Release v2.7.0

.github/dependabot.yml

@@ -0,0 +1,34 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "go"
+    commit-message:
+      prefix: "chore(deps)"
+      include: "scope"
+    ignore:
+      # Quorum relies on a forked etcd replacement pinned in go.mod.
+      - dependency-name: "github.com/coreos/etcd"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "dependencies"
+      - "ci"
+    commit-message:
+      prefix: "chore(ci)"
+      include: "scope"
+    groups:
+      all-dependencies:
+        patterns:
+          - "*"

.github/workflows/codeql.yml

@@ -25,22 +25,22 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
-    - uses: actions/setup-go@v5
+      uses: actions/checkout@v6
+    - uses: actions/setup-go@v6
       with:
-        go-version: '1.25'
+        go-version-file: go.mod
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
 
     # Autobuild attempts to build any compiled languages  (C/C++, Go).
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v4
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4
       with:
         category: "/language:${{matrix.language}}"

.github/workflows/pr.yml

@@ -6,18 +6,18 @@ on:
       - '**.md'
       - .gitignore
 env:
-  GO_VERSION: 1.25.0
+  GO_VERSION: 1.25.8
 jobs:
   lint:
     name: 'Code linters'
     runs-on: ubuntu-latest
     steps:
       - name: 'Setup Go ${{ env.GO_VERSION }}'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: 'Check out project files'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: '0'
           submodules: false
@@ -38,11 +38,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: 'Setup Go ${{ env.GO_VERSION }}'
-        uses: actions/setup-go@v1
+        uses: actions/setup-go@v6
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: 'Check out project files'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: '0'
           submodules: recursive

README.md

@@ -5,7 +5,7 @@
 # GoQuorum for ibet Network
 
 <p>
-  <img alt="Version" src="https://img.shields.io/badge/version-2.5-blue.svg?cacheSeconds=2592000" />
+  <img alt="Version" src="https://img.shields.io/badge/version-2.7-blue.svg?cacheSeconds=2592000" />
 </p>
 
 This project is [GoQuorum](https://github.com/ConsenSys/quorum) fork for [ibet Network](https://github.com/BoostryJP/ibet-Network)
@@ -24,6 +24,9 @@ However, it has been variously patched to be optimized for ibet Network. For exa
 - The default block generation interval is set to 1 second.
 - Fully supports Go 1.25 and applies new 3rd party packages from a security perspective.
 - Made temporary fixes for bugs before they were fixed in the original GoQuorum.
+- Added precompile for secp256r1 signature verification ([EIP-7951](https://eips.ethereum.org/EIPS/eip-7951)).
+- Added precompile for BLS12-381 curve operations ([EIP-2537](https://eips.ethereum.org/EIPS/eip-2537)).
+- Added support for AWS Secrets Manager / KMS based node key management.
 
 ## Building the source
 Building quorum requires both a Go (version 1.25) and a C compiler. 
@@ -38,6 +41,11 @@ or, to build the full suite of utilities:
 make all
 ```
 
+## AWS node key management
+
+For AWS Secrets Manager / KMS based node key setup, see
+[docs/aws-nodekey.md](docs/aws-nodekey.md).
+
 ## License
 
 The go-ethereum library (i.e. all code outside of the `cmd` directory) is licensed under the

build/checksums.txt

@@ -1,53 +1,53 @@
 # This file contains sha256 checksums of optional build dependencies.
 
-# version:golang 1.25.0
+# version:golang 1.25.8
 # https://go.dev/dl/
-4bd01e91297207bfa450ea40d4d5a93b1b531a5e438473b2a06e18e077227225  go1.25.0.src.tar.gz
-e5234a7dac67bc86c528fe9752fc9d63557918627707a733ab4cac1a6faed2d4  go1.25.0.aix-ppc64.tar.gz
-5bd60e823037062c2307c71e8111809865116714d6f6b410597cf5075dfd80ef  go1.25.0.darwin-amd64.tar.gz
-95e836238bcf8f9a71bffea43344cbd35ee1f16db3aaced2f98dbac045d102db  go1.25.0.darwin-amd64.pkg
-544932844156d8172f7a28f77f2ac9c15a23046698b6243f633b0a0b00c0749c  go1.25.0.darwin-arm64.tar.gz
-202a0d8338c152cb4c9f04782429e9ba8bef31d9889272380837e4043c9d800a  go1.25.0.darwin-arm64.pkg
-5ed3cf9a810a1483822538674f1336c06b51aa1b94d6d545a1a0319a48177120  go1.25.0.dragonfly-amd64.tar.gz
-abea5d5c6697e6b5c224731f2158fe87c602996a2a233ac0c4730cd57bf8374e  go1.25.0.freebsd-386.tar.gz
-86e6fe0a29698d7601c4442052dac48bd58d532c51cccb8f1917df648138730b  go1.25.0.freebsd-amd64.tar.gz
-d90b78e41921f72f30e8bbc81d9dec2cff7ff384a33d8d8debb24053e4336bfe  go1.25.0.freebsd-arm.tar.gz
-451d0da1affd886bfb291b7c63a6018527b269505db21ce6e14724f22ab0662e  go1.25.0.freebsd-arm64.tar.gz
-7b565f76bd8bda46549eeaaefe0e53b251e644c230577290c0f66b1ecdb3cdbe  go1.25.0.freebsd-riscv64.tar.gz
-b1e1fdaab1ad25aa1c08d7a36c97d45d74b98b89c3f78c6d2145f77face54a2c  go1.25.0.illumos-amd64.tar.gz
-8c602dd9d99bc9453b3995d20ce4baf382cc50855900a0ece5de9929df4a993a  go1.25.0.linux-386.tar.gz
-2852af0cb20a13139b3448992e69b868e50ed0f8a1e5940ee1de9e19a123b613  go1.25.0.linux-amd64.tar.gz
-05de75d6994a2783699815ee553bd5a9327d8b79991de36e38b66862782f54ae  go1.25.0.linux-arm64.tar.gz
-a5a8f8198fcf00e1e485b8ecef9ee020778bf32a408a4e8873371bfce458cd09  go1.25.0.linux-armv6l.tar.gz
-cab86b1cf761b1cb3bac86a8877cfc92e7b036fc0d3084123d77013d61432afc  go1.25.0.linux-loong64.tar.gz
-d66b6fb74c3d91b9829dc95ec10ca1f047ef5e89332152f92e136cf0e2da5be1  go1.25.0.linux-mips.tar.gz
-4082e4381a8661bc2a839ff94ba3daf4f6cde20f8fb771b5b3d4762dc84198a2  go1.25.0.linux-mips64.tar.gz
-70002c299ec7f7175ac2ef673b1b347eecfa54ae11f34416a6053c17f855afcc  go1.25.0.linux-mips64le.tar.gz
-b00a3a39eff099f6df9f1c7355bf28e4589d0586f42d7d4a394efb763d145a73  go1.25.0.linux-mipsle.tar.gz
-df166f33bd98160662560a72ff0b4ba731f969a80f088922bddcf566a88c1ec1  go1.25.0.linux-ppc64.tar.gz
-0f18a89e7576cf2c5fa0b487a1635d9bcbf843df5f110e9982c64df52a983ad0  go1.25.0.linux-ppc64le.tar.gz
-c018ff74a2c48d55c8ca9b07c8e24163558ffec8bea08b326d6336905d956b67  go1.25.0.linux-riscv64.tar.gz
-34e5a2e19f2292fbaf8783e3a241e6e49689276aef6510a8060ea5ef54eee408  go1.25.0.linux-s390x.tar.gz
-f8586cdb7aa855657609a5c5f6dbf523efa00c2bbd7c76d3936bec80aa6c0aba  go1.25.0.netbsd-386.tar.gz
-ae8dc1469385b86a157a423bb56304ba45730de8a897615874f57dd096db2c2a  go1.25.0.netbsd-amd64.tar.gz
-1ff7e4cc764425fc9dd6825eaee79d02b3c7cafffbb3691687c8d672ade76cb7  go1.25.0.netbsd-arm.tar.gz
-e1b310739f26724216aa6d7d7208c4031f9ff54c9b5b9a796ddc8bebcb4a5f16  go1.25.0.netbsd-arm64.tar.gz
-4802a9b20e533da91adb84aab42e94aa56cfe3e5475d0550bed3385b182e69d8  go1.25.0.openbsd-386.tar.gz
-c016cd984bebe317b19a4f297c4f50def120dc9788490540c89f28e42f1dabe1  go1.25.0.openbsd-amd64.tar.gz
-a1e31d0bf22172ddde42edf5ec811ef81be43433df0948ece52fecb247ccfd8d  go1.25.0.openbsd-arm.tar.gz
-343ea8edd8c218196e15a859c6072d0dd3246fbbb168481ab665eb4c4140458d  go1.25.0.openbsd-arm64.tar.gz
-694c14da1bcaeb5e3332d49bdc2b6d155067648f8fe1540c5de8f3cf8e157154  go1.25.0.openbsd-ppc64.tar.gz
-aa510ad25cf54c06cd9c70b6d80ded69cb20188ac6e1735655eef29ff7e7885f  go1.25.0.openbsd-riscv64.tar.gz
-46f8cef02086cf04bf186c5912776b56535178d4cb319cd19c9fdbdd29231986  go1.25.0.plan9-386.tar.gz
-29b34391d84095e44608a228f63f2f88113a37b74a79781353ec043dfbcb427b  go1.25.0.plan9-amd64.tar.gz
-0a047107d13ebe7943aaa6d54b1d7bbd2e45e68ce449b52915a818da715799c2  go1.25.0.plan9-arm.tar.gz
-9977f9e4351984364a3b2b78f8b88bfd1d339812356d5237678514594b7d3611  go1.25.0.solaris-amd64.tar.gz
-df9f39db82a803af0db639e3613a36681ab7a42866b1384b3f3a1045663961a7  go1.25.0.windows-386.zip
-afd9e0a8d2665ff122c8302bb4a3ce4a5331e4e630ddc388be1f9238adfa8fe3  go1.25.0.windows-386.msi
-89efb4f9b30812eee083cc1770fdd2913c14d301064f6454851428f9707d190b  go1.25.0.windows-amd64.zip
-936bd87109da515f79d80211de5bc6cbda071f2cc577f7e6af1a9e754ea34819  go1.25.0.windows-amd64.msi
-27bab004c72b3d7bd05a69b6ec0fc54a309b4b78cc569dd963d8b3ec28bfdb8c  go1.25.0.windows-arm64.zip
-357d030b217ff68e700b6cfc56097bc21ad493bb45b79733a052d112f5031ed9  go1.25.0.windows-arm64.msi
+e988d4a2446ac7fe3f6daa089a58e9936a52a381355adec1c8983230a8d6c59e  go1.25.8.src.tar.gz
+1bf607b624eae2265deb9a7b3d0991598c77e9387207644ddd3538c6722a46b3  go1.25.8.aix-ppc64.tar.gz
+a0b8136598baf192af400051cee2481ffb407f4c113a81ff400896e26cbce9e4  go1.25.8.darwin-amd64.tar.gz
+9722bc398901f73b98c8475d5414dfd68c004fb54225b1ac66f2abcc4870c3f4  go1.25.8.darwin-amd64.pkg
+c6547959f5dbe8440bf3da972bd65ba900168de5e7ab01464fbdc7ac8375c21c  go1.25.8.darwin-arm64.tar.gz
+8f149c27924b46c933db76f9c39a5a615b0873e87da3836951232eb460b73ba7  go1.25.8.darwin-arm64.pkg
+861ed963876fd93929fedc2dae706c30b1f23e28daaf028fd71f24ef0b708a81  go1.25.8.dragonfly-amd64.tar.gz
+6b28b9c531706fd6cbb8c197b70a31ade42aa3aa537102dcfdcfb516c20852cf  go1.25.8.freebsd-386.tar.gz
+660cb8e324633c27bf9a002fa9431b403c74990d124caaf14282db5fb514d183  go1.25.8.freebsd-amd64.tar.gz
+f5a4901040f901fbfb909784f58072271a81dbbc5abb5a500e5c0993b8792468  go1.25.8.freebsd-arm.tar.gz
+8611b7fc2880a55431f8c59d78312fc49a618ce873ec6f49b7ff182ee4230274  go1.25.8.freebsd-arm64.tar.gz
+7c260fbef616bd266e01785bfdbd26115174f850a002b0e854f1d3eeaf095296  go1.25.8.freebsd-riscv64.tar.gz
+e962f45b16229081634e626efa7e6c8630ac0e0be5ed7f9c48bfbc349d75805c  go1.25.8.illumos-amd64.tar.gz
+40530cd40ccfa4c9934663c1d6c4ef6fb1651db70ffd50af6687520f51b311bb  go1.25.8.linux-386.tar.gz
+ceb5e041bbc3893846bd1614d76cb4681c91dadee579426cf21a63f2d7e03be6  go1.25.8.linux-amd64.tar.gz
+7d137f59f66bb93f40a6b2b11e713adc2a9d0c8d9ae581718e3fad19e5295dc7  go1.25.8.linux-arm64.tar.gz
+cda7e553fa9f6d39e48ed9061bd3da47f6a30b398179d1b2a2f50d9853cafcae  go1.25.8.linux-armv6l.tar.gz
+0ebadb1805a0d2e15dedba9c702c2e89cb7aa6307415a00d1d1e318112511e8d  go1.25.8.linux-loong64.tar.gz
+001fb956e34b3d33a4910be95a20f26a7cc82b6f7deb406d7f6c9af1267e2437  go1.25.8.linux-mips.tar.gz
+054badfc891d688f07fed342a72bf06bb83713d7913fb325857dfaeef8a3f8fb  go1.25.8.linux-mips64.tar.gz
+0feca5fcf234ae6c29d8fd78d4c04d2fe9964eb6be0489cb2090c757e5e0bfea  go1.25.8.linux-mips64le.tar.gz
+0dcc6e2c17a68c805007cd24f6942c09c244aa898616eba498eccd96998d74a7  go1.25.8.linux-mipsle.tar.gz
+2524fd020455be0fd9708a24d32c150ede3e18d004e244f3ef4e079ae878ba2e  go1.25.8.linux-ppc64.tar.gz
+28ed144a945e4d7188c93f8d85fb772a98ed18f8f9f8d3a650696b739f8cc57c  go1.25.8.linux-ppc64le.tar.gz
+1f90bdfabbbf8060f048186f6355b2fb6a839aab499b61f790f90ee5367b05a5  go1.25.8.linux-riscv64.tar.gz
+5496dec036f044ba9833db5d1748b6335a679b61f95ac448bdc356a8a7cbcb10  go1.25.8.linux-s390x.tar.gz
+ff1664c484db5a88cabb95489b21542c6c8bb84737e3bbc9a65633656bd22502  go1.25.8.netbsd-386.tar.gz
+182d9b9ee2990879c6af8030aa9f29cec3cced1adeb46b10145c0d3526856092  go1.25.8.netbsd-amd64.tar.gz
+61cc24bf631fc0a3f4136a2f20077891f1025d673faff5b33dc203c8dd323e98  go1.25.8.netbsd-arm.tar.gz
+4b8a6d86f13db657ddee0e4978ad651ec75289b29f024b11b15a5d7d71ea33e1  go1.25.8.netbsd-arm64.tar.gz
+76568f46851688784c2ac5a71a59bd03b836ffb951f4a271cc03797a56820ed1  go1.25.8.openbsd-386.tar.gz
+dcd515857c70499e1b62ff89401a13d05746d322c4e0833f2a92b9d48a80a73c  go1.25.8.openbsd-amd64.tar.gz
+9fafde8575591f1e4f6052358c0bd5d34a6a361c3b8f977f9742a440b72bb4a7  go1.25.8.openbsd-arm.tar.gz
+94e9bf0f6774b2af7ccad05a303d502039a80ddce77d9c556fc6cfe14bb3ba64  go1.25.8.openbsd-arm64.tar.gz
+5c3b46c2e7201bce2519a74e9d24cf6e1784a18e9984ab6d84e4113b7245400b  go1.25.8.openbsd-ppc64.tar.gz
+58f93c699435ce0906b6cfe91db478fbe2d55bc6a5a5fa6c36b36138bf1e9e15  go1.25.8.openbsd-riscv64.tar.gz
+76b354130e8b1ec5566142dddecd009ad59090b954cc728095ce8d65f5a6ed68  go1.25.8.plan9-386.tar.gz
+64550745e46e589a8c4d25136fb121f9154331e7d8746d4b75497a554a737fba  go1.25.8.plan9-amd64.tar.gz
+48e47d686120eb801c5b05bb434830a28b4a2977531e79ad835dcaffd2281047  go1.25.8.plan9-arm.tar.gz
+08fb8411cca57f619b17ad2dec60dd418c4f2c539f9951a32dd35af9927712a5  go1.25.8.solaris-amd64.tar.gz
+1a48143752863d7a35223f5e1587315e4fa2db7d77695d6ccb11ee5c37b32739  go1.25.8.windows-386.zip
+c6bd560a7825c108d6432ec4fa8ca376df217b1a04d75b45d54c5207ead00201  go1.25.8.windows-386.msi
+8d4ed9a270b33df7a6d3ff3a5316e103e0042fcc4f0c9a80e40378700bab6794  go1.25.8.windows-amd64.zip
+df006a579f55ecc18fbe7c90d27045c070b76641a0c251101a0ca32e314f863b  go1.25.8.windows-amd64.msi
+0ffaef4a9617a8819294b5f52aefca1415dce644a70f5ad155676293ab052a31  go1.25.8.windows-arm64.zip
+ef9df3df960787900e9a680241d624c8556cb09e5f4fabb1e82a928086a999c5  go1.25.8.windows-arm64.msi
 
 # version:golangci 2.4.0
 # https://github.com/golangci/golangci-lint/releases/

build/ci.go

@@ -130,7 +130,7 @@ var (
 	// This is the version of go that will be downloaded by
 	//
 	//     go run ci.go install -dlgo
-	dlgoVersion = "1.25.0"
+	dlgoVersion = "1.25.8"
 )
 
 var GOBIN, _ = filepath.Abs(filepath.Join("build", "bin"))
@@ -207,6 +207,10 @@ func doInstall(cmdline []string) {
 
 	// Disable CLI markdown doc generation in release builds.
 	gobuild.Args = append(gobuild.Args, "-tags", "urfave_cli_no_docs")
+	if runtime.GOOS == "darwin" {
+		// Silence noisy third-party cgo warnings (e.g. go-duktape) on clang.
+		gobuild.Env = appendEnvValue(gobuild.Env, "CGO_CFLAGS", "-w")
+	}
 
 	// We use -trimpath to avoid leaking local paths into the built executables.
 	gobuild.Args = append(gobuild.Args, "-trimpath")
@@ -264,6 +268,22 @@ func buildFlags(env build.Environment, staticLinking bool, buildTags []string) (
 	return flags
 }
 
+func appendEnvValue(env []string, key, value string) []string {
+	prefix := key + "="
+	for i, kv := range env {
+		if strings.HasPrefix(kv, prefix) {
+			current := strings.TrimPrefix(kv, prefix)
+			if current == "" {
+				env[i] = prefix + value
+			} else if !strings.Contains(current, value) {
+				env[i] = prefix + current + " " + value
+			}
+			return env
+		}
+	}
+	return append(env, prefix+value)
+}
+
 // Running The Tests
 //
 // "tests" also includes static analysis tools such as vet.

cmd/geth/main.go

@@ -124,6 +124,8 @@ var (
 		utils.NetrestrictFlag,
 		utils.NodeKeyFileFlag,
 		utils.NodeKeyHexFlag,
+		utils.NodeKeySource,
+		utils.NodeKeyDecryption,
 		utils.DNSDiscoveryFlag,
 		utils.MainnetFlag,
 		utils.DeveloperFlag,

cmd/utils/common/aws_client.go

@@ -0,0 +1,57 @@
+package common
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/kms"
+	"github.com/aws/aws-sdk-go-v2/service/secretsmanager"
+	"github.com/ethereum/go-ethereum/p2p/nodekey"
+	"github.com/naoina/toml"
+)
+
+type AwsClient struct {
+	Config        nodekey.AwsConfig
+	SecretsClient *secretsmanager.Client
+	KMSClient     *kms.Client
+}
+
+func NewAwsClient(configBytes []byte) (*AwsClient, error) {
+	ctx := context.Background()
+
+	// Parse only the AWS-related nodekey sub-config from TOML bytes.
+	var cfg nodekey.AwsConfig
+	if err := toml.Unmarshal(configBytes, &cfg); err != nil {
+		return nil, fmt.Errorf("invalid configuration passed: %w", err)
+	}
+	if err := validateConfigurationValues(cfg); err != nil {
+		return nil, err
+	}
+
+	// Credentials and region are resolved by the AWS default provider chain.
+	awsConfig, err := config.LoadDefaultConfig(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to load AWS config: %w", err)
+	}
+
+	return &AwsClient{
+		Config:        cfg,
+		SecretsClient: secretsmanager.NewFromConfig(awsConfig),
+		KMSClient:     kms.NewFromConfig(awsConfig),
+	}, nil
+}
+
+func validateConfigurationValues(config nodekey.AwsConfig) error {
+	if config.SecretName == "" {
+		return errors.New("need to specify secret name to retrieve data from AWS Secrets Manager")
+	}
+	if config.SecretVersionId == "" && config.SecretVersionStage == "" {
+		return errors.New("need to specify either secret version id or secret version stage")
+	}
+	if config.SecretVersionId != "" && config.SecretVersionStage != "" {
+		return errors.New("secret version id and secret version stage are mutually exclusive")
+	}
+	return nil
+}

cmd/utils/common/aws_client_test.go

@@ -0,0 +1,38 @@
+package common
+
+import (
+	"testing"
+
+	"github.com/ethereum/go-ethereum/p2p/nodekey"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateConfigurationValues(t *testing.T) {
+	err := validateConfigurationValues(nodekey.AwsConfig{})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "secret name")
+
+	err = validateConfigurationValues(nodekey.AwsConfig{SecretName: "boostry/ibet-network/quorum/nodekey"})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "either secret version id or secret version stage")
+
+	err = validateConfigurationValues(nodekey.AwsConfig{
+		SecretName:         "boostry/ibet-network/quorum/nodekey",
+		SecretVersionStage: "AWSCURRENT",
+	})
+	require.NoError(t, err)
+
+	err = validateConfigurationValues(nodekey.AwsConfig{
+		SecretName:      "boostry/ibet-network/quorum/nodekey",
+		SecretVersionId: "f368ae7f-41e6-4d25-8e8e-a3aad0130846",
+	})
+	require.NoError(t, err)
+
+	err = validateConfigurationValues(nodekey.AwsConfig{
+		SecretName:         "boostry/ibet-network/quorum/nodekey",
+		SecretVersionId:    "f368ae7f-41e6-4d25-8e8e-a3aad0130846",
+		SecretVersionStage: "AWSCURRENT",
+	})
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "mutually exclusive")
+}