggoodOldPrefix / kSfSigbadOldPrefix in
// tx/apply.cpp) to keep a pre-fix verdict from being reused in the post-fix
// era, and vice versa. See the block comment in tx/apply.cpp for the details
// and the reason both directions matter.
HashPrefix
signingPrefix(SignatureRole role, bool multiSigning, Rules const& rules)
{
// Before fixCleanup3_4_0 every signature on a transaction covered the same
// bytes, so a signature could be moved from one role to another.
if (!rules.enabled(fixCleanup3_4_0))
return multiSigning ? HashPrefix::TxMultiSign : HashPrefix::TxSign;
switch (role)
{
case SignatureRole::Transaction:
return multiSigning ? HashPrefix::TxMultiSign : HashPrefix::TxSign;
case SignatureRole::Counterparty:
return multiSigning ? HashPrefix::CounterpartyTxMultiSign
: HashPrefix::CounterpartyTxSign;
case SignatureRole::Sponsor:
return multiSigning ? HashPrefix::SponsorTxMultiSign : HashPrefix::SponsorTxSign;
}
UNREACHABLE("xrpl::signingPrefix : unknown SignatureRole");
return multiSigning ? HashPrefix::TxMultiSign : HashPrefix::TxSign;
}
void
sign(
STObject& st,
@@ -70,18 +130,18 @@ verify(STObject const& st, HashPrefix const& prefix, PublicKey const& pk, SF_VL
// So, if we support multiple levels of signing, then we'll need to
// incorporate the "signing for" accounts into the signing data as well.
Serializer
buildMultiSigningData(STObject const& obj, AccountID const& signingID)
buildMultiSigningData(STObject const& obj, AccountID const& signingID, HashPrefix prefix)
{
Serializer s{startMultiSigningData(obj)};
Serializer s{startMultiSigningData(obj, prefix)};
finishMultiSigningData(signingID, s);
return s;
}
Serializer
startMultiSigningData(STObject const& obj)
startMultiSigningData(STObject const& obj, HashPrefix prefix)
{
Serializer s;
s.add32(HashPrefix::TxMultiSign);
s.add32(prefix);
obj.addWithoutSigningFields(s);
return s;
}

2
src/libxrpl/protocol/TER.cpp
View File

@@ -136,7 +136,7 @@ transResults()
MAKE_ERROR(tefNO_DST_PARTIAL, "Partial payment to create account not allowed."),
MAKE_ERROR(tefBAD_PATH_COUNT, "Malformed: Too many paths."),
MAKE_ERROR(tefNO_BYTECODE, "There is no WASM code to run, but a WASM-specific field was included."),
MAKE_ERROR(tefBYTECODE_NOT_INCLUDED, "WASM code requires a field to be included that was not included."),
MAKE_ERROR(tefBYTECODE_NOT_INCLUDED, "WASM code requires a field that was not included."),
MAKE_ERROR(telLOCAL_ERROR, "Local failure."),
MAKE_ERROR(telBAD_DOMAIN, "Domain too long."),

63
src/libxrpl/shamap/SHAMapNodeID.cpp
View File

@@ -6,6 +6,7 @@
#include <xrpl/protocol/Serializer.h>
#include <xrpl/shamap/SHAMap.h>
#include <algorithm>
#include <cstddef>
#include <optional>
#include <stdexcept>
@@ -40,11 +41,41 @@ depthMask(unsigned int depth)
return kMasks.entry[depth];
}
// The prefix of `key` at `depth`: the leading nibbles naming the subtree a node at that depth
// identifies, with the remainder of the key masked off.
static uint256
maskedToDepth(uint256 const& key, unsigned int depth)
{
return key & depthMask(depth);
}
// Whether `id` at `depth` is what `key` looks like once masked down to that depth, i.e.
// whether an ID with this depth and id names a subtree that `key` falls under.
static bool
isPrefixOfAtDepth(uint256 const& id, unsigned int depth, uint256 const& key)
{
return maskedToDepth(key, depth) == id;
}
// canonicalize the hash to a node ID for this depth
SHAMapNodeID::SHAMapNodeID(unsigned int depth, uint256 const& hash) : id_(hash), depth_(depth)
{
XRPL_ASSERT(
depth <= SHAMap::kLeafDepth, "xrpl::SHAMapNodeID::SHAMapNodeID : maximum depth input");
// Every SHAMapNodeID's depth is stored here, so this is the one place that can stop an
// out-of-range one from being kept: a depth past kLeafDepth would go on to index depthMask
// out of bounds, and getRawString would narrow it to a byte, silently renaming the node.
// Clamp rather than throw, since node IDs are built from peer-supplied depths on the ledger
// data path, where no caller catches an exception before it reaches a thread boundary.
if (depth_ > SHAMap::kLeafDepth)
{
// LCOV_EXCL_START
UNREACHABLE("xrpl::SHAMapNodeID::SHAMapNodeID : depth within tree");
depth_ = SHAMap::kLeafDepth;
id_ = maskedToDepth(id_, depth_);
// LCOV_EXCL_STOP
}
// Reads the clamped member rather than the depth argument, so it cannot index depthMask past
// its last entry even once the clamp above has reported the bad input and carried on.
XRPL_ASSERT(
isPrefixOf(id_), "xrpl::SHAMapNodeID::SHAMapNodeID : hash and depth inputs do match");
}
@@ -89,7 +120,7 @@ SHAMapNodeID::getChildNodeID(unsigned int branch) const
bool
SHAMapNodeID::isPrefixOf(uint256 const& key) const
{
return (key & depthMask(depth_)) == id_;
return isPrefixOfAtDepth(id_, depth_, key);
}
[[nodiscard]] std::optional<SHAMapNodeID>
@@ -102,9 +133,9 @@ deserializeSHAMapNodeID(void const* data, std::size_t size)
unsigned int const depth = *(static_cast<unsigned char const*>(data) + 32);
if (depth <= SHAMap::kLeafDepth)
{
auto const id = uint256::fromVoid(data);
if (id == (id & depthMask(depth)))
// Reject a serialized ID carrying bits below its own depth. Checked before
// constructing, since the constructor asserts that same property.
if (auto const id = uint256::fromVoid(data); isPrefixOfAtDepth(id, depth, id))
ret.emplace(depth, id);
}
}
@@ -115,7 +146,11 @@ deserializeSHAMapNodeID(void const* data, std::size_t size)
[[nodiscard]] unsigned int
selectBranch(SHAMapNodeID const& id, uint256 const& hash)
{
auto const depth = id.getDepth();
XRPL_ASSERT(id.getDepth() < SHAMap::kLeafDepth, "xrpl::selectBranch : depth below leaf depth");
// A depth-64 ID has no nibble left to select. Callers must not ask, but clamp anyway to keep
// the read below the end of the 32-byte key.
auto const depth = std::min(id.getDepth(), SHAMap::kLeafDepth - 1u);
auto branch = static_cast<unsigned int>(*(hash.begin() + (depth / 2)));
if ((depth & 1) != 0u)
@@ -134,8 +169,18 @@ selectBranch(SHAMapNodeID const& id, uint256 const& hash)
SHAMapNodeID
SHAMapNodeID::createID(unsigned int depth, uint256 const& key)
{
XRPL_ASSERT(depth <= SHAMap::kLeafDepth, "xrpl::SHAMapNodeID::createID : valid depth");
return SHAMapNodeID(depth, key & depthMask(depth));
// The mask is chosen here, before the constructor runs, so the clamp there cannot cover this
// call: an out-of-range depth would index depthMask's table while still evaluating this
// argument. A public factory has to hold its own bound.
if (depth > SHAMap::kLeafDepth)
{
// LCOV_EXCL_START
UNREACHABLE("xrpl::SHAMapNodeID::createID : depth within tree");
depth = SHAMap::kLeafDepth;
// LCOV_EXCL_STOP
}
return SHAMapNodeID(depth, maskedToDepth(key, depth));
}
} // namespace xrpl

5
src/libxrpl/tx/AGENTS.md Normal file
View File

@@ -0,0 +1,5 @@
# AGENTS.md — tx
See the repo-level [AGENTS.md](../../../AGENTS.md) for general build/test/style guidance.
Any change to transaction-processing behavior must be gated behind an amendment. New amendments (and fixes, i.e. `fix*` amendments) are added to [`include/xrpl/protocol/detail/features.macro`](../../../include/xrpl/protocol/detail/features.macro), as an `XRPL_FEATURE(...)` or `XRPL_FIX(...)` entry added to the top of the list (the list is kept in reverse chronological order). Once the pre-amendment code path for a retired amendment is removed, move its entry to `XRPL_RETIRE_FEATURE(...)`/`XRPL_RETIRE_FIX(...)` instead of deleting it.

1
src/libxrpl/tx/CLAUDE.md Symbolic link
View File

@@ -0,0 +1 @@
AGENTS.md

14
src/libxrpl/tx/Transactor.cpp
View File

@@ -1246,7 +1246,7 @@ removeExpiredNFTokenOffers(
}
static void
removeDeletedCredentials(ApplyView& view, std::vector<uint256> const& creds, beast::Journal viewJ)
removeExpiredCredentials(ApplyView& view, std::vector<uint256> const& creds, beast::Journal viewJ)
{
for (auto const& index : creds)
{
@@ -1255,7 +1255,7 @@ removeDeletedCredentials(ApplyView& view, std::vector<uint256> const& creds, bea
if (auto const ter = credentials::deleteSLE(view, sle, viewJ); !isTesSuccess(ter))
{
JLOG(viewJ.error())
<< "removeDeletedCredentials: failed to delete credential. Err: "
<< "removeExpiredCredentials: failed to delete expired credential. Err: "
<< transToken(ter);
}
}
@@ -1454,8 +1454,7 @@ Transactor::processPersistentChanges(TER result, XRPAmount fee)
// should be used, making it possible to do more useful work
// when transactions fail with a `tec` code.
auto typesForResult = [credentialCleanup =
view().rules().enabled(fixCleanup3_4_0)](TER const ter) {
auto typesForResult = [](TER const ter) {
std::unordered_set<LedgerEntryType> types;
if ((ter == tecOVERSIZE) || (ter == tecKILLED))
{
@@ -1464,11 +1463,6 @@ Transactor::processPersistentChanges(TER result, XRPAmount fee)
else if (ter == tecINCOMPLETE)
{
types.insert(ltRIPPLE_STATE);
// A bounded pseudo-account credential cleanup (VaultDelete /
// LoanBrokerDelete) persists its partial credential deletions so a
// later transaction can resume.
if (credentialCleanup)
types.insert(ltCREDENTIAL);
}
else if (ter == tecEXPIRED)
{
@@ -1561,7 +1555,7 @@ Transactor::processPersistentChanges(TER result, XRPAmount fee)
removeDeletedTrustLines(view(), ids, viewJ);
break;
case ltCREDENTIAL:
removeDeletedCredentials(view(), ids, viewJ);
removeExpiredCredentials(view(), ids, viewJ);
break;
// LCOV_EXCL_START
default:

73
src/libxrpl/tx/apply.cpp
View File

@@ -8,6 +8,7 @@
#include <xrpl/core/ServiceRegistry.h>
#include <xrpl/ledger/ApplyView.h>
#include <xrpl/ledger/OpenView.h>
#include <xrpl/protocol/Feature.h>
#include <xrpl/protocol/Rules.h>
#include <xrpl/protocol/SField.h>
#include <xrpl/protocol/STObject.h>
@@ -23,13 +24,38 @@
namespace xrpl {
// These are the same flags defined as HashRouterFlags::PRIVATE1-4 in
// HashRouter.h
// This file owns HashRouterFlags::PRIVATE1-4 and PRIVATE7-8 in HashRouter.h.
// These are the first four; the other two are below.
constexpr HashRouterFlags kSfSigbad = HashRouterFlags::PRIVATE1; // Signature is bad
constexpr HashRouterFlags kSfSiggood = HashRouterFlags::PRIVATE2; // Signature is good
constexpr HashRouterFlags kSfLocalbad = HashRouterFlags::PRIVATE3; // Local checks failed
constexpr HashRouterFlags kSfLocalgood = HashRouterFlags::PRIVATE4; // Local checks passed
// Before fixCleanup3_4_0, a signature in an alternate role field, such as
// sfSponsorSignature, covered the same bytes as the top level signature. Which
// bytes a role signature must cover therefore depends on whether the fix is
// enabled, but the four flags above record only the verdict, not the rules that
// produced it. A verdict reached under one prefix would otherwise be reused
// under the other.
//
// The two flags below hold the verdict for the pre-fix prefixes, so the pre-fix
// and post-fix verdicts occupy separate slots and neither is ever read in the
// other's era. Nothing is cleared when the amendment activates: setFlags only
// sets bits, so a stale pre-fix verdict simply stops being read and ages out
// with the rest of the routing table.
//
// This is not one switchover at a single instant. The era is chosen per call
// from the rules passed in, and callers do not agree on the rules: relay and
// submit verify against the validated rules, which lag the open ledger rules
// that preflight2 verifies against. At the amendment's flag ledger the same
// transaction can therefore be checked under both prefixes, on the same node,
// at the same time.
//
// Remove these two flags, and oldPrefixSig below, when Cleanup3_4_0 is retired
// in features.macro.
constexpr HashRouterFlags kSfSigbadOldPrefix = HashRouterFlags::PRIVATE7;
constexpr HashRouterFlags kSfSiggoodOldPrefix = HashRouterFlags::PRIVATE8;
//------------------------------------------------------------------------------
std::pair<Validity, std::string>
@@ -48,21 +74,41 @@ checkValidity(HashRouter& router, STTx const& tx, Rules const& rules)
return {Validity::SigBad, "Batch inner transactions are never considered validly signed."};
}
if (any(flags & kSfSigbad))
// Pick the cache slot for this call's era; see kSfSiggoodOldPrefix above.
// Only a transaction that carries a role signature, and only while the fix
// is disabled, uses the separate slot. Every other transaction, and every
// transaction once the fix is enabled, uses the ordinary flags and verifies
// exactly once, so there is no steady state cost.
//
// Both directions matter. A good verdict from before the fix must not let a
// signature moved between roles survive the amendment, and a bad verdict
// from before the fix must not condemn a transaction that the new prefixes
// accept.
//
// Whether a transaction carries a role signature is fixed for its ID: the
// fields are kNotSigning, so they are excluded from the signed bytes, but
// they are still covered by the transaction ID. Repeat calls for one ID
// therefore always agree on which slot pair to use.
bool const oldPrefixSig = !rules.enabled(fixCleanup3_4_0) &&
(tx.isFieldPresent(sfSponsorSignature) || tx.isFieldPresent(sfCounterpartySignature));
auto const sigbadFlag = oldPrefixSig ? kSfSigbadOldPrefix : kSfSigbad;
auto const siggoodFlag = oldPrefixSig ? kSfSiggoodOldPrefix : kSfSiggood;
if (any(flags & sigbadFlag))
{
// Signature is known bad
return {Validity::SigBad, "Transaction has bad signature."};
}
if (!any(flags & kSfSiggood))
if (!any(flags & siggoodFlag))
{
auto const sigVerify = tx.checkSign(rules);
if (!sigVerify)
{
router.setFlags(id, kSfSigbad);
router.setFlags(id, sigbadFlag);
return {Validity::SigBad, sigVerify.error()};
}
router.setFlags(id, kSfSiggood);
router.setFlags(id, siggoodFlag);
}
// Signature is now known good
@@ -94,6 +140,19 @@ checkValidity(HashRouter& router, STTx const& tx, Rules const& rules)
void
forceValidity(HashRouter& router, uint256 const& txid, Validity validity)
{
// Callers reach here when they deliberately skip signature verification,
// such as a cluster peer that trusts its neighbor's checks, or a
// configuration that turns signature checks off. Nothing was verified, so
// there is no prefix era to record. Mark both of checkValidity's signature
// slots good: otherwise the forced verdict is ignored for a role-signature
// transaction until fixCleanup3_4_0 is enabled, and the signature the
// caller meant to skip gets verified after all. Marking both cannot leak a
// verdict across eras, because no verdict was reached, and this is the only
// place the distinction can be recorded: kSfSiggood alone does not say
// whether checkValidity verified a post-fix signature or a caller forced
// the result. An already cached bad verdict still wins, since checkValidity
// tests its bad flag first. Drop kSfSiggoodOldPrefix when Cleanup3_4_0 is
// retired.
HashRouterFlags flags = HashRouterFlags::UNDEFINED;
switch (validity)
{
@@ -101,7 +160,7 @@ forceValidity(HashRouter& router, uint256 const& txid, Validity validity)
flags |= kSfLocalgood;
[[fallthrough]];
case Validity::SigGoodOnly:
flags |= kSfSiggood;
flags |= kSfSiggood | kSfSiggoodOldPrefix;
[[fallthrough]];
case Validity::SigBad:
// would be silly to call directly

51
src/libxrpl/tx/invariants/InvariantCheck.cpp
View File

@@ -1123,10 +1123,17 @@ NoModifiedUnmodifiableFields::finalize(
ReadView const& view,
beast::Journal const& j)
{
static auto const kFieldChanged = [](auto const& before, auto const& after, auto const& field) {
auto const kFieldChanged = [&j, &tx](auto const& before, auto const& after, auto const& field) {
bool const beforeField = before->isFieldPresent(field);
bool const afterField = after->isFieldPresent(field);
return beforeField != afterField || (afterField && before->at(field) != after->at(field));
bool const changed =
beforeField != afterField || (afterField && before->at(field) != after->at(field));
if (changed)
{
JLOG(j.fatal()) << "Invariant failed: " << field.getName()
<< " changed on immutable ledger entry in " << tx.getTransactionID();
}
return changed;
};
for (auto const& slePair : changedEntries_)
{
@@ -1172,13 +1179,40 @@ NoModifiedUnmodifiableFields::finalize(
kFieldChanged(before, after, sfPaymentInterval) ||
kFieldChanged(before, after, sfGracePeriod) ||
kFieldChanged(before, after, sfLoanScale);
// lsfLoanOverpayment must never toggle. lsfLoanDefault may only
// transition from unset to set, which combined with ValidLoan's rule that
// only LoanManage may change it makes the flag write-once.
if (view.rules().enabled(featureLendingProtocolV1_1))
{
std::uint32_t const beforeFlags = before->getFlags();
std::uint32_t const afterFlags = after->getFlags();
bool const overpaymentChanged =
(beforeFlags & lsfLoanOverpayment) != (afterFlags & lsfLoanOverpayment);
if (overpaymentChanged)
{
JLOG(j.fatal()) << "Invariant failed: lsfLoanOverpayment flag "
"toggled on immutable ledger entry in "
<< tx.getTransactionID();
}
bad = bad || overpaymentChanged;
bool const defaultCleared =
(beforeFlags & lsfLoanDefault) != 0 && (afterFlags & lsfLoanDefault) == 0;
if (defaultCleared)
{
JLOG(j.fatal()) << "Invariant failed: lsfLoanDefault flag "
"cleared on immutable ledger entry in "
<< tx.getTransactionID();
}
bad = bad || defaultCleared;
}
break;
case ltVAULT:
/*
* sfAccount, sfAsset and sfShareMPTID are already
* captured by VaultInvariant. The additional fields
* below are introduced by featureLendingProtocolV1_1
* and only exist on V1_1 vaults.
* All the fields below are only immutable from
* featureLendingProtocolV1_1 onwards; some of them only exist on
* V1_1 vaults. Before that amendment, sfAsset, sfAccount and
* sfShareMPTID are checked by VaultInvariant instead.
*/
if (view.rules().enabled(featureLendingProtocolV1_1))
{
@@ -1190,7 +1224,10 @@ NoModifiedUnmodifiableFields::finalize(
kFieldChanged(before, after, sfOwner) ||
kFieldChanged(before, after, sfWithdrawalPolicy) ||
kFieldChanged(before, after, sfScale) ||
kFieldChanged(before, after, sfLEVersion);
kFieldChanged(before, after, sfLEVersion) ||
kFieldChanged(before, after, sfAsset) ||
kFieldChanged(before, after, sfAccount) ||
kFieldChanged(before, after, sfShareMPTID);
}
break;
default:

82
src/libxrpl/tx/invariants/LoanBrokerInvariant.cpp
View File

@@ -1,13 +1,18 @@
#include <xrpl/tx/invariants/LoanBrokerInvariant.h>
#include <xrpl/basics/Log.h>
#include <xrpl/basics/Number.h>
#include <xrpl/beast/utility/Journal.h>
#include <xrpl/beast/utility/Zero.h>
#include <xrpl/ledger/ReadView.h>
#include <xrpl/ledger/helpers/LendingHelpers.h>
#include <xrpl/ledger/helpers/TokenHelpers.h>
#include <xrpl/protocol/Asset.h>
#include <xrpl/protocol/Feature.h>
#include <xrpl/protocol/Indexes.h>
#include <xrpl/protocol/LedgerFormats.h>
#include <xrpl/protocol/SField.h>
#include <xrpl/protocol/STAmount.h>
#include <xrpl/protocol/STLedgerEntry.h>
#include <xrpl/protocol/STNumber.h> // IWYU pragma: keep
#include <xrpl/protocol/STTx.h>
@@ -22,6 +27,24 @@ namespace xrpl {
void
ValidLoanBroker::visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after)
{
// Track LoanBroker deletions so finalize() can enforce:
// (a) only ttLOAN_BROKER_DELETE removes a broker
// (b) at most one broker is removed per transaction
// (c) DebtTotal and OwnerCount were zero before deletion
// `before` is the pre-transaction state, which is what
// LoanBrokerDelete::preclaim reads. Erased trust lines and MPTokens need no
// special handling here: the `if (after)` branch below already records them.
if (isDelete && before && before->getType() == ltLOAN_BROKER)
{
if (deletedBroker_)
{
multipleBrokerDeletions_ = true;
}
else
{
deletedBroker_ = before;
}
}
if (after)
{
if (after->getType() == ltLOAN_BROKER)
@@ -99,6 +122,64 @@ ValidLoanBroker::finalize(
// Loan Brokers will not exist on ledger if the Lending Protocol amendment
// is not enabled, so there's no need to check it.
// Deletion invariants (featureLendingProtocolV1_1). At most one
// LoanBroker may be removed per transaction, and only by
// ttLOAN_BROKER_DELETE, and only when its pre-state OwnerCount is zero and
// its pre-state DebtTotal is zero to the precision of the vault asset. The
// DebtTotal check complements ValidLoan's
// LoanBrokerDelete-must-not-touch-any-loan rule: even a broker that has
// finished paying off every loan may still hold non-zero exposure until
// its LoanBrokerCoverWithdraw settles, and neither state is safe to
// delete.
if (view.rules().enabled(featureLendingProtocolV1_1))
{
if (multipleBrokerDeletions_)
{
JLOG(j.fatal())
<< "Invariant failed: more than one Loan Broker deleted in a single transaction";
return false;
}
if (deletedBroker_)
{
if (tx.getTxnType() != ttLOAN_BROKER_DELETE)
{
JLOG(j.fatal()) << "Invariant failed: " << //
"Loan Broker deleted by a transaction other than LoanBrokerDelete";
return false;
}
// Mirror LoanBrokerDelete::preclaim, which accepts a DebtTotal
// that rounds to zero at the vault's AssetsTotal scale rather than
// requiring an exact zero. Requiring more here would turn a
// transaction the transactor deliberately permits into an
// invariant failure.
if (auto const debtTotal = deletedBroker_->at(sfDebtTotal); debtTotal != beast::kZero)
{
// The erased broker is also collected in brokers_, and that
// loop reports a missing vault, so no separate diagnostic is
// needed here. Without a vault there is no scale to round at,
// so the residue cannot be excused as dust.
auto const vault = view.read(keylet::vault(deletedBroker_->at(sfVaultID)));
if (!vault ||
roundToAsset(
Asset{vault->at(sfAsset)},
debtTotal,
getAssetsTotalScale(vault),
Number::RoundingMode::TowardsZero) != beast::kZero)
{
JLOG(j.fatal())
<< "Invariant failed: Loan Broker deleted with non-zero debt total";
return false;
}
}
if (deletedBroker_->at(sfOwnerCount) != 0)
{
JLOG(j.fatal())
<< "Invariant failed: Loan Broker deleted with non-zero owner count";
return false;
}
}
}
for (auto const& line : lines_)
{
for (auto const& field : {&sfLowLimit, &sfHighLimit})
@@ -142,7 +223,6 @@ ValidLoanBroker::finalize(
auto const& before = broker.brokerBefore;
// https://github.com/Tapanito/XRPL-Standards/blob/xls-66-lending-protocol/XLS-0066d-lending-protocol/README.md#3123-invariants
// If `LoanBroker.OwnerCount = 0` the `DirectoryNode` will have at most
// one node (the root), which will only hold entries for `RippleState`
// or `MPToken` objects.

163
src/libxrpl/tx/invariants/LoanInvariant.cpp
View File

@@ -1,10 +1,13 @@
#include <xrpl/tx/invariants/LoanInvariant.h>
#include <xrpl/basics/Log.h>
#include <xrpl/basics/Number.h>
#include <xrpl/beast/utility/Journal.h>
#include <xrpl/beast/utility/Zero.h>
#include <xrpl/ledger/ReadView.h>
#include <xrpl/ledger/helpers/VaultHelpers.h>
#include <xrpl/protocol/Asset.h>
#include <xrpl/protocol/Feature.h>
#include <xrpl/protocol/Indexes.h>
#include <xrpl/protocol/LedgerFormats.h>
#include <xrpl/protocol/Protocol.h>
@@ -13,6 +16,7 @@
#include <xrpl/protocol/STNumber.h> // IWYU pragma: keep
#include <xrpl/protocol/STTx.h>
#include <xrpl/protocol/TER.h>
#include <xrpl/protocol/TxFormats.h>
#include <xrpl/protocol/XRPAmount.h>
#include <cstdint>
@@ -22,7 +26,14 @@ namespace xrpl {
void
ValidLoan::visitEntry(bool isDelete, SLE::const_ref before, SLE::const_ref after)
{
if (after && after->getType() == ltLOAN)
// Classify here, but leave the decision about which checks apply to
// finalize(), which is the only place that can see the Rules.
if (isDelete)
{
if (before && before->getType() == ltLOAN)
deletedLoans_.emplace_back(before, after);
}
else if (after && after->getType() == ltLOAN)
{
loans_.emplace_back(before, after);
}
@@ -39,12 +50,23 @@ ValidLoan::finalize(
// Loans will not exist on ledger if the Lending Protocol amendment
// is not enabled, so there's no need to check it.
auto const txType = tx.getTxnType();
bool const lpV11Enabled = view.rules().enabled(featureLendingProtocolV1_1);
// Without featureLendingProtocolV1_1 an erased Loan is subject to the same
// per-entry checks as any modified Loan. From V1_1 onward it is only subject
// to the ttLOAN_DELETE check below.
if (!lpV11Enabled)
loans_.insert(loans_.end(), deletedLoans_.begin(), deletedLoans_.end());
// Ledger entry validation checks.
for (auto const& [before, after] : loans_)
{
// A closed-ended vault must not accept a loan whose final scheduled payment falls on or
// after the vault's RedemptionDate. This mirrors the LoanSet::preclaim gate and only fires
// on loan creation; once the loan exists, its StartDate / PaymentInterval are immutable and
// PaymentRemaining only decreases, so the bound is preserved.
// A closed-ended vault must not accept a loan whose final scheduled payment falls fewer
// than kLoanRedemptionBuffer seconds before the vault's RedemptionDate. This mirrors the
// LoanSet::preclaim gate and only fires on loan creation; once the loan exists, its
// StartDate / PaymentInterval are immutable and PaymentRemaining only decreases, so the
// bound is preserved.
if (!before && isTesSuccess(result))
{
auto const broker = view.read(keylet::loanBroker(after->at(sfLoanBrokerID)));
@@ -59,11 +81,13 @@ ValidLoan::finalize(
std::uint32_t const interval = after->at(sfPaymentInterval);
std::uint32_t const remaining = after->at(sfPaymentRemaining);
std::uint32_t const redemption = vault->at(sfRedemptionDate);
if (std::uint64_t{startDate} + (std::uint64_t{interval} * remaining) >=
if (std::uint64_t{startDate} + (std::uint64_t{interval} * remaining) +
kLoanRedemptionBuffer >
redemption)
{
JLOG(j.fatal()) << "Invariant failed: closed-ended loan final payment "
"must precede RedemptionDate";
"must precede RedemptionDate by at least "
"kLoanRedemptionBuffer";
return false;
}
}
@@ -91,7 +115,11 @@ ValidLoan::finalize(
JLOG(j.fatal()) << "Invariant failed: Fully paid off Loan still has payments remaining";
return false;
}
if (before && (before->isFlag(lsfLoanOverpayment) != after->isFlag(lsfLoanOverpayment)))
// From featureLendingProtocolV1_1 onwards this flag is immutable by way of
// NoModifiedUnmodifiableFields.
if (!lpV11Enabled && before &&
(before->isFlag(lsfLoanOverpayment) != after->isFlag(lsfLoanOverpayment)))
{
JLOG(j.fatal()) << "Invariant failed: Loan Overpayment flag changed";
return false;
@@ -123,6 +151,125 @@ ValidLoan::finalize(
return false;
}
}
if (lpV11Enabled)
{
// Only LoanSet may create a loan.
if (!before && txType != ttLOAN_SET)
{
JLOG(j.fatal()) << "Invariant failed: Loan created by a transaction "
"other than LoanSet";
return false;
}
if (after->at(sfPaymentRemaining) == 0 &&
after->at(~sfNextPaymentDueDate).value_or(0) != 0)
{
JLOG(j.fatal()) << "Invariant failed: Loan with zero payments must have zero next "
"payment due date";
return false;
}
if (before)
{
bool const wasImpaired = before->isFlag(lsfLoanImpaired);
bool const isImpaired = after->isFlag(lsfLoanImpaired);
bool const wasDefaulted = before->isFlag(lsfLoanDefault);
bool const isDefaulted = after->isFlag(lsfLoanDefault);
if (wasImpaired != isImpaired && txType != ttLOAN_MANAGE && txType != ttLOAN_PAY)
{
JLOG(j.fatal()) << "Invariant failed: lsfLoanImpaired changed "
"outside LoanManage or LoanPay";
return false;
}
if (wasDefaulted != isDefaulted && txType != ttLOAN_MANAGE)
{
JLOG(j.fatal()) << "Invariant failed: lsfLoanDefault changed "
"outside LoanManage";
return false;
}
}
// A loan must reference a live loan broker, and that broker must
// reference a live vault; otherwise the loan is orphaned and its
// balances have no counterparty on the ledger.
auto const brokerSle = view.read(keylet::loanBroker(after->at(sfLoanBrokerID)));
if (!brokerSle)
{
JLOG(j.fatal()) << "Invariant failed: Loan broker does not exist";
return false;
}
auto const vaultSle = view.read(keylet::vault(brokerSle->at(sfVaultID)));
if (!vaultSle)
{
JLOG(j.fatal()) << "Invariant failed: Loan broker vault does not exist";
return false;
}
// Interest due (the total value owed less principal and management fee)
// must never be negative. TotalValueOutstanding, PrincipalOutstanding and
// ManagementFeeOutstanding are each independently rounded to sfLoanScale
// by the accounting code, so their difference can carry one unit of
// quantization noise even when the underlying flow is correct. Absorb
// one unit at that scale, matching the pattern used in ValidVault.
auto const interestDue = after->at(sfTotalValueOutstanding) -
after->at(sfPrincipalOutstanding) - after->at(sfManagementFeeOutstanding);
// Only IOU amounts can accumulate STAmount quantization noise. For integral-domain
// assets (XRP/MPT) enforce the boundary strictly.
bool const integral = Asset{vaultSle->at(sfAsset)}.integral();
Number const tolerance = integral ? Number{} : Number{-1, after->at(sfLoanScale)};
if (interestDue < tolerance)
{
JLOG(j.fatal()) << "Invariant failed: Loan interest due is negative";
return false;
}
// Transaction success post-conditions. A successful loan pay makes at least
// one scheduled payment, so a loan left with payments still outstanding
// must show that payment in its balance and schedule. A payment that clears
// the loan outright instead drives PaymentRemaining to zero, which the
// fully-paid-off and zero due-date checks above pin.
if (isTesSuccess(result) && txType == ttLOAN_PAY)
{
if (before && after->at(sfPaymentRemaining) != 0)
{
if (!(after->at(sfPrincipalOutstanding) < before->at(sfPrincipalOutstanding)))
{
JLOG(j.fatal()) << "Invariant failed: loan pay must strictly decrease "
"PrincipalOutstanding on a non-full-repayment";
return false;
}
if (!(after->at(sfPaymentRemaining) < before->at(sfPaymentRemaining)))
{
JLOG(j.fatal()) << "Invariant failed: loan pay must decrease "
"PaymentRemaining on a non-full-repayment";
return false;
}
std::uint32_t const beforeDue = before->at(~sfNextPaymentDueDate).value_or(0);
std::uint32_t const afterDue = after->at(~sfNextPaymentDueDate).value_or(0);
std::uint32_t const interval = after->at(sfPaymentInterval);
if (afterDue <= beforeDue || interval == 0 ||
(afterDue - beforeDue) % interval != 0)
{
JLOG(j.fatal()) << "Invariant failed: loan pay must advance "
"NextPaymentDueDate by a positive multiple of "
"PaymentInterval on a non-full-repayment";
return false;
}
}
}
}
}
// Only LoanDelete may delete a loan.
if (lpV11Enabled && txType != ttLOAN_DELETE && !deletedLoans_.empty())
{
JLOG(j.fatal()) << "Invariant failed: Loan deleted by a transaction "
"other than LoanDelete";
return false;
}
return true;
}

29
src/libxrpl/tx/invariants/MPTInvariant.cpp
View File

@@ -234,14 +234,6 @@ ValidMPTIssuance::finalize(
if (hasPrivilege(tx, Privilege::DestroyMptIssuance))
{
// A VaultDelete that is still cleaning up credentials pinned to its
// pseudo-account returns tecINCOMPLETE and has not yet reached the
// share issuance. Don't require the issuance to be removed until
// the deletion completes (a later transaction).
if (rules.enabled(fixCleanup3_4_0) && txnType == ttVAULT_DELETE &&
result == tecINCOMPLETE)
return mptIssuancesDeleted_ == 0 && mptIssuancesCreated_ == 0;
if (mptIssuancesDeleted_ == 0)
{
JLOG(j.fatal()) << "Invariant failed: MPT issuance deletion "
@@ -832,6 +824,14 @@ ValidMPTTransfer::visitEntry(
if (after)
update(*after, false);
// Record whether every touched AccountRoot was a pseudo-account BEFORE
// the transaction applied (true and false). A transaction that erases a
// pseudo-account (and moves MPT out of it) in the same transaction leaves
// no trace of its pseudo-account status in the post-transaction view
// isAuthorized() sees at finalize() time.
if (before && before->getType() == ltACCOUNT_ROOT)
pseudoAccountsBefore_[before->at(sfAccount)] = isPseudoAccount(before);
}
bool
@@ -844,10 +844,19 @@ ValidMPTTransfer::isAuthorized(
// Pseudo-accounts (Vault, LoanBroker, AMM) hold assets on behalf of their
// participants and are implicitly authorized for any MPT they hold,
// including vault shares whose underlying asset would otherwise require
// auth. Exempt them here rather than relying on requireAuth: the recursive
// auth. Exempt them here rather than relying on requireAuth: the recursive
// share -> underlying descent in requireAuth fails for a pseudo-account
// that holds the share but not the underlying.
if (isPseudoAccount(view, holder, {&sfVaultID, &sfLoanBrokerID, &sfAMMID}))
//
// Use the pre-transaction classification for any account this
// transaction touched (pseudoAccountsBefore_): the post-transaction view
// is wrong for an account this same transaction erased. Untouched
// accounts aren't in the map, so fall back to the current view, which is
// still accurate for them since nothing changed.
auto const pseudoIt = pseudoAccountsBefore_.find(holder);
bool const isPseudo =
pseudoIt != pseudoAccountsBefore_.end() ? pseudoIt->second : isPseudoAccount(view, holder);
if (isPseudo)
return true;
auto const key = keylet::mptoken(mptid, holder);

Some files were not shown because too many files have changed in this diff Show More