mirror of
https://github.com/luxfi/pulsar.git
synced 2026-09-24 00:25:52 +00:00
zeekay
c79fe61d62
Single repo, one canonical impl + spec + proofs + KAT + cut tool.
Per "ONE and ONLY ONE way to do things" the prior dual-repo split
(luxfi/pulsar = production library, luxfi/pulsar-mptc = NIST MPTC
submission framework) is collapsed into a single canonical home at
github.com/luxfi/pulsar. SINGLE-IMPL-PLAN.md (now marked COMPLETED)
describes the steps; this commit lands the final step.
Files moved (89 new):
16 submission docs (SUBMISSION, NIST-SUBMISSION, SPEC, SUITE,
PATENTS, AXIOM-INVENTORY, PROOF-CLAIMS, FIPS-TRACEABILITY,
TRUSTED-COMPUTING-BASE, HANZO-CRYPTO-SUITE, INFORMATION-
ARCHITECTURE, ROADMAP, CHANGELOG, SYNC-STATUS, STATUS-
SUBMISSION-READINESS, SINGLE-IMPL-PLAN)
10 docs/ supplements (ietf-draft-skeleton, magnetar, evaluation,
patent-claims, x-wing-sig, design-decisions, family-architecture,
threat-model, nist-mptc-category, patent-notes-draft)
19 proofs/ (13 EC theories + 2 EC lemmas + 4 metadata/READMEs +
lean-easycrypt-bridge.md)
14 jasmin/ (lib/* + ml-dsa-65 fetch + threshold/{combine,round1,
round2}.jazz + READMEs)
10 ct/dudect/ (Makefile, combine_ct.go, dudect_combine.c,
dudect_compat.h, dudect_verify.c, fetch.sh, README, run-
submission.sh, verify_ct.go) + ct/jasmin-ct-libjade.md
1 .github/workflows/ci.yml
1 test/interoperability/n1_class_test.go (19/19 N1 subtests)
1 bench/results/REPORT.md
11 scripts/ (cut-submission, check-high-assurance, check-lean-
bridge, nightly, extract-jasmin-ec, checks/{ec-admits, ec-
compile, ec-refinement-scaffold, ec-regressions, extraction,
jasmin}, checks/test/{go-unit, interop, kat, no-secret-logs})
Files merged (16 overlapping, mptc-canonical chosen because newer +
post-rewire-correct; pulsar versions still bore stale "Pulsar-M" /
"pulsarm" branding):
README.md, BLOCKERS.md, CONTRIBUTING.md, LICENSE, LICENSING.md,
SECURITY.md, .gitignore, bench/run_all.sh, vectors/dkg.json (v1.0.7
regen), scripts/{bench,build,gen_vectors,sbom,test}.sh,
spec/{pulsar,parameters,system-model}.tex,
CRYPTOGRAPHER-SIGN-OFF.md (path refs).
Pulsar-only spec supplements preserved:
spec/{blockers,design-decisions,family-architecture,nist-mptc-
category,patent-notes,threat-model}.tex.
Path rewrites applied: 158 occurrences across 26 files
github.com/luxfi/pulsar-mptc -> github.com/luxfi/pulsar
~/work/lux/pulsar-mptc/ -> ~/work/lux/pulsar/
luxfi/pulsar-mptc -> luxfi/pulsar
pulsar-mptc/ -> ./
Narrative collapses (no more two-repo framing):
SUBMISSION.md "At a glance" — single Repository row
SYNC-STATUS.md — rewritten to single-repo state
SINGLE-IMPL-PLAN.md — marked COMPLETED 2026-05-18
HANZO-CRYPTO-SUITE.md — tier 1 row = single canonical home
scripts/cut-submission.sh — replace/vendor dance removed; cuts
directly from in-tree canonical sources
go.mod: dropped mptc's replace directive (no longer needed since this
IS the canonical pulsar repo). Module path is github.com/luxfi/pulsar.
Deps: cloudflare/circl v1.6.3, golang.org/x/crypto v0.32.0.
Verification:
GOWORK=off go build ./... PASS
GOWORK=off go test -count=1 ./... PASS (1.4s)
GOWORK=off go test -race ./ref/... PASS (14.7s)
go test ./test/interoperability/ PASS (19/19 N1 subtests)
scripts/check-high-assurance.sh PASS
scripts/check-lean-bridge.sh PASS (5/5 bridges)
scripts/gen_vectors.sh byte-identical replay
scripts/cut-submission.sh --help PASS
103 lines
3.7 KiB
Bash
Executable File
103 lines
3.7 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Pulsar nightly gate — REAL-budget runs for the things that the
|
|
# per-push gates skip because their per-push budget is too small to
|
|
# be meaningful.
|
|
#
|
|
# This script is what should run from CRON / scheduled CI, NOT the
|
|
# per-push hook. Expected runtime: hours, not seconds.
|
|
#
|
|
# The runs, in order:
|
|
#
|
|
# 1. fuzz (parser): 1h per target — Makefile.fuzz fuzz-nightly.
|
|
# Five parser-surface targets at ~200k-400k execs/sec each.
|
|
# Approx 5h total.
|
|
#
|
|
# 2. fuzz (differential): 1h — Makefile.fuzz fuzz-diff-nightly.
|
|
# ~150-450 execs/sec (heavy: full DKG + threshold-sign +
|
|
# reconstruct + centralized-sign each iter). ~500k-1M iters.
|
|
#
|
|
# 3. dudect submission: 10^9 samples per target via
|
|
# ct/dudect/run-submission.sh. Hours per target on a pinned CPU.
|
|
# Produces ct/dudect/results/submission-<commit>-<utc>.* with
|
|
# audit metadata.
|
|
#
|
|
# Per-push gates (test.sh + check-high-assurance.sh) cover everything
|
|
# else (Go unit tests, KAT, interop, jasmin-ct, EC compile, bridge
|
|
# guard, etc.) at real-budget. Run those first via:
|
|
#
|
|
# bash scripts/test.sh
|
|
# bash scripts/check-high-assurance.sh
|
|
#
|
|
# This nightly script does NOT re-run those — it assumes a green
|
|
# per-push gate (otherwise the longer runs are wasted).
|
|
#
|
|
# Override per-target budgets via env:
|
|
#
|
|
# FUZZ_TIME=2h per parser-fuzz target window
|
|
# DIFF_FUZZ_TIME=2h differential-fuzz window
|
|
# DUDECT_SAMPLES=... per-batch sample count
|
|
# DUDECT_MAX_BATCHES=... max batches per target
|
|
# CPU=N CPU to pin to (Linux taskset)
|
|
|
|
set -euo pipefail
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
FUZZ_TIME="${FUZZ_TIME:-1h}"
|
|
DIFF_FUZZ_TIME="${DIFF_FUZZ_TIME:-1h}"
|
|
|
|
echo "==> Pulsar nightly gate"
|
|
echo " fuzz_time $FUZZ_TIME"
|
|
echo " diff_fuzz_time $DIFF_FUZZ_TIME"
|
|
echo " dudect_samples ${DUDECT_SAMPLES:-1000000}"
|
|
echo " dudect_max_batches ${DUDECT_MAX_BATCHES:-1000}"
|
|
echo " cpu_pin ${CPU:-autodetect on Linux, none on Darwin}"
|
|
echo
|
|
|
|
OVERALL=0
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 1. Parser-surface fuzz (REAL budget — 1h per target by default).
|
|
# ---------------------------------------------------------------------------
|
|
echo "==> Layer-6 parser fuzz (REAL — $FUZZ_TIME per target)"
|
|
if ! NIGHTLY_TIME="$FUZZ_TIME" make -C ref/go/pkg/pulsar -f Makefile.fuzz fuzz-nightly; then
|
|
rc=$?
|
|
echo " [FAIL] parser fuzz exited rc=$rc"
|
|
OVERALL=$rc
|
|
fi
|
|
echo
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 2. Differential fuzz (REAL — 1h by default).
|
|
# ---------------------------------------------------------------------------
|
|
if [[ $OVERALL -eq 0 ]]; then
|
|
echo "==> Layer-6 differential fuzz (REAL — $DIFF_FUZZ_TIME)"
|
|
if ! NIGHTLY_TIME="$DIFF_FUZZ_TIME" make -C ref/go/pkg/pulsar -f Makefile.fuzz fuzz-diff-nightly; then
|
|
rc=$?
|
|
echo " [FAIL] differential fuzz exited rc=$rc"
|
|
OVERALL=$rc
|
|
fi
|
|
echo
|
|
fi
|
|
|
|
# ---------------------------------------------------------------------------
|
|
# 3. dudect submission-grade run (REAL — 10^9 samples per target).
|
|
# ---------------------------------------------------------------------------
|
|
if [[ $OVERALL -eq 0 ]]; then
|
|
echo "==> dudect submission-grade run (REAL — pinned-CPU, 10^9 samples)"
|
|
if ! bash ct/dudect/run-submission.sh; then
|
|
rc=$?
|
|
echo " [FAIL] dudect submission exited rc=$rc"
|
|
OVERALL=$rc
|
|
fi
|
|
echo
|
|
fi
|
|
|
|
if [[ $OVERALL -eq 0 ]]; then
|
|
echo "==> done — nightly gate green"
|
|
else
|
|
echo "==> nightly gate FAILED with rc=$OVERALL"
|
|
fi
|
|
exit $OVERALL
|