Skip to content

Release 0.4.3 candidate: audit fixes + zebra 6.0.0#4

Closed
emersonian wants to merge 5 commits into
ci-base-0.4.xfrom
release/0.4.x
Closed

Release 0.4.3 candidate: audit fixes + zebra 6.0.0#4
emersonian wants to merge 5 commits into
ci-base-0.4.xfrom
release/0.4.x

Conversation

@emersonian

Copy link
Copy Markdown
Contributor

Draft for CI validation of the 0.4.3 release candidate (audit fixes 3.14/3.15/3.16, zebra 6.0.0 pin, enable crates.io publishing). Not for merge - release/0.4.x is a release branch, cut by tag. Base is a throwaway branch at v0.4.2 for a clean diff.

Runs ci.yml (build/test/clippy/fmt) and regtest.yml (general regtest tier) against the 0.4.x changes.

emersonian and others added 5 commits July 11, 2026 09:31
A send that pays a Sapling output must not take the cached-proving-key path: that path's extractor is handed no Sapling verifying key, so it rejects a Sapling bundle. Divert any send with a Sapling-output recipient to the fused build path, which builds its own keys. This is about paying a Sapling recipient, not spending Sapling notes, which zecd never does on the cached path.

Co-authored-by: AI <noreply+norm@overpay.com>
`/readyz` now defaults to "synced": ready only once the wallet has scanned to within `max_scan_lag` blocks of the tip and drained the enhancement backlog, so a client routed by readiness never treats an empty or stale balance as authoritative while the wallet is still scanning. Set `readiness = "connected"` for the old reachability-only behavior. Both modes now surface a per-wallet `scan_lag` (the block gap between the chain tip and the last fully-scanned height) on `/readyz` and `/status`.

Co-authored-by: AI <noreply+norm@overpay.com>
The single-instance datadir lock is an advisory `flock`, so it only guards against a second zecd on the same host. It does not span hosts: two machines sharing one datadir over a network filesystem (NFS, SMB, a Kubernetes ReadWriteMany volume) would each be granted the lock independently. Document this limitation and stamp the lockfile with its holder (hostname and pid) as a breadcrumb for diagnosing a suspected shared-datadir conflict.

Co-authored-by: AI <noreply+norm@overpay.com>
Update the compose and regtest zebra pins to the current verified release.

Co-authored-by: AI <noreply+norm@overpay.com>
Set publish to true and add the repository and homepage links, so the crate can be uploaded to crates.io and installed with `cargo install zecd`.

Co-authored-by: AI <noreply+norm@overpay.com>
@emersonian

Copy link
Copy Markdown
Contributor Author

CI + regtest + Docker all green on release/0.4.x. Closing - this was a validation vehicle only; 0.4.x is cut by tag.

@emersonian emersonian closed this Jul 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant