Merge branch 'main' into upgrade-prometheus-1.x

acceptance-tests/test-plugins/src/main/java/org/hyperledger/besu/tests/acceptance/plugins/privacy/TestPrivacyPluginPayloadProvider.java

@@ -28,6 +28,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+@Deprecated(since = "24.11.0")
 public class TestPrivacyPluginPayloadProvider implements PrivacyPluginPayloadProvider {
   private static final Logger LOG = LoggerFactory.getLogger(TestPrivacyPluginPayloadProvider.class);
   private String prefix;

besu/src/main/java/org/hyperledger/besu/cli/BesuCommand.java

@@ -505,77 +505,95 @@ void setUserName(final String userName) {
   @CommandLine.ArgGroup(validate = false, heading = "@|bold In-Process RPC Options|@%n")
   InProcessRpcOptions inProcessRpcOptions = InProcessRpcOptions.create();
 
+  private static final String PRIVACY_DEPRECATION_PREFIX =
+      "Deprecated. Tessera-based privacy is deprecated. See CHANGELOG for alternative options. ";
+
   // Privacy Options Group
-  @CommandLine.ArgGroup(validate = false, heading = "@|bold Privacy Options|@%n")
+  @CommandLine.ArgGroup(validate = false, heading = "@|bold (Deprecated) Privacy Options |@%n")
   PrivacyOptionGroup privacyOptionGroup = new PrivacyOptionGroup();
 
   static class PrivacyOptionGroup {
     @Option(
         names = {"--privacy-tls-enabled"},
         paramLabel = MANDATORY_FILE_FORMAT_HELP,
-        description = "Enable TLS for connecting to privacy enclave (default: ${DEFAULT-VALUE})")
+        description =
+            PRIVACY_DEPRECATION_PREFIX
+                + "Enable TLS for connecting to privacy enclave (default: ${DEFAULT-VALUE})")
     private final Boolean isPrivacyTlsEnabled = false;
 
     @Option(
         names = "--privacy-tls-keystore-file",
         paramLabel = MANDATORY_FILE_FORMAT_HELP,
         description =
-            "Path to a PKCS#12 formatted keystore; used to enable TLS on inbound connections.")
+            PRIVACY_DEPRECATION_PREFIX
+                + "Path to a PKCS#12 formatted keystore; used to enable TLS on inbound connections.")
     private final Path privacyKeyStoreFile = null;
 
     @Option(
         names = "--privacy-tls-keystore-password-file",
         paramLabel = MANDATORY_FILE_FORMAT_HELP,
-        description = "Path to a file containing the password used to decrypt the keystore.")
+        description =
+            PRIVACY_DEPRECATION_PREFIX
+                + "Path to a file containing the password used to decrypt the keystore.")
     private final Path privacyKeyStorePasswordFile = null;
 
     @Option(
         names = "--privacy-tls-known-enclave-file",
         paramLabel = MANDATORY_FILE_FORMAT_HELP,
         description =
-            "Path to a file containing the fingerprints of the authorized privacy enclave.")
+            PRIVACY_DEPRECATION_PREFIX
+                + "Path to a file containing the fingerprints of the authorized privacy enclave.")
     private final Path privacyTlsKnownEnclaveFile = null;
 
     @Option(
         names = {"--privacy-enabled"},
-        description = "Enable private transactions (default: ${DEFAULT-VALUE})")
+        description =
+            PRIVACY_DEPRECATION_PREFIX + "Enable private transactions (default: ${DEFAULT-VALUE})")
     private final Boolean isPrivacyEnabled = false;
 
     @Option(
         names = {"--privacy-multi-tenancy-enabled"},
-        description = "Enable multi-tenant private transactions (default: ${DEFAULT-VALUE})")
+        description =
+            PRIVACY_DEPRECATION_PREFIX
+                + "Enable multi-tenant private transactions (default: ${DEFAULT-VALUE})")
     private final Boolean isPrivacyMultiTenancyEnabled = false;
 
     @Option(
         names = {"--privacy-url"},
-        description = "The URL on which the enclave is running")
+        description = PRIVACY_DEPRECATION_PREFIX + "The URL on which the enclave is running")
     private final URI privacyUrl = PrivacyParameters.DEFAULT_ENCLAVE_URL;
 
     @Option(
         names = {"--privacy-public-key-file"},
-        description = "The enclave's public key file")
+        description = PRIVACY_DEPRECATION_PREFIX + "The enclave's public key file")
     private final File privacyPublicKeyFile = null;
 
     @Option(
         names = {"--privacy-marker-transaction-signing-key-file"},
         description =
-            "The name of a file containing the private key used to sign privacy marker transactions. If unset, each will be signed with a random key.")
+            PRIVACY_DEPRECATION_PREFIX
+                + "The name of a file containing the private key used to sign privacy marker transactions. If unset, each will be signed with a random key.")
     private final Path privateMarkerTransactionSigningKeyPath = null;
 
     @Option(
         names = {"--privacy-enable-database-migration"},
-        description = "Enable private database metadata migration (default: ${DEFAULT-VALUE})")
+        description =
+            PRIVACY_DEPRECATION_PREFIX
+                + "Enable private database metadata migration (default: ${DEFAULT-VALUE})")
     private final Boolean migratePrivateDatabase = false;
 
     @Option(
         names = {"--privacy-flexible-groups-enabled"},
-        description = "Enable flexible privacy groups (default: ${DEFAULT-VALUE})")
+        description =
+            PRIVACY_DEPRECATION_PREFIX
+                + "Enable flexible privacy groups (default: ${DEFAULT-VALUE})")
     private final Boolean isFlexiblePrivacyGroupsEnabled = false;
 
     @Option(
         names = {"--privacy-nonce-always-increments"},
         description =
-            "Enable private nonce "
+            PRIVACY_DEPRECATION_PREFIX
+                + "Enable private nonce "
                 + "incrementation even if the transaction didn't succeeded (default: ${DEFAULT-VALUE})")
     private final Boolean isPrivateNonceAlwaysIncrementsEnabled = false;
   }
@@ -1293,6 +1311,8 @@ private void validatePrivacyPluginOptions() {
     // after start has been called on plugins
 
     if (Boolean.TRUE.equals(privacyOptionGroup.isPrivacyEnabled)) {
+      logger.warn(
+          "--Xprivacy-plugin-enabled and related options are " + PRIVACY_DEPRECATION_PREFIX);
 
       if (privacyOptionGroup.privateMarkerTransactionSigningKeyPath != null
           && privacyPluginService != null
@@ -1922,6 +1942,7 @@ private PrivacyParameters privacyParameters() {
 
     final PrivacyParameters.Builder privacyParametersBuilder = new PrivacyParameters.Builder();
     if (Boolean.TRUE.equals(privacyOptionGroup.isPrivacyEnabled)) {
+      logger.warn("--privacy-enabled and related options are " + PRIVACY_DEPRECATION_PREFIX);
       final String errorSuffix = "cannot be enabled with privacy.";
       if (syncMode == SyncMode.FAST) {
         throw new ParameterException(commandLine, String.format("%s %s", "Fast sync", errorSuffix));

besu/src/main/java/org/hyperledger/besu/cli/options/PrivacyPluginOptions.java

@@ -17,6 +17,7 @@
 import static picocli.CommandLine.Option;
 
 /** The Privacy plugin Cli options. */
+@Deprecated(since = "24.11.0")
 public class PrivacyPluginOptions {
   /** Default Constructor. */
   PrivacyPluginOptions() {}
@@ -33,7 +34,7 @@ public static PrivacyPluginOptions create() {
   @Option(
       names = "--Xprivacy-plugin-enabled",
       description =
-          "Enables the use of a plugin to implement your own privacy strategy (default: ${DEFAULT-VALUE})",
+          "Deprecated. Tessera-based privacy is deprecated. See CHANGELOG for alternative options. Enables the use of a plugin to implement your own privacy strategy (default: ${DEFAULT-VALUE})",
       hidden = true)
   private final Boolean isPrivacyPluginEnabled = false;
 

besu/src/main/java/org/hyperledger/besu/services/PrivacyPluginServiceImpl.java

@@ -24,6 +24,7 @@
 import org.slf4j.LoggerFactory;
 
 /** The Privacy plugin service implementation. */
+@Deprecated(since = "24.11.0")
 public class PrivacyPluginServiceImpl implements PrivacyPluginService {
   private static final Logger LOG = LoggerFactory.getLogger(PrivacyPluginServiceImpl.class);
 

docs/tracing/README.md

@@ -2,7 +2,7 @@
 
 Hyperledger Besu integrates with the [open-telemetry](https://opentelemetry.io/) project to integrate tracing reporting.
 
-This allows to report all JSON-RPC traffic as traces.
+This allows reporting all JSON-RPC traffic as traces.
 
 To try out this example, start the Open Telemetry Collector and the Zipkin service with:
 

ethereum/core/src/main/java/org/hyperledger/besu/ethereum/MainnetBlockValidator.java

@@ -171,7 +171,12 @@ public BlockProcessingResult validateAndProcessBlock(
         Optional<List<Request>> maybeRequests =
             result.getYield().flatMap(BlockProcessingOutputs::getRequests);
         if (!blockBodyValidator.validateBody(
-            context, block, receipts, worldState.rootHash(), ommerValidationMode)) {
+            context,
+            block,
+            receipts,
+            worldState.rootHash(),
+            ommerValidationMode,
+            BodyValidationMode.FULL)) {
           result = new BlockProcessingResult("failed to validate output of imported block");
           handleFailedBlockProcessing(block, result, shouldRecordBadBlock);
           return result;
@@ -246,15 +251,24 @@ public boolean validateBlockForSyncing(
       final HeaderValidationMode headerValidationMode,
       final HeaderValidationMode ommerValidationMode,
       final BodyValidationMode bodyValidationMode) {
+
+    if (bodyValidationMode == BodyValidationMode.FULL) {
+      throw new UnsupportedOperationException(
+          "Full body validation is not supported for syncing blocks");
+    }
+
     final BlockHeader header = block.getHeader();
     if (!blockHeaderValidator.validateHeader(header, context, headerValidationMode)) {
       String description = String.format("Failed header validation (%s)", headerValidationMode);
       badBlockManager.addBadBlock(block, BadBlockCause.fromValidationFailure(description));
       return false;
     }
 
-    if (!blockBodyValidator.validateBodyLight(
-        context, block, receipts, ommerValidationMode, bodyValidationMode)) {
+    if (bodyValidationMode == BodyValidationMode.NONE) {
+      return true;
+    }
+
+    if (!blockBodyValidator.validateBodyLight(context, block, receipts, ommerValidationMode)) {
       badBlockManager.addBadBlock(
           block, BadBlockCause.fromValidationFailure("Failed body validation (light)"));
       return false;

ethereum/core/src/main/java/org/hyperledger/besu/ethereum/mainnet/BaseFeeBlockBodyValidator.java

@@ -41,11 +41,9 @@ public boolean validateBodyLight(
       final ProtocolContext context,
       final Block block,
       final List<TransactionReceipt> receipts,
-      final HeaderValidationMode ommerValidationMode,
-      final BodyValidationMode bodyValidationMode) {
+      final HeaderValidationMode ommerValidationMode) {
 
-    return super.validateBodyLight(
-            context, block, receipts, ommerValidationMode, bodyValidationMode)
+    return super.validateBodyLight(context, block, receipts, ommerValidationMode)
         && validateTransactionGasPrice(block);
   }
 

ethereum/core/src/main/java/org/hyperledger/besu/ethereum/mainnet/BlockBodyValidator.java

@@ -33,14 +33,16 @@ public interface BlockBodyValidator {
    * @param worldStateRootHash The rootHash defining the world state after processing this block and
    *     all of its transactions.
    * @param ommerValidationMode The validation mode to use for ommer headers
+   * @param bodyValidationMode The validation mode to use for the body
    * @return {@code true} if valid; otherwise {@code false}
    */
   boolean validateBody(
-      ProtocolContext context,
-      Block block,
-      List<TransactionReceipt> receipts,
-      Hash worldStateRootHash,
-      final HeaderValidationMode ommerValidationMode);
+      final ProtocolContext context,
+      final Block block,
+      final List<TransactionReceipt> receipts,
+      final Hash worldStateRootHash,
+      final HeaderValidationMode ommerValidationMode,
+      final BodyValidationMode bodyValidationMode);
 
   /**
    * Validates that the block body is valid, but skips state root validation.
@@ -55,6 +57,5 @@ boolean validateBodyLight(
       ProtocolContext context,
       Block block,
       List<TransactionReceipt> receipts,
-      final HeaderValidationMode ommerValidationMode,
-      final BodyValidationMode bodyValidationMode);
+      final HeaderValidationMode ommerValidationMode);
 }

ethereum/core/src/main/java/org/hyperledger/besu/ethereum/mainnet/BodyValidationMode.java

@@ -21,6 +21,9 @@ public enum BodyValidationMode {
   /** Skip receipts and transactions root validation */
   LIGHT,
 
+  /** Validate transactions, state, and receipts root */
+  ROOT_ONLY,
+
   /** Fully validate the body */
   FULL;
 }

ethereum/core/src/main/java/org/hyperledger/besu/ethereum/mainnet/MainnetBlockBodyValidator.java

@@ -50,10 +50,39 @@ public boolean validateBody(
       final Block block,
       final List<TransactionReceipt> receipts,
       final Hash worldStateRootHash,
-      final HeaderValidationMode ommerValidationMode) {
+      final HeaderValidationMode ommerValidationMode,
+      final BodyValidationMode bodyValidationMode) {
+    if (bodyValidationMode == BodyValidationMode.NONE) {
+      return true;
+    }
+
+    if (bodyValidationMode == BodyValidationMode.LIGHT
+        || bodyValidationMode == BodyValidationMode.FULL) {
+      if (!validateBodyLight(context, block, receipts, ommerValidationMode)) {
+        return false;
+      }
+    }
+
+    if (bodyValidationMode == BodyValidationMode.ROOT_ONLY
+        || bodyValidationMode == BodyValidationMode.FULL) {
+      return validateBodyRoots(block, receipts, worldStateRootHash);
+    }
+    return true;
+  }
+
+  @VisibleForTesting
+  protected boolean validateBodyRoots(
+      final Block block, final List<TransactionReceipt> receipts, final Hash worldStateRootHash) {
+    final BlockHeader header = block.getHeader();
+    final BlockBody body = block.getBody();
+
+    final Bytes32 transactionsRoot = BodyValidation.transactionsRoot(body.getTransactions());
+    if (!validateTransactionsRoot(header, header.getTransactionsRoot(), transactionsRoot)) {
+      return false;
+    }
 
-    if (!validateBodyLight(
-        context, block, receipts, ommerValidationMode, BodyValidationMode.FULL)) {
+    final Bytes32 receiptsRoot = BodyValidation.receiptsRoot(receipts);
+    if (!validateReceiptsRoot(header, header.getReceiptsRoot(), receiptsRoot)) {
       return false;
     }
 
@@ -65,7 +94,6 @@ public boolean validateBody(
               LOG.warn("Transaction receipt found in the invalid block {}", receipt.toString()));
       return false;
     }
-
     return true;
   }
 
@@ -74,27 +102,9 @@ public boolean validateBodyLight(
       final ProtocolContext context,
       final Block block,
       final List<TransactionReceipt> receipts,
-      final HeaderValidationMode ommerValidationMode,
-      final BodyValidationMode bodyValidationMode) {
-    if (bodyValidationMode == BodyValidationMode.NONE) {
-      return true;
-    }
+      final HeaderValidationMode ommerValidationMode) {
 
     final BlockHeader header = block.getHeader();
-    final BlockBody body = block.getBody();
-
-    // these checks are only needed for full validation and can be skipped for light validation
-    if (bodyValidationMode == BodyValidationMode.FULL) {
-      final Bytes32 transactionsRoot = BodyValidation.transactionsRoot(body.getTransactions());
-      if (!validateTransactionsRoot(header, header.getTransactionsRoot(), transactionsRoot)) {
-        return false;
-      }
-
-      final Bytes32 receiptsRoot = BodyValidation.receiptsRoot(receipts);
-      if (!validateReceiptsRoot(header, header.getReceiptsRoot(), receiptsRoot)) {
-        return false;
-      }
-    }
 
     final long gasUsed =
         receipts.isEmpty() ? 0 : receipts.get(receipts.size() - 1).getCumulativeGasUsed();
@@ -113,15 +123,13 @@ public boolean validateBodyLight(
     if (!validateWithdrawals(block)) {
       return false;
     }
-
     return true;
   }
 
-  @VisibleForTesting
-  protected boolean validateTransactionsRoot(
+  private boolean validateTransactionsRoot(
       final BlockHeader header, final Bytes32 expected, final Bytes32 actual) {
     if (!expected.equals(actual)) {
-      LOG.info(
+      LOG.warn(
           "Invalid block {}: transaction root mismatch (expected={}, actual={})",
           header.toLogString(),
           expected,
@@ -160,8 +168,7 @@ private static boolean validateGasUsed(
     return true;
   }
 
-  @VisibleForTesting
-  protected boolean validateReceiptsRoot(
+  private boolean validateReceiptsRoot(
       final BlockHeader header, final Bytes32 expected, final Bytes32 actual) {
     if (!expected.equals(actual)) {
       LOG.warn(
@@ -175,7 +182,7 @@ protected boolean validateReceiptsRoot(
     return true;
   }
 
-  private static boolean validateStateRoot(
+  private boolean validateStateRoot(
       final BlockHeader header, final Bytes32 expected, final Bytes32 actual) {
     if (!expected.equals(actual)) {
       LOG.warn(

ethereum/core/src/main/java/org/hyperledger/besu/ethereum/mainnet/precompiles/privacy/PrivacyPluginPrecompiledContract.java

@@ -34,6 +34,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+@Deprecated(since = "24.11.0")
 public class PrivacyPluginPrecompiledContract extends PrivacyPrecompiledContract {
   private static final Logger LOG = LoggerFactory.getLogger(PrivacyPluginPrecompiledContract.class);
   private final PrivacyParameters privacyParameters;