Skip to content

cmd: validate addresses consistently across create and edit - #4805

Merged
obol-bulldozer[bot] merged 7 commits into
mainfrom
oisin/address-validation
Nov 4, 2026
Merged

cmd: validate addresses consistently across create and edit#4805
obol-bulldozer[bot] merged 7 commits into
mainfrom
oisin/address-validation

Conversation

@OisinKyne

@OisinKyne OisinKyne commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Validates fee recipient and withdrawal addresses the same way in create cluster, create dkg and edit add-validators, and stores them in EIP-55 checksummed form. Before this, create cluster without a definition file skipped the withdrawal address check entirely. A zero address on mainnet or gnosis is an error in create dkg and a warning elsewhere (where it's legitimate, e.g. splitting the keys of validators that are already active).

The "all-lowercase or all-uppercase, otherwise it must match EIP-55" rule now lives in one place, eth2util.ValidateChecksumAddress. It's used by these commands, by feerecipient sign (which wrongly rejected all-uppercase addresses) and by deposit.WithdrawalCredsFromAddrOrCreds (#4804).

category: bug
ticket: none

@OisinKyne
cmd: validate addresses consistently across create and edit
35997cf 
create cluster without a definition file skipped withdrawal address
validation and the insecure-keys-on-mainnet check, and add-validators
and create dkg fee recipients were never validated, so a zero or
mistyped address on mainnet produced valid deposits.

All create/edit paths now share one rule: 0x + 40 hex, all lower or
all upper case accepted, mixed case must match EIP-55, zero address
forbidden on mainnet/gnosis, stored checksummed.

feerecipient sign refuses gas limit 0 and adopting an in-progress
registration timestamped more than 5 minutes ahead unless --timestamp
confirms it. exit sign with both --validator-public-key and
--validator-index checks the index belongs to the pubkey when the
beacon node knows it.
@codecov

codecov Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 94.78261% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.77%. Comparing base (e7d8587) to head (32bdda9).

Files with missing lines Patch % Lines
cmd/createcluster.go 89.18% 4 Missing ⚠️
cmd/exit_sign.go 88.88% 2 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #4805      +/-   ##
==========================================
+ Coverage   67.72%   67.77%   +0.04%     
==========================================
  Files         255      255              
  Lines       33711    33749      +38     
==========================================
+ Hits        22832    22873      +41     
+ Misses      10878    10875       -3     
  Partials        1        1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

aly-obol
aly-obol previously approved these changes Oct 23, 2026
View reviewed changes
@OisinKyne
cmd: warn instead of fail on new zero address checks
6cf2087 
Zero withdrawal and fee recipient addresses are legitimate when the
generated deposit data is never used, e.g. splitting existing keys of
active validators, or clusters that deposit through their own contracts
(EtherFi's mainnet clusters use the zero withdrawal address).

Keep the existing zero withdrawal address errors in create dkg and
create cluster --definition-file, and only warn on the paths this
branch newly validates: create cluster from flags, add-validators and
fee recipients.
aly-obol
aly-obol previously approved these changes Oct 23, 2026
View reviewed changes
KaloyanTanev
KaloyanTanev previously approved these changes Oct 30, 2026
View reviewed changes
Comment thread cmd/exit_sign.go
Comment on lines +195 to +199
if config.SkipBeaconNodeCheck {
if err := crossCheckValidatorIndex(ctx, eth2Cl, valEth2, valIndex); err != nil {
return nil, err
}
}

@KaloyanTanev KaloyanTanev Oct 30, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIRC the initial idea of using validator indices was precisely for the fact not to require operators to have BN available?

@OisinKyne OisinKyne Nov 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question, I dug into the history. exit sign has needed a beacon node since #2934: the exit domain comes from signing.GetDomain → eth2Cl.Spec and eth2Cl.Domain, even when both --validator-public-key and --validator-index are given. #3104 floated dropping the BN once index was supported, but #3106 kept it, and --beacon-node-endpoints is still [REQUIRED]. So this check added no new requirement. It's one extra Validators call, and it only warns if that call fails.

I've taken the original idea further, though. Since EIP-7044 the exit domain is fixed (Capella fork version plus genesis validators root), so I've opened a follow-up stacked on this one, oisin/exit-sign-offline. It computes the domain locally for known networks and makes the BN optional when both the pubkey and the index are given. It's tested against an independent go-eth2-client computation from each network's genesis validators root (taken from a public beacon API), and end to end: a BN-less sign is verified by the mock API using the BN-derived domain.

@OisinKyne
Merge branch 'main' into oisin/address-validation
fce6ece
@OisinKyne
cmd: use ValidateChecksumAddress for fee recipients and deposit addre…
32bdda9 
…sses

Points feerecipient sign and deposit.WithdrawalCredsFromAddrOrCreds at the shared
eth2util.ValidateChecksumAddress, so the EIP-55 rule lives in one place. This also
fixes feerecipient sign rejecting all-uppercase addresses.

category: refactor
ticket: none
@sonarqubecloud

sonarqubecloud Bot commented Nov 4, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@OisinKyne OisinKyne added the merge when ready Indicates bulldozer bot may merge when all checks pass label Nov 4, 2026
@obol-bulldozer
obol-bulldozer Bot merged commit fd8c6fa into main Nov 4, 2026
13 checks passed
@obol-bulldozer
obol-bulldozer Bot deleted the oisin/address-validation branch November 4, 2026 17:17
@KaloyanTanev KaloyanTanev mentioned this pull request Nov 6, 2026
Merged
KaloyanTanev added a commit that referenced this pull request Nov 6, 2026
@KaloyanTanev @dependabot
@aly-obol @OisinKyne
*: backport bugfixes to v1.11.4 (#4824)
4e9ab50 
* app: fix flaky TestStartChecker (#4654)

(cherry picked from commit f0633d4)

* core/tracker: fix inclusion trim underflow at chain start (#4662)

* core/tracker: fix inclusion trim underflow at chain start

The inclusion checker's slot arithmetic underflows on fresh chains:
before genesis the wall-clock offset is negative, during the first
InclCheckLag slots the checked slot goes negative, and until wall slot
InclCheckLag+InclMissedLag the trim slot goes negative. The trim
underflow makes Trim(huge) delete every pending submission and report
each fresh duty as "duty not included on-chain", failing all early
proposals on every fresh-genesis network.

Skip ticks until a slot is old enough to check, and only trim once a
slot can actually be declared missed.

* core/tracker: check the genesis slot and deflake the regression test

The zero-valued checkedSlot skipped slot 0 as already-checked; start
from a MaxUint64 sentinel instead. Synchronize the chain-start
regression test on the first inclusion check rather than sleeping,
and pin it to the genesis slot so it covers both guards.

* core/tracker: pin attestation-inclusion feature off in regression test

The test wires only checkBlockFunc; disable the attestation_inclusion
feature explicitly so Run cannot take the nil checkBlockAndAttsFunc
path regardless of test ordering.

(cherry picked from commit ad04571)

* build(deps): Bump the docker-dependencies group across 2 directories with 1 update (#4661)

* build(deps): Bump the docker-dependencies group across 2 directories with 1 update

Bumps the docker-dependencies group with 1 update in the / directory: golang.
Bumps the docker-dependencies group with 1 update in the /testutil/promrated directory: golang.

Updates `golang` from 1.26.6-trixie to 1.27.0-trixie

Updates `golang` from 1.26.6-trixie to 1.27.0-trixie

Updates `golang` from 1.26.6-alpine to 1.27.0-alpine

Updates `golang` from 1.26.6-alpine to 1.27.0-alpine

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.27.0-alpine
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-dependencies
- dependency-name: golang
  dependency-version: 1.27.0-trixie
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* bump go to 1.27

* bump cockroachdb/swiss for go1.27 support

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit a67667d)

* build(deps): Bump the go-dependencies group across 1 directory with 4 updates (#4687)

Bumps the go-dependencies group with 4 updates in the / directory: [github.com/prometheus/client_model](https://github.com/prometheus/client_model), [github.com/showwin/speedtest-go](https://github.com/showwin/speedtest-go), [golang.org/x/crypto](https://github.com/golang/crypto) and [github.com/vektra/mockery/v2](https://github.com/vektra/mockery).

Updates `github.com/prometheus/client_model` from 0.6.2 to 0.6.3
- [Release notes](https://github.com/prometheus/client_model/releases)
- [Commits](prometheus/client_model@v0.6.2...v0.6.3)

Updates `github.com/showwin/speedtest-go` from 1.8.2 to 1.8.3
- [Release notes](https://github.com/showwin/speedtest-go/releases)
- [Changelog](https://github.com/showwin/speedtest-go/blob/master/docs/release.md)
- [Commits](showwin/speedtest-go@v1.8.2...v1.8.3)

Updates `golang.org/x/crypto` from 0.55.0 to 0.56.0
- [Commits](golang/crypto@v0.55.0...v0.56.0)

Updates `github.com/vektra/mockery/v2` from 2.53.6 to 2.53.7
- [Release notes](https://github.com/vektra/mockery/releases)
- [Commits](vektra/mockery@v2.53.6...v2.53.7)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_model
  dependency-version: 0.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/showwin/speedtest-go
  dependency-version: 1.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/vektra/mockery/v2
  dependency-version: 2.53.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 4eef0bd)

* app/stacksnipe: redact secret flag values from exported command lines (#4688)

The stack sniping collector read the full command line of every detected
validator client and exported it verbatim, both as the cli_parameters label
of the app_validator_stack_params gauge served on the monitoring endpoint,
and as a field of a debug log line.

Validator client command lines routinely carry secret material, for example
keystore passwords, the paths of files holding them, and keymanager bearer
tokens. Exporting them unmodified pushes that material into the metrics and
log planes, whose readers and retention are usually much broader than the
process table it came from.

Redact the values of flags whose names look sensitive (auth, jwt, key,
passphrase, password, secret, token) before the command line is logged or
handed to the metrics callback. Both the "--flag value" and the
"--flag=value" forms are handled, and flag names are preserved so the
telemetry stays useful. A /proc cmdline is NUL separated, so redaction
normally operates per argument; if the whole command line ever arrives as a
single blob it is split on whitespace first, so redaction fails safe rather
than passing the blob through untouched.

Also warn at startup when --proc-directory is set, and note the disclosure
tradeoff in the flag's help text, so the behaviour is not a surprise.

The feature remains disabled by default.

(cherry picked from commit d467312)

* build(deps): Bump the go-dependencies group with 2 updates (#4690)

Bumps the go-dependencies group with 2 updates: [golang.org/x/sync](https://github.com/golang/sync) and [golang.org/x/time](https://github.com/golang/time).

Updates `golang.org/x/sync` from 0.22.0 to 0.23.0
- [Commits](golang/sync@v0.22.0...v0.23.0)

Updates `golang.org/x/time` from 0.15.0 to 0.16.0
- [Commits](golang/time@v0.15.0...v0.16.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/time
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 67f4b59)

# Conflicts:
#	go.mod
#	go.sum

* dkg/pedersen: buffer channels to not drop early bundles (#4683)

* dkg/pedersen: buffer bundle channels to avoid dropping early bundles

* test response and justification bundle paths

(cherry picked from commit 7464e13)

* dkg: retry transient p2p send failures during ceremonies (#4684)

* p2p: include peer name in send errors

* dkg: retry transient p2p send failures during ceremonies

* p2p: address copilot review on send retries

* dkg: add frost round 1 send retry test

* dkg: apply 60s p2p send timeout to ceremony sends

* dkg: increase ceremony send retries to 5

* p2p: bound send retries by the send timeout budget

* p2p: bound stream creation by the send timeout budget

* p2p: cap each send attempt at its slice of the timeout budget

* p2p: bound each attempt's dial by its deadline slice

* p2p: give each SendReceive attempt the full timeout, clamp negative retries

* p2p: bound SendReceive by its send timeout without slicing the response wait

* p2p: make send timeout per-attempt instead of a shared budget

(cherry picked from commit c878ff0)

* p2p: add message size, read error and concurrency metrics (#4680)

* p2p: add message size and concurrency metrics

* p2p: update inflight gauge under lock

* p2p: cleanup idle inflight keys, observe sent after close write

* p2p: consistent relay error handling, concurrency test

* p2p: count direct-stream resets as read errors

* p2p: observe received size before proto validation

* p2p: named struct for inflight key

(cherry picked from commit c6a6d42)

* build(deps): Bump the go-dependencies group across 1 directory with 5 updates (#4698)

Bumps the go-dependencies group with 3 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/tools](https://github.com/golang/tools).

Updates `golang.org/x/crypto` from 0.56.0 to 0.57.0
- [Commits](golang/crypto@v0.56.0...v0.57.0)

Updates `golang.org/x/net` from 0.58.0 to 0.59.0
- [Commits](golang/net@v0.58.0...v0.59.0)

Updates `golang.org/x/term` from 0.45.0 to 0.46.0
- [Commits](golang/term@v0.45.0...v0.46.0)

Updates `golang.org/x/text` from 0.41.0 to 0.42.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.41.0...v0.42.0)

Updates `golang.org/x/tools` from 0.49.0 to 0.50.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.49.0...v0.50.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 6b1e607)

# Conflicts:
#	go.mod
#	go.sum

* cmd/exit_sign: warn on validators with pending deposits and no index (#4702)

(cherry picked from commit 1928fd0)

* *: keep //nolint:revive from nolintlint false autofix (#4703)

(cherry picked from commit 3f40e6c)

* build(deps): Bump github.com/ethereum/go-ethereum (#4730)

Bumps the go-dependencies group with 1 update: [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum).

Updates `github.com/ethereum/go-ethereum` from 1.17.5 to 1.17.6
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.17.5...v1.17.6)

---
updated-dependencies:
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.17.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit bcd3f41)

* build(deps): Bump the go-dependencies group with 7 updates (#4737)

Bumps the go-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) | `1.17.6` | `1.17.7` |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/stdout/stdouttrace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |

Updates `github.com/ethereum/go-ethereum` from 1.17.6 to 1.17.7
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.17.6...v1.17.7)

Updates `go.opentelemetry.io/otel` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/trace` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

---
updated-dependencies:
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.17.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit ce7f7b2)

* core/scheduler: fix flaky TestSchedulerWait clock rewind (#4726)

(cherry picked from commit a818241)

* p2p: label handler metrics from validated stream protocol (#4722)

* p2p: label handler metrics from validated stream protocol

* p2p: deflake metrics tests racing deferred observations
(cherry picked from commit eb506a6)

* p2p: restore message handler panics metric (#4706)

* build(deps): Bump golang.org/x/tools (#4742)

Bumps the go-dependencies group with 1 update: [golang.org/x/tools](https://github.com/golang/tools).

Updates `golang.org/x/tools` from 0.50.0 to 0.51.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.50.0...v0.51.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 7c0ff60)

* build(deps): Bump the go-dependencies group with 3 updates (#4770)

Bumps the go-dependencies group with 3 updates: [github.com/drand/kyber](https://github.com/drand/kyber), [github.com/drand/kyber-bls12381](https://github.com/drand/kyber-bls12381) and [golang.org/x/sync](https://github.com/golang/sync).

Updates `github.com/drand/kyber` from 1.3.2 to 1.3.3
- [Release notes](https://github.com/drand/kyber/releases)
- [Commits](drand/kyber@v1.3.2...v1.3.3)

Updates `github.com/drand/kyber-bls12381` from 0.3.4 to 0.3.5
- [Release notes](https://github.com/drand/kyber-bls12381/releases)
- [Commits](drand/kyber-bls12381@v0.3.4...v0.3.5)

Updates `golang.org/x/sync` from 0.23.0 to 0.24.0
- [Commits](golang/sync@v0.23.0...v0.24.0)

---
updated-dependencies:
- dependency-name: github.com/drand/kyber
  dependency-version: 1.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/drand/kyber-bls12381
  dependency-version: 0.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 3c480a1)

# Conflicts:
#	go.mod

* app/eth2wrap: bind eth2http service lifetime to caller ctx (#4772)

* app/eth2wrap: bind eth2http service lifetime to caller ctx

* app/retry: retry eth2http not active and not synced errors

(cherry picked from commit e76d179)

* build(deps): Bump the go-dependencies group across 1 directory with 7 updates (#4778)

Bumps the go-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) | `1.17.7` | `1.17.8` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.60.0` | `0.61.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.46.0` | `0.47.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.42.0` | `0.43.0` |
| [golang.org/x/tools](https://github.com/golang/tools) | `0.51.0` | `0.52.0` |

Updates `github.com/ethereum/go-ethereum` from 1.17.7 to 1.17.8
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.17.7...v1.17.8)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
- [Commits](golang/crypto@v0.57.0...v0.58.0)

Updates `golang.org/x/net` from 0.60.0 to 0.61.0
- [Commits](golang/net@v0.60.0...v0.61.0)

Updates `golang.org/x/term` from 0.46.0 to 0.47.0
- [Commits](golang/term@v0.46.0...v0.47.0)

Updates `golang.org/x/text` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.42.0...v0.43.0)

Updates `golang.org/x/tools` from 0.51.0 to 0.52.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.51.0...v0.52.0)

---
updated-dependencies:
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.17.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 6704e6a)

* build(deps): Bump the go-dependencies group across 1 directory with 2 updates (#4790)

* build(deps): Bump the go-dependencies group across 1 directory with 2 updates

Bumps the go-dependencies group with 2 updates in the / directory: [github.com/bufbuild/buf](https://github.com/bufbuild/buf) and [github.com/vektra/mockery/v2](https://github.com/vektra/mockery).

Updates `github.com/bufbuild/buf` from 1.72.0 to 1.74.0
- [Release notes](https://github.com/bufbuild/buf/releases)
- [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md)
- [Commits](bufbuild/buf@v1.72.0...v1.74.0)

Updates `github.com/vektra/mockery/v2` from 2.53.7 to 2.53.8
- [Release notes](https://github.com/vektra/mockery/releases)
- [Commits](vektra/mockery@v2.53.7...v2.53.8)

---
updated-dependencies:
- dependency-name: github.com/bufbuild/buf
  dependency-version: 1.74.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/vektra/mockery/v2
  dependency-version: 2.53.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* *: bump go-libp2p to v0.50.0 for quic-go v0.63

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit dd58d17)

# Conflicts:
#	go.mod
#	go.sum

* core/tracker: debug log sync selection proof inconsistency (#4801)
(cherry picked from commit 2b534eb)

* app/obolapi: send a User-Agent and type 404s on POST (#4808)

* app/obolapi: send a User-Agent and type 404s on POST

* app/obolapi: make WithUserAgent override the default

---------

Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit ae46490)

* cmd: convert deposit sign withdrawal addresses to creds (#4804)

* cmd: convert deposit sign withdrawal addresses to credentials

charon deposit sign hex-decoded --withdrawal-addresses straight into
DepositMessage.WithdrawalCredentials. A 20 byte address (as documented)
was zero-padded by SSZ hashing, so operators signed and the API stored
malformed deposits.

Addresses are now converted to 0x01 (or 0x02 for compounding clusters)
withdrawal credentials. Mixed case addresses must match their EIP-55
checksum. Full 32 byte credentials are still accepted if the prefix
matches the cluster's compounding setting. deposit fetch rejects
credentials from the API that are not 32 bytes.

* eth2util/deposit: reuse withdrawalCredsFromAddr for 32 byte creds

* cmd: test deposit sign zero address and compounding creds

---------

Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit e7d8587)

* cmd: validate addresses consistently across create and edit (#4805)

Validates fee recipient and withdrawal addresses the same way in `create cluster`, `create dkg` and `edit add-validators`, and stores them in EIP-55 checksummed form. Before this, `create cluster` without a definition file skipped the withdrawal address check entirely. A zero address on mainnet or gnosis is an error in `create dkg` and a warning elsewhere (where it's legitimate, e.g. splitting the keys of validators that are already active).

The "all-lowercase or all-uppercase, otherwise it must match EIP-55" rule now lives in one place, `eth2util.ValidateChecksumAddress`. It's used by these commands, by `feerecipient sign` (which wrongly rejected all-uppercase addresses) and by `deposit.WithdrawalCredsFromAddrOrCreds` (#4804).

category: bug
ticket: none
(cherry picked from commit fd8c6fa)

* build(deps): Bump the go-dependencies group across 1 directory with 4 updates (#4817)

Partial backport: only golang.org/x/net v0.62.0. go-builder-client, go-eth2-client and go-ethereum v1.17.10 (requires go-eth2-client v0.30.1 and dynamic-ssz v1.4.0) are gloas-related and left out.

(cherry picked from commit beea8ba)

* *: bump golangci-lint to v2.14.0 (#4741)

(cherry picked from commit 589fc22)

* app/log: silence revive package-naming in redact.go

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: aly <16789036+aly-obol@users.noreply.github.com>
Co-authored-by: Oisín Kyne <4981644+OisinKyne@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@KaloyanTanev KaloyanTanev KaloyanTanev approved these changes
@aly-obol aly-obol aly-obol left review comments

Assignees

No one assigned

Labels

merge when ready Indicates bulldozer bot may merge when all checks pass

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@OisinKyne @aly-obol @KaloyanTanev