refactor: reject legacy BLS storage formats

.github/SELF_HOSTED_RUNNER.md

@@ -27,13 +27,17 @@ downloaded toolchains to exact URLs and SHA-256 hashes. It includes:
 
 | Toolchain | Contract |
 | --- | --- |
-| Native build | build-essential, clang/LLVM, Snappy, CMake, GMP, OpenSSL, pkg-config |
+| Native build | build-essential, clang/LLVM, GMP, Snappy, CMake, OpenSSL, pkg-config |
 | Rust | rustup plus the repository baseline; exact repo-selected toolchains may be installed user-locally |
 | Cargo helpers | llvm-cov **0.9.1**, nextest **0.9.144**, machete **0.9.2**, ndk **4.1.2** |
 | Protobuf / Java | protoc **32.0**, JDK **17** |
 | Android | API **35**, build-tools **35.0.0**, NDK **28.1.13356709**, pinned emulator/system image |
 | Other job tools | Git, GitHub CLI, jq, Python 3, gpg, zip/unzip |
 
+GMP remains in both image manifests because the pinned trusted publisher requires
+it. Rust no longer needs it after the legacy BLS crate removal; dropping it from
+the images requires updating the publisher contract first.
+
 The SDK is image-owned. The persistent Kotlin workflow uses the image's
 `ci-android-emulator` wrapper to create user-writable AVDs, boot with KVM, and stop
 the emulator after testing. It does **not** run setup-android, sdkmanager, or an

.github/actions/npm-release-build/action.yaml

@@ -14,7 +14,7 @@ runs:
 
         ci-image-contract verify .github/runner-requirements.json
         python3 packages/dapi-grpc/scripts/setup-codegen.py
-        for pkg in build-essential cmake curl jq libgmp-dev libssl-dev pkg-config python3 unzip zip; do
+        for pkg in build-essential cmake curl jq libssl-dev pkg-config python3 unzip zip; do
           dpkg-query -W -f='${Status}' "$pkg" | grep -Fx 'install ok installed'
         done
         test -x "$HOME/.cargo/bin/rustup"

.github/workflows/kotlin-sdk-build.yml

@@ -95,7 +95,7 @@ jobs:
           for tool in cmake curl jq python3 rustup unzip zip; do
             command -v "$tool" >/dev/null 2>&1 || missing+=("$tool")
           done
-          for pkg in build-essential libgmp-dev libpulse0 libssl-dev libx11-xcb1 pkg-config; do
+          for pkg in build-essential libpulse0 libssl-dev libx11-xcb1 pkg-config; do
             dpkg -s "$pkg" >/dev/null 2>&1 || missing+=("$pkg")
           done
           if [ ${#missing[@]} -gt 0 ]; then

.github/workflows/release-kotlin-sdk.yml

@@ -91,7 +91,7 @@ jobs:
         run: |
           set -euo pipefail
 
-          for pkg in build-essential cmake curl gh jq libgmp-dev libpulse0 libssl-dev libx11-xcb1 pkg-config python3 unzip zip; do
+          for pkg in build-essential cmake curl gh jq libpulse0 libssl-dev libx11-xcb1 pkg-config python3 unzip zip; do
             dpkg-query -W -f='${Status}' "$pkg" | grep -Fx 'install ok installed'
           done
           test -x "$HOME/.cargo/bin/rustup"

.github/workflows/tests-rs-workspace.yml

@@ -172,7 +172,7 @@ jobs:
               missing=1
             fi
           done
-          for library in /opt/homebrew/opt/gmp/include/gmp.h /opt/homebrew/opt/gmp/lib/libgmp.dylib /opt/homebrew/opt/llvm/lib/libclang.dylib; do
+          for library in /opt/homebrew/opt/llvm/lib/libclang.dylib; do
             if [ ! -r "$library" ]; then
               echo "::error::Missing or unreadable $library. Provision this dependency on the runner before running CI."
               missing=1
@@ -192,7 +192,7 @@ jobs:
           for tool in clang cmake gh jq llvm-config rustup zip; do
             command -v "$tool" >/dev/null 2>&1 || missing+=("$tool")
           done
-          for pkg in build-essential clang libgmp-dev libsnappy-dev libssl-dev llvm pkg-config; do
+          for pkg in build-essential clang libsnappy-dev libssl-dev llvm pkg-config; do
             dpkg -s "$pkg" >/dev/null 2>&1 || missing+=("$pkg")
           done
           if [ ${#missing[@]} -gt 0 ]; then

packages/rs-drive-abci/Cargo.toml

@@ -81,7 +81,7 @@ tokio-util = { version = "0.7" }
 derive_more = { version = "1.0", features = ["from", "deref", "deref_mut"] }
 async-trait = "0.1.77"
 console-subscriber = { version = "0.4", optional = true }
-bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f", optional = true }
+dashcore-crypto = { workspace = true, features = ["bls"], optional = true }
 grovedb-commitment-tree = { workspace = true }
 nonempty = "0.11"
 # Shielded-pool snapshot needs raw RocksDB SstFileWriter + ingest_external_file_cf
@@ -121,7 +121,6 @@ strategy-tests = { path = "../strategy-tests" }
 grovedb-commitment-tree = { workspace = true, features = ["client"] }
 assert_matches = "1.5.0"
 drive-abci = { path = ".", features = ["testing-config", "mocks", "shielded_test_data"] }
-bls-signatures = { git = "https://github.com/dashpay/bls-signatures", rev = "0842b17583888e8f46c252a4ee84cdfd58e0546f" }
 mockall = { version = "0.13" }
 dash-platform-macros = { path = "../rs-dash-platform-macros" }
 libc = "0.2"
@@ -136,8 +135,8 @@ grovedb-path = { workspace = true }
 grovedb-storage = { workspace = true }
 
 [features]
-default = ["bls-signatures"]
-mocks = ["mockall", "drive/fixtures-and-mocks", "bls-signatures"]
+default = []
+mocks = ["mockall", "drive/fixtures-and-mocks", "dep:dashcore-crypto"]
 console = ["console-subscriber", "tokio/tracing"]
 testing-config = []
 # Compiles in the shielded-pool seeder, the `snapshot-bake` subcommand, and

packages/rs-drive-abci/src/execution/platform_events/core_based_updates/update_masternode_identities/update_operator_identity/v0/mod.rs

@@ -427,16 +427,7 @@ mod tests {
         let node_id_bytes: [u8; 20] = rng.gen();
 
         // Create a public key operator and payout address
-        let private_key_operator_bytes = bls_signatures::PrivateKey::generate_dash(rng)
-            .expect("expected to generate a private key")
-            .to_bytes()
-            .to_vec();
-        let private_key_operator = BlsPrivateKey::from_be_bytes(
-            &private_key_operator_bytes
-                .try_into()
-                .expect("expected the secret key to be 32 bytes"),
-        )
-        .expect("Core fixture secret key must decode");
+        let private_key_operator = BlsPrivateKey::random(&mut *rng);
         let pub_key_operator = private_key_operator.public_key().to_bytes().to_vec();
 
         let operator_key: IdentityPublicKey = IdentityPublicKeyV0 {
@@ -972,16 +963,7 @@ mod tests {
         ) = create_operator_identity(&platform, &mut rng);
 
         // Generate a new public key operator
-        let private_key_operator_bytes = bls_signatures::PrivateKey::generate_dash(&mut rng)
-            .expect("expected to generate a private key")
-            .to_bytes()
-            .to_vec();
-        let private_key_operator = BlsPrivateKey::from_be_bytes(
-            &private_key_operator_bytes
-                .try_into()
-                .expect("expected the secret key to be 32 bytes"),
-        )
-        .expect("Core fixture secret key must decode");
+        let private_key_operator = BlsPrivateKey::random(&mut rng);
         let new_pub_key_operator = private_key_operator.public_key().to_bytes().to_vec();
 
         // Create an old masternode state
@@ -1070,16 +1052,7 @@ mod tests {
         ) = create_operator_identity(&platform, &mut rng);
 
         // Pre-create an operator identity for the new operator key that lacks the platform node key
-        let private_key_operator_bytes = bls_signatures::PrivateKey::generate_dash(&mut rng)
-            .expect("expected to generate a private key")
-            .to_bytes()
-            .to_vec();
-        let private_key_operator = BlsPrivateKey::from_be_bytes(
-            &private_key_operator_bytes
-                .try_into()
-                .expect("expected the secret key to be 32 bytes"),
-        )
-        .expect("Core fixture secret key must decode");
+        let private_key_operator = BlsPrivateKey::random(&mut rng);
         let new_pub_key_operator = private_key_operator.public_key().to_bytes().to_vec();
 
         let new_operator_identifier = Identifier::create_operator_identifier(
@@ -1211,16 +1184,7 @@ mod tests {
         ) = create_operator_identity(&platform, &mut rng);
 
         // Generate a new public key operator
-        let private_key_operator_bytes = bls_signatures::PrivateKey::generate_dash(&mut rng)
-            .expect("expected to generate a private key")
-            .to_bytes()
-            .to_vec();
-        let private_key_operator = BlsPrivateKey::from_be_bytes(
-            &private_key_operator_bytes
-                .try_into()
-                .expect("expected the secret key to be 32 bytes"),
-        )
-        .expect("Core fixture secret key must decode");
+        let private_key_operator = BlsPrivateKey::random(&mut rng);
         let new_pub_key_operator = private_key_operator.public_key().to_bytes().to_vec();
 
         // Create an old masternode state with original public key operator

packages/rs-drive-abci/src/mimic/fixtures/README.md

@@ -0,0 +1,15 @@
+# Core quorum compatibility vectors
+
+`core_quorums.json` freezes outputs from `dashpay/bls-signatures` at
+`0842b17583888e8f46c252a4ee84cdfd58e0546f`, captured before its removal.
+These synthetic keys are public test material.
+
+Each case seeds rand 0.8.5 `StdRng` with 42, calls `PrivateKey::generate_dash_many`
+for 2, 3 or 5 members, and calls `PrivateKey::threshold_recover` on those keys.
+Member index `i` has a 32-byte ID with byte 0 equal to `i + 1`, byte 31 equal
+to `i + 11`, and all other bytes zero. The asymmetric IDs pin Core's scalar
+byte order. Signatures use the Basic scheme over `b"quorum compatibility"`.
+
+The test checks generated member keys, the interpolated quorum key, and its
+signature against these frozen values. It preserves an independent compatibility
+oracle without linking or building the historical implementation.

packages/rs-drive-abci/src/mimic/fixtures/core_quorums.json

@@ -0,0 +1,63 @@
+[
+  {
+    "members": [
+      {
+        "secret_key": "60cc232b5d9fd6f6a17b9f807e17d269463b8be9d79d8c8d8e7b7325467ef724",
+        "public_key": "85d81dd12c73cca83f7d1bf8b78fadb695e3a2bc21d53b35ff2f74eaa28c6e163c98d3d5f9bb7252b4d836e484c7cc60"
+      },
+      {
+        "secret_key": "60d4cd010b78057205135c1024f2e62847e5f2a94cb429011bb28680a3e27ba4",
+        "public_key": "969c5d5873f49aa994c5f6a850924ca1840c4ad1791aaaecd90093d4a5c0c3799f2d98540f5366cfa0a33f143fd69263"
+      }
+    ],
+    "secret_key": "1fcedaede8dcf78f22a37886ba8c5a6819b54f0df353226fde8254ded687f4be",
+    "public_key": "af9b0df76bd36c822a3c033a32a9f85a2dd1c2f608d8f77fabe86f3e642f71d7c6b391c6aa1fe47e9b4dfba9a0f86a0c",
+    "signature": "ad5b7abba9e99925463851e70bd76f80f0be6f72ebf6d7a5cbcb7d94eac919708666e2669f3448b383bf178c08c41c6a015e242e7c2b898772bdf36b2e17f529876f89367e791dc1b059e3170b2f656cf77c64fe3d942aa6775f5c38147d9897"
+  },
+  {
+    "members": [
+      {
+        "secret_key": "60cc232b5d9fd6f6a17b9f807e17d269463b8be9d79d8c8d8e7b7325467ef724",
+        "public_key": "85d81dd12c73cca83f7d1bf8b78fadb695e3a2bc21d53b35ff2f74eaa28c6e163c98d3d5f9bb7252b4d836e484c7cc60"
+      },
+      {
+        "secret_key": "60d4cd010b78057205135c1024f2e62847e5f2a94cb429011bb28680a3e27ba4",
+        "public_key": "969c5d5873f49aa994c5f6a850924ca1840c4ad1791aaaecd90093d4a5c0c3799f2d98540f5366cfa0a33f143fd69263"
+      },
+      {
+        "secret_key": "1875901a20c05263718b60b6c7d076d17f198be2c1c74076a987a8247b831374",
+        "public_key": "82e296280f7b8220cf4822c6767f1dac24a55e2ef4250ba3690ef17207ebfc3de1b0af1e1b92a3b0a5db73c3dff3e82e"
+      }
+    ],
+    "secret_key": "6a7016bc45678d62d7f42c98c20b70d183579cd811b13e1bb832b8f15b317366",
+    "public_key": "94074dae16b081c8c4eb132cf0be7e718f83bb51e7e1ebc557adb21776344a161067a73e50b04251051a48d6ce5005f3",
+    "signature": "89359843132417bf3112e0ab09bc64904dbce8ce07e55f4cf65f0c6dd8179e46f89e1eecf94c18a7903fcd054874a0f416d427a594105d83e256ab4d45f57679d6c298d5659fd4189290a90c9489ea3e36218d8f70ac7854fae10fc07c56ad90"
+  },
+  {
+    "members": [
+      {
+        "secret_key": "60cc232b5d9fd6f6a17b9f807e17d269463b8be9d79d8c8d8e7b7325467ef724",
+        "public_key": "85d81dd12c73cca83f7d1bf8b78fadb695e3a2bc21d53b35ff2f74eaa28c6e163c98d3d5f9bb7252b4d836e484c7cc60"
+      },
+      {
+        "secret_key": "60d4cd010b78057205135c1024f2e62847e5f2a94cb429011bb28680a3e27ba4",
+        "public_key": "969c5d5873f49aa994c5f6a850924ca1840c4ad1791aaaecd90093d4a5c0c3799f2d98540f5366cfa0a33f143fd69263"
+      },
+      {
+        "secret_key": "1875901a20c05263718b60b6c7d076d17f198be2c1c74076a987a8247b831374",
+        "public_key": "82e296280f7b8220cf4822c6767f1dac24a55e2ef4250ba3690ef17207ebfc3de1b0af1e1b92a3b0a5db73c3dff3e82e"
+      },
+      {
+        "secret_key": "36e6194880c3797f0ee82a463b5bf94d69462756b62a0fbe88fe3f706b1540aa",
+        "public_key": "8a2f736a2488f75742c863f5e57430c77b6fd7a96b2cebff104319ddee98a2afcf181b0448bc7af7847b478af2ec4ec2"
+      },
+      {
+        "secret_key": "0625b848ac8adcf9a492c608b6f3c68de3a695ee52684282a359dd1485982094",
+        "public_key": "b60530373ad3505639863ed4c3d56c9ad90c7385b3e81bc66dde9705ff5b9b090957ae1b2010036e28457aa14e9ba4bd"
+      }
+    ],
+    "secret_key": "1e998cb2d5e16542273243f3a39146714b1f52e51d882051654fd01d2ffbccf0",
+    "public_key": "b11e0e7d90633d09f69aedcc1c2853c30357bc3cff19682c693bc1bdef488bf87119290f0aae643227ba91bdeb43de7e",
+    "signature": "b9f8f49b1c38b4c9d96a6c9812d8c58961783f7b68e1925953f0d19e5b968223800dd7695348f576db68164a36b66b68136a4ed2699f7c0627ee9d153d1c1ba8077886f39614d773564e415652b7a2bb32044f8d253e82b7dcf8a0e971de722d"
+  }
+]