From bc3ad2686e044fe03639e2357e081febeab1709f Mon Sep 17 00:00:00 2001 From: Seth For Privacy <40500387+sethforprivacy@users.noreply.github.com> Date: Sat, 15 Aug 2026 14:59:04 -0400 Subject: [PATCH 1/2] fix(deps): restore missing silentpayments crates in Cargo.lock The "Merge new-index branch into cake-update-v1" merge (9dffb84) resolved the Cargo.lock conflict by taking the upstream side for the crate stanzas while keeping the `silentpayments` git package from the cake side. That dropped every package only silentpayments depends on, leaving the lock internally inconsistent: the `silentpayments` entry referenced `bech32 0.9.1`, `bitcoin_hashes 0.13.0` and `secp256k1 0.28.2`, none of which had a [[package]] stanza of their own. The cargo-based CI jobs do not pass --locked, so they silently repaired the lock over the network and stayed green. The `nix` job builds with crane, which vendors strictly from the committed Cargo.lock into a directory source that replaces crates-io and then builds offline, so the missing stanzas were unrecoverable: error: failed to select a version for the requirement `bech32 = "^0.9"` candidate versions found which didn't match: 0.11.0, 0.8.1 Regenerate the lock with the pinned toolchain (cargo 1.75.0, per rust-toolchain.toml). The change is purely additive: 5 packages added, none removed, no existing version changed, silentpayments git rev unchanged. Verified with `cargo check --locked --release --all-features` (the same resolution crane performs offline), which now succeeds and compiles bech32 0.9.1, bitcoin_hashes 0.13.1, secp256k1 0.28.2 and silentpayments. Co-Authored-By: Claude Fable 5 --- Cargo.lock | 47 ++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 44 insertions(+), 3 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index 20ee530a6..976628fd5 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -249,6 +249,12 @@ version = "0.8.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cf9ff0bbfd639f15c74af777d81383cf53efb7c93613f6cab67c6c11e05bbf8b" +[[package]] +name = "bech32" +version = "0.9.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d86b93f97252c47b41663388e6d155714a9d0c398b99f1005cbc5f978b29f445" + [[package]] name = "bech32" version = "0.11.0" @@ -315,7 +321,7 @@ dependencies = [ "bitcoin-io", "bitcoin-units", "bitcoin_hashes 0.14.0", - "hex-conservative", + "hex-conservative 0.2.1", "hex_lit", "secp256k1 0.29.1", "serde", @@ -376,6 +382,15 @@ dependencies = [ "bitcoin-private", ] +[[package]] +name = "bitcoin_hashes" +version = "0.13.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "446819536d8121575eeb7e89efdbadb3f055e87e4bb66c6679a6d5cc2f4b64fd" +dependencies = [ + "hex-conservative 0.1.2", +] + [[package]] name = "bitcoin_hashes" version = "0.14.0" @@ -383,7 +398,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bb18c03d0db0247e147a21a6faafd5a7eb851c743db062de72018b6b7e8e4d16" dependencies = [ "bitcoin-io", - "hex-conservative", + "hex-conservative 0.2.1", "serde", ] @@ -913,6 +928,7 @@ dependencies = [ "elementsd", "error-chain", "glob", + "hex", "hyper", "hyperlocal", "itertools 0.12.1", @@ -1315,6 +1331,12 @@ version = "0.4.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70" +[[package]] +name = "hex-conservative" +version = "0.1.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "212ab92002354b4819390025006c897e8140934349e8635c9b077f47b4dcbd20" + [[package]] name = "hex-conservative" version = "0.2.1" @@ -2765,6 +2787,16 @@ dependencies = [ "serde", ] +[[package]] +name = "secp256k1" +version = "0.28.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d24b59d129cdadea20aea4fb2352fa053712e5d713eee47d700cd4b2bc002f10" +dependencies = [ + "rand 0.8.5", + "secp256k1-sys 0.9.2", +] + [[package]] name = "secp256k1" version = "0.29.1" @@ -2786,6 +2818,15 @@ dependencies = [ "cc", ] +[[package]] +name = "secp256k1-sys" +version = "0.9.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "e5d1746aae42c19d583c3c1a8c646bfad910498e2051c551a7f2e3c0c9fbb7eb" +dependencies = [ + "cc", +] + [[package]] name = "secp256k1-sys" version = "0.10.1" @@ -2964,7 +3005,7 @@ source = "git+https://github.com/cygnet3/rust-silentpayments?branch=master#48e27 dependencies = [ "bech32 0.9.1", "bimap", - "bitcoin_hashes 0.13.0", + "bitcoin_hashes 0.13.1", "hex", "secp256k1 0.28.2", "serde", From 26ee628dcb4d670c1396085d72f87429e637889a Mon Sep 17 00:00:00 2001 From: Seth For Privacy <40500387+sethforprivacy@users.noreply.github.com> Date: Sat, 15 Aug 2026 15:32:03 -0400 Subject: [PATCH 2/2] ci: run cargo check with --locked to catch lock-file corruption Plain cargo silently repairs an inconsistent Cargo.lock over the network, which is how the merge-corrupted lock fixed in the previous commit shipped unnoticed in February and only surfaced in the nix job's offline vendored build. With --locked, the fast check job fails immediately on any lock/manifest mismatch. Co-Authored-By: Claude Fable 5 --- .github/workflows/rust.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml index f8eab1525..e0d5c3f20 100644 --- a/.github/workflows/rust.yml +++ b/.github/workflows/rust.yml @@ -16,8 +16,8 @@ jobs: - uses: actions/checkout@v4 - uses: dtolnay/rust-toolchain@1.75.0 - uses: Swatinem/rust-cache@v2 - - name: Run cargo check --all-targets - run: cargo check --all-targets + - name: Run cargo check --locked --all-targets + run: cargo check --locked --all-targets test: runs-on: ubuntu-22.04