Skip to content

cmd: convert deposit sign withdrawal addresses to creds - #4804

Merged
OisinKyne merged 3 commits into
mainfrom
oisin/deposit-sign-withdrawal-creds
Nov 3, 2026
Merged

cmd: convert deposit sign withdrawal addresses to creds#4804
OisinKyne merged 3 commits into
mainfrom
oisin/deposit-sign-withdrawal-creds

Conversation

@OisinKyne

@OisinKyne OisinKyne commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

charon deposit sign hex-decoded --withdrawal-addresses straight into DepositMessage.WithdrawalCredentials. A 20 byte address, as the alter withdrawal address docs show, was silently zero-padded by SSZ hashing, so operators signed, and the Obol API stored, deposits with malformed credentials (<address><12 zero bytes>).

  • Adds deposit.WithdrawalCredsFromAddrOrCreds: a 20 byte address becomes 0x01 credentials (0x02 for compounding clusters). Mixed case addresses must match their EIP-55 checksum; all lower or all upper case is accepted. Full 32 byte credentials are still accepted if the prefix matches the cluster's compounding setting and bytes 1-11 are zero. Anything else is rejected.
  • deposit sign uses it and rejects the zero address on mainnet/gnosis, as create dkg does.
  • deposit fetch rejects API credentials that are not 32 bytes, covering bad records already stored.
  • obolapimock rejects non 32 byte credentials, mirroring the API fix.
  • Tests now use real addresses (the 32 byte input in the old test hid the bug) and the sign/fetch test checks the credentials written to the deposit data file.

Companion changes: obol-api oisin/validate-withdrawal-creds, obol-sdk oisin/validate-withdrawal-creds-length, obol-docs oisin/deposit-sign-v1.11-credentials and oisin/deposit-sign-withdrawal-addresses.

category: bug
ticket: none

@OisinKyne
cmd: convert deposit sign withdrawal addresses to credentials
60c1892 
charon deposit sign hex-decoded --withdrawal-addresses straight into
DepositMessage.WithdrawalCredentials. A 20 byte address (as documented)
was zero-padded by SSZ hashing, so operators signed and the API stored
malformed deposits.

Addresses are now converted to 0x01 (or 0x02 for compounding clusters)
withdrawal credentials. Mixed case addresses must match their EIP-55
checksum. Full 32 byte credentials are still accepted if the prefix
matches the cluster's compounding setting. deposit fetch rejects
credentials from the API that are not 32 bytes.
@codecov

codecov Bot commented Oct 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 91.89189% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.69%. Comparing base (4e4d996) to head (f137bd8).
⚠️ Report is 4 commits behind head on main.

Files with missing lines Patch % Lines
eth2util/deposit/deposit.go 92.00% 2 Missing ⚠️
cmd/depositsign.go 88.88% 1 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##             main    #4804      +/-   ##
==========================================
+ Coverage   67.61%   67.69%   +0.08%     
==========================================
  Files         254      255       +1     
  Lines       33609    33698      +89     
==========================================
+ Hits        22725    22813      +88     
- Misses      10883    10884       +1     
  Partials        1        1

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

aly-obol
aly-obol previously approved these changes Oct 23, 2026
View reviewed changes
@OisinKyne OisinKyne changed the title cmd: convert deposit sign withdrawal addresses to credentials cmd: convert deposit sign withdrawal addresses to creds Oct 23, 2026
@sonarqubecloud

sonarqubecloud Bot commented Oct 30, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@OisinKyne
OisinKyne merged commit e7d8587 into main Nov 3, 2026
11 checks passed
@OisinKyne
OisinKyne deleted the oisin/deposit-sign-withdrawal-creds branch November 3, 2026 16:22
@OisinKyne OisinKyne mentioned this pull request Nov 4, 2026
Merged
obol-bulldozer Bot pushed a commit that referenced this pull request Nov 4, 2026
@OisinKyne
cmd: validate addresses consistently across create and edit (#4805)
fd8c6fa 
Validates fee recipient and withdrawal addresses the same way in `create cluster`, `create dkg` and `edit add-validators`, and stores them in EIP-55 checksummed form. Before this, `create cluster` without a definition file skipped the withdrawal address check entirely. A zero address on mainnet or gnosis is an error in `create dkg` and a warning elsewhere (where it's legitimate, e.g. splitting the keys of validators that are already active).

The "all-lowercase or all-uppercase, otherwise it must match EIP-55" rule now lives in one place, `eth2util.ValidateChecksumAddress`. It's used by these commands, by `feerecipient sign` (which wrongly rejected all-uppercase addresses) and by `deposit.WithdrawalCredsFromAddrOrCreds` (#4804).

category: bug
ticket: none
@KaloyanTanev KaloyanTanev mentioned this pull request Nov 6, 2026
Merged
KaloyanTanev added a commit that referenced this pull request Nov 6, 2026
@KaloyanTanev @dependabot
@aly-obol @OisinKyne
*: backport bugfixes to v1.11.4 (#4824)
4e9ab50 
* app: fix flaky TestStartChecker (#4654)

(cherry picked from commit f0633d4)

* core/tracker: fix inclusion trim underflow at chain start (#4662)

* core/tracker: fix inclusion trim underflow at chain start

The inclusion checker's slot arithmetic underflows on fresh chains:
before genesis the wall-clock offset is negative, during the first
InclCheckLag slots the checked slot goes negative, and until wall slot
InclCheckLag+InclMissedLag the trim slot goes negative. The trim
underflow makes Trim(huge) delete every pending submission and report
each fresh duty as "duty not included on-chain", failing all early
proposals on every fresh-genesis network.

Skip ticks until a slot is old enough to check, and only trim once a
slot can actually be declared missed.

* core/tracker: check the genesis slot and deflake the regression test

The zero-valued checkedSlot skipped slot 0 as already-checked; start
from a MaxUint64 sentinel instead. Synchronize the chain-start
regression test on the first inclusion check rather than sleeping,
and pin it to the genesis slot so it covers both guards.

* core/tracker: pin attestation-inclusion feature off in regression test

The test wires only checkBlockFunc; disable the attestation_inclusion
feature explicitly so Run cannot take the nil checkBlockAndAttsFunc
path regardless of test ordering.

(cherry picked from commit ad04571)

* build(deps): Bump the docker-dependencies group across 2 directories with 1 update (#4661)

* build(deps): Bump the docker-dependencies group across 2 directories with 1 update

Bumps the docker-dependencies group with 1 update in the / directory: golang.
Bumps the docker-dependencies group with 1 update in the /testutil/promrated directory: golang.

Updates `golang` from 1.26.6-trixie to 1.27.0-trixie

Updates `golang` from 1.26.6-trixie to 1.27.0-trixie

Updates `golang` from 1.26.6-alpine to 1.27.0-alpine

Updates `golang` from 1.26.6-alpine to 1.27.0-alpine

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.27.0-alpine
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-dependencies
- dependency-name: golang
  dependency-version: 1.27.0-trixie
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: docker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* bump go to 1.27

* bump cockroachdb/swiss for go1.27 support

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit a67667d)

* build(deps): Bump the go-dependencies group across 1 directory with 4 updates (#4687)

Bumps the go-dependencies group with 4 updates in the / directory: [github.com/prometheus/client_model](https://github.com/prometheus/client_model), [github.com/showwin/speedtest-go](https://github.com/showwin/speedtest-go), [golang.org/x/crypto](https://github.com/golang/crypto) and [github.com/vektra/mockery/v2](https://github.com/vektra/mockery).

Updates `github.com/prometheus/client_model` from 0.6.2 to 0.6.3
- [Release notes](https://github.com/prometheus/client_model/releases)
- [Commits](prometheus/client_model@v0.6.2...v0.6.3)

Updates `github.com/showwin/speedtest-go` from 1.8.2 to 1.8.3
- [Release notes](https://github.com/showwin/speedtest-go/releases)
- [Changelog](https://github.com/showwin/speedtest-go/blob/master/docs/release.md)
- [Commits](showwin/speedtest-go@v1.8.2...v1.8.3)

Updates `golang.org/x/crypto` from 0.55.0 to 0.56.0
- [Commits](golang/crypto@v0.55.0...v0.56.0)

Updates `github.com/vektra/mockery/v2` from 2.53.6 to 2.53.7
- [Release notes](https://github.com/vektra/mockery/releases)
- [Commits](vektra/mockery@v2.53.6...v2.53.7)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_model
  dependency-version: 0.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/showwin/speedtest-go
  dependency-version: 1.8.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.56.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/vektra/mockery/v2
  dependency-version: 2.53.7
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 4eef0bd)

* app/stacksnipe: redact secret flag values from exported command lines (#4688)

The stack sniping collector read the full command line of every detected
validator client and exported it verbatim, both as the cli_parameters label
of the app_validator_stack_params gauge served on the monitoring endpoint,
and as a field of a debug log line.

Validator client command lines routinely carry secret material, for example
keystore passwords, the paths of files holding them, and keymanager bearer
tokens. Exporting them unmodified pushes that material into the metrics and
log planes, whose readers and retention are usually much broader than the
process table it came from.

Redact the values of flags whose names look sensitive (auth, jwt, key,
passphrase, password, secret, token) before the command line is logged or
handed to the metrics callback. Both the "--flag value" and the
"--flag=value" forms are handled, and flag names are preserved so the
telemetry stays useful. A /proc cmdline is NUL separated, so redaction
normally operates per argument; if the whole command line ever arrives as a
single blob it is split on whitespace first, so redaction fails safe rather
than passing the blob through untouched.

Also warn at startup when --proc-directory is set, and note the disclosure
tradeoff in the flag's help text, so the behaviour is not a surprise.

The feature remains disabled by default.

(cherry picked from commit d467312)

* build(deps): Bump the go-dependencies group with 2 updates (#4690)

Bumps the go-dependencies group with 2 updates: [golang.org/x/sync](https://github.com/golang/sync) and [golang.org/x/time](https://github.com/golang/time).

Updates `golang.org/x/sync` from 0.22.0 to 0.23.0
- [Commits](golang/sync@v0.22.0...v0.23.0)

Updates `golang.org/x/time` from 0.15.0 to 0.16.0
- [Commits](golang/time@v0.15.0...v0.16.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/time
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 67f4b59)

# Conflicts:
#	go.mod
#	go.sum

* dkg/pedersen: buffer channels to not drop early bundles (#4683)

* dkg/pedersen: buffer bundle channels to avoid dropping early bundles

* test response and justification bundle paths

(cherry picked from commit 7464e13)

* dkg: retry transient p2p send failures during ceremonies (#4684)

* p2p: include peer name in send errors

* dkg: retry transient p2p send failures during ceremonies

* p2p: address copilot review on send retries

* dkg: add frost round 1 send retry test

* dkg: apply 60s p2p send timeout to ceremony sends

* dkg: increase ceremony send retries to 5

* p2p: bound send retries by the send timeout budget

* p2p: bound stream creation by the send timeout budget

* p2p: cap each send attempt at its slice of the timeout budget

* p2p: bound each attempt's dial by its deadline slice

* p2p: give each SendReceive attempt the full timeout, clamp negative retries

* p2p: bound SendReceive by its send timeout without slicing the response wait

* p2p: make send timeout per-attempt instead of a shared budget

(cherry picked from commit c878ff0)

* p2p: add message size, read error and concurrency metrics (#4680)

* p2p: add message size and concurrency metrics

* p2p: update inflight gauge under lock

* p2p: cleanup idle inflight keys, observe sent after close write

* p2p: consistent relay error handling, concurrency test

* p2p: count direct-stream resets as read errors

* p2p: observe received size before proto validation

* p2p: named struct for inflight key

(cherry picked from commit c6a6d42)

* build(deps): Bump the go-dependencies group across 1 directory with 5 updates (#4698)

Bumps the go-dependencies group with 3 updates in the / directory: [golang.org/x/crypto](https://github.com/golang/crypto), [golang.org/x/net](https://github.com/golang/net) and [golang.org/x/tools](https://github.com/golang/tools).

Updates `golang.org/x/crypto` from 0.56.0 to 0.57.0
- [Commits](golang/crypto@v0.56.0...v0.57.0)

Updates `golang.org/x/net` from 0.58.0 to 0.59.0
- [Commits](golang/net@v0.58.0...v0.59.0)

Updates `golang.org/x/term` from 0.45.0 to 0.46.0
- [Commits](golang/term@v0.45.0...v0.46.0)

Updates `golang.org/x/text` from 0.41.0 to 0.42.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.41.0...v0.42.0)

Updates `golang.org/x/tools` from 0.49.0 to 0.50.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.49.0...v0.50.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-version: 0.57.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.46.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.42.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 6b1e607)

# Conflicts:
#	go.mod
#	go.sum

* cmd/exit_sign: warn on validators with pending deposits and no index (#4702)

(cherry picked from commit 1928fd0)

* *: keep //nolint:revive from nolintlint false autofix (#4703)

(cherry picked from commit 3f40e6c)

* build(deps): Bump github.com/ethereum/go-ethereum (#4730)

Bumps the go-dependencies group with 1 update: [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum).

Updates `github.com/ethereum/go-ethereum` from 1.17.5 to 1.17.6
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.17.5...v1.17.6)

---
updated-dependencies:
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.17.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit bcd3f41)

* build(deps): Bump the go-dependencies group with 7 updates (#4737)

Bumps the go-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) | `1.17.6` | `1.17.7` |
| [go.opentelemetry.io/otel](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/exporters/stdout/stdouttrace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |
| [go.opentelemetry.io/otel/trace](https://github.com/open-telemetry/opentelemetry-go) | `1.46.0` | `1.47.0` |

Updates `github.com/ethereum/go-ethereum` from 1.17.6 to 1.17.7
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.17.6...v1.17.7)

Updates `go.opentelemetry.io/otel` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/exporters/stdout/stdouttrace` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/sdk` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

Updates `go.opentelemetry.io/otel/trace` from 1.46.0 to 1.47.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-go@v1.46.0...v1.47.0)

---
updated-dependencies:
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.17.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: go.opentelemetry.io/otel/trace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit ce7f7b2)

* core/scheduler: fix flaky TestSchedulerWait clock rewind (#4726)

(cherry picked from commit a818241)

* p2p: label handler metrics from validated stream protocol (#4722)

* p2p: label handler metrics from validated stream protocol

* p2p: deflake metrics tests racing deferred observations
(cherry picked from commit eb506a6)

* p2p: restore message handler panics metric (#4706)

* build(deps): Bump golang.org/x/tools (#4742)

Bumps the go-dependencies group with 1 update: [golang.org/x/tools](https://github.com/golang/tools).

Updates `golang.org/x/tools` from 0.50.0 to 0.51.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.50.0...v0.51.0)

---
updated-dependencies:
- dependency-name: golang.org/x/tools
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 7c0ff60)

* build(deps): Bump the go-dependencies group with 3 updates (#4770)

Bumps the go-dependencies group with 3 updates: [github.com/drand/kyber](https://github.com/drand/kyber), [github.com/drand/kyber-bls12381](https://github.com/drand/kyber-bls12381) and [golang.org/x/sync](https://github.com/golang/sync).

Updates `github.com/drand/kyber` from 1.3.2 to 1.3.3
- [Release notes](https://github.com/drand/kyber/releases)
- [Commits](drand/kyber@v1.3.2...v1.3.3)

Updates `github.com/drand/kyber-bls12381` from 0.3.4 to 0.3.5
- [Release notes](https://github.com/drand/kyber-bls12381/releases)
- [Commits](drand/kyber-bls12381@v0.3.4...v0.3.5)

Updates `golang.org/x/sync` from 0.23.0 to 0.24.0
- [Commits](golang/sync@v0.23.0...v0.24.0)

---
updated-dependencies:
- dependency-name: github.com/drand/kyber
  dependency-version: 1.3.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/drand/kyber-bls12381
  dependency-version: 0.3.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 3c480a1)

# Conflicts:
#	go.mod

* app/eth2wrap: bind eth2http service lifetime to caller ctx (#4772)

* app/eth2wrap: bind eth2http service lifetime to caller ctx

* app/retry: retry eth2http not active and not synced errors

(cherry picked from commit e76d179)

* build(deps): Bump the go-dependencies group across 1 directory with 7 updates (#4778)

Bumps the go-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/ethereum/go-ethereum](https://github.com/ethereum/go-ethereum) | `1.17.7` | `1.17.8` |
| [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) | `1.24.1` | `1.25.0` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.60.0` | `0.61.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.46.0` | `0.47.0` |
| [golang.org/x/text](https://github.com/golang/text) | `0.42.0` | `0.43.0` |
| [golang.org/x/tools](https://github.com/golang/tools) | `0.51.0` | `0.52.0` |

Updates `github.com/ethereum/go-ethereum` from 1.17.7 to 1.17.8
- [Release notes](https://github.com/ethereum/go-ethereum/releases)
- [Commits](ethereum/go-ethereum@v1.17.7...v1.17.8)

Updates `github.com/prometheus/client_golang` from 1.24.1 to 1.25.0
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](prometheus/client_golang@v1.24.1...v1.25.0)

Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
- [Commits](golang/crypto@v0.57.0...v0.58.0)

Updates `golang.org/x/net` from 0.60.0 to 0.61.0
- [Commits](golang/net@v0.60.0...v0.61.0)

Updates `golang.org/x/term` from 0.46.0 to 0.47.0
- [Commits](golang/term@v0.46.0...v0.47.0)

Updates `golang.org/x/text` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/golang/text/releases)
- [Commits](golang/text@v0.42.0...v0.43.0)

Updates `golang.org/x/tools` from 0.51.0 to 0.52.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.51.0...v0.52.0)

---
updated-dependencies:
- dependency-name: github.com/ethereum/go-ethereum
  dependency-version: 1.17.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/net
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/term
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/text
  dependency-version: 0.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: golang.org/x/tools
  dependency-version: 0.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 6704e6a)

* build(deps): Bump the go-dependencies group across 1 directory with 2 updates (#4790)

* build(deps): Bump the go-dependencies group across 1 directory with 2 updates

Bumps the go-dependencies group with 2 updates in the / directory: [github.com/bufbuild/buf](https://github.com/bufbuild/buf) and [github.com/vektra/mockery/v2](https://github.com/vektra/mockery).

Updates `github.com/bufbuild/buf` from 1.72.0 to 1.74.0
- [Release notes](https://github.com/bufbuild/buf/releases)
- [Changelog](https://github.com/bufbuild/buf/blob/main/CHANGELOG.md)
- [Commits](bufbuild/buf@v1.72.0...v1.74.0)

Updates `github.com/vektra/mockery/v2` from 2.53.7 to 2.53.8
- [Release notes](https://github.com/vektra/mockery/releases)
- [Commits](vektra/mockery@v2.53.7...v2.53.8)

---
updated-dependencies:
- dependency-name: github.com/bufbuild/buf
  dependency-version: 1.74.0
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/vektra/mockery/v2
  dependency-version: 2.53.8
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

* *: bump go-libp2p to v0.50.0 for quic-go v0.63

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit dd58d17)

# Conflicts:
#	go.mod
#	go.sum

* core/tracker: debug log sync selection proof inconsistency (#4801)
(cherry picked from commit 2b534eb)

* app/obolapi: send a User-Agent and type 404s on POST (#4808)

* app/obolapi: send a User-Agent and type 404s on POST

* app/obolapi: make WithUserAgent override the default

---------

Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit ae46490)

* cmd: convert deposit sign withdrawal addresses to creds (#4804)

* cmd: convert deposit sign withdrawal addresses to credentials

charon deposit sign hex-decoded --withdrawal-addresses straight into
DepositMessage.WithdrawalCredentials. A 20 byte address (as documented)
was zero-padded by SSZ hashing, so operators signed and the API stored
malformed deposits.

Addresses are now converted to 0x01 (or 0x02 for compounding clusters)
withdrawal credentials. Mixed case addresses must match their EIP-55
checksum. Full 32 byte credentials are still accepted if the prefix
matches the cluster's compounding setting. deposit fetch rejects
credentials from the API that are not 32 bytes.

* eth2util/deposit: reuse withdrawalCredsFromAddr for 32 byte creds

* cmd: test deposit sign zero address and compounding creds

---------

Co-authored-by: kalo <24719519+KaloyanTanev@users.noreply.github.com>
(cherry picked from commit e7d8587)

* cmd: validate addresses consistently across create and edit (#4805)

Validates fee recipient and withdrawal addresses the same way in `create cluster`, `create dkg` and `edit add-validators`, and stores them in EIP-55 checksummed form. Before this, `create cluster` without a definition file skipped the withdrawal address check entirely. A zero address on mainnet or gnosis is an error in `create dkg` and a warning elsewhere (where it's legitimate, e.g. splitting the keys of validators that are already active).

The "all-lowercase or all-uppercase, otherwise it must match EIP-55" rule now lives in one place, `eth2util.ValidateChecksumAddress`. It's used by these commands, by `feerecipient sign` (which wrongly rejected all-uppercase addresses) and by `deposit.WithdrawalCredsFromAddrOrCreds` (#4804).

category: bug
ticket: none
(cherry picked from commit fd8c6fa)

* build(deps): Bump the go-dependencies group across 1 directory with 4 updates (#4817)

Partial backport: only golang.org/x/net v0.62.0. go-builder-client, go-eth2-client and go-ethereum v1.17.10 (requires go-eth2-client v0.30.1 and dynamic-ssz v1.4.0) are gloas-related and left out.

(cherry picked from commit beea8ba)

* *: bump golangci-lint to v2.14.0 (#4741)

(cherry picked from commit 589fc22)

* app/log: silence revive package-naming in redact.go

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: aly <16789036+aly-obol@users.noreply.github.com>
Co-authored-by: Oisín Kyne <4981644+OisinKyne@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@KaloyanTanev KaloyanTanev KaloyanTanev approved these changes
@aly-obol aly-obol aly-obol left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@OisinKyne @aly-obol @KaloyanTanev