Several luxfi versions carry TWO different contents across this workspace,
because published tags were moved instead of a new patch being cut:
age@v1.5.0, pq@v1.0.3, threshold@v1.9.4, zap@v0.6.0, zap@v0.8.1.
Adjudicated before editing, since "checksum mismatch / SECURITY ERROR" is also
what a real supply-chain attack looks like. It is not one here: sum.golang.org
holds the OLD hash while proxy.golang.org and a direct fetch BOTH serve the same
NEW bytes. Two independent transports agreeing means nothing is rewriting
content in flight — the tag moved at source. The sumdb entry is a fossil:
GOPRIVATE covers github.com/luxfi/* with GOSUMDB=off, so our own modules never
consult the checksum DB and a moved tag splits consumers silently.
The old bytes are served by nothing now, so a stale pin can never build.
Corrected to the only content that exists, in BOTH line forms (h1: and
/go.mod h1:) — Go reports these one at a time, so a partial fix just relocates
the error.
Deliberately no `go mod tidy`: this changes no selected version, only the
recorded hash of versions already chosen.
Verified: `go list -m all` resolves with no checksum error.
The durable fix is upstream: never move a published tag, cut x.y.z+1 instead.
Picks up the 2026-06-06 relicensing:
- luxfi/vm v1.2.0 → Lux Ecosystem License v1.2 (was Lux Research v1.0).
License-only retag of the extracted runtime; patent reservation
preserved for runtime optimization surfaces, royalty-free for
Descending Chains.
- luxfi/sampler v1.1.0 → BSD-3-Clause (was Lux Research v1.0).
License restored to match the luxfi/node provenance (originally
extracted from node/utils/sampler).
- luxfi/staking v1.5.0 → BSD-3-Clause (was Lux Research v1.0).
License restored to match the luxfi/node provenance.
No code changes in this commit — go.mod/go.sum only.
api was already at v0.36.1 (which dropped autoscaling/v2beta1 +
scheduling/v1alpha1) but client-go@v0.35.1's scheme/register.go still
imports those subpackages — bumping client-go to v0.36.1 picks up the
matching scheme/register.go that drops the removed alphas.
Closes the SKIP-BROKEN status from the Wave 2G codec rip sweep.
KMS = generic secret store; mnemonic semantics live in luxfi/keys.
Same signature, same behavior — import line only.
Deps: luxfi/keys v1.0.8→v1.0.9, luxfi/kms v1.9.12→v1.9.13. Build clean.
Switches both cmd/genkeys and cmd/testkeys from a bare MNEMONIC env-var
read to the canonical luxfi/kms zapclient.LoadMnemonic loader. Same path
luxd's keyutil (lux/node @ e1ecb6d) and lux/cli's ammcmd (lux/cli @ ad1e849b)
now use — every Lux-derived tool resolves mnemonics the same way.
Source order (handled inside the shared loader):
1. MNEMONIC env var local dev + CI test seam
2. KMS_ADDR + KMS_ENV + native ZAP fetch from Liquid KMS
KMS_MNEMONIC_PATH
Backwards-compatible: setting MNEMONIC env still works exactly as before
(short-circuits the KMS call). New capability: setting KMS_* envs lets
netrunner tools fetch from KMS in CI / cluster contexts where the
mnemonic should not be a plaintext env var.
Dep:
+ github.com/luxfi/kms v1.9.12 (carries zapclient.LoadMnemonic)
Build clean.
luxfi/sdk v1.16.57 renamed APIBlockchain.ChainID → APIBlockchain.NetID
to match the platformvm wire format. Update server/network.go's two
call sites to use blockchain.NetID instead of blockchain.ChainID;
the local chainInfo struct field is left as `chainID ids.ID` so
downstream code that reads it isn't affected.
Bumps luxfi/sdk to v1.16.57 + transitive Z-Wing PQ stack tracked in
v1.18.1.
luxfi/constants and luxfi/genesis just split LocalID and CustomID
into distinct constants:
LocalID = 1337 canonical local single/multi-node dev
CustomID = 0 sentinel for user-defined non-well-known networks
This repo now uses LocalID everywhere it actually meant the local
dev network, and constants.LocalID for the same in places that
imported through luxfi/constants. Plus configs.LocalnetID →
configs.LocalID and configs.LocalnetChainID → configs.LocalChainID
to track the renamed constants.
Net effect on netrunner:
* NewLocalConfig uses configs.LocalID (was configs.CustomID/1337)
* NewCanonicalCustomConfig uses configs.LocalID
* NewLocalConfigFromMnemonic uses configs.LocalID
* network/config.go default switch now lists LocalID alongside Mainnet/Testnet
* server/network.go default networkID set to LocalID for the local server
The Custom* constants remain available for genuine user-defined
networks; on those, addresses use the "custom" HRP from
luxfi/constants and look like P-custom1..., X-custom1...
zapwire (Z-Wing PQ control RPC) and network tests still green; the
heavy local/ integration tests that actually spawn luxd are out of
scope for this change.
Replace plain TCP zap.Dial / zap.Listen with zwing.DialZAP /
zwing.ListenZAP. zapwire.Dial and zapwire.NewServer now require a
*zwing.Config carrying a LocalIdentity — there is no cleartext mode.
Every netrunner control connection is X-Wing-encapsulated,
ChaCha20-Poly1305-encrypted, and identity-pinned via Ed25519 +
ML-DSA-65 hybrid signatures.
Wire format and opcode set are unchanged; only the dial/listen
seams are upgraded. The 14 e2e tests are updated to mint ephemeral
identities per test (newTestRig) and pin the server side, which
also proves the handshake actually authenticates.
Pairs with luxfi/zwing v0.2.1 (DialZAP / ListenZAP) and luxfi/api
v1.0.10 (zap.NewListener).
- Bump luxfi/config v1.1.1 -> v1.1.2 for BootstrapNodesKey symbol
- Fix Dockerfile GO_VERSION=1.26 -> 1.26.1 (go1.26 tarball does not exist)
- Update build-test.yml go-version 1.25.5 -> 1.26.1 to match go.mod
- Update golangci-lint from v1.49 to v2.1.6 in lint.sh
- Add GOWORK=off to workflow env for workspace isolation
- Add CGO_ENABLED=0 to unit tests (avoids luxfi/accel C headers)
- Update GitHub Actions: checkout v4, setup-go v5, upload-artifact v4
- Update OS matrix: ubuntu-22.04, macos-14
- Run go mod tidy for updated checksums
zeekay