use consistent HTTP server header on failure responses

[3.1 -> 3.2] Test nodeos_forked_chain_test: Fix race on kill of bridge node

.cicd/platforms/ubuntu18.Dockerfile

@@ -7,10 +7,13 @@ RUN apt-get update && apt-get upgrade -y && \
                                                       g++-8                       \
                                                       git                         \
                                                       jq                          \
+                                                      libcurl4-openssl-dev        \
                                                       libgmp-dev                  \
                                                       libssl-dev                  \
+                                                      libusb-1.0-0-dev            \
                                                       llvm-7-dev                  \
                                                       ninja-build                 \
+                                                      pkg-config                  \
                                                       python3                     \
                                                       software-properties-common  \
                                                       zlib1g-dev                  \

.cicd/platforms/ubuntu20.Dockerfile

@@ -7,8 +7,11 @@ RUN apt-get update && apt-get upgrade -y && \
                                                       git                  \
                                                       jq                   \
                                                       libboost-all-dev     \
+                                                      libcurl4-openssl-dev \
                                                       libgmp-dev           \
                                                       libssl-dev           \
+                                                      libusb-1.0-0-dev     \
                                                       llvm-11-dev          \
                                                       ninja-build          \
+                                                      pkg-config           \
                                                       zstd

.cicd/platforms/ubuntu22.Dockerfile

@@ -7,8 +7,11 @@ RUN apt-get update && apt-get upgrade -y && \
                                                       git                  \
                                                       jq                   \
                                                       libboost-all-dev     \
+                                                      libcurl4-openssl-dev \
                                                       libgmp-dev           \
                                                       libssl-dev           \
+                                                      libusb-1.0-0-dev     \
                                                       llvm-11-dev          \
                                                       ninja-build          \
+                                                      pkg-config           \
                                                       zstd

.github/workflows/label_new_issues.yaml

@@ -12,7 +12,6 @@ jobs:
       label: triage
       org-project: 'Team Backlog'
       project-field: Status=Todo
-      skip-if-existing-project: true
     secrets:
       token: ${{secrets.ENFCIBOT_REPO_AND_PROJECTS}}
 

.gitmodules

@@ -13,6 +13,9 @@
 [submodule "libraries/rapidjson"]
 	path = libraries/rapidjson
 	url = https://github.com/Tencent/rapidjson/
+[submodule "libraries/yubihsm"]
+	path = libraries/yubihsm
+	url = https://github.com/Yubico/yubihsm-shell
 [submodule "tests/abieos"]
 	path = tests/abieos
 	url = https://github.com/AntelopeIO/abieos

CMakeLists.txt

@@ -13,10 +13,10 @@ set( CMAKE_CXX_STANDARD 17 )
 set( CMAKE_CXX_EXTENSIONS ON )
 set( CXX_STANDARD_REQUIRED ON)
 
-set(VERSION_MAJOR 4)
-set(VERSION_MINOR 0)
+set(VERSION_MAJOR 3)
+set(VERSION_MINOR 2)
 set(VERSION_PATCH 0)
-set(VERSION_SUFFIX dev)
+#set(VERSION_SUFFIX rc2)
 
 if(VERSION_SUFFIX)
     set(VERSION_FULL "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}-${VERSION_SUFFIX}")
@@ -60,6 +60,8 @@ if(APPLE AND UNIX AND "${OPENSSL_ROOT_DIR}" STREQUAL "")
       set(OPENSSL_ROOT_DIR "/usr/local/opt/openssl@3;/usr/local/opt/openssl@1.1")
    endif()
 endif()
+# fc also adds these definitions to its public interface. once fc becomes the sole importer of openssl, this should be removed
+add_definitions(-DOPENSSL_API_COMPAT=0x10100000L -DOPENSSL_NO_DEPRECATED)
 
 option(ENABLE_OC "Enable eosvm-oc on supported platforms" ON)
 
@@ -222,6 +224,7 @@ configure_file(libraries/libfc/src/network/LICENSE.go                      licen
 configure_file(libraries/eos-vm/LICENSE                                    licenses/leap/LICENSE.eos-vm    COPYONLY)
 configure_file(libraries/libfc/libraries/ff/LICENSE                        licenses/leap/LICENSE.libff     COPYONLY)
 configure_file(programs/cleos/LICENSE.CLI11                                licenses/leap/LICENSE.CLI11     COPYONLY)
+configure_file(libraries/yubihsm/LICENSE                                   licenses/leap/LICENSE.yubihsm   COPYONLY)
 
 install(DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/licenses/leap" DESTINATION "${CMAKE_INSTALL_FULL_DATAROOTDIR}/licenses/" COMPONENT base)
 
@@ -240,6 +243,9 @@ add_custom_target(dev-install
   USES_TERMINAL
 )
 
+get_property(_CTEST_CUSTOM_TESTS_IGNORE GLOBAL PROPERTY CTEST_CUSTOM_TESTS_IGNORE)
+file(WRITE "${CMAKE_BINARY_DIR}/CTestCustom.cmake" "SET(CTEST_CUSTOM_TESTS_IGNORE ${_CTEST_CUSTOM_TESTS_IGNORE})")
+
 include(doxygen)
 
 include(package.cmake)

README.md

@@ -50,7 +50,9 @@ Requirements to build:
 - LLVM 7 - 11 - for Linux only
   - newer versions do not work
 - openssl 1.1+
+- libcurl
 - curl
+- libusb
 - git
 - GMP
 - Python 3
@@ -134,16 +136,19 @@ sudo apt-get install -y \
         curl \
         git \
         libboost-all-dev \
+        libcurl4-openssl-dev \
         libgmp-dev \
         libssl-dev \
-        llvm-11-dev
+        libusb-1.0-0-dev \
+        llvm-11-dev \
+        pkg-config
 ```
 To build, make sure you are in the root of the `leap` repo, then run the following command:
 ```bash
 mkdir -p build
 cd build
 cmake -DCMAKE_BUILD_TYPE=Release -DCMAKE_PREFIX_PATH=/usr/lib/llvm-11 ..
-make -j "$(nproc)" package
+make -j $(nproc) package
 ```
 </details>
 
@@ -158,9 +163,12 @@ sudo apt-get install -y \
         curl \
         g++-8 \
         git \
+        libcurl4-openssl-dev \
         libgmp-dev \
         libssl-dev \
+        libusb-1.0-0-dev \
         llvm-7-dev \
+        pkg-config \
         python3 \
         zlib1g-dev
 ```

docs/00_install/01_build-from-source/index.md

@@ -2,19 +2,19 @@
 content_title: Build Antelope from Source
 ---
 
-The shell scripts previously recommended for building the software have been removed in favor of a build process entirely driven by CMake. Those wishing to build from source are now responsible for installing the necessary dependencies. The list of dependencies and the recommended build procedure are in the [`README.md`](https://github.com/AntelopeIO/leap/blob/main/README.md) file. Instructions are also included for efficiently running the tests.
+The shell scripts previously recommended for building the software have been removed in favor of a build process entirely driven by CMake. Those wishing to build from source are now responsible for installing the necessary dependencies. The list of dependencies and the recommended build procedure are in the [`README.md`](https://github.com/AntelopeIO/leap/blob/release/3.2/README.md) file. Instructions are also included for efficiently running the tests.
 
 ### Using DUNE
 As an alternative to building from source, try [Docker Utilities for Node Execution](https://github.com/AntelopeIO/DUNE) for the easiest way to get started and for multi-platform support.
 
 ### Building From Source
-You can also build and install Leap from source. Instructions for that currently live [here](https://github.com/AntelopeIO/leap/blob/main/README.md#build-and-install-from-source).
+You can also build and install Leap from source. Instructions for that currently live [here](https://github.com/AntelopeIO/leap/blob/release/3.2/README.md#build-and-install-from-source).
 
 #### Building Pinned Build Binary Packages
-The pinned build instructions have moved [here](https://github.com/AntelopeIO/leap/blob/main/README.md#pinned-build). You may want to look at the [prerequisites](https://github.com/AntelopeIO/leap/blob/main/README.md#prerequisites) and our warning on parallelization using the `-j` jobs flag [here](https://github.com/AntelopeIO/leap/blob/main/README.md#step-3---build) before you build.
+The pinned build instructions have moved [here](https://github.com/AntelopeIO/leap/blob/release/3.2/README.md#pinned-build). You may want to look at the [prerequisites](https://github.com/AntelopeIO/leap/blob/release/3.2/README.md#prerequisites) and our warning on parallelization using the `-j` jobs flag [here](https://github.com/AntelopeIO/leap/blob/release/3.2/README.md#step-3---build) before you build.
 
 #### Manual (non "pinned") Build Instructions
-The unpinned build instructions have moved [here](https://github.com/AntelopeIO/leap/blob/main/README.md#unpinned-build). You may want to look at the [prerequisites](https://github.com/AntelopeIO/leap/blob/main/README.md#prerequisites) and our warning on parallelization using the `-j` jobs flag [here](https://github.com/AntelopeIO/leap/blob/main/README.md#step-3---build) before you build.
+The unpinned build instructions have moved [here](https://github.com/AntelopeIO/leap/blob/release/3.2/README.md#unpinned-build). You may want to look at the [prerequisites](https://github.com/AntelopeIO/leap/blob/release/3.2/README.md#prerequisites) and our warning on parallelization using the `-j` jobs flag [here](https://github.com/AntelopeIO/leap/blob/release/3.2/README.md#step-3---build) before you build.
 
 ### Running Tests
-Documentation on available test suites and how to run them has moved [here](https://github.com/AntelopeIO/leap/blob/main/README.md#test).
+Documentation on available test suites and how to run them has moved [here](https://github.com/AntelopeIO/leap/blob/release/3.2/README.md#test).

docs/01_nodeos/03_plugins/index.md

@@ -13,6 +13,7 @@ For information on specific plugins, just select from the list below:
 * [`db_size_api_plugin`](db_size_api_plugin/index.md)
 * [`http_client_plugin`](http_client_plugin/index.md)
 * [`http_plugin`](http_plugin/index.md)
+* [`login_plugin`](login_plugin/index.md)
 * [`net_api_plugin`](net_api_plugin/index.md)
 * [`net_plugin`](net_plugin/index.md)
 * [`producer_plugin`](producer_plugin/index.md)

docs/01_nodeos/03_plugins/login_plugin/index.md

@@ -0,0 +1,47 @@
+## Description
+
+The `login_plugin` supports the concept of applications authenticating with the Antelope blockchain. The `login_plugin` API allows an application to verify whether an account is allowed to sign in order to satisfy a specified authority.
+
+## Usage
+
+```console
+# config.ini
+plugin = eosio::login_plugin
+[options]
+```
+```sh
+# command-line
+nodeos ... --plugin eosio::login_plugin [options]
+```
+
+## Options
+
+These can be specified from both the `nodeos` command-line or the `config.ini` file:
+
+```console
+Config Options for eosio::login_plugin:
+  --max-login-requests arg (=1000000)   The maximum number of pending login 
+                                        requests
+  --max-login-timeout arg (=60)         The maximum timeout for pending login 
+                                        requests (in seconds)
+```
+
+## Dependencies
+
+* [`chain_plugin`](../chain_plugin/index.md)
+* [`http_plugin`](../http_plugin/index.md)
+
+### Load Dependency Examples
+
+```console
+# config.ini
+plugin = eosio::chain_plugin
+[options]
+plugin = eosio::http_plugin 
+[options]
+```
+```sh
+# command-line
+nodeos ... --plugin eosio::chain_plugin [options]  \
+           --plugin eosio::http_plugin [options]
+```

docs/03_keosd/10_usage.md

@@ -91,6 +91,11 @@ Config Options for eosio::wallet_plugin:
                                         number of seconds of inactivity.
                                         Activity is defined as any wallet
                                         command e.g. list-wallets.
+  --yubihsm-url URL                     Override default URL of
+                                        http://localhost:12345 for connecting
+                                        to yubihsm-connector
+  --yubihsm-authkey key_num             Enables YubiHSM support using given
+                                        Authkey
 
 Application Config Options:
   --plugin arg                          Plugin(s) to enable, may be specified

docs/03_keosd/30_how-to-guides/how-to-attach-a-yubihsm-hard-wallet.md

@@ -0,0 +1,73 @@
+---
+content_title: How To Attach a YubiHSM Hard Wallet
+link_text: How To Attach a YubiHSM Hard Wallet
+---
+
+## Goal
+
+Attach a YubiHSM as a hard wallet
+
+## Before you begin
+
+* Install the currently supported version of `keosd`
+
+* Install YubiHSM2 Software Toolkit (YubiHSM2 SDK)
+
+* Create an AuthKey with at least the following Capabilities:
+
+   * sign-ecdsa
+   * generate-asymmetric-key
+   * export-wrapped
+
+* **Delete the default AuthKey**
+
+[[warning | Security]]
+| It is extremely important to create a new AuthKey and remove the default AuthKey before proceed to the following steps.
+
+## Steps
+
+### Configure `keosd`
+
+   There are two options to connect `keosd` to YubiHSM:
+
+   #### Using a YubiHSM connector
+
+   By default, `keosd` will connect to the YubiHSM connector on the default host and port. If a non-default URL is used, set the `--yubihsm-url` option or `yubihsm-url` in `config.ini` with the correct connector URL
+
+   #### Directly connect via USB
+
+   `keosd` also can directly connect to YubiHSM via USB protocol
+
+   If this option is used, set `keosd` startup option as the below:
+
+   ```sh
+   --yubihsm-url=ysb://
+   ```
+
+### Start `keosd` with AuthKey:
+
+   ```sh
+   --yubihsm-authkey Your_AuthKey_Object_Number
+   ```
+
+   if a YubiHSM connector is used, check the YubiHSM connector is up and running by visiting YubiHSM URL:
+      http://YubiHSM_HOST:YubiHSM_PORT/connector/status ((Default HOST and Port: http://127.0.0.1:12345)
+
+   You should see something like this:
+
+   ```console
+   status=OK
+   serial=*
+   version=2.0.0
+   pid=666
+   address=localhost
+   port=12345
+   ```
+
+### Unlock YubiHSM wallet with the password of AuthKey using the following option:
+
+   ```sh
+   cleos wallet unlock -n YubiHSM --password YOUR_AUTHKEY_PASSWORD
+   ```
+
+After unlocking the wallet, you can use `cleos wallet` commands as usual. Beware as a part of security mechanism, some wallet subcommands, such as retrieve private keys, or remove a key, are not supported when a YubiHSM is used

docs/03_keosd/30_how-to-guides/index.md

@@ -0,0 +1,5 @@
+---
+content_title: Keosd How-to Guides
+---
+
+* [How to attach a YubiHSM hard wallet](how-to-attach-a-yubihsm-hard-wallet.md)

libraries/CMakeLists.txt

@@ -26,3 +26,23 @@ set(ENABLE_PROFILE OFF CACHE BOOL "Enable for profile builds")
 if(eos-vm IN_LIST EOSIO_WASM_RUNTIMES OR eos-vm-jit IN_LIST EOSIO_WASM_RUNTIMES)
 add_subdirectory( eos-vm )
 endif()
+
+#yubihsm's openssl discovery is via pkg-config instead of find_package. Help it out on macOS otherwise openssl's pkgconfig
+# files may not be found down in the /opt/homebrew/opt directory
+if(APPLE)
+  get_filename_component(OPENSSL_LIB_PATH "${OPENSSL_CRYPTO_LIBRARY}" DIRECTORY)
+  set(ENV{PKG_CONFIG_PATH} "$ENV{PKG_CONFIG_PATH}:${OPENSSL_LIB_PATH}/pkgconfig")
+endif()
+set(ENABLE_STATIC ON)
+set(CMAKE_MACOSX_RPATH OFF)
+set(BUILD_ONLY_LIB ON CACHE BOOL "Library only build")
+message(STATUS "Starting yubihsm configuration...")
+add_subdirectory( yubihsm EXCLUDE_FROM_ALL )
+target_compile_options(yubihsm_static PRIVATE -fno-lto -fcommon)
+message(STATUS "yubihsm configuration complete")
+
+get_property(_CTEST_CUSTOM_TESTS_IGNORE GLOBAL PROPERTY CTEST_CUSTOM_TESTS_IGNORE)
+set_property(GLOBAL PROPERTY CTEST_CUSTOM_TESTS_IGNORE
+  "change_authkey import_ed decrypt_ec decrypt_rsa ssh logs generate_rsa import_ec echo\
+  yubico_otp wrap_data wrap info import_rsa import_authkey generate_hmac generate_ec\
+  attest pbkdf2 parsing ${_CTEST_CUSTOM_TESTS_IGNORE}")

plugins/CMakeLists.txt

@@ -14,5 +14,6 @@ add_subdirectory(wallet_plugin)
 add_subdirectory(wallet_api_plugin)
 add_subdirectory(txn_test_gen_plugin)
 add_subdirectory(db_size_api_plugin)
+add_subdirectory(login_plugin)
 add_subdirectory(test_control_plugin)
 add_subdirectory(test_control_api_plugin)

plugins/chain_plugin/chain_plugin.cpp

@@ -1138,6 +1138,13 @@ void chain_plugin::plugin_initialize(const variables_map& options) {
          // For the time being, when `deep-mind = true` is activated, we set `stdout` here to
          // be an unbuffered I/O stream.
          setbuf(stdout, NULL);
+         
+         //verify configuration is correct
+         EOS_ASSERT( options.at("api-accept-transactions").as<bool>() == false, plugin_config_exception,
+            "api-accept-transactions must be set to false in order to enable deep-mind logging.");
+
+         EOS_ASSERT( options.at("p2p-accept-transactions").as<bool>() == false, plugin_config_exception,
+            "p2p-accept-transactions must be set to false in order to enable deep-mind logging.");
 
          my->chain->enable_deep_mind( &_deep_mind_log );
       }

plugins/http_plugin/http_plugin.cpp

@@ -359,6 +359,8 @@ class http_plugin_impl : public std::enable_shared_from_this<http_plugin_impl> {
             }
          }
 
+         my->plugin_state->server_header = current_http_plugin_defaults.server_header;
+
          
          //watch out for the returns above when adding new code here
       } FC_LOG_AND_RETHROW()

plugins/http_plugin/include/eosio/http_plugin/beast_http_session.hpp

@@ -106,7 +106,8 @@ protected:
       res_->version(req.version());
       res_->set(http::field::content_type, "application/json");
       res_->keep_alive(req.keep_alive());
-      res_->set(http::field::server, BOOST_BEAST_VERSION_STRING);
+      if(plugin_state_->server_header.size())
+         res_->set(http::field::server, plugin_state_->server_header);
 
       // Request path must be absolute and not contain "..".
       if(req.target().empty() || req.target()[0] != '/' || req.target().find("..") != beast::string_view::npos) {
@@ -342,9 +343,7 @@ public:
 
 
       if(is_send_exception_response_) {
-         res_->set(http::field::content_type, "application/json");
          res_->keep_alive(false);
-         res_->set(http::field::server, BOOST_BEAST_VERSION_STRING);
 
          send_response(std::move(err_str), static_cast<unsigned int>(http::status::internal_server_error));
          derived().do_eof();

plugins/http_plugin/include/eosio/http_plugin/common.hpp

@@ -130,6 +130,8 @@ struct http_plugin_state {
    bool validate_host = true;
    set<string> valid_hosts;
 
+   string server_header;
+
    url_handlers_type url_handlers;
    bool keep_alive = false;
 

plugins/http_plugin/include/eosio/http_plugin/http_plugin.hpp

@@ -45,6 +45,8 @@ namespace eosio {
       //If non 0, HTTP will be enabled by default on the given port number. If
       // 0, HTTP will not be enabled by default
       uint16_t default_http_port{0};
+      //If set, a Server header will be added to the HTTP reply with this value
+      string server_header;
    };
 
    /**

plugins/login_plugin/.clang-format

@@ -0,0 +1,5 @@
+BasedOnStyle: LLVM
+IndentWidth: 3
+ColumnLimit: 120
+PointerAlignment: Left
+AlwaysBreakTemplateDeclarations: true

plugins/login_plugin/CMakeLists.txt

@@ -0,0 +1,7 @@
+file(GLOB HEADERS "include/eosio/login_plugin/*.hpp")
+add_library( login_plugin
+             login_plugin.cpp
+             ${HEADERS} )
+
+target_link_libraries( login_plugin chain_plugin http_plugin appbase )
+target_include_directories( login_plugin PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}/include" )

plugins/login_plugin/include/eosio/login_plugin/login_plugin.hpp

@@ -0,0 +1,94 @@
+#pragma once
+#include <eosio/chain_plugin/chain_plugin.hpp>
+#include <eosio/http_plugin/http_plugin.hpp>
+
+#include <appbase/application.hpp>
+#include <eosio/chain/controller.hpp>
+
+namespace eosio {
+
+class login_plugin : public plugin<login_plugin> {
+ public:
+   APPBASE_PLUGIN_REQUIRES((chain_plugin)(http_plugin))
+
+   login_plugin();
+   virtual ~login_plugin();
+
+   virtual void set_program_options(options_description&, options_description&) override;
+   void plugin_initialize(const variables_map&);
+   void plugin_startup();
+   void plugin_shutdown();
+
+   struct start_login_request_params {
+      chain::time_point_sec expiration_time;
+   };
+
+   struct start_login_request_results {
+      chain::public_key_type server_ephemeral_pub_key;
+   };
+
+   struct finalize_login_request_params {
+      chain::public_key_type server_ephemeral_pub_key;
+      chain::public_key_type client_ephemeral_pub_key;
+      chain::permission_level permission;
+      std::string data;
+      std::vector<chain::signature_type> signatures;
+   };
+
+   struct finalize_login_request_results {
+      chain::sha256 digest{};
+      flat_set<chain::public_key_type> recovered_keys{};
+      bool permission_satisfied = false;
+      std::string error{};
+   };
+
+   struct do_not_use_gen_r1_key_params {};
+
+   struct do_not_use_gen_r1_key_results {
+      chain::public_key_type pub_key;
+      chain::private_key_type priv_key;
+   };
+
+   struct do_not_use_sign_params {
+      chain::private_key_type priv_key;
+      chain::bytes data;
+   };
+
+   struct do_not_use_sign_results {
+      chain::signature_type sig;
+   };
+
+   struct do_not_use_get_secret_params {
+      chain::public_key_type pub_key;
+      chain::private_key_type priv_key;
+   };
+
+   struct do_not_use_get_secret_results {
+      chain::sha512 secret;
+   };
+
+   start_login_request_results start_login_request(const start_login_request_params&);
+   finalize_login_request_results finalize_login_request(const finalize_login_request_params&);
+
+   do_not_use_gen_r1_key_results do_not_use_gen_r1_key(const do_not_use_gen_r1_key_params&);
+   do_not_use_sign_results do_not_use_sign(const do_not_use_sign_params&);
+   do_not_use_get_secret_results do_not_use_get_secret(const do_not_use_get_secret_params&);
+
+ private:
+   unique_ptr<class login_plugin_impl> my;
+};
+
+} // namespace eosio
+
+FC_REFLECT(eosio::login_plugin::start_login_request_params, (expiration_time))
+FC_REFLECT(eosio::login_plugin::start_login_request_results, (server_ephemeral_pub_key))
+FC_REFLECT(eosio::login_plugin::finalize_login_request_params,
+           (server_ephemeral_pub_key)(client_ephemeral_pub_key)(permission)(data)(signatures))
+FC_REFLECT(eosio::login_plugin::finalize_login_request_results, (digest)(recovered_keys)(permission_satisfied)(error))
+
+FC_REFLECT_EMPTY(eosio::login_plugin::do_not_use_gen_r1_key_params)
+FC_REFLECT(eosio::login_plugin::do_not_use_gen_r1_key_results, (pub_key)(priv_key))
+FC_REFLECT(eosio::login_plugin::do_not_use_sign_params, (priv_key)(data))
+FC_REFLECT(eosio::login_plugin::do_not_use_sign_results, (sig))
+FC_REFLECT(eosio::login_plugin::do_not_use_get_secret_params, (pub_key)(priv_key))
+FC_REFLECT(eosio::login_plugin::do_not_use_get_secret_results, (secret))

plugins/login_plugin/login_plugin.cpp

@@ -0,0 +1,160 @@
+#include <eosio/chain/authorization_manager.hpp>
+#include <eosio/chain/exceptions.hpp>
+#include <eosio/login_plugin/login_plugin.hpp>
+
+#include <fc/io/json.hpp>
+
+namespace eosio {
+
+static appbase::abstract_plugin& _login_plugin = app().register_plugin<login_plugin>();
+
+using namespace eosio;
+
+struct login_request {
+   chain::private_key_type server_ephemeral_priv_key{};
+   chain::public_key_type server_ephemeral_pub_key{};
+   chain::time_point_sec expiration_time;
+};
+
+struct login_request_pub_key_index {};
+struct login_request_time_index {};
+
+using login_request_container = boost::multi_index_container<
+    login_request,
+    indexed_by< //
+        ordered_unique<tag<login_request_pub_key_index>,
+                       member<login_request, chain::public_key_type, &login_request::server_ephemeral_pub_key>>,
+        ordered_non_unique<tag<login_request_time_index>,
+                           member<login_request, chain::time_point_sec, &login_request::expiration_time>> //
+        >>;
+
+class login_plugin_impl {
+ public:
+   login_request_container requests{};
+   uint32_t max_login_requests = 1000000;
+   uint32_t max_login_timeout = 60;
+
+   void expire_requests() {
+      auto& index = requests.get<login_request_time_index>();
+      auto now = fc::time_point::now();
+      for (auto it = index.begin(); it != index.end() && it->expiration_time < now; it = index.erase(it))
+         ;
+   }
+};
+
+login_plugin::login_plugin() : my{std::make_unique<login_plugin_impl>()} {}
+login_plugin::~login_plugin() {}
+
+void login_plugin::set_program_options(options_description&, options_description& cfg) {
+   cfg.add_options() //
+       ("max-login-requests", bpo::value<uint32_t>()->default_value(1000000),
+        "The maximum number of pending login requests") //
+       ("max-login-timeout", bpo::value<uint32_t>()->default_value(60),
+        "The maximum timeout for pending login requests (in seconds)");
+}
+
+void login_plugin::plugin_initialize(const variables_map& options) {
+   my->max_login_requests = options.at("max-login-requests").as<uint32_t>();
+   my->max_login_timeout = options.at("max-login-timeout").as<uint32_t>();
+}
+
+#define CALL(call_name, http_response_code)                                                                            \
+   {                                                                                                                   \
+      std::string("/v1/login/" #call_name), [this](string, string body, url_response_callback cb) mutable {            \
+         try {                                                                                                         \
+            if (body.empty())                                                                                          \
+               body = "{}";                                                                                            \
+            fc::variant result( call_name(fc::json::from_string(body).as<login_plugin::call_name##_params>()) );       \
+            cb(http_response_code, fc::time_point::maximum(), std::move(result));                                      \
+         } catch (...) {                                                                                               \
+            http_plugin::handle_exception("login", #call_name, body, cb);                                              \
+         }                                                                                                             \
+      }                                                                                                                \
+   }
+
+void login_plugin::plugin_startup() {
+   ilog("starting login_plugin");
+   app().get_plugin<http_plugin>().add_api({
+       CALL(start_login_request, 200), //
+       CALL(finalize_login_request, 200),
+       // CALL(do_not_use_gen_r1_key, 200),  //
+       // CALL(do_not_use_sign, 200),        //
+       // CALL(do_not_use_get_secret, 200),  //
+   });
+}
+
+void login_plugin::plugin_shutdown() {}
+
+login_plugin::start_login_request_results
+login_plugin::start_login_request(const login_plugin::start_login_request_params& params) {
+   my->expire_requests();
+   EOS_ASSERT(params.expiration_time > fc::time_point::now(), fc::timeout_exception,
+              "Requested expiration time ${expiration_time} is in the past",
+              ("expiration_time", params.expiration_time));
+   EOS_ASSERT(my->requests.size() < my->max_login_requests, fc::timeout_exception, "Too many pending login requests");
+   login_request request;
+   request.server_ephemeral_priv_key = chain::private_key_type::generate_r1();
+   request.server_ephemeral_pub_key = request.server_ephemeral_priv_key.get_public_key();
+   request.expiration_time =
+       std::min(params.expiration_time, fc::time_point_sec{fc::time_point::now()} + my->max_login_timeout);
+   my->requests.insert(request);
+   return {request.server_ephemeral_pub_key};
+}
+
+login_plugin::finalize_login_request_results
+login_plugin::finalize_login_request(const login_plugin::finalize_login_request_params& params) {
+   finalize_login_request_results result;
+   my->expire_requests();
+   auto& index = my->requests.get<login_request_pub_key_index>();
+   auto it = index.find(params.server_ephemeral_pub_key);
+   if (it == index.end()) {
+      result.error = "server_ephemeral_pub_key expired or not found";
+      return result;
+   }
+   auto request = *it;
+   index.erase(it);
+
+   auto shared_secret = request.server_ephemeral_priv_key.generate_shared_secret(params.client_ephemeral_pub_key);
+
+   chain::bytes combined_data(1024 * 1024);
+   chain::datastream<char*> sig_data_ds{combined_data.data(), combined_data.size()};
+   fc::raw::pack(sig_data_ds, params.permission);
+   fc::raw::pack(sig_data_ds, shared_secret);
+   fc::raw::pack(sig_data_ds, params.data);
+   combined_data.resize(sig_data_ds.tellp());
+
+   result.digest = chain::sha256::hash(combined_data);
+   for (auto& sig : params.signatures)
+      result.recovered_keys.insert(chain::public_key_type{sig, result.digest});
+
+   try {
+      auto noop_checktime = [] {};
+      auto& chain = app().get_plugin<chain_plugin>().chain();
+      chain.get_authorization_manager().check_authorization( //
+          params.permission.actor, params.permission.permission, result.recovered_keys, {}, fc::microseconds(0),
+          noop_checktime, true);
+      result.permission_satisfied = true;
+   } catch (...) {
+      result.error = "keys do not satisfy permission";
+   }
+
+   return result;
+}
+
+login_plugin::do_not_use_gen_r1_key_results
+login_plugin::do_not_use_gen_r1_key(const login_plugin::do_not_use_gen_r1_key_params& params) {
+   auto priv = chain::private_key_type::generate_r1();
+   return {priv.get_public_key(), priv};
+}
+
+login_plugin::do_not_use_sign_results
+login_plugin::do_not_use_sign(const login_plugin::do_not_use_sign_params& params) {
+   return {params.priv_key.sign(chain::sha256::hash(params.data))};
+}
+
+login_plugin::do_not_use_get_secret_results
+login_plugin::do_not_use_get_secret(const login_plugin::do_not_use_get_secret_params& params) {
+   return {params.priv_key.generate_shared_secret(params.pub_key)};
+}
+
+} // namespace eosio

plugins/net_plugin/net_plugin.cpp

@@ -2686,7 +2686,7 @@ namespace eosio {
          my_impl->producer_plug->log_failed_transaction(ptr->id(), ptr, reason);
          if (fc::time_point::now() - fc::seconds(1) >= last_dropped_trx_msg_time) {
             last_dropped_trx_msg_time = fc::time_point::now();
-            wlog(reason);
+            peer_wlog(this, reason);
          }
          return true;
       }

plugins/state_history_plugin/state_history_plugin.cpp

@@ -570,14 +570,14 @@ struct state_history_plugin_impl : std::enable_shared_from_this<state_history_pl
          return;
       bool fresh = chain_state_log->begin_block() == chain_state_log->end_block();
       if (fresh)
-         fc_ilog(_log, "Placing initial state in block ${n}", ("n", block_state->block_num));
+         fc_ilog(_log, "Placing initial state in block ${n}", ("n", block_state->block->block_num()));
 
       std::vector<table_delta> deltas     = state_history::create_deltas(chain_plug->chain().db(), fresh);
       auto                     deltas_bin = state_history::zlib_compress_bytes(fc::raw::pack(deltas));
       state_history_log_header header{.magic        = ship_magic(ship_current_version, 0),
                                       .block_id     = block_state->id,
                                       .payload_size = sizeof(uint32_t) + deltas_bin.size()};
-      chain_state_log->write_entry(header, block_state->header.previous, [&](auto& stream) {
+      chain_state_log->write_entry(header, block_state->block->previous, [&](auto& stream) {
          // Compressed deltas now exceeds 4GB on one of the public chains. This length prefix
          // was intended to support adding additional fields in the future after the
          // packed deltas. For now we're going to ignore on read. The 0 is an attempt to signal
@@ -694,12 +694,6 @@ void state_history_plugin::plugin_startup() {
 
    try {
       my->thr = std::thread([ptr = my.get()] { ptr->ctx.run(); });
-      auto bsp = my->chain_plug->chain().head_block_state();
-      if( bsp && my->chain_state_log && my->chain_state_log->begin_block() == my->chain_state_log->end_block() ) {
-         fc_ilog( _log, "Storing initial state on startup, this can take a considerable amount of time" );
-         my->store_chain_state( bsp );
-         fc_ilog( _log, "Done storing initial state on startup" );
-      }
       my->listen();
    } catch (std::exception& ex) {
       appbase::app().quit();

plugins/wallet_plugin/CMakeLists.txt

@@ -19,7 +19,11 @@ add_library( wallet_plugin
              wallet_plugin.cpp
              wallet_manager.cpp
              ${SE_WALLET_SOURCES}
+             yubihsm_wallet.cpp
              ${HEADERS} )
 
-target_link_libraries( wallet_plugin eosio_chain appbase ${security_framework} ${corefoundation_framework} ${localauthentication_framework} ${cocoa_framework})
+target_link_libraries( wallet_plugin yubihsm_static eosio_chain appbase ${security_framework} ${corefoundation_framework} ${localauthentication_framework} ${cocoa_framework})
 target_include_directories( wallet_plugin PUBLIC "${CMAKE_CURRENT_SOURCE_DIR}/include" )
+
+#sadly old cmake 2.8 support in yubihsm cmake prevents usage of target_include_directories there
+target_include_directories( wallet_plugin PRIVATE "${CMAKE_SOURCE_DIR}/libraries/yubihsm/lib" )

plugins/wallet_plugin/include/eosio/wallet_plugin/yubihsm_wallet.hpp

@@ -0,0 +1,41 @@
+#pragma once
+
+#include <eosio/chain/types.hpp>
+#include <eosio/wallet_plugin/wallet_api.hpp>
+
+using namespace std;
+using namespace eosio::chain;
+
+namespace eosio { namespace wallet {
+
+namespace detail {
+struct yubihsm_wallet_impl;
+}
+
+class yubihsm_wallet final : public wallet_api {
+   public:
+      yubihsm_wallet(const string& connector, const uint16_t authkey);
+      ~yubihsm_wallet();
+
+      private_key_type get_private_key(public_key_type pubkey) const override;
+
+      bool is_locked() const override;
+      void lock() override;
+      void unlock(string password) override;
+      void check_password(string password) override;
+      void set_password(string password) override;
+
+      map<public_key_type, private_key_type> list_keys() override;
+      flat_set<public_key_type> list_public_keys() override;
+
+      bool import_key(string wif_key) override;
+      string create_key(string key_type) override;
+      bool remove_key(string key) override;
+
+      std::optional<signature_type> try_sign_digest(const digest_type digest, const public_key_type public_key) override;
+
+   private:
+      std::unique_ptr<detail::yubihsm_wallet_impl> my;
+};
+
+}}

plugins/wallet_plugin/wallet_plugin.cpp

@@ -1,5 +1,6 @@
 #include <eosio/wallet_plugin/wallet_plugin.hpp>
 #include <eosio/wallet_plugin/wallet_manager.hpp>
+#include <eosio/wallet_plugin/yubihsm_wallet.hpp>
 #include <eosio/chain/exceptions.hpp>
 #include <boost/filesystem/path.hpp>
 #include <chrono>
@@ -26,6 +27,10 @@ void wallet_plugin::set_program_options(options_description& cli, options_descri
           "Timeout for unlocked wallet in seconds (default 900 (15 minutes)). "
           "Wallets will automatically lock after specified number of seconds of inactivity. "
           "Activity is defined as any wallet command e.g. list-wallets.")
+         ("yubihsm-url", bpo::value<string>()->value_name("URL"),
+          "Override default URL of http://localhost:12345 for connecting to yubihsm-connector")
+         ("yubihsm-authkey", bpo::value<uint16_t>()->value_name("key_num"),
+          "Enables YubiHSM support using given Authkey")
          ;
 }
 
@@ -48,6 +53,15 @@ void wallet_plugin::plugin_initialize(const variables_map& options) {
          std::chrono::seconds t(timeout);
          wallet_manager_ptr->set_timeout(t);
       }
+      if (options.count("yubihsm-authkey")) {
+         uint16_t key = options.at("yubihsm-authkey").as<uint16_t>();
+         string connector_endpoint = "http://localhost:12345";
+         if(options.count("yubihsm-url"))
+            connector_endpoint = options.at("yubihsm-url").as<string>();
+         try {
+            wallet_manager_ptr->own_and_use_wallet("YubiHSM", make_unique<yubihsm_wallet>(connector_endpoint, key));
+         }FC_LOG_AND_RETHROW()
+      }
    } FC_LOG_AND_RETHROW()
 }
 

plugins/wallet_plugin/yubihsm_wallet.cpp

@@ -0,0 +1,268 @@
+#include <appbase/application.hpp>
+
+#include <eosio/wallet_plugin/yubihsm_wallet.hpp>
+#include <eosio/chain/exceptions.hpp>
+#include <yubihsm.h>
+
+#include <fc/crypto/openssl.hpp>
+
+#include <boost/range/adaptor/map.hpp>
+#include <boost/range/algorithm/copy.hpp>
+#include <boost/asio/posix/stream_descriptor.hpp>
+#include <boost/dll/runtime_symbol_info.hpp>
+
+namespace eosio { namespace wallet {
+
+using namespace fc::crypto::r1;
+
+namespace detail {
+
+struct yubihsm_wallet_impl {
+   using key_map_type = map<public_key_type,uint16_t>;
+
+   yubihsm_wallet_impl(const string& ep, const uint16_t ak) : endpoint(ep), authkey(ak) {
+      yh_rc rc;
+      if((rc = yh_init()))
+         FC_THROW("yubihsm init failure: ${c}", ("c", yh_strerror(rc)));
+   }
+
+   ~yubihsm_wallet_impl() {
+      lock();
+      yh_exit();
+      //bizarre, is there no way to destroy a yh_connector??
+
+      ///XXX Probably a race condition on timer shutdown and appbase destruction
+   }
+
+   bool is_locked() const {
+      return !connector;
+   }
+
+   key_map_type::iterator populate_key_map_with_keyid(const uint16_t key_id) {
+      yh_rc rc;
+      size_t blob_sz = 128;
+      uint8_t blob[blob_sz];
+      if((rc = yh_util_get_public_key(session, key_id, blob, &blob_sz, nullptr)))
+         FC_THROW_EXCEPTION(chain::wallet_exception, "yh_util_get_public_key failed: ${m}", ("m", yh_strerror(rc)));
+      if(blob_sz != 64)
+         FC_THROW_EXCEPTION(chain::wallet_exception, "unexpected pubkey size from yh_util_get_public_key");
+
+      ///XXX This is junky and common with SE wallet; commonize it
+      char serialized_pub_key[sizeof(public_key_data) + 1];
+      serialized_pub_key[0] = 0x01; //means R1 key
+      serialized_pub_key[1] = 0x02 + (blob[63]&1); //R1 header; even or odd Y
+      memcpy(serialized_pub_key+2, blob, 32); //copy in the 32 bytes of X
+
+      public_key_type pub_key;
+      fc::datastream<const char *> ds(serialized_pub_key, sizeof(serialized_pub_key));
+      fc::raw::unpack(ds, pub_key);
+
+      return _keys.emplace(pub_key, key_id).first;
+   }
+
+   void unlock(const string& password) {
+      yh_rc rc;
+
+      try {
+         if((rc = yh_init_connector(endpoint.c_str(), &connector)))
+            FC_THROW_EXCEPTION(chain::wallet_exception, "Failled to initialize yubihsm connector URL: ${c}", ("c", yh_strerror(rc)));
+         if((rc = yh_connect(connector, 0)))
+            FC_THROW_EXCEPTION(chain::wallet_exception, "Failed to connect to YubiHSM connector: ${m}", ("m", yh_strerror(rc)));
+         if((rc = yh_create_session_derived(connector, authkey, (const uint8_t *)password.data(), password.size(), false, &session)))
+            FC_THROW_EXCEPTION(chain::wallet_exception, "Failed to create YubiHSM session: ${m}", ("m", yh_strerror(rc)));
+         if((rc = yh_authenticate_session(session)))
+            FC_THROW_EXCEPTION(chain::wallet_exception, "Failed to authenticate YubiHSM session: ${m}", ("m", yh_strerror(rc)));
+
+         yh_object_descriptor authkey_desc;
+         if((rc = yh_util_get_object_info(session, authkey, YH_AUTHENTICATION_KEY, &authkey_desc)))
+            FC_THROW_EXCEPTION(chain::wallet_exception, "Failed to get authkey info: ${m}", ("m", yh_strerror(rc)));
+
+         authkey_caps = authkey_desc.capabilities;
+         authkey_domains = authkey_desc.domains;
+
+         if(!yh_check_capability(&authkey_caps, "sign-ecdsa"))
+            FC_THROW_EXCEPTION(chain::wallet_exception, "Given authkey cannot perform signing");
+
+         size_t found_objects_n = 64*1024;
+         yh_object_descriptor found_objs[found_objects_n];
+         yh_capabilities find_caps;
+         yh_string_to_capabilities("sign-ecdsa", &find_caps);
+         if((rc = yh_util_list_objects(session, 0, YH_ASYMMETRIC_KEY, 0, &find_caps, YH_ALGO_EC_P256, nullptr, found_objs, &found_objects_n)))
+            FC_THROW_EXCEPTION(chain::wallet_exception, "yh_util_list_objects failed: ${m}", ("m", yh_strerror(rc)));
+
+         for(size_t i = 0; i < found_objects_n; ++i)
+            populate_key_map_with_keyid(found_objs[i].id);
+      }
+      catch(chain::wallet_exception& e) {
+         lock();
+         throw;
+      }
+
+      prime_keepalive_timer();
+   }
+
+   void lock() {
+      if(session) {
+         yh_util_close_session(session);
+         yh_destroy_session(&session);
+      }
+      session = nullptr;
+      if(connector)
+         yh_disconnect(connector);
+      //it would seem like this would leak-- there is no destroy() call for it. But I clearly can't reuse connectors
+      // as that fails with a "Unable to find a suitable connector"
+      connector = nullptr;
+
+      _keys.clear();
+      keepalive_timer.cancel();
+   }
+
+   void prime_keepalive_timer() {
+      keepalive_timer.expires_at(std::chrono::steady_clock::now() + std::chrono::seconds(20));
+      keepalive_timer.async_wait([this](const boost::system::error_code& ec){
+         if(ec || !session)
+            return;
+
+         uint8_t data, resp;
+         yh_cmd resp_cmd;
+         size_t resp_sz = 1;
+         if(yh_send_secure_msg(session, YHC_ECHO, &data, 1, &resp_cmd, &resp, &resp_sz))
+            lock();
+         else
+            prime_keepalive_timer();
+      });
+   }
+
+   std::optional<signature_type> try_sign_digest(const digest_type d, const public_key_type public_key) {
+      auto it = _keys.find(public_key);
+      if(it == _keys.end())
+         return std::optional<signature_type>();
+
+      size_t der_sig_sz = 128;
+      uint8_t der_sig[der_sig_sz];
+      yh_rc rc;
+      if((rc = yh_util_sign_ecdsa(session, it->second, (uint8_t*)d.data(), d.data_size(), der_sig, &der_sig_sz))) {
+         lock();
+         FC_THROW_EXCEPTION(chain::wallet_exception, "yh_util_sign_ecdsa failed: ${m}", ("m", yh_strerror(rc)));
+      }
+
+      ///XXX a lot of this below is similar to SE wallet; commonize it in non-junky way
+      fc::ecdsa_sig sig = ECDSA_SIG_new();
+      BIGNUM *r = BN_new(), *s = BN_new();
+      BN_bin2bn(der_sig+4, der_sig[3], r);
+      BN_bin2bn(der_sig+6+der_sig[3], der_sig[4+der_sig[3]+1], s);
+      ECDSA_SIG_set0(sig, r, s);
+
+      char pub_key_shim_data[64];
+      fc::datastream<char *> eds(pub_key_shim_data, sizeof(pub_key_shim_data));
+      fc::raw::pack(eds, it->first);
+      public_key_data* kd = (public_key_data*)(pub_key_shim_data+1);
+
+      compact_signature compact_sig;
+      compact_sig = signature_from_ecdsa(key, *kd, sig, d);
+
+      char serialized_signature[sizeof(compact_sig) + 1];
+      serialized_signature[0] = 0x01;
+      memcpy(serialized_signature+1, compact_sig.data, sizeof(compact_sig));
+
+      signature_type final_signature;
+      fc::datastream<const char *> ds(serialized_signature, sizeof(serialized_signature));
+      fc::raw::unpack(ds, final_signature);
+      return final_signature;
+   }
+
+   public_key_type create() {
+      if(!yh_check_capability(&authkey_caps, "generate-asymmetric-key"))
+         FC_THROW_EXCEPTION(chain::wallet_exception, "Given authkey cannot create keys");
+
+      yh_rc rc;
+      uint16_t new_key_id = 0;
+      yh_capabilities creation_caps = {};
+      if(yh_string_to_capabilities("sign-ecdsa:export-wrapped", &creation_caps))
+         FC_THROW_EXCEPTION(chain::wallet_exception, "Cannot create caps mask");
+
+      try {
+         if((rc = yh_util_generate_ec_key(session, &new_key_id, "keosd created key", authkey_domains, &creation_caps, YH_ALGO_EC_P256)))
+            FC_THROW_EXCEPTION(chain::wallet_exception, "yh_util_generate_ec_key failed: ${m}", ("m", yh_strerror(rc)));
+         return populate_key_map_with_keyid(new_key_id)->first;
+      }
+      catch(chain::wallet_exception& e) {
+         lock();
+         throw;
+      }
+   }
+
+   yh_connector* connector = nullptr;
+   yh_session* session = nullptr;
+   string endpoint;
+   uint16_t authkey;
+
+   map<public_key_type,uint16_t> _keys;
+
+   yh_capabilities authkey_caps;
+   uint16_t authkey_domains;
+
+   boost::asio::steady_timer keepalive_timer{appbase::app().get_io_service()};
+   fc::ec_key key = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+};
+
+
+}
+
+yubihsm_wallet::yubihsm_wallet(const string& connector, const uint16_t authkey) : my(new detail::yubihsm_wallet_impl(connector, authkey)) {
+}
+
+yubihsm_wallet::~yubihsm_wallet() {
+}
+
+private_key_type yubihsm_wallet::get_private_key(public_key_type pubkey) const {
+   FC_THROW_EXCEPTION(chain::wallet_exception, "Obtaining private key for a key stored in YubiHSM is impossible");
+}
+
+bool yubihsm_wallet::is_locked() const {
+   return my->is_locked();
+}
+void yubihsm_wallet::lock() {
+   FC_ASSERT(!is_locked());
+   my->lock();
+}
+
+void yubihsm_wallet::unlock(string password) {
+   my->unlock(password);
+}
+void yubihsm_wallet::check_password(string password) {
+   //just leave this as a noop for now; remove_key from wallet_mgr calls through here
+}
+void yubihsm_wallet::set_password(string password) {
+   FC_THROW_EXCEPTION(chain::wallet_exception, "YubiHSM wallet cannot have a password set");
+}
+
+map<public_key_type, private_key_type> yubihsm_wallet::list_keys() {
+   FC_THROW_EXCEPTION(chain::wallet_exception, "Getting the private keys from the YubiHSM wallet is impossible");
+}
+flat_set<public_key_type> yubihsm_wallet::list_public_keys() {
+   flat_set<public_key_type> keys;
+   boost::copy(my->_keys | boost::adaptors::map_keys, std::inserter(keys, keys.end()));
+   return keys;
+}
+
+bool yubihsm_wallet::import_key(string wif_key) {
+   FC_THROW_EXCEPTION(chain::wallet_exception, "It is not possible to import a key in to the YubiHSM wallet");
+}
+
+string yubihsm_wallet::create_key(string key_type) {
+   EOS_ASSERT(key_type.empty() || key_type == "R1", chain::unsupported_key_type_exception, "YubiHSM wallet only supports R1 keys");
+   return my->create().to_string();
+}
+
+bool yubihsm_wallet::remove_key(string key) {
+   FC_ASSERT(!is_locked());
+   FC_THROW_EXCEPTION(chain::wallet_exception, "YubiHSM wallet does not currently support removal of keys");
+   return true;
+}
+
+std::optional<signature_type> yubihsm_wallet::try_sign_digest(const digest_type digest, const public_key_type public_key) {
+   return my->try_sign_digest(digest, public_key);
+}
+
+}}

programs/cleos/main.cpp

@@ -173,6 +173,7 @@ bool   tx_skip_sign = false;
 bool   tx_print_json = false;
 bool   tx_rtn_failure_trace = true;
 bool   tx_read_only = false;
+bool   tx_dry_run = false;
 bool   tx_retry_lib = false;
 uint16_t tx_retry_num_blocks = 0;
 bool   tx_use_old_rpc = false;
@@ -441,7 +442,7 @@ fc::variant push_transaction( signed_transaction& trx, const std::vector<public_
       trx.delay_sec = delaysec;
    }
 
-   if (!tx_skip_sign) {
+   auto sign_trx = [&] () {
       fc::variant required_keys;
       if (signing_keys.size() > 0) {
          required_keys = fc::variant(signing_keys);
@@ -450,6 +451,16 @@ fc::variant push_transaction( signed_transaction& trx, const std::vector<public_
          required_keys = determine_required_keys(trx);
       }
       sign_transaction(trx, required_keys, info.chain_id);
+   };
+   if (!tx_skip_sign) {
+      // sign dry-run transactions only when explcitly requested
+      if ( tx_dry_run ) {
+         if ( signing_keys.size() > 0 ) {
+            sign_trx();
+         }
+      } else {
+         sign_trx();
+      }
    }
 
    packed_transaction::compression_type compression = to_compression_type( tx_compression );
@@ -458,12 +469,14 @@ fc::variant push_transaction( signed_transaction& trx, const std::vector<public_
       EOSC_ASSERT( !(tx_retry_lib && tx_retry_num_blocks > 0), "ERROR: --retry-irreversible and --retry-num-blocks are mutually exclusive" );
       if (tx_use_old_rpc) {
          EOSC_ASSERT( !tx_read_only, "ERROR: --read-only can not be used with --use-old-rpc" );
+         EOSC_ASSERT( !tx_dry_run, "ERROR: --dry-run can not be used with --use-old-rpc" );
          EOSC_ASSERT( !tx_rtn_failure_trace, "ERROR: --return-failure-trace can not be used with --use-old-rpc" );
          EOSC_ASSERT( !tx_retry_lib, "ERROR: --retry-irreversible can not be used with --use-old-rpc" );
          EOSC_ASSERT( !tx_retry_num_blocks, "ERROR: --retry-num-blocks can not be used with --use-old-rpc" );
          return call( push_txn_func, packed_transaction( trx, compression ) );
       } else if (tx_use_old_send_rpc) {
          EOSC_ASSERT( !tx_read_only, "ERROR: --read-only can not be used with --use-old-send-rpc" );
+         EOSC_ASSERT( !tx_dry_run, "ERROR: --dry-run can not be used with --use-old-send-rpc" );
          EOSC_ASSERT( !tx_rtn_failure_trace, "ERROR: --return-failure-trace can not be used with --use-old-send-rpc" );
          EOSC_ASSERT( !tx_retry_lib, "ERROR: --retry-irreversible can not be used with --use-old-send-rpc" );
          EOSC_ASSERT( !tx_retry_num_blocks, "ERROR: --retry-num-blocks can not be used with --use-old-send-rpc" );
@@ -474,9 +487,9 @@ fc::variant push_transaction( signed_transaction& trx, const std::vector<public_
             throw;
          }
       } else {
-         if( tx_read_only ) {
-            EOSC_ASSERT( !tx_retry_lib, "ERROR: --retry-irreversible can not be used with --read-only" );
-            EOSC_ASSERT( !tx_retry_num_blocks, "ERROR: --retry-num-blocks can not be used with --read-only" );
+         if( tx_dry_run || tx_read_only ) {
+            EOSC_ASSERT( !tx_retry_lib, "ERROR: --retry-irreversible can not be used with --dry-run or --read-only" );
+            EOSC_ASSERT( !tx_retry_num_blocks, "ERROR: --retry-num-blocks can not be used with --dry-run or --read-only" );
             try {
                auto compute_txn_arg = fc::mutable_variant_object ("transaction",
                                                                   packed_transaction(trx,compression));
@@ -3912,7 +3925,8 @@ int main( int argc, char** argv ) {
    trxSubcommand->add_option("transaction", trx_to_push, localized("The JSON string or filename defining the transaction to push"))->required();
    trxSubcommand->add_option("--signature", extra_sig_opt_callback, localized("append a signature to the transaction; repeat this option to append multiple signatures"))->type_size(0, 1000);
    add_standard_transaction_options_plus_signing(trxSubcommand);
-   trxSubcommand->add_flag("-o,--read-only", tx_read_only, localized("Specify a transaction is read-only"));
+   trxSubcommand->add_flag("-o,--read-only", tx_read_only, localized("Deprecated, use --dry-run instead"));
+   trxSubcommand->add_flag("--dry-run", tx_dry_run, localized("Specify a transaction is dry-run"));
 
    trxSubcommand->callback([&] {
       fc::variant trx_var = json_from_file_or_string(trx_to_push);

programs/keosd/main.cpp

@@ -81,7 +81,8 @@ int main(int argc, char** argv)
       app().set_default_config_dir(home / "eosio-wallet");
       http_plugin::set_defaults({
          .default_unix_socket_path = keosd::config::key_store_executable_name + ".sock",
-         .default_http_port = 0
+         .default_http_port = 0,
+         .server_header = keosd::config::key_store_executable_name + "/" + app().version_string()
       });
       app().register_plugin<wallet_api_plugin>();
       if(!app().initialize<wallet_plugin, wallet_api_plugin, http_plugin>(argc, argv)) {

programs/nodeos/CMakeLists.txt

@@ -26,6 +26,7 @@ endif()
 
 target_link_libraries( ${NODE_EXECUTABLE_NAME}
         PRIVATE appbase version
+        PRIVATE -Wl,${whole_archive_flag} login_plugin               -Wl,${no_whole_archive_flag}
         PRIVATE -Wl,${whole_archive_flag} state_history_plugin       -Wl,${no_whole_archive_flag}
         PRIVATE -Wl,${whole_archive_flag} trace_api_plugin           -Wl,${no_whole_archive_flag}
         PRIVATE -Wl,${whole_archive_flag} chain_api_plugin           -Wl,${no_whole_archive_flag}

programs/nodeos/main.cpp

@@ -120,7 +120,8 @@ int main(int argc, char** argv)
       app().set_default_config_dir(root / "eosio" / nodeos::config::node_executable_name / "config" );
       http_plugin::set_defaults({
          .default_unix_socket_path = "",
-         .default_http_port = 8888
+         .default_http_port = 8888,
+         .server_header = nodeos::config::node_executable_name + "/" + app().version_string()
       });
       if(!app().initialize<chain_plugin, net_plugin, producer_plugin, resource_monitor_plugin>(argc, argv)) {
          const auto& opts = app().get_options();

scripts/install_deps.sh

@@ -3,4 +3,4 @@
 apt-get update
 apt-get update --fix-missing
 DEBIAN_FRONTEND=noninteractive TZ=Etc/UTC apt-get -y install tzdata
-apt-get -y install zip unzip libncurses5 wget git build-essential cmake curl libgmp-dev libssl-dev libzstd-dev time zlib1g-dev libtinfo-dev bzip2 libbz2-dev python3 file
+apt-get -y install zip unzip libncurses5 wget git build-essential cmake curl libcurl4-openssl-dev libgmp-dev libssl-dev libusb-1.0.0-dev libzstd-dev time pkg-config zlib1g-dev libtinfo-dev bzip2 libbz2-dev python3 file

tests/compute_transaction_test.py

@@ -115,6 +115,8 @@ try:
 
     results = node.pushTransaction(trx, opts='--read-only', permissions=account1.name)
     assert(results[0])
+    results = node.pushTransaction(trx, opts='--dry-run', permissions=account1.name)
+    assert(results[0])
     node.waitForLibToAdvance(30)
 
     postBalances = node.getEosBalances([account1, account2])
@@ -122,6 +124,8 @@ try:
 
     results = node.pushTransaction(trx, opts='--read-only --skip-sign')
     assert(results[0])
+    results = node.pushTransaction(trx, opts='--dry-run --skip-sign')
+    assert(results[0])
     node.waitForLibToAdvance(30)
 
     postBalances = node.getEosBalances([account1, account2])
@@ -141,6 +145,8 @@ try:
 
         results = npnode.pushTransaction(trx2, opts="--read-only")
         assert(not results[0])
+        results = npnode.pushTransaction(trx2, opts="--dry-run")
+        assert(not results[0])
 
 # Verify that no subjective billing was charged
     acct2 = npnode.getAccountSubjectiveInfo("account2")
@@ -174,10 +180,12 @@ try:
     }
     results = npnode.pushTransaction(trx3, opts="--read-only")
     assert(results[0])
+    results = npnode.pushTransaction(trx3, opts="--dry-run")
+    assert(results[0])
 
     testSuccessful = True
 finally:
     TestHelper.shutdown(cluster, walletMgr, testSuccessful, killEosInstances, killWallet, keepLogs, killAll, dumpErrorDetails)
 
 errorCode = 0 if testSuccessful else 1
-exit(errorCode)
+exit(errorCode)

tests/nodeos_forked_chain_test.py

@@ -230,7 +230,7 @@ try:
         transferAmount="100000000.0000 {0}".format(CORE_SYMBOL)
         Print("Transfer funds %s from account %s to %s" % (transferAmount, cluster.eosioAccount.name, account.name))
         node.transferFunds(cluster.eosioAccount, account, transferAmount, "test transfer", waitForTransBlock=True)
-        trans=node.delegatebw(account, 20000000.0000, 20000000.0000, waitForTransBlock=True, exitOnError=True)
+        trans=node.delegatebw(account, 20000000.0000, 20000000.0000, waitForTransBlock=False, exitOnError=True)
 
 
     # ***   vote using accounts   ***
@@ -240,7 +240,7 @@ try:
     index=0
     for account in accounts:
         Print("Vote for producers=%s" % (producers))
-        trans=prodNodes[index % len(prodNodes)].vote(account, producers, waitForTransBlock=True)
+        trans=prodNodes[index % len(prodNodes)].vote(account, producers, waitForTransBlock=False)
         index+=1
 
 
@@ -372,6 +372,9 @@ try:
     # block number to start expecting node killed after
     preKillBlockNum=nonProdNode.getBlockNum()
     preKillBlockProducer=nonProdNode.getBlockProducerByNum(preKillBlockNum)
+    if preKillBlockProducer == "defproducerj" or preKillBlockProducer == "defproducerk":
+        # wait for defproduceri so there is plenty of time to send kill before defproducerk
+        nonProdNode.waitForProducer("defproduceri")
     Print("preKillBlockProducer = {}".format(preKillBlockProducer))
     # kill at last block before defproducerl, since the block it is killed on will get propagated
     killAtProducer="defproducerk"

tests/trx_finality_status_test.py

@@ -142,7 +142,7 @@ try:
     state = getState(retStatus)
 
     assert (state == localState or state == inBlockState), \
-        f"ERROR: getTransactionStatus didn't return \"{localState}\" state.\n\nstatus: {json.dumps(retStatus, indent=1)}"
+        f"ERROR: getTransactionStatus didn't return \"{localState}\" or \"{inBlockState}\" state.\n\nstatus: {json.dumps(retStatus, indent=1)}"
     status.append(copy.copy(retStatus))
     startingBlockNum=testNode.getInfo()["head_block_num"]
 
@@ -150,12 +150,13 @@ try:
         bnPresent = "block_number" in status
         biPresent = "block_id" in status
         btPresent = "block_timestamp" in status
-        desc = "" if present else "not "
+        desc = "" if present else " not"
         group = bnPresent and biPresent and btPresent if present else not bnPresent and not biPresent and not btPresent
         assert group, \
             f"ERROR: getTransactionStatus should{desc} contain \"block_number\", \"block_id\", or \"block_timestamp\" since state was \"{getState(status)}\".\nstatus: {json.dumps(status, indent=1)}"
 
-    validateTrxState(status[0], present=False)
+    present = True if state == inBlockState else False
+    validateTrxState(status[0], present)
 
     def validate(status, knownTrx=True):
         assert "head_number" in status and "head_id" in status and "head_timestamp" in status, \

tutorials/bios-boot-tutorial/bios-boot-tutorial.py

@@ -346,8 +346,6 @@ def stepSetSystemContract():
     retry(args.cleos + 'push action eosio activate \'["4fca8bd82bbd181e714e283f83e1b45d95ca5af40fb89ad3977b653c448f78c2"]\' -p eosio@active')
     # WTMSIG_BLOCK_SIGNATURES
     retry(args.cleos + 'push action eosio activate \'["299dcb6af692324b899b39f16d5a530a33062804e41f09dc97e9f156b4476707"]\' -p eosio@active')
-    # CRYPTO_PRIMITIVES
-    retry(args.cleos + 'push action eosio activate \'["6bcb40a24e49c26d0a60513b6aeb8551d264e4717f306b81a37a5afb3b47cedc"]\' -p eosio@active')
     sleep(1)
 
     # install eosio.system latest version