Reduce diff with upstream

Cargo.toml

@@ -41,9 +41,9 @@ reddsa = { version = "0.5", default-features = false }
 nonempty = { version = "0.11", default-features = false }
 poseidon = { package = "halo2_poseidon", version = "0.1" }
 serde = { version = "1.0", default-features = false, features = ["derive"] }
-sinsemilla = { git = "https://github.com/zcash/sinsemilla", rev = "aabb707e862bc3d7b803c77d14e5a771bcee3e8c" }
+sinsemilla = "0.1"
 subtle = { version = "2.3", default-features = false }
-zcash_note_encryption = { git = "https://github.com/zcash/zcash_note_encryption", rev = "668ea44cf59a226715a5f3cb1bf88710a8c188a3" }
+zcash_note_encryption = "0.4"
 incrementalmerkletree = "0.8.1"
 zcash_spec = "0.2.1"
 zip32 = { version = "0.2.0", default-features = false }
@@ -71,7 +71,7 @@ criterion = "0.4" # 0.5 depends on clap 4 which has MSRV 1.70
 halo2_gadgets = { version = "0.3", features = ["test-dependencies"] }
 hex = "0.4"
 proptest = ">=1.0.0, <1.7.0"
-zcash_note_encryption = { git = "https://github.com/zcash/zcash_note_encryption", rev = "668ea44cf59a226715a5f3cb1bf88710a8c188a3", features = ["pre-zip-212"] }
+zcash_note_encryption = { version = "0.4", features = ["pre-zip-212"] }
 incrementalmerkletree = { version = "0.8.1", features = ["test-dependencies"] }
 shardtree = "0.6"
 
@@ -110,6 +110,8 @@ debug = true
 debug = true
 
 [patch.crates-io]
+sinsemilla = { git = "https://github.com/zcash/sinsemilla", rev = "aabb707e862bc3d7b803c77d14e5a771bcee3e8c" }
+zcash_note_encryption = { git = "https://github.com/zcash/zcash_note_encryption", rev = "668ea44cf59a226715a5f3cb1bf88710a8c188a3" }
 zcash_spec = { git = "https://github.com/QED-it/zcash_spec", rev = "842d697048a8960348adcde704c24438fc5b4544" }
 halo2_gadgets = { git = "https://github.com/zcash/halo2", rev = "2308caf68c48c02468b66cfc452dad54e355e32f" }
 halo2_proofs = { git = "https://github.com/zcash/halo2", rev = "2308caf68c48c02468b66cfc452dad54e355e32f" }

src/builder.rs

@@ -560,7 +560,7 @@ impl ActionInfo {
 ///
 /// This is returned by [`Builder::build`].
 #[cfg(feature = "circuit")]
-pub type UnauthorizedBundle<V, D> = Bundle<InProgress<Unproven, Unauthorized>, V, D>;
+pub type UnauthorizedBundle<V, P> = Bundle<InProgress<Unproven, Unauthorized>, V, P>;
 
 /// Metadata about a bundle created by [`bundle`] or [`Builder::build`] that is not
 /// necessarily recoverable from the bundle itself.
@@ -1126,19 +1126,6 @@ pub struct InProgress<P, S: InProgressSignatures> {
     sigs: S,
 }
 
-impl<P, S: InProgressSignatures> InProgress<P, S> {
-    /// Mutate the proof using the provided function.
-    pub fn map_proof<F, P2>(self, f: F) -> InProgress<P2, S>
-    where
-        F: FnOnce(P) -> P2,
-    {
-        InProgress {
-            proof: f(self.proof),
-            sigs: self.sigs,
-        }
-    }
-}
-
 impl<P: fmt::Debug, S: InProgressSignatures> Authorization for InProgress<P, S> {
     type SpendAuth = S::SpendAuth;
 }

src/bundle.rs

@@ -260,6 +260,7 @@ impl<A: Authorization, V, P: OrchardPrimitives> Bundle<A, V, P> {
             value_balance,
             burn,
             anchor,
+            // For the OrchardZSA protocol, `expiry_height` is set to 0, indicating no expiry.
             expiry_height: 0,
             authorization,
         }
@@ -625,19 +626,18 @@ pub mod testing {
 
     use crate::{
         builder::{VerBindingSig, VerSpendAuthSig},
-        primitives::redpallas::testing::arb_binding_signing_key,
-        value::{testing::arb_note_value_bounded, NoteValue, ValueSum, MAX_NOTE_VALUE},
+        note::{asset_base::testing::arb_zsa_asset_base, AssetBase},
+        primitives::{redpallas::testing::arb_binding_signing_key, OrchardPrimitives},
+        value::{
+            testing::{arb_note_value, arb_note_value_bounded},
+            NoteValue, ValueSum, MAX_NOTE_VALUE,
+        },
         Anchor, Proof,
     };
 
     use super::{Action, Authorized, Bundle, Flags};
 
     pub use crate::action::testing::ActionArb;
-    use crate::{
-        note::{asset_base::testing::arb_zsa_asset_base, AssetBase},
-        primitives::OrchardPrimitives,
-        value::testing::arb_note_value,
-    };
 
     /// Marker type for a bundle that contains no authorizing data.
     pub type Unauthorized = super::EffectsOnly;

src/bundle/commitments.rs

@@ -44,10 +44,10 @@ pub(crate) fn hash_bundle_txid_data<A: Authorization, V: Copy + Into<i64>, P: Or
     P::hash_bundle_txid_data(bundle)
 }
 
-/// Construct the `orchard_digest` commitment for the absent bundle as defined in
-/// [ZIP-246: Digests for the Version 6 Transaction Format][zip246]
+/// Construct the commitment for the absent bundle as defined in
+/// [ZIP-244: Transaction Identifier Non-Malleability][zip244]
 ///
-/// [zip246]: https://zips.z.cash/zip-0246
+/// [zip244]: https://zips.z.cash/zip-0244
 pub fn hash_bundle_txid_empty() -> Blake2bHash {
     hasher(ZCASH_ORCHARD_HASH_PERSONALIZATION).finalize()
 }

src/circuit/circuit_vanilla.rs

@@ -2,6 +2,8 @@
 //!
 //! Includes the configuration, synthesis, and proof verification logic.
 
+// Review hint: this file is largely derived from src/circuit.rs
+
 use group::Curve;
 
 use pasta_curves::pallas;

src/issuance.rs

@@ -22,16 +22,14 @@ use rand::RngCore;
 use zcash_spec::sighash_versioning::{VersionedSig, SIGHASH_V0};
 
 use crate::{
-    asset_record::AssetRecord,
     bundle::commitments::{hash_issue_bundle_auth_data, hash_issue_bundle_txid_data},
     constants::reference_keys::ReferenceKeys,
-    issuance_auth::{IssueAuthKey, IssueAuthSig, IssueValidatingKey},
+    issuance_auth::{IssueAuthKey, IssueAuthSig, IssueValidatingKey, ZSASchnorr},
     note::{rho_for_issuance_note, AssetBase, Nullifier, Rho},
     value::NoteValue,
     Address, Note,
 };
 
-use crate::issuance_auth::ZSASchnorr;
 use Error::{
     AssetBaseCannotBeIdentityPoint, CannotBeFirstIssuance, IncorrectRhoDerivation,
     InvalidIssueAuthKey, InvalidIssueBundleSig, InvalidIssueValidatingKey, InvalidSighashVersion,
@@ -701,6 +699,31 @@ pub fn verify_issue_bundle(
     )
 }
 
+/// Represents aggregated information about an asset, including its supply, finalization status,
+/// and reference note.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct AssetRecord {
+    /// The amount of the asset.
+    pub amount: NoteValue,
+
+    /// Whether or not the asset is finalized.
+    pub is_finalized: bool,
+
+    /// A reference note
+    pub reference_note: Note,
+}
+
+impl AssetRecord {
+    /// Creates a new [`AssetRecord`] instance.
+    pub fn new(amount: NoteValue, is_finalized: bool, reference_note: Note) -> Self {
+        Self {
+            amount,
+            is_finalized,
+            reference_note,
+        }
+    }
+}
+
 /// Errors produced during the issuance process
 #[derive(Debug, PartialEq, Eq)]
 pub enum Error {
@@ -808,16 +831,15 @@ impl fmt::Display for Error {
 #[cfg(test)]
 mod tests {
     use crate::{
-        asset_record::AssetRecord,
         builder::{Builder, BundleType},
         circuit::ProvingKey,
         issuance::Error::{
             IncorrectRhoDerivation, InvalidIssueBundleSig, IssueActionNotFound,
             IssueActionPreviouslyFinalizedAssetBase, IssueBundleIkMismatchAssetBase,
         },
         issuance::{
-            compute_asset_desc_hash, is_reference_note, verify_issue_bundle, IssueAction,
-            IssueBundle, IssueInfo, Signed, VerBIP340IssueAuthSig,
+            compute_asset_desc_hash, is_reference_note, verify_issue_bundle, AssetRecord,
+            IssueAction, IssueBundle, IssueInfo, Signed, VerBIP340IssueAuthSig,
         },
         issuance_auth::{IssueAuthKey, IssueValidatingKey, ZSASchnorr},
         keys::{FullViewingKey, Scope, SpendAuthorizingKey, SpendingKey},

src/keys.rs

@@ -12,14 +12,14 @@ use group::{
     prime::PrimeCurveAffine,
     Curve, GroupEncoding,
 };
-use pasta_curves::{pallas, pallas::Scalar};
+use pasta_curves::pallas;
 use rand::RngCore;
 use subtle::{Choice, ConditionallySelectable, ConstantTimeEq, CtOption};
 use zcash_note_encryption::EphemeralKeyBytes;
 
 use crate::{
     address::Address,
-    primitives::redpallas::{self, SpendAuth, VerificationKey},
+    primitives::redpallas::{self, SpendAuth},
     spec::{
         commit_ivk, diversify_hash, extract_p, ka_orchard, ka_orchard_prepared, prf_nf, to_base,
         to_scalar, NonIdentityPallasPoint, NonZeroPallasBase, NonZeroPallasScalar,
@@ -141,17 +141,13 @@ impl From<&SpendingKey> for SpendAuthorizingKey {
         // SpendingKey cannot be constructed such that this assertion would fail.
         assert!(!bool::from(ask.is_zero()));
         // TODO: Add TryFrom<S::Scalar> for SpendAuthorizingKey.
-        SpendAuthorizingKey(conditionally_negate(ask))
-    }
-}
-
-// If the last bit of repr_P(ak) is 1, negate ask.
-fn conditionally_negate<T: redpallas::SigType>(scalar: Scalar) -> redpallas::SigningKey<T> {
-    let ret = redpallas::SigningKey::<T>(scalar.to_repr().try_into().unwrap());
-    if (<[u8; 32]>::from(redpallas::VerificationKey::<T>::from(&ret).0)[31] >> 7) == 1 {
-        redpallas::SigningKey::<T>((-scalar).to_repr().try_into().unwrap())
-    } else {
-        ret
+        let ret = SpendAuthorizingKey(ask.to_repr().try_into().unwrap());
+        // If the last bit of repr_P(ak) is 1, negate ask.
+        if (<[u8; 32]>::from(SpendValidatingKey::from(&ret).0)[31] >> 7) == 1 {
+            SpendAuthorizingKey((-ask).to_repr().try_into().unwrap())
+        } else {
+            ret
+        }
     }
 }
 
@@ -209,26 +205,21 @@ impl SpendValidatingKey {
     pub(crate) fn from_bytes(bytes: &[u8]) -> Option<Self> {
         <[u8; 32]>::try_from(bytes)
             .ok()
-            .and_then(check_structural_validity)
+            .and_then(|b| {
+                // Structural validity checks for ak_P:
+                // - The point must not be the identity
+                //   (which for Pallas is canonically encoded as all-zeroes).
+                // - The sign of the y-coordinate must be positive.
+                if b != [0; 32] && b[31] & 0x80 == 0 {
+                    <redpallas::VerificationKey<SpendAuth>>::try_from(b).ok()
+                } else {
+                    None
+                }
+            })
             .map(SpendValidatingKey)
     }
 }
 
-/// A function to check structural validity of the validating keys for authorizing transfers and
-/// issuing assets
-/// Structural validity checks for ak_P or ik_P:
-///  - The point must not be the identity (which for Pallas is canonically encoded as all-zeroes).
-///  - The compressed y-coordinate bit must be 0.
-fn check_structural_validity(
-    verification_key_bytes: [u8; 32],
-) -> Option<VerificationKey<SpendAuth>> {
-    if verification_key_bytes != [0; 32] && verification_key_bytes[31] & 0x80 == 0 {
-        <redpallas::VerificationKey<SpendAuth>>::try_from(verification_key_bytes).ok()
-    } else {
-        None
-    }
-}
-
 /// A key used to derive [`Nullifier`]s from [`Note`]s.
 ///
 /// $\mathsf{nk}$ as defined in [Zcash Protocol Spec § 4.2.3: Orchard Key Components][orchardkeycomponents].
@@ -925,9 +916,10 @@ impl SharedSecret {
 #[cfg(any(test, feature = "test-dependencies"))]
 #[cfg_attr(docsrs, doc(cfg(feature = "test-dependencies")))]
 pub mod testing {
-    use super::{DiversifierIndex, DiversifierKey, EphemeralSecretKey, SpendingKey};
     use proptest::prelude::*;
 
+    use super::{DiversifierIndex, DiversifierKey, EphemeralSecretKey, SpendingKey};
+
     prop_compose! {
         /// Generate a uniformly distributed Orchard spending key.
         pub fn arb_spending_key()(

src/lib.rs

@@ -4,9 +4,9 @@
 //!
 //! All types in the `orchard` crate, unless otherwise specified, are Orchard-specific
 //! types. For example, [`Address`] is documented as being a shielded payment address; we
 //! implicitly mean it is an Orchard payment address (as opposed to e.g. a Sapling payment
 //! address, which is also shielded).
 
 #![no_std]
 #![cfg_attr(docsrs, feature(doc_cfg))]
 // Temporary until we have more of the crate implemented.
@@ -27,7 +27,6 @@
 
 mod action;
 mod address;
-pub mod asset_record;
 pub mod builder;
 pub mod bundle;
 #[cfg(feature = "circuit")]

src/note/asset_base.rs

@@ -9,13 +9,12 @@ use pasta_curves::{arithmetic::CurveExt, pallas};
 use rand_core::CryptoRngCore;
 use subtle::{Choice, ConstantTimeEq, CtOption};
 
-use crate::issuance_auth::ZSASchnorr;
 use crate::{
     constants::fixed_bases::{
         NATIVE_ASSET_BASE_V_BYTES, VALUE_COMMITMENT_PERSONALIZATION, ZSA_ASSET_BASE_PERSONALIZATION,
     },
     issuance::compute_asset_desc_hash,
-    issuance_auth::{IssueAuthKey, IssueValidatingKey},
+    issuance_auth::{IssueAuthKey, IssueValidatingKey, ZSASchnorr},
 };
 
 /// Note type identifier.

src/primitives/compact_action.rs

@@ -1,5 +1,7 @@
 //! Defines actions for Orchard shielded outputs and compact action for light clients.
 
+// Review hint: this file is largely derived from src/note_encryption.rs
+
 use core::fmt;
 
 use zcash_note_encryption::{note_bytes::NoteBytes, EphemeralKeyBytes, ShieldedOutput};

src/primitives/orchard_domain.rs

@@ -1,5 +1,7 @@
 //! Orchard-specific note encryption domain.
 
+// Review hint: this file is largely derived from src/note_encryption.rs
+
 use crate::{
     action::Action, note::Rho, primitives::compact_action::CompactAction,
     primitives::orchard_primitives::OrchardPrimitives,

src/primitives/redpallas.rs

@@ -24,7 +24,7 @@ impl SigType for Binding {}
 
 /// A RedPallas signing key.
 #[derive(Clone, Copy, Debug)]
-pub struct SigningKey<T: SigType>(pub(crate) reddsa::SigningKey<T>);
+pub struct SigningKey<T: SigType>(reddsa::SigningKey<T>);
 
 impl<T: SigType> From<SigningKey<T>> for [u8; 32] {
     fn from(sk: SigningKey<T>) -> [u8; 32] {
@@ -64,7 +64,7 @@ impl<T: SigType> SigningKey<T> {
 
 /// A RedPallas verification key.
 #[derive(Clone, Debug)]
-pub struct VerificationKey<T: SigType>(pub(crate) reddsa::VerificationKey<T>);
+pub struct VerificationKey<T: SigType>(reddsa::VerificationKey<T>);
 
 impl<T: SigType> From<VerificationKey<T>> for [u8; 32] {
     fn from(vk: VerificationKey<T>) -> [u8; 32] {