We can migrate existing test suites for the crypto algorithms. Add use fuzz test to discover possible bugs.

This is an Epic, please start new issue for each objective listed below.

Reproducible Docker Builder

• Provide a Dockerfile to show how we create the builder.

Security Requirements:

• The Dockerfile must verify the downloaded gcc package checksum.

Build using an existing Docker Builder image

• Ease building the scripts using a docker image.

Security Requirements:

• The build script must verify the checksum of the builder image

CI has already been setup in #15

Binary Build and Crate Publish via CI

• Do not store the binaries in the repository. Developer and CI must build the scripts into binaries by themselves.

Setup CI to automate the publishing workflow:

• Build binaries
• Run test
• Publish the Rust crate including the binaries.

Security Requirements:

• Publish the code hashes of each system scripts in the release.

Does this script secp256k1_blake160_multisig_all have rust implementation?

nervosnetwork/ckb#533

Background

In Bitcoin, a multisign script is written like this:

M <Public Key 1> <Public Key 2> ... <Public Key N> N CHECKMULTISIG

One can embed this script in a TX's output, and provide enough legal signatures to unlock. However, the most popular multisign method in Bitcoin is P2SH. P2SH allows users embed the Hash160 of multisign script in an UTXO, and provide original script and signatures to unlock it later.

P2SH reduces the script size to a 20bytes hash, and thus it is easy to be encoded to a multisign address.

Multisign Script Support on CKB

Current multisign script on CKB is plain mode, which means the lock script has to embed and exposure all of the PKs. It costs more capacity, lack of security and privacy, and hard to be encoded to a short address.

So i suggest we follow Bitcoin's P2SH multisign method. Lock script only includes the script hash, and we use witness to provide full script.

Demo Implement

int main(argc, args[]) {
    if (argc == 2) {
          //  do single signature verification.
    } else if (argc == 3) {
           multisign_PK_hash = args[1]
           multisign_script = args[2]
           signers = []
           PK_hash = hash()
           for (signature in witness) {
                   PK = signature.recover()
                   PK_hash.append(PK)
                   signers.add(PK)
           }
           if (PK_hash != multisign_PK_hash) return -1;
           
           return check_multisign_script(signers, multisign_script)
    } 
}

Keep multisign_script simple, like "2/3"，and "3/5!1!4". Where "n/m" means at least n of m signature should be provided, and "!i" means one of signature must match the i-th PK.

via discord

razum2umYesterday at 1:54 PM
Hi, I'm just looking around and trying to compile & run ckb on arm64 just for fun, and noticed that ckb-system-scripts fails to compile because it needs this nervosnetwork/faster-hex#9
Should I make a PR to bump this line? https://github.com/nervosnetwork/ckb-system-scripts/blob/master/Cargo.toml#L19

source