Resolve orchard via valar-orchard on crates.io (rebased onto PR #40)

.github/helpers/check-dep-graph.py

@@ -32,6 +32,14 @@
     'zip32',
 ])
 
+# Maps cargo package names to the logical name used in README.md's mermaid graph.
+# The workspace imports `orchard` via the `valar-orchard` crates.io package using
+# cargo's `package = "valar-orchard"` rename, so `cargo tree` reports the real
+# package name `valar-orchard` while the README uses the alias `orchard`.
+PACKAGE_NAME_REMAP = {
+    'valar-orchard': 'orchard',
+}
+
 def main():
     script_dir = os.path.dirname(os.path.realpath(__file__))
     base_dir = os.path.dirname(os.path.dirname(script_dir))
@@ -79,6 +87,7 @@ def main():
             continue
         (depth, crate, _) = line.strip().split(' ', 2)
         depth = int(depth)
+        crate = PACKAGE_NAME_REMAP.get(crate, crate)
 
         if depth == 0:
             crate_stack = [crate]

Cargo.toml

@@ -68,7 +68,14 @@ redjubjub = { version = "0.8", default-features = false }
 sapling = { package = "sapling-crypto", version = "0.6.2", default-features = false }
 
 # - Orchard
-orchard = { version = "0.12", default-features = false }
+#
+# Points at the Valar Group `valar-orchard` fork on crates.io, aliased locally to
+# `orchard` so every member still writes `use orchard::…`. The fork is
+# upstream-0.12.0 + post-release fixes (up to zcash/orchard 6b12c77) + governance-
+# visibility additions needed by the shielded-voting circuits in
+# valargroup/voting-circuits. Drop back to `orchard = "0.12"` once those
+# visibility changes land in zcash/orchard upstream.
+orchard = { version = "0.12.0", package = "valar-orchard", default-features = false }
 pasta_curves = "0.5"
 
 # - Transparent
@@ -231,4 +238,6 @@ unexpected_cfgs = { level = "warn", check-cfg = [
 
 [patch.crates-io]
 sapling = { package = "sapling-crypto", git = "https://github.com/zcash/sapling-crypto.git", rev = "b8a81c22f034d68f9bbd6cba728aab807b9ba2ea" }
-orchard = { package = "orchard", git = "https://github.com/zcash/orchard.git", rev = "b0bf2670e248958c6ce7c1deed466032e0dbd4d9" }
+# No orchard patch: the workspace resolves `orchard` via its `package = "valar-orchard"`
+# alias on crates.io, which already carries the post-0.12.0 upstream fixes plus the
+# governance-visibility additions.

supply-chain/config.toml

@@ -844,10 +844,6 @@ criteria = "safe-to-deploy"
 version = "11.1.4"
 criteria = "safe-to-deploy"
 
-[[exemptions.orchard]]
-version = "0.12.0@git:b0bf2670e248958c6ce7c1deed466032e0dbd4d9"
-criteria = "safe-to-deploy"
-
 [[exemptions.ordered-float]]
 version = "2.10.1"
 criteria = "safe-to-deploy"
@@ -1588,6 +1584,10 @@ criteria = "safe-to-deploy"
 version = "1.8.0"
 criteria = "safe-to-deploy"
 
+[[exemptions.valar-orchard]]
+version = "0.12.0"
+criteria = "safe-to-deploy"
+
 [[exemptions.wait-timeout]]
 version = "0.2.0"
 criteria = "safe-to-deploy"