Repository navigation
fix: gate BLS vote-signature failure log behind gobject category - #7556
Merged
PastaPastaPasta merged 1 commit intoAug 7, 2026
Merged
PastaPastaPasta merged 1 commit into
PastaPastaPasta merged 1 commit into
Conversation
Gate BLS vote-signature failure logs in CGovernanceVote::CheckSignature and CGovernanceObject::ProcessVote behind the BCLog::GOBJECT log category instead of logging unconditionally via LogPrintf. This prevents peers holding valid masternode outpoints with invalid BLS vote signatures or unsupported/invalid signals from spamming debug.log when -debug=gobject is not enabled.
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
WalkthroughGovernance vote validation messages now use category-based Estimated code review effort: 1 (Trivial) | ~2 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/governance/object.cpp (1)
411-411: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winVerify regression coverage for the logging-category contract.
If existing governance tests do not cover these paths, add a focused test that verifies the messages are emitted only when
BCLog::GOBJECTis enabled. Also cover the related change insrc/governance/vote.cppline 204.As per coding guidelines, governance changes must add small tests that prove the changed invariant.
Also applies to: 462-462
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/governance/object.cpp` at line 411, Add focused governance tests covering the logging paths in object.cpp and vote.cpp, verifying messages are emitted only when BCLog::GOBJECT is enabled and suppressed when it is disabled. Reuse existing logging-test utilities and cover both referenced object.cpp locations plus the related vote.cpp path.Source: Coding guidelines
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@src/governance/object.cpp`:
- Line 411: Add focused governance tests covering the logging paths in
object.cpp and vote.cpp, verifying messages are emitted only when BCLog::GOBJECT
is enabled and suppressed when it is disabled. Reuse existing logging-test
utilities and cover both referenced object.cpp locations plus the related
vote.cpp path.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 3e90c0f8-3dff-4ae6-a1aa-e0aff43e1b06
📒 Files selected for processing (2)
src/governance/object.cppsrc/governance/vote.cpp
Collaborator
|
⛔ Blockers found — Opus deferred (commit afe5fda) |
3 of 5 tasks
PastaPastaPasta
added
the
backport-candidate-23.1.x
label
ChatGPT Codex Connector
PastaPastaPasta
added a commit
that referenced
this pull request
Oct 29, 2026
…category afe5fda fix: gate BLS vote-signature failure log behind gobject category (pasta) Pull request description: ## Issue being fixed or feature implemented In `CGovernanceVote::CheckSignature(const CBLSPublicKey&)` (`src/governance/vote.cpp`), a signature verification failure was logged unconditionally via `LogPrintf` instead of `LogPrint(BCLog::GOBJECT, ...)`, unlike key ID signature verification and the rest of vote validation. After PR #7527 (orphan governance votes must pass `GovernanceVote::IsValid` before caching), a peer holding a valid masternode outpoint (public data) plus an invalid BLS signature can reach this path with a vote naming an arbitrary parent hash, producing a `debug.log` line per message without `-debug=gobject` set. Similarly, `CGovernanceObject::ProcessVote` (`src/governance/object.cpp`) logged unsupported vote signals and invalid votes via unconditional `LogPrintf`. ## What was done? Updated the unconditional `LogPrintf` calls in `CGovernanceVote::CheckSignature` and `CGovernanceObject::ProcessVote` to use `LogPrint(BCLog::GOBJECT, ...)`. - `src/governance/vote.cpp`: `CGovernanceVote::CheckSignature(const CBLSPublicKey&)` - `src/governance/object.cpp`: `CGovernanceObject::ProcessVote` (unsupported vote signal and invalid vote paths) ## How Has This Been Tested? - Built locally with dependencies prefix. - Unit tests (`./src/test/test_dash --run_test="*gov*"`) pass. - Log and whitespace linters (`test/lint/lint-logs.py`, `test/lint/lint-whitespace.py`) pass. ## Breaking Changes None. ## Checklist: - [x] I have performed a self-review of my own code - [ ] I have commented my code, particularly in hard-to-understand areas - [ ] I have added or updated relevant unit/integration/functional/e2e tests - [ ] I have made corresponding changes to the documentation - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_ This pull request was created by Codex. Top commit has no ACKs. Tree-SHA512: 99f9fa375dd5ac0d4a21e615938af367650898b3249204956203e3e17965a7e142a40c581bfc93ece8cec999d5064fd41b5443d73c8f453044422a952b20a3a2 (cherry picked from commit 42f9264)
PastaPastaPasta
added a commit
that referenced
this pull request
Oct 29, 2026
71b3f0c Merge #7556: fix: gate BLS vote-signature failure log behind gobject category (pasta) 14dddb1 Merge #7838: fix(wallet): authenticate unlock deadline extensions (pasta) 5f73355 Merge #7858: fix: do not InstantSend-lock provider transactions (pasta) 0d2e579 fix(evo): keep -allowprivatenet out of masternode address validation (Konstantin Akimov) b4cd3fa fix(evo): only write credit pool snapshots inside a block-scoped EvoDB transaction (#7549) (pasta) d215280 Merge #7846: fix: treat pending owner keys and Platform node IDs as one conflict namespace (pasta) db9ec2b Merge #7826: fix: skip repeated authenticated Platform bans (pasta) dcc9596 Merge #7867: fix: refuse masternode list RPCs for blocks outside the active chain (pasta) 197b14a Merge #7866: fix: stop `masternode payments` at the genesis block (pasta) 3055a19 Merge #7850: perf: let CHECKDATASIG use the signature cache (pasta) 4da0099 Merge #7821: fix: relock encrypted wallets after HD upgrade failures (pasta) c7393c0 Merge #7833: fix: gate signing intake before quorum retrieval (pasta) fdf40fe Merge #7828: fix: omit recovery words from invalid mnemonic errors (pasta) 8888af8 Merge #7753: fix: bound masternode list caches by size instead of by new block (pasta) 457af6d Merge #7738: refactor: avoid double lookups and default-inserting map access in governance (pasta) be3b55e Merge #7662: fix: isolate missing quorums in InstantSend batches (pasta) 9bc1e77 Merge #7489: fix: conflict ProRegTx collateral reuse with in-mempool masternode updates (pasta) 5278ce8 Merge #7583: fix: bound pending DKG message retention per proTxHash (pasta) 9ebf78f Merge #7522: fix(net): bound verified inbound connections per proRegTxHash (pasta) 9f2946e Merge #7487: fix: bound DomainPort string deserialization and stop swallowing deser failures (pasta) c077d32 Merge #7527: fix: require a valid masternode signature before caching an orphan governance vote (pasta) dfa7db1 Merge #7518: fix: memoize governance vote signature checks to bound govsync cost (pasta) bb09c49 Merge #7532: fix: bound DYNBITSET allocation against remaining stream size (pasta) 9739f35 Merge #7488: fix: validate ProUpServTx nType at mempool acceptance (pasta) 4687550 Merge #7385: fix: reject invalid extended masternode net info (Pasta) Pull request description: ## Issue being fixed or feature implemented Backports for v23.1.9, on top of current `v23.1.x`. The base already carries the negative-nVersion consensus fix (#2), the invalid-DKG-share fix (#4), the per-sender sig-share scoping (#5), the individual DKG contribution verification (#7) and the provider-decode/orphan-cap hardening (#8), so those are not part of this diff. ## What was done? Cherry-picked (`git cherry-pick -m1 -x`) the develop merges below into `v23.1.x`, in develop merge order. Where a develop merge carried develop-only refactors or APIs absent on `v23.1.x`, only the fix was taken and the adaptation is noted in that commit's message. ### Included (cherry-picks of merged dashpay/dash PRs) - #7385 — `fix: reject invalid extended masternode net info` - #7488 — `fix: validate ProUpServTx nType at mempool acceptance` - #7532 — `fix: bound DYNBITSET allocation against remaining stream size` - #7518 — `fix: memoize governance vote signature checks to bound govsync cost` - #7527 — `fix: require a valid masternode signature before caching an orphan governance vote` - #7487 — `fix: bound DomainPort string deserialization and stop swallowing deser failures` - #7522 — `fix(net): bound verified inbound connections per proRegTxHash` - #7583 — `fix: bound pending DKG message retention per proTxHash` - #7489 — `fix: conflict ProRegTx collateral reuse with in-mempool masternode updates` - #7662 — `fix: isolate missing quorums in InstantSend batches` - #7738 — `fix: do not record a masternode vote before it is validated` - #7753 — `fix: bound masternode list caches by size instead of by new block` - #7828 — `fix: omit recovery words from invalid mnemonic errors` - #7833 — `fix: gate signing intake before quorum retrieval` - #7821 — `fix: relock encrypted wallets after HD upgrade failures` - #7850 — `perf: let CHECKDATASIG use the signature cache` - #7866 — `fix: stop 'masternode payments' at the genesis block` - #7867 — `fix: refuse masternode list RPCs for blocks outside the active chain` - #7826 — `fix: skip repeated authenticated Platform bans` - #7846 — `fix: treat pending owner keys and Platform node IDs as one conflict namespace` - #7858 — `fix: do not InstantSend-lock provider transactions` (with its functional test, ported to v23.1.x) - #7838 — `fix(wallet): authenticate unlock deadline extensions` - #7556 — `fix: gate BLS vote-signature failure log behind gobject category` ### Upstream-derived changes with no clean develop merge (own commits) - `fix(evo): only write credit pool snapshots inside a block-scoped EvoDB transaction (#7549)` — the develop fix landed inside #7639, which is not on this branch, so it is hand-ported (EvoDB transaction-depth counter + `HasActiveTransaction()` gate); develop commits `8503c5d211`/`0325195ecb` cited in the commit. - `fix(evo): keep -allowprivatenet out of masternode address validation` — the consensus portion of #7888 only (develop commit `e3e780801b`); the V24-gated ExtNetInfo parts are excluded. ### Adaptation notes - #7556 pairs with #7527 (already here): once orphan governance votes must pass `IsValid` before caching, a peer with a valid masternode outpoint and an invalid BLS signature can reach the BLS vote-signature failure log, so that log (and two sibling `ProcessVote` logs) is gated behind `BCLog::GOBJECT`. - #7662: the unit test calls `SetMinSporkKeys(1)`; v23.1.x defaults the spork signer threshold to `INT_MAX`, so without it `SPORK_2_INSTANTSEND_ENABLED` never activates and the regression check would be vacuous. - #7858 is taken with its functional test ported to v23.1.x: `wait_for_instantlock` is `(txid, node)` here and does not sync/bump mocktime itself, and develop's `DashTestFramework.bury_tx` does not exist, so the waits sync+bump per node and the bury step is inlined. `IsProviderTx` lists only the four v23.1.x provider special-tx types (the v24-only `DISSOLVE`/`UPDATE_SHARE`/`UPDATE_SHARED_REGISTRAR` are omitted). - #7385/#7488/#7489/#7846: kept v23.1.x `ProTxVersion::ExtAddr` equality and the atomic-pointer `dmnman`; dropped develop-only test setups and the shared-masternode owner-key branch. - #7527/#7738: v23.1.x governance lookup/`ProcessVote` shapes; develop-only refactors excluded. - #7583: re-threaded through `active/dkgsession.*`; #7867: `insert_or_assign`; #7821: `interfaces::MakeHandler`; #7753: dropped the `<atomic>` include/`DoMaintenance` test calls. ### Not included - #7822 (`fix: reject malformed detached quorum share batches`) — its one-line change (record the node in `badSources` rather than `BanNode`) is already present in the base via #5, so the pick is redundant and was dropped. - #7895 (`test: cover retroactive provider tx refusal`) — its functional test needs the single-member-quorum harness absent on `v23.1.x`. - Compact-block extra-tx fix (bitcoin bitcoin#35670) — dropped from this release as a latent, very-hard-to-trigger crash; opened as its own PR against `develop`. - #7861 (pruned-node historical-block reject) — deferred; also missing from `v24.0.0-rc.4` (should land in v24.0.0 final). - Develop-only regressions and V24-gated changes that do not affect `v23.1.x`. ## How Has This Been Tested? Rebased onto current `v23.1.x`; the only merge conflicts were the additive test appends in `src/test/evo_netinfo_tests.cpp` and `src/test/governance_inv_tests.cpp` (kept both the base's and the picks' cases). Assembled branch builds with `--enable-werror` (`dashd` + `test_dash`). The full `test_dash` unit suite passes, and `p2p_instantsend.py` (including the restored `test_provider_tx_not_locked`) passes. Each pick's changed lines were compared with its develop merge; differences are the adaptations above. ## Breaking Changes - #7858: provider transactions no longer receive InstantSend locks. Software that waited for an islock on a ProTx should wait for a ChainLock or confirmations instead. - #7828: invalid-mnemonic RPC errors no longer echo the mnemonic. #7821: encrypted wallets relock after a failed HD upgrade. #7867: `protx info/listdiff` and `masternode payments` error for blocks off the active chain. #7489/#7488: provider transactions with reused collateral or an invalid type are rejected at mempool acceptance. #7888: the RFC1918 masternode-address check applies even with `-allowprivatenet`. #7838: a wallet unlock deadline can no longer be extended without re-authenticating. ## Checklist: - [x] I have performed a self-review of my own code - [ ] I have made corresponding changes to the documentation - [ ] I have assigned this pull request to a milestone 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Behavior Changes** * Provider transactions no longer receive InstantSend locks. They are mined after 10 minutes in the mempool and then protected by a ChainLock; transactions spending their outputs can be locked once mined. Use ChainLocks or confirmations instead of waiting for an InstantSend lock on a provider transaction. * **Bug Fixes** * Masternode RPCs now reject blocks outside the active chain. * Wallet unlock attempts with an incorrect passphrase no longer alter an existing unlock period. * Improved validation and handling of governance votes, network addresses, and masternode connections. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Top commit has no ACKs. Tree-SHA512: d48eaae945bcbad443cf3280c08d2ed00f06816bb09ef70f85fca497a864b89e502d09fb3c9c977f8d0a74d761dc3c29f3b11e217cc7e29c43d1ee691d4df572
PastaPastaPasta
added a commit
that referenced
this pull request
Oct 29, 2026
4722ad9 chore: prepare v23.1.9 release (pasta) Pull request description: ## Issue being fixed or feature implemented Release preparation for **v23.1.9**. This should be the **last** PR merged on `v23.1.x` for this release — after the fix/backport PRs land — then the `v23.1.9` tag is cut from it. ## What was done? - `configure.ac`: bump `_CLIENT_VERSION_BUILD` 8 → 9 (`_CLIENT_VERSION_IS_RELEASE` stays `true`, no RC). - `doc/release-notes.md`: v23.1.9 notes (consensus fix, crash fixes, InstantSend behavior change, security/DoS hardening, wallet). Includes the **Credits** (contributors) and **Older releases** sections and the **v23.1.9 Change log** set-of-changes link. - Archived the v23.1.8 notes to `doc/release-notes/dash/release-notes-23.1.8.md`. - `contrib/flatpak/org.dash.dash-core.metainfo.xml`: added the `23.1.9` release entry. - `doc/man/*.1`: version/date string bump (no CLI options changed this release). ## Notes / decisions for the release owner - **The release notes track the full merged fix set on `v23.1.x`** — #2, #4, #5, #6, #7, #8, #9: - #6: provider transactions are no longer InstantSend-locked (#7858, its own "InstantSend" note), the wallet unlock-deadline re-authentication (#7838), and the BLS vote-signature log gating (#7556, folded into the governance line). - #9: flat-file (block/undo) positions are now 64-bit (folded into "Crash fixes"); socket `poll()`/`select()` exception monitoring alignment and the paused-send peer timeout (folded into "Security and denial-of-service hardening"). - The compact-block extra-tx fix (bitcoin bitcoin#35670) was **dropped** from this release and moved to its own `develop` PR, so it is not in the notes. - **Release notes wording** is a draft and should get a final editorial pass before public disclosure — in particular the consensus-split and DKG items. It follows the v23.1.8 tone (effect, not exploit detail). - **Contributor list** mirrors v23.1.8's; adjust names at release time if needed. - **Man pages**: this commit carries only the version/date bump. A full `contrib/devtools/gen-manpages.py` regeneration from the release build (no `--enable-debug`) is part of the tag/build step, as for v23.1.8. - **Version string vs nightly disclosure**: `_CLIENT_VERSION_IS_RELEASE` is `true`, so the binary reports `v23.1.9` regardless of the git tag name. If the initial (pre-disclosure) publish is under a nightly tag, confirm that is acceptable or decide whether `IS_RELEASE` should be `false` for that phase. - Rebased onto current `v23.1.x` (`4695b31275`, through #9). After #6 merges this should get one final trivial rebase onto `v23.1.x` so the release commit lands on top of every fix. ## Breaking Changes None in this PR (version/notes/manpages only). The behavior changes themselves ship in the fix PRs (most notably #6: provider transactions no longer receive InstantSend locks; #7838: wallet unlock deadline re-authentication). ## Checklist: - [x] I have performed a self-review of my own code - [ ] I have made corresponding changes to the documentation - [ ] I have assigned this pull request to a milestone 🤖 Generated with [Claude Code](https://claude.com/claude-code) Top commit has no ACKs. Tree-SHA512: 877689ec8c661010ffbf6224ed553f1abb131c62ba86c8ac3eac657c7d0811eb58b15654f6ce7818b7ea9aa2b33028ba5c9ded740a31e3328585cfab46e8be75
4 of 5 tasks
PastaPastaPasta
added a commit
that referenced
this pull request
Oct 29, 2026
4722ad9 chore: prepare v23.1.9 release (pasta) 71b3f0c Merge #7556: fix: gate BLS vote-signature failure log behind gobject category (pasta) 14dddb1 Merge #7838: fix(wallet): authenticate unlock deadline extensions (pasta) 5f73355 Merge #7858: fix: do not InstantSend-lock provider transactions (pasta) 0d2e579 fix(evo): keep -allowprivatenet out of masternode address validation (Konstantin Akimov) b4cd3fa fix(evo): only write credit pool snapshots inside a block-scoped EvoDB transaction (#7549) (pasta) d215280 Merge #7846: fix: treat pending owner keys and Platform node IDs as one conflict namespace (pasta) db9ec2b Merge #7826: fix: skip repeated authenticated Platform bans (pasta) dcc9596 Merge #7867: fix: refuse masternode list RPCs for blocks outside the active chain (pasta) 197b14a Merge #7866: fix: stop `masternode payments` at the genesis block (pasta) 3055a19 Merge #7850: perf: let CHECKDATASIG use the signature cache (pasta) 4da0099 Merge #7821: fix: relock encrypted wallets after HD upgrade failures (pasta) c7393c0 Merge #7833: fix: gate signing intake before quorum retrieval (pasta) fdf40fe Merge #7828: fix: omit recovery words from invalid mnemonic errors (pasta) 8888af8 Merge #7753: fix: bound masternode list caches by size instead of by new block (pasta) 457af6d Merge #7738: refactor: avoid double lookups and default-inserting map access in governance (pasta) be3b55e Merge #7662: fix: isolate missing quorums in InstantSend batches (pasta) 9bc1e77 Merge #7489: fix: conflict ProRegTx collateral reuse with in-mempool masternode updates (pasta) 5278ce8 Merge #7583: fix: bound pending DKG message retention per proTxHash (pasta) 9ebf78f Merge #7522: fix(net): bound verified inbound connections per proRegTxHash (pasta) 9f2946e Merge #7487: fix: bound DomainPort string deserialization and stop swallowing deser failures (pasta) c077d32 Merge #7527: fix: require a valid masternode signature before caching an orphan governance vote (pasta) dfa7db1 Merge #7518: fix: memoize governance vote signature checks to bound govsync cost (pasta) bb09c49 Merge #7532: fix: bound DYNBITSET allocation against remaining stream size (pasta) 9739f35 Merge #7488: fix: validate ProUpServTx nType at mempool acceptance (pasta) 4687550 Merge #7385: fix: reject invalid extended masternode net info (Pasta) 58b9bce fix: keep flat-file positions 64-bit clean at the remaining raw seek/tell sites (Konstantin Akimov) 7a21752 Merge bitcoin#36667: net: enforce timeout interval for paused send peers (Konstantin Akimov) 58abb28 Merge bitcoin#36665: sock: align exception monitoring between poll() and select() backends (Konstantin Akimov) 8030deb Merge bitcoin#36669: refactor: store positions as a 64 bits integer in flatfiles (Konstantin Akimov) b1178f9 fix(llmq): judge every sig-share sender by its own verified shares (pasta) 33ec74e fix(governance): cap the orphan parent objects re-requested per tick (pasta) 7fc0edb doc(rpc): mark provider payload network fields optional in the help (pasta) 2aa3a87 fix(rpc): don't dereference a missing netInfo when decoding provider payloads (pasta) 120b5db fix(llmq): verify DKG contributions individually when a batch vvec check fails (pasta) 808b105 Merge #7486: fix: guard VerifyContributionShares against an empty verification-vector set (pasta) 8351db9 fix(llmq): reject invalid decrypted DKG shares before aggregation (pasta) 07494dd fix(consensus): reject negative transaction nVersion after DIP3 (pasta) Pull request description: ## Issue being fixed or feature implemented Merges the v23.1.9 release back into develop. v23.1.9 ships five security fixes and three Bitcoin Core network/storage backports that develop doesn't have yet. Without this merge, develop-based nodes (v24) stay exposed to all of them. Note on the base: `master` is still at 728f505 (v23.1.8 + crash fixes) and has not been fast-forwarded to the release yet. It is an ancestor of the signed `v23.1.9` tag, so this PR merges the tag commit (67c106f). That gives exactly the result of merging `master` once it is fast-forwarded. ## What was done? One merge commit. Most of v23.1.9 is backports of develop PRs that develop already has (#7385, #7486, #7487, #7488, #7489, #7518, #7522, #7527, #7532, #7556, #7583, #7662, #7738, #7753, #7821, #7826, #7828, #7833, #7838, #7846, #7850, #7858, #7866, #7867, and the `-allowprivatenet` fix from #7888). Those conflicts resolve to develop's code. The new payload, adapted to develop's layout: - **Sig-share sender aliasing** (`fix(llmq): judge every sig-share sender by its own verified shares`). The batch verifier is now keyed by `(NodeId, SigShareKey)`, so two peers pushing the same key can't be judged by each other's signature. Ported into develop's `NetSigning::ProcessPendingSigShares` (`net_signing.cpp`). The second half of the v23 fix (malformed share → `badSources`) was already on develop. - **Negative tx `nVersion`** (`fix(consensus): reject negative transaction nVersion after DIP3`). Applied as-is, plus `PackVersionAndType()` at all three pack sites. - **Invalid decrypted DKG shares** (`fix(llmq): reject invalid decrypted DKG shares before aggregation`). The QDATA check lived in `src/active/quorums.cpp`, which develop deleted; it is ported into `NetQuorum::ProcessContribQDATA` (`llmq/net_quorum.cpp`). The new `feature_llmq_dkgerrors.py` case passes numeric `dkgsimerror` rates, which develop's RPC requires. - **Batch vvec fallback** (`fix(llmq): verify DKG contributions individually when a batch vvec check fails`). The new `bls_tests` case calls develop's `CBLSWorker::Start(4)`, which takes an explicit worker count. - **Orphan governance re-request cap** (`fix(governance): cap the orphan parent objects re-requested per tick`). At most 100 orphan parents are re-requested per tick. The test helper uses develop's `governance::OrphanVote`. - **bitcoin#36665, bitcoin#36667**. Applied cleanly. - **bitcoin#36669**. Develop moved `TruncateFile`/`AllocateFileRange` into `util/fs_helpers.{h,cpp}`, so those hunks, `FileSeek64` and `FileTell64` land there. - **64-bit flat-file positions** (`fix: keep flat-file positions 64-bit clean at the remaining raw seek/tell sites`). Covers `txindex.cpp` and `blockstorage.cpp`, which now include `util/fs_helpers.h`. It also covers develop-only `BlockFilterIndex::LookupFilterRange` (from #7574's file-handle reuse), which seeks on a `FlatFilePos` the same way. - **Release bookkeeping**: v23.1.9 release notes, archived 23.1.8 notes, flatpak release entry and regenerated man pages. `configure.ac` keeps develop's 24.1.0 / `IS_RELEASE=false`. Deliberately resolved to develop's side: - `fix(rpc): don't dereference a missing netInfo when decoding provider payloads` and its help-text follow-up. On develop an unknown-version ProTx payload reaches `netInfo` only through `CHECK_NONFATAL`, so `decoderawtransaction` returns an RPC error instead of dereferencing null; the v23 commit message says this is the develop equivalent. Reporting the payload without network fields (as v23.1.9 now does) would be a nicer develop follow-up, but it doesn't belong in this merge. - `fix(evo): only write credit pool snapshots inside a block-scoped EvoDB transaction (#7549)`. This is a v23 hand-port of develop's own 8503c5d / 0325195. - `src/active/quorums.cpp` stays deleted. ## How Has This Been Tested? Linux x86_64, `--enable-debug --enable-werror`, built `dashd` and `test_dash`. - Unit suites, all passing: `llmq_utils_tests`, `transaction_tests`, `txvalidation_tests`, `sighash_tests`, `bls_tests`, `governance_inv_tests`, `llmq_dkg_tests`, `flatfile_tests`, `fs_tests`, `net_tests`, `sock_tests`, `evo_netinfo_tests`, `evo_assetlocks_tests`, `blockfilter_index_tests`, `txindex_tests`, `blockmanager_tests`. - Functional tests, all passing: `feature_llmq_dkgerrors.py` (including the new contribution-invalid case), `feature_llmq_signing.py` (both variants), `p2p_timeouts.py` (v1/v2), `mempool_accept.py`. - `git diff --remerge-diff` is empty on all eight v23.1.9 merge commits, so the release has no hidden merge-only changes. - An independent review compared each port with its v23.1.9 commit and checked develop for second copies of each bug: other `SigShareKey` batch verifiers, other decrypt-then-aggregate sites, other `fPauseSend` setters and other raw seeks on `FlatFilePos`. It also spot-checked that the PRs treated as "already on develop" have equivalent code there. I did not run the full functional suite locally; CI covers it. ## Breaking Changes Consensus: once DIP3 is active, transactions with a negative `nVersion` are rejected (`bad-txns-version`). Every v23.1.9 node already enforces this. Such transactions were already split-inducing, since a re-serialized copy changes `nType`. ## Checklist: - [x] I have performed a self-review of my own code - [x] I have commented my code, particularly in hard-to-understand areas - [x] I have added or updated relevant unit/integration/functional/e2e tests - [x] I have made corresponding changes to the documentation - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) ACKs for top commit: UdjinM6: utACK 257af26 Tree-SHA512: d6d19ecbfaa0a891b09887169ec2709a7dfde06af022203ca28e80fdf009ca360f2704ebadca1f830a97663dac09da78d05c979d9c30ee91780065550070b954
PastaPastaPasta
added a commit
that referenced
this pull request
Oct 29, 2026
…xes, #7947) 4722ad9 chore: prepare v23.1.9 release (pasta) 71b3f0c Merge #7556: fix: gate BLS vote-signature failure log behind gobject category (pasta) 14dddb1 Merge #7838: fix(wallet): authenticate unlock deadline extensions (pasta) 5f73355 Merge #7858: fix: do not InstantSend-lock provider transactions (pasta) 0d2e579 fix(evo): keep -allowprivatenet out of masternode address validation (Konstantin Akimov) b4cd3fa fix(evo): only write credit pool snapshots inside a block-scoped EvoDB transaction (#7549) (pasta) d215280 Merge #7846: fix: treat pending owner keys and Platform node IDs as one conflict namespace (pasta) db9ec2b Merge #7826: fix: skip repeated authenticated Platform bans (pasta) dcc9596 Merge #7867: fix: refuse masternode list RPCs for blocks outside the active chain (pasta) 197b14a Merge #7866: fix: stop `masternode payments` at the genesis block (pasta) 3055a19 Merge #7850: perf: let CHECKDATASIG use the signature cache (pasta) 4da0099 Merge #7821: fix: relock encrypted wallets after HD upgrade failures (pasta) c7393c0 Merge #7833: fix: gate signing intake before quorum retrieval (pasta) fdf40fe Merge #7828: fix: omit recovery words from invalid mnemonic errors (pasta) 8888af8 Merge #7753: fix: bound masternode list caches by size instead of by new block (pasta) 457af6d Merge #7738: refactor: avoid double lookups and default-inserting map access in governance (pasta) be3b55e Merge #7662: fix: isolate missing quorums in InstantSend batches (pasta) 9bc1e77 Merge #7489: fix: conflict ProRegTx collateral reuse with in-mempool masternode updates (pasta) 5278ce8 Merge #7583: fix: bound pending DKG message retention per proTxHash (pasta) 9ebf78f Merge #7522: fix(net): bound verified inbound connections per proRegTxHash (pasta) 9f2946e Merge #7487: fix: bound DomainPort string deserialization and stop swallowing deser failures (pasta) c077d32 Merge #7527: fix: require a valid masternode signature before caching an orphan governance vote (pasta) dfa7db1 Merge #7518: fix: memoize governance vote signature checks to bound govsync cost (pasta) bb09c49 Merge #7532: fix: bound DYNBITSET allocation against remaining stream size (pasta) 9739f35 Merge #7488: fix: validate ProUpServTx nType at mempool acceptance (pasta) 4687550 Merge #7385: fix: reject invalid extended masternode net info (Pasta) 58b9bce fix: keep flat-file positions 64-bit clean at the remaining raw seek/tell sites (Konstantin Akimov) 7a21752 Merge bitcoin#36667: net: enforce timeout interval for paused send peers (Konstantin Akimov) 58abb28 Merge bitcoin#36665: sock: align exception monitoring between poll() and select() backends (Konstantin Akimov) 8030deb Merge bitcoin#36669: refactor: store positions as a 64 bits integer in flatfiles (Konstantin Akimov) b1178f9 fix(llmq): judge every sig-share sender by its own verified shares (pasta) 33ec74e fix(governance): cap the orphan parent objects re-requested per tick (pasta) 7fc0edb doc(rpc): mark provider payload network fields optional in the help (pasta) 2aa3a87 fix(rpc): don't dereference a missing netInfo when decoding provider payloads (pasta) 120b5db fix(llmq): verify DKG contributions individually when a batch vvec check fails (pasta) 808b105 Merge #7486: fix: guard VerifyContributionShares against an empty verification-vector set (pasta) 8351db9 fix(llmq): reject invalid decrypted DKG shares before aggregation (pasta) 07494dd fix(consensus): reject negative transaction nVersion after DIP3 (pasta) 11ea306 Merge #7947: fix: stop quorum key warming from stalling DKG on 2-core masternodes (pasta) 25d7c85 Merge #7826: fix: skip repeated authenticated Platform bans (pasta) 18073dd Merge #7850: perf: let CHECKDATASIG use the signature cache (pasta) 3759397 Merge #7833: fix: gate signing intake before quorum retrieval (pasta) db98ee2 fix: keep flat-file positions 64-bit clean at the remaining raw seek/tell sites (Konstantin Akimov) 54c9738 Merge bitcoin#36667: net: enforce timeout interval for paused send peers (Konstantin Akimov) f1adb2c Merge bitcoin#36665: sock: align exception monitoring between poll() and select() backends (Konstantin Akimov) 8becf6a Merge bitcoin#36669: refactor: store positions as a 64 bits integer in flatfiles (Konstantin Akimov) 4c0cbd6 fix(llmq): judge every sig-share sender by its own verified shares (pasta) 649259f fix(governance): cap the orphan parent objects re-requested per tick (pasta) 418f5ee fix(llmq): verify DKG contributions individually when a batch vvec check fails (pasta) abf2eb0 fix(llmq): reject invalid decrypted DKG shares before aggregation (pasta) 39bda8f fix(consensus): reject negative transaction nVersion after DIP3 (pasta) Pull request description: ## Issue being fixed or feature implemented Backports for v24.0.0-rc.5, on top of `v24.0.x` at the v24.0.0-rc.4 tag (0e7382d, #7917). This PR holds the must-haves for rc.5: the v23.1.9 fixes that v24.0.x does not have yet, and #7947 (DKG stalls that get 2-core masternodes PoSe-banned). Without the v23.1.9 part, rc.5 would be missing fixes that the already published v23.1.9 ships, and it would accept transactions that v23.1.9 nodes reject (see Breaking Changes). The remaining `backport-candidate-24.0.x` work (#7916 and its test prerequisite) will follow in a separate PR so this one stays reviewable. ## What was done? ### v23.1.9 fixes not yet on v24.0.x v23.1.9 (tag 67c106f) contains 46 commits since v23.1.8. Each one was checked by content against `v24.0.x`. Most are backports of develop PRs that `v24.0.x` already has, either from before its branch point or picked for rc.3/rc.4. The rest are picked here with `git cherry-pick -x` from `v23.1.x`, in v23.1.9 merge order: - `fix(consensus): reject negative transaction nVersion after DIP3` (07494dd), **consensus**. Context-only conflict in `primitives/transaction.h`. - `fix(llmq): reject invalid decrypted DKG shares before aggregation` (8351db9). The QDATA path that v23 has in `src/active/quorums.cpp` is `src/llmq/net_quorum.cpp` on this branch. The new `feature_llmq_dkgerrors.py` case passes numeric `dkgsimerror` rates. - `fix(llmq): verify DKG contributions individually when a batch vvec check fails` (120b5db). The new `bls_tests` case calls `CBLSWorker::Start(4)`, since `Start()` takes an explicit worker count here. - `fix(governance): cap the orphan parent objects re-requested per tick` (33ec74e). The test helper uses this branch's `governance::OrphanVote`. - `fix(llmq): judge every sig-share sender by its own verified shares` (b1178f9). Ported into `NetSigning::ProcessPendingSigShares` (`llmq/net_signing.cpp`). The second half of the v23 fix (malformed share → `badSources`) is already on this branch. - bitcoin#36669 (8030deb). The `util/system` hunks land in `util/fs_helpers.{h,cpp}`. Two upstream hunks that the v23 port dropped are restored here, because this branch has their equivalents: `BlockInfo::data_pos` becomes `uint64_t` (in `interfaces/chain.h`), and `AutoFile`'s XOR read/write paths use `FileTell64`. - bitcoin#36665 (58abb28), bitcoin#36667 (7a21752). Clean. - `fix: keep flat-file positions 64-bit clean at the remaining raw seek/tell sites` (58b9bce). Also covers `BlockFilterIndex::LookupFilterRange`, which only this branch has. - #7833 fix: gate signing intake before quorum retrieval - #7850 perf: let CHECKDATASIG use the signature cache - #7826 fix: skip repeated authenticated Platform bans The last three are develop merges, picked with `-m1 -x` from develop; they change exactly the same lines as their develop merges. Every adaptation above is described in its commit message, and each matches how the open v23.1.9 → develop merge (#7961) resolves the same commit. Already on `v24.0.x` in another form, so not picked: - The credit-pool snapshot fix for #7549 (b4cd3fa) is a v23 hand-port of develop's 8503c5d / 0325195 (#7639), which this branch already has. - `fix(evo): keep -allowprivatenet out of masternode address validation` (0d2e579) is already covered by #7888. - `fix(rpc): don't dereference a missing netInfo when decoding provider payloads` (2aa3a87) and its help-text follow-up (7fc0edb). Here those accesses go through `CHECK_NONFATAL`, so an unknown-version ProTx payload gets an RPC error instead of a crash. The v23 commit message names this as the develop equivalent. ### Merge of v23.1.9 The last commit merges the v23.1.9 tag (67c106f, now `master`) with the tree unchanged (`-s ours`). `master` moved to v23.1.9 today, and `check_merge` requires `master` to fast-forward to `v24.0.x` plus the PR. The final v24.0.0 also has to contain every v23.1.9 commit. All of v23.1.9's content is already on the branch through the picks above, so every commit resolves to the `v24.0.x` side, as #7961 did on develop. Release bookkeeping (version, v23.1.9 release notes, man pages, flatpak entry) stays with v24's own release process. A trial real merge confirmed this: its only clean additions were those docs and three duplicate re-insertions of code the branch already has. ### #7947 fix: stop quorum key warming from stalling DKG on 2-core masternodes Picked with `-m1 -x`, before the merge. It changes exactly the same lines as its develop merge, and `v24.0.x` has 756fc4f (#7659), the commit it reverts. No version change is needed. `configure.ac` is already 24.0.0 with `CLIENT_VERSION_IS_RELEASE` false, so the build takes its version string from the `v24.0.0-rc.5` tag. ## How Has This Been Tested? Linux x86_64 against depends, `--enable-debug --enable-werror --disable-hardening --without-gui`: `dashd` and `test_dash` build cleanly. - Unit suites, all passing (149 cases): `transaction_tests`, `txvalidation_tests`, `sighash_tests`, `bls_tests`, `governance_inv_tests`, `llmq_utils_tests`, `llmq_dkg_tests`, `quorum_proofs_tests`, `flatfile_tests`, `fs_tests`, `net_tests`, `sock_tests`, `evo_netinfo_tests`, `evo_assetlocks_tests`, `blockfilter_index_tests`, `txindex_tests`, `blockmanager_tests`, `checkdatasig_tests`. - Functional tests, all passing: `feature_llmq_dkgerrors.py` (including the new contribution-invalid case), `feature_llmq_signing.py` (plain and `--spork21`), `feature_llmq_simplepose.py` (plain and `--disable-spork23`), `feature_llmq_rotation.py`, `feature_llmq_data_recovery.py`, `p2p_timeouts.py` (v1/v2), `mempool_accept.py`, `p2p_platform_ban.py`. In the first parallel run, `feature_llmq_data_recovery.py` (known flaky, see #7947), one `feature_llmq_signing.py --spork21` run and `p2p_platform_ban.py` failed while another build was loading the machine. All three pass when re-run on their own. - Each port was compared with its v23.1.9 commit and with #7961's develop resolution. The per-file changes are identical apart from the branch's own API differences listed above. A separate review checked v24-only call sites for second copies of each bug: - other `SigShareKey` batch verifiers; - other decrypt-then-aggregate paths; - other orphan re-request loops; - other tx version packing sites; - other raw `FlatFilePos` seeks. It also checked that the batch-vvec fallback cannot deadlock on a single-thread BLS pool; it runs on the DKG phase threads, not on a BLS worker. ## Breaking Changes - Consensus: once DIP3 is active, transactions with a negative `nVersion` are rejected (`bad-txns-version`). Every v23.1.9 node already enforces this, so mixed v23.1.9/rc.4 networks could disagree until rc.5 is deployed. Valid transactions and their txids are unchanged. - From #7947: quorum key share warming runs on its own `q-cache` thread again, which is one more thread per node. ## Checklist: - [x] I have performed a self-review of my own code - [ ] I have made corresponding changes to the documentation - [ ] I have assigned this pull request to a milestone 🤖 Generated with [Claude Code](https://claude.com/claude-code) Top commit has no ACKs. Tree-SHA512: eaf46d1446c5f6752f2ac5d7aeaa37234cb6da4430db0a1a432320cfe61242dc3bb90c42e0a364238c2817ce0b1b1654dcc0cdd1ed9570f3b35cd2af5330e98e
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue being fixed or feature implemented
In
CGovernanceVote::CheckSignature(const CBLSPublicKey&)(src/governance/vote.cpp), a signature verification failure was logged unconditionally viaLogPrintfinstead ofLogPrint(BCLog::GOBJECT, ...), unlike key ID signature verification and the rest of vote validation.After PR #7527 (orphan governance votes must pass
GovernanceVote::IsValidbefore caching), a peer holding a valid masternode outpoint (public data) plus an invalid BLS signature can reach this path with a vote naming an arbitrary parent hash, producing adebug.logline per message without-debug=gobjectset.Similarly,
CGovernanceObject::ProcessVote(src/governance/object.cpp) logged unsupported vote signals and invalid votes via unconditionalLogPrintf.What was done?
Updated the unconditional
LogPrintfcalls inCGovernanceVote::CheckSignatureandCGovernanceObject::ProcessVoteto useLogPrint(BCLog::GOBJECT, ...).src/governance/vote.cpp:CGovernanceVote::CheckSignature(const CBLSPublicKey&)src/governance/object.cpp:CGovernanceObject::ProcessVote(unsupported vote signal and invalid vote paths)How Has This Been Tested?
./src/test/test_dash --run_test="*gov*") pass.test/lint/lint-logs.py,test/lint/lint-whitespace.py) pass.Breaking Changes
None.
Checklist:
This pull request was created by Codex.