mirror of
https://github.com/luxfi/precompile.git
synced 2026-09-24 00:26:21 +00:00
zeekay
12a326ed3d
BLAKE3 is gated under strict-PQ NOT because the primitive is classical (it's a hash function, PQ-safe at 128-bit Grover security on 256-bit output — same as SHA-256) but because the strict-PQ profile mandates a ≥192-bit PQ security floor consistent with SHAKE256-384 + ML-DSA-65 elsewhere in the stack. Documenting the policy intent inline so the next-rev reviewer doesn't have to triangulate from strict_pq.go comments. The gate stays. Cryptographer audit 2026-06-05 verdict: YELLOW (ship #48/#144, address 3 cleanups next rev). Y2 closed by this comment. Y1 (migration/LLM.md double-SHAKE doc lies) closed in a sibling commit. Y3 (routerConfig placeholders) waits on #48 contract deploys to land real addresses.
45 lines
1.1 KiB
Bash
Executable File
45 lines
1.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# scripts/checks/ec-compile.sh — EasyCrypt compile-from-source gate.
|
|
#
|
|
# Compiles every EC file in the canonical set. Skipped gracefully if
|
|
# easycrypt is not on PATH (developer machine without EC installed —
|
|
# the static admit-budget check still trips on regressions).
|
|
#
|
|
# Adding a new EC file requires adding it to the EC_FILES list here.
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
EC_ROOT="$REPO_ROOT/proofs/easycrypt"
|
|
|
|
EC_FILES=(
|
|
"$EC_ROOT/P3Q_Verifier.ec"
|
|
"$EC_ROOT/P3Q_Wire_Format.ec"
|
|
"$EC_ROOT/P3Q_Gas_Model.ec"
|
|
"$EC_ROOT/lemmas/P3Q_CT.ec"
|
|
)
|
|
|
|
if ! command -v easycrypt >/dev/null 2>&1; then
|
|
echo "==> [skip] easycrypt not on PATH; skipping EC compile check"
|
|
echo " (static admit-budget check still runs)"
|
|
exit 0
|
|
fi
|
|
|
|
OVERALL=0
|
|
for f in "${EC_FILES[@]}"; do
|
|
if [[ ! -f "$f" ]]; then
|
|
echo "==> [FAIL] missing EC file: $f"
|
|
OVERALL=2
|
|
continue
|
|
fi
|
|
echo "==> easycrypt $f"
|
|
easycrypt -I "$EC_ROOT" "$f" || OVERALL=2
|
|
done
|
|
|
|
if [[ $OVERALL -eq 0 ]]; then
|
|
echo "==> done — EC compile gate green"
|
|
fi
|
|
exit $OVERALL
|