Implements the issuer keys as

    IssuerAuthorizingKey -> isk
    IssuerVerifyingKey -> ik

Test vectors generated with zcash_test_vectors repo

* Added NoteType to Notes
* Added NoteType to value commitment derivation

* Circleci project setup (#1)

* Added .circleci/config.yml

* Added NoteType to Notes

* reformated file

* updated `derive` for NoteType

* added note_type to value commit derivation

* rustfmt

* updated ci config

* updated ci config

* updated ci config

* updated derive for note_type

* added test for arb note_type

* added test for `native` note type

* zsa-note-encryption: introduce AssetType and encode and decode it in note plaintexts

* zsa-note-encryption: extend the size of compact notes to include asset_type

* fixed clippy warrnings

* rustfmt

* zsa-note-encryption: document parsing requirement

* zsa-note-encryption: revert support of ZSA compact action

* zsa_value: add NoteType method is_native

* zsa-note-encryption: remove dependency on changes in the other crate

* zsa-note-encryption: extract memo of ZSA notes

* zsa-note-encryption: tests (zcash_test_vectors 77c73492)

* zsa-note-encryption: simplify roundtrip test

* zsa-note-encryption: more test vectors (zcash_test_vectors c10da464)

* Circleci project setup (#1)

* Added .circleci/config.yml

* issuer keys implementation (#5)

Implements the issuer keys as

    IssuerAuthorizingKey -> isk
    IssuerVerifyingKey -> ik

Test vectors generated with zcash_test_vectors repo

* Added NoteType to Notes (#2)

* Added NoteType to Notes
* Added NoteType to value commitment derivation

* zsa-note-encryption: use both native and ZSA in proptests

* zsa-note-encryption: test vector commit 51398c93

* zsa-note-encryption: fix after merge

Co-authored-by: Paul <3682187+PaulLaux@users.noreply.github.com>
Co-authored-by: Paul <lauxpaul@protonmail.com>
Co-authored-by: Aurélien Nicolas <info@nau.re>
Co-authored-by: Daniel Benarroch <danielbenarroch92@gmail.com>

+ Updated test bsk_consistent_with_bvk to verify mixed note types.
+ Added NoteType support to the builder and the bundle.
+ added split_flag to SpentInfo and as input to the Circuit (currently commented out)
+ added conditional cv_sum calculation (currently commented out)
+ added padding to actions

- added IssueBundle and IssueAction
- added a builder for IssueBundle
- added verify_issue_bundle() for consensus verification.
- unit tests.

added tests in `tests/zsa.rs`

* disabled split notes and proof check for zsa transfer

* fixes and suggestions

* changed "issuer" to "issuance" as per zcash#356 (comment)

* terminology fixes

* updated naming

* rename 2 note_type -> asset as per  zcash#356 (comment)

* added a dedicated type for "IssuanceAuth"

* disabled codecov github action due to bad behavior. 

* extracted "is_asset_desc_of_valid_size()" into asset_id.rs

* improved `verify_issue_bundle()`

Added CI badge to README

Added `OrchardDomainV3` on top of the encryption generalization (QED-it/librustzcash#18).

not for review: note_encryption.rs, note_encryptionv2v3.rs and src/test_vectors/note_encryption.rs. These files represent two possible approaches for backward compatibility and will be finalized down the road. (the files were excluded from the build).

Make IVK::from_bytes public

When split_flag is set, the following values are modified
* v_net is equal to -v_new instead of v_old - v_new
* cv_net is evaluated with this new value of v_net

The following constraints are modified
* (v_old - v_new = magnitude * sign) becomes (v_old * (1-split_flag) - v_new = magnitude * sign) to take into
   account the new value of v_net
* nf_old = nf_old_pub is only checked when split_flag=0
 * the new constraint asset_old = asset_new is always checked regardless of the value of split_flag

- Renamed AssetId to AssetBase
- Changed the  AssetBase implementation to support the zip update.
- Updated visibility for various members of issuance.rs

…#49)

This PR updates the test-vectors from the updates to the zcash-test-vectors repository (see here).

The keys test is also updated to now use the asset base from the test vectors instead of just using the native asset.

In the circuit, we update value_commit_orchard to take into account asset.
Previously, value_commit_orchard returns cv_net = [v_net] ValueCommitV + [rcv] ValueCommitR..
Now, value_commit_orchard returns cv_net = [v_net] asset + [rcv] ValueCommitR.
ValueCommitV and ValueCommitR are constants
v_net is equal to sign * magnitude where sign is in {-1, 1} and magnitude is an unsigned integer on 64 bits.

To evaluate [v_net] asset where v_net = sign * magnitude, we perform the following steps
1. verify that magnitude is on 64 bits
2. evaluate commitment=[magnitude]asset with the variable-base long-scalar multiplication
3. evaluate result=[sign]commitment with the new mul_sign gate

We would like to have a constant-time evaluation of the note commitment for both ZEC and ZSA.
ZEC_note_commitment=Extract_P(SinsemillaHashToPoint(zec_personalization, common_bits) + [rcm]R)
ZSA_note_commitment=Extract_P(SinsemillaHashToPoint(zsa_personalization, common_bits || asset) + [rcm]R)

R is the same constant for ZEC and ZSA note commitments.

1. Added a new error, `ValueSumOverflow`, that occurs if the sum value overflows when adding new supply amounts.
2. Created a new `supply_info` module containing `SupplyInfo` and `AssetSupply` structures, with `add_supply` function and unit tests for it.
3. Renamed the `are_note_asset_ids_derived_correctly` function to `verify_supply`, changed its behavior to verify and compute asset supply, added unit tests for it.
4. Updated the `verify_issue_bundle` function to use the changes mentioned above, updated its description, and added new unit tests.
5. Renamed errors with `...NoteType` suffix in the name to `...AssetBase`.
6.  Added `update_finalization_set` method to `SupplyInfo` and use after the calls of `verify_issue_bundle function` (if needed), instead of mutating the finalization set inside `verify_issue_bundle`.

updated comment to address
zcash#471 (comment)
and
zcash#471 (comment)

fixes zcash#471 (comment)
and zcash#471 (comment)

as requested in
zcash#471 (comment)

- Expose ReferenceKeys as orchard::issuance::ReferenceKeys for
  consensus verification of reference notes
- Update tests to use ReferenceKeys::recipient() instead of manually
  recreating the reference recipient from well-known seed

Added MAX_BURN_VALUE to be u63 in order to fit both u64 and i64 as
requested in
zcash#471 (comment)

Removed #[allow(clippy::suspicious_arithmetic_impl)] that does not seems
to be needed.

signature.

as requested in zcash#471 (comment)

…AULT)` test

to make sure we can create an OrchardZSA bundle with DEFAULT flags

During `Bundle` creation in `build_bundle`, update the order of dummy
spend/output creation and shuffling to ensure backward compatibility
with zcash/orchard.

---------

Co-authored-by: Paul <3682187+PaulLaux@users.noreply.github.com>

This ability is not needed. The only time we need to pad with a non-zatoshi asset,
it is done using `OutputInfo::dummy()`

…st 1.70

…st 1.70

This PR mirrors zcash#471 on our fork for internal review and
changes.

We’ll address upstream review comments here, then propagate the final
commits and responses back to zcash#471.

…ors` (#238)

QED-it/zcash-test-vectors#47 expands the sample set of Unicode code
points, which leads to a different random selection of asset description
strings, and therefore different asset base values in
`src/test_vectors/asset_base.rs`. This PR copies those changes in, along with 
some CI locking for tests to pass.

---------

Co-authored-by: Dmitry Demin <dmitry@qed-it.com>

This PR refactors Orchard’s issue/burn validation so Zebra can call it
directly when maintaining its `issued_assets` state and when processing
checkpointed blocks.

The changes:
- extend issuance and burn error types (derives + a few new variants)
- make state lookup callbacks `FnMut` so Zebra can keep a local cache
- split `verify_issue_bundle` to reuse core validation as
`verify_trusted_issue_bundle` (no sighash/signature, for checkpoints)
- update `validate_bundle_burn` to check burns against the asset state
and return updated `AssetRecord`s, making it symmetric with
`verify_issue_bundle`

Compact and add missing covarage

Add tests for untested error paths and consensus rules:
- MissingReferenceNoteOnFirstIssuance
- Successful subsequent issuance (supply accumulation)
- ValueOverflow on supply accumulation
- IssueActionWithoutNoteNotFinalized
- CannotBeFirstIssuance
- InvalidIssueValidatingKey

…m IssueBundle in tests) (#242)

Zebra no longer calls `create_test_reference_note`. Instead, it
generates a reference note by constructing an `IssueBundle` and
extracting the reference note from its actions.

This change is needed because `create_test_reference_note` produced
reference notes with `rho = None`, which breaks `librustzcash`
serialization and is undesirable in general.

Since the only purpose of `create_test_reference_note` in `orchard` was
Zebra testing, it’s no longer needed and is removed in this PR.

Address the second round of review feedback.

Merge upstream up to commit
zcash@64599b8

---------

Co-authored-by: Kris Nuttycombe <kris@nutty.land>
Co-authored-by: Jack Grigg <jack@electriccoin.co>
Co-authored-by: Jack Grigg <thestr4d@gmail.com>

#245)

This adds `IssueBundle::note_commitments()` to expose extracted note
commitments directly as `pallas::Base` values.

This is useful in Zebra to recompute issuance-related commitments
without the current `to_bytes`/`from_bytes` workaround:


https://github.com/QED-it/zebra/blob/2634fd662a4eaca6df901c82b1bc05d2982636d7/zebra-chain/src/orchard_zsa/issuance.rs#L43

See also the related Zebra PR review comment:

QED-it/zebra#111 (comment)

Import the following changes from upstream: 

- Bump rust version to 1.85.1 (and fix clippy issues/warnings)
- Replace core2 crate with corez crate
- Remove no_std from typenum in CI

And adjust to fix clippy errors.

---------

Co-authored-by: Kris Nuttycombe <kris@nutty.land>
Co-authored-by: Adam Tucker <adam@osmosis.team>

This PR fixes an issue in the ZSA note commitment circuit where
`q_init_zec` and `q_init_zsa` were previously treated as unconstrained
witnesses. The fix pins these points to their expected constant values,
ensuring they cannot be altered during proof generation.