mirror of
https://github.com/luxfi/pulsar.git
synced 2026-07-27 06:55:04 +00:00
Hanzo AI
ac293cbe49
Single repo, one canonical impl + spec + proofs + KAT + cut tool.
Per "ONE and ONLY ONE way to do things" the prior dual-repo split
(luxfi/pulsar = production library, luxfi/pulsar-mptc = NIST MPTC
submission framework) is collapsed into a single canonical home at
github.com/luxfi/pulsar. SINGLE-IMPL-PLAN.md (now marked COMPLETED)
describes the steps; this commit lands the final step.
Files moved (89 new):
16 submission docs (SUBMISSION, NIST-SUBMISSION, SPEC, SUITE,
PATENTS, AXIOM-INVENTORY, PROOF-CLAIMS, FIPS-TRACEABILITY,
TRUSTED-COMPUTING-BASE, HANZO-CRYPTO-SUITE, INFORMATION-
ARCHITECTURE, ROADMAP, CHANGELOG, SYNC-STATUS, STATUS-
SUBMISSION-READINESS, SINGLE-IMPL-PLAN)
10 docs/ supplements (ietf-draft-skeleton, magnetar, evaluation,
patent-claims, x-wing-sig, design-decisions, family-architecture,
threat-model, nist-mptc-category, patent-notes-draft)
19 proofs/ (13 EC theories + 2 EC lemmas + 4 metadata/READMEs +
lean-easycrypt-bridge.md)
14 jasmin/ (lib/* + ml-dsa-65 fetch + threshold/{combine,round1,
round2}.jazz + READMEs)
10 ct/dudect/ (Makefile, combine_ct.go, dudect_combine.c,
dudect_compat.h, dudect_verify.c, fetch.sh, README, run-
submission.sh, verify_ct.go) + ct/jasmin-ct-libjade.md
1 .github/workflows/ci.yml
1 test/interoperability/n1_class_test.go (19/19 N1 subtests)
1 bench/results/REPORT.md
11 scripts/ (cut-submission, check-high-assurance, check-lean-
bridge, nightly, extract-jasmin-ec, checks/{ec-admits, ec-
compile, ec-refinement-scaffold, ec-regressions, extraction,
jasmin}, checks/test/{go-unit, interop, kat, no-secret-logs})
Files merged (16 overlapping, mptc-canonical chosen because newer +
post-rewire-correct; pulsar versions still bore stale "Pulsar-M" /
"pulsarm" branding):
README.md, BLOCKERS.md, CONTRIBUTING.md, LICENSE, LICENSING.md,
SECURITY.md, .gitignore, bench/run_all.sh, vectors/dkg.json (v1.0.7
regen), scripts/{bench,build,gen_vectors,sbom,test}.sh,
spec/{pulsar,parameters,system-model}.tex,
CRYPTOGRAPHER-SIGN-OFF.md (path refs).
Pulsar-only spec supplements preserved:
spec/{blockers,design-decisions,family-architecture,nist-mptc-
category,patent-notes,threat-model}.tex.
Path rewrites applied: 158 occurrences across 26 files
github.com/luxfi/pulsar-mptc -> github.com/luxfi/pulsar
~/work/lux/pulsar-mptc/ -> ~/work/lux/pulsar/
luxfi/pulsar-mptc -> luxfi/pulsar
pulsar-mptc/ -> ./
Narrative collapses (no more two-repo framing):
SUBMISSION.md "At a glance" — single Repository row
SYNC-STATUS.md — rewritten to single-repo state
SINGLE-IMPL-PLAN.md — marked COMPLETED 2026-05-18
HANZO-CRYPTO-SUITE.md — tier 1 row = single canonical home
scripts/cut-submission.sh — replace/vendor dance removed; cuts
directly from in-tree canonical sources
go.mod: dropped mptc's replace directive (no longer needed since this
IS the canonical pulsar repo). Module path is github.com/luxfi/pulsar.
Deps: cloudflare/circl v1.6.3, golang.org/x/crypto v0.32.0.
Verification:
GOWORK=off go build ./... PASS
GOWORK=off go test -count=1 ./... PASS (1.4s)
GOWORK=off go test -race ./ref/... PASS (14.7s)
go test ./test/interoperability/ PASS (19/19 N1 subtests)
scripts/check-high-assurance.sh PASS
scripts/check-lean-bridge.sh PASS (5/5 bridges)
scripts/gen_vectors.sh byte-identical replay
scripts/cut-submission.sh --help PASS
240 lines
8.6 KiB
Bash
Executable File
240 lines
8.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# scripts/cut-submission.sh — produce the NIST MPTC submission tarball.
|
|
#
|
|
# Since the consolidation of 2026-05-18, the `luxfi/pulsar` repository
|
|
# is the single canonical home for the submission: spec, proofs (EC +
|
|
# Lean bridge), Jasmin sources, KAT vectors, Go reference impl, dudect
|
|
# constant-time evidence, and cover sheet all live in-tree. The cut
|
|
# tool produces a self-contained tarball from a clean checkout — no
|
|
# replace-directive dance or external module vendoring.
|
|
#
|
|
# Usage:
|
|
# scripts/cut-submission.sh [TAG] [--force]
|
|
#
|
|
# TAG e.g. "submission-2026-11-16"
|
|
# omit for dry-run (no tarball, no tag)
|
|
# --force re-cut over an existing tag / tarball
|
|
#
|
|
# Steps:
|
|
# 1. verify clean working tree (git status -s empty)
|
|
# 2. verify on branch main
|
|
# 3. verify scripts/check-high-assurance.sh exits 0
|
|
# 4. verify scripts/check-lean-bridge.sh exits 0
|
|
# 5. regenerate KATs (scripts/gen_vectors.sh) and verify byte-equal
|
|
# to committed vectors/*.json
|
|
# 6. run Class N1 interop (test/interoperability/) and core tests
|
|
# 7. tar czf submission-<TAG>.tar.gz (excluding .git, vendor caches)
|
|
# 8. sha256 the tarball; print to stdout
|
|
# 9. git tag <TAG>
|
|
#
|
|
# The script is idempotent: re-running with the same TAG without
|
|
# --force fails fast.
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Argument parsing.
|
|
# -----------------------------------------------------------------------------
|
|
TAG=""
|
|
FORCE=0
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--force) FORCE=1 ;;
|
|
-h|--help)
|
|
sed -n '4,30p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
|
|
exit 0
|
|
;;
|
|
--*)
|
|
echo "cut-submission: unknown flag: $arg" >&2
|
|
exit 2
|
|
;;
|
|
*)
|
|
if [[ -n "$TAG" ]]; then
|
|
echo "cut-submission: only one TAG allowed (got '$TAG' and '$arg')" >&2
|
|
exit 2
|
|
fi
|
|
TAG="$arg"
|
|
;;
|
|
esac
|
|
done
|
|
|
|
DRY_RUN=0
|
|
if [[ -z "$TAG" ]]; then
|
|
DRY_RUN=1
|
|
echo "==> cut-submission: DRY-RUN (no TAG given; will not write tarball or tag)"
|
|
fi
|
|
|
|
TARBALL=""
|
|
if [[ $DRY_RUN -eq 0 ]]; then
|
|
TARBALL="$REPO_ROOT/${TAG}.tar.gz"
|
|
if [[ "$TAG" != submission-* ]]; then
|
|
echo "cut-submission: TAG must start with 'submission-' (got '$TAG')" >&2
|
|
exit 2
|
|
fi
|
|
fi
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Step 1: clean working tree.
|
|
# -----------------------------------------------------------------------------
|
|
echo
|
|
echo "==> Step 1: verify clean working tree"
|
|
if [[ -n "$(git status --porcelain)" ]]; then
|
|
echo "cut-submission: working tree not clean — commit or stash changes first" >&2
|
|
git status --short >&2
|
|
exit 2
|
|
fi
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Step 2: on branch main.
|
|
# -----------------------------------------------------------------------------
|
|
echo
|
|
echo "==> Step 2: verify on branch main"
|
|
CURRENT_BRANCH="$(git rev-parse --abbrev-ref HEAD)"
|
|
if [[ "$CURRENT_BRANCH" != "main" ]]; then
|
|
echo "cut-submission: must run from branch 'main' (currently on '$CURRENT_BRANCH')" >&2
|
|
exit 2
|
|
fi
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Step 2.5: idempotency guard for tag + tarball.
|
|
# -----------------------------------------------------------------------------
|
|
if [[ $DRY_RUN -eq 0 ]]; then
|
|
if git rev-parse --verify --quiet "refs/tags/$TAG" >/dev/null; then
|
|
if [[ $FORCE -eq 0 ]]; then
|
|
echo "cut-submission: tag '$TAG' already exists — pass --force to re-cut" >&2
|
|
exit 2
|
|
fi
|
|
echo " [force] tag '$TAG' will be re-cut (existing tag deleted later)"
|
|
fi
|
|
if [[ -e "$TARBALL" ]]; then
|
|
if [[ $FORCE -eq 0 ]]; then
|
|
echo "cut-submission: tarball '$TARBALL' already exists — pass --force to overwrite" >&2
|
|
exit 2
|
|
fi
|
|
echo " [force] tarball '$TARBALL' will be overwritten"
|
|
fi
|
|
fi
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Step 3: high-assurance gate.
|
|
# -----------------------------------------------------------------------------
|
|
echo
|
|
echo "==> Step 3: high-assurance gate (scripts/check-high-assurance.sh)"
|
|
bash "$REPO_ROOT/scripts/check-high-assurance.sh"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Step 4: Lean-bridge gate.
|
|
# -----------------------------------------------------------------------------
|
|
echo
|
|
echo "==> Step 4: Lean-bridge gate (scripts/check-lean-bridge.sh)"
|
|
bash "$REPO_ROOT/scripts/check-lean-bridge.sh"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Step 5: regenerate KATs and verify byte-identical.
|
|
# -----------------------------------------------------------------------------
|
|
echo
|
|
echo "==> Step 5: regenerate KAT vectors and verify byte-identical"
|
|
TMP_VECTORS="$(mktemp -d)"
|
|
trap 'rm -rf "$TMP_VECTORS"' EXIT
|
|
cp -R vectors "$TMP_VECTORS/before"
|
|
bash "$REPO_ROOT/scripts/gen_vectors.sh"
|
|
for f in vectors/*.json; do
|
|
if ! diff -q "$f" "$TMP_VECTORS/before/$(basename "$f")" >/dev/null; then
|
|
echo "cut-submission: regenerated $(basename "$f") differs from committed copy" >&2
|
|
diff "$TMP_VECTORS/before/$(basename "$f")" "$f" | head -20 >&2
|
|
exit 2
|
|
fi
|
|
done
|
|
echo " [ok] all KAT vectors are byte-identical to committed copies"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Step 6: core tests + Class N1 interop.
|
|
# -----------------------------------------------------------------------------
|
|
echo
|
|
echo "==> Step 6: core tests + Class N1 interop"
|
|
export GOWORK=off
|
|
go test -count=1 -timeout 240s ./ref/go/pkg/pulsar/
|
|
go test -count=1 ./test/interoperability/
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Step 7: build the tarball.
|
|
# -----------------------------------------------------------------------------
|
|
if [[ $DRY_RUN -eq 1 ]]; then
|
|
echo
|
|
echo "==> Step 7: SKIP — dry-run, no tarball will be written"
|
|
else
|
|
echo
|
|
echo "==> Step 7: tar czf $(basename "$TARBALL")"
|
|
# We tar from the parent directory so the tarball expands to a
|
|
# './pulsar/' top-level directory.
|
|
(
|
|
cd "$(dirname "$REPO_ROOT")"
|
|
tar czf "$TARBALL" \
|
|
--exclude='./.git' \
|
|
--exclude='./.claude' \
|
|
--exclude='./jasmin/ml-dsa-65/libjade' \
|
|
--exclude='./ct/dudect/dudect' \
|
|
--exclude='./bench/results/*.txt' \
|
|
--exclude='./spec/*.pdf' \
|
|
--exclude='./spec/*.aux' \
|
|
--exclude='./spec/*.log' \
|
|
--exclude='./spec/*.toc' \
|
|
--exclude='./spec/*.out' \
|
|
--exclude='./spec/*.fls' \
|
|
--exclude='./spec/*.fdb_latexmk' \
|
|
--exclude='./spec/*.bbl' \
|
|
--exclude='./spec/*.blg' \
|
|
--exclude='./spec/*.synctex.gz' \
|
|
--exclude='./proofs/easycrypt/*.eco' \
|
|
--exclude='./proofs/easycrypt/lemmas/*.eco' \
|
|
--exclude='./proofs/easycrypt/extraction/build' \
|
|
pulsar
|
|
)
|
|
if [[ ! -f "$TARBALL" ]]; then
|
|
echo "cut-submission: tarball not produced at $TARBALL" >&2
|
|
exit 2
|
|
fi
|
|
echo " [ok] $TARBALL"
|
|
fi
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Step 8: SHA-256 the tarball.
|
|
# -----------------------------------------------------------------------------
|
|
if [[ $DRY_RUN -eq 0 ]]; then
|
|
echo
|
|
echo "==> Step 8: SHA-256"
|
|
if command -v shasum >/dev/null 2>&1; then
|
|
shasum -a 256 "$TARBALL"
|
|
elif command -v sha256sum >/dev/null 2>&1; then
|
|
sha256sum "$TARBALL"
|
|
else
|
|
echo "cut-submission: neither shasum nor sha256sum found in PATH" >&2
|
|
exit 2
|
|
fi
|
|
fi
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Step 9: tag the repo.
|
|
# -----------------------------------------------------------------------------
|
|
if [[ $DRY_RUN -eq 0 ]]; then
|
|
echo
|
|
echo "==> Step 9: git tag $TAG"
|
|
if git rev-parse --verify --quiet "refs/tags/$TAG" >/dev/null; then
|
|
git tag -d "$TAG" >/dev/null
|
|
fi
|
|
git tag -a "$TAG" -m "NIST MPTC submission cut $TAG"
|
|
echo " [ok] tag '$TAG' created (NOT pushed — push manually when ready)"
|
|
fi
|
|
|
|
echo
|
|
if [[ $DRY_RUN -eq 1 ]]; then
|
|
echo "==> done — dry-run validated (no tarball / no tag produced)"
|
|
else
|
|
echo "==> done — tarball cut, tag created"
|
|
echo " tarball: $TARBALL"
|
|
echo " tag: $TAG (local; not pushed)"
|
|
fi
|