Run the proof verifier in the browser instead of on a server

.github/workflows/cont_integration.yml

@@ -18,47 +18,49 @@ jobs:
     strategy:
       matrix:
         rust:
-          - version: 1.83.0 # STABLE
+          - version: 1.97.1 # STABLE
             clippy: true
-          - version: 1.78.0 # MSRV
+          - version: 1.85.0 # MSRV
     steps:
       - name: checkout
         uses: actions/checkout@v4
       - name: Generate cache key
         run: echo "${{ matrix.rust.version }}" | tee .cache_key
       - name: cache
-        uses: actions/cache@v2
+        uses: actions/cache@v4
         with:
           path: |
             ~/.cargo/registry
             ~/.cargo/git
             target
+            .tools
           key: ${{ runner.os }}-cargo-${{ hashFiles('.cache_key') }}-${{ hashFiles('**/Cargo.toml','**/Cargo.lock') }}
       - name: Set default toolchain
         run: rustup default ${{ matrix.rust.version }}
       - name: Set profile
         run: rustup set profile minimal
+      - name: Add the wasm target
+        run: rustup target add wasm32-unknown-unknown
       - name: Add clippy
         if: ${{ matrix.rust.clippy }}
         run: rustup component add clippy
       - name: Update toolchain
         run: rustup update
-      - name: Build
-        run: cargo build
+      - name: Test the verification logic
+        run: cargo test
       - name: Clippy
         if: ${{ matrix.rust.clippy }}
         run: cargo clippy --all-targets -- -D warnings
-      - name: Test
-        run: cargo test
-
-  build-docker:
-    name: build docker
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-      - name: Build the  Docker image
-        run: docker build --file Dockerfile --tag bdk-reserves-web .
+      - name: Build the static site
+        run: make build
+      - name: Test the built module end to end
+        run: make test-e2e
+      - name: Upload the site
+        if: ${{ matrix.rust.clippy }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist
 
   fmt:
     name: Rust fmt
@@ -67,12 +69,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Set default toolchain
-        run: rustup default nightly
+        run: rustup default 1.97.1
       - name: Set profile
         run: rustup set profile minimal
       - name: Add rustfmt
         run: rustup component add rustfmt
-      - name: Update toolchain
-        run: rustup update
       - name: Check fmt
-        run: cargo fmt --all -- --config format_code_in_doc_comments=true --check
+        run: cargo fmt --all -- --check

.github/workflows/pages.yml

@@ -0,0 +1,69 @@
+name: Pages
+
+# Publishes the static site to https://aminabank.github.io/bdk-reserves-web/
+#
+# Needs "Build and deployment > Source" set to "GitHub Actions" once, under the
+# repository's Settings > Pages. Without that the deploy step fails.
+
+on:
+  push:
+    branches:
+      - 'master'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Let a running deploy finish rather than cancelling it half way, but queue at
+# most one behind it.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: Build and deploy
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deploy.outputs.page_url }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set default toolchain
+        run: rustup default 1.97.1
+      - name: Add the wasm target
+        run: rustup target add wasm32-unknown-unknown
+
+      # The wasi-sdk is a ~130MB download, so keep it between runs.
+      - name: Cache the build tools
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            target
+            .tools
+          key: ${{ runner.os }}-pages-${{ hashFiles('**/Cargo.lock', 'build.sh') }}
+
+      # Build and test together, so a broken proof verifier never reaches the
+      # published site. make test-e2e builds dist/ as a side effect.
+      - name: Build and test
+        run: make test
+
+      # Pages runs Jekyll otherwise, which skips files it does not expect.
+      - name: Disable Jekyll
+        run: touch dist/.nojekyll
+
+      - name: Configure Pages
+        uses: actions/configure-pages@v5
+      - name: Upload the site
+        uses: actions/upload-pages-artifact@v3
+        with:
+          path: dist
+      - name: Deploy
+        id: deploy
+        uses: actions/deploy-pages@v4

.github/workflows/release.yml

@@ -20,41 +20,22 @@ jobs:
           # (required) GitHub token for creating GitHub Releases.
           token: ${{ secrets.GITHUB_TOKEN }}
 
-  upload-assets:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: taiki-e/upload-rust-binary-action@v1
-        with:
-          # (required) Comma-separated list of binary names (non-extension portion of filename) to build and upload.
-          # Note that glob pattern is not supported yet.
-          bin: bdk-reserves-web
-          # (required) GitHub token for uploading assets to GitHub Releases.
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-  heroku-deploy:
+  # The app is a static site now, so the release asset is the site itself
+  # rather than a server binary.
+  upload-site:
     runs-on: ubuntu-latest
+    needs: create-release
     steps:
       - uses: actions/checkout@v4
       - name: Set default toolchain
-        run: rustup default 1.72.0
-      - name: Build
-        run: cargo build --release
-      - name: make dir
-        run: mkdir app
-      - name: copy
-        run: cp ./target/release/bdk-reserves-web ./app/
-      - uses: akhileshns/heroku-deploy@v3.12.12
-        with:
-          # key from repository secrets
-          heroku_api_key: ${{secrets.HEROKU_API_KEY}}
-          # name of the Heroku app
-          heroku_app_name: "bdk-reserves-web"
-          # app directory
-          appdir: "./app"
-          # start command
-          procfile: "web: ./bdk-reserves-web"
-          # email from which the app is uploaded
-          heroku_email: "richi+heroku@ulrichard.ch"
-          # buildpack is like environment used to run the app
-          buildpack: "https://github.com/ph3nx/heroku-binary-buildpack.git"
+        run: rustup default 1.97.1
+      - name: Add the wasm target
+        run: rustup target add wasm32-unknown-unknown
+      - name: Build the static site
+        run: make build
+      - name: Package it
+        run: tar czf bdk-reserves-web-${{ github.ref_name }}.tar.gz -C dist .
+      - name: Attach it to the release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release upload ${{ github.ref_name }} bdk-reserves-web-*.tar.gz

.gitignore

@@ -1 +1,15 @@
+# Build output
 /target
+/dist
+
+# Toolchains build.sh fetches (wasi-sdk, wasm-bindgen)
+/.tools
+
+# Written by the CI workflow when its steps are run locally
+/.cache_key
+
+# Editor and OS noise
+.DS_Store
+*.swp
+/.idea/
+/.vscode/

CHANGELOG.md

@@ -3,7 +3,57 @@
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [v0.3.0]
+
+### Summary
+
+The app now runs entirely in the browser. There is no backend left.
+
+### Changed
+
+- Verification is compiled to WebAssembly and runs in the page. The PSBT is no
+  longer uploaded to a server.
+- UTXO lookups moved from Electrum to Esplora over HTTP, because a browser
+  cannot open the TCP connection Electrum needs. The server is configurable.
+- The network is worked out by parsing the addresses instead of guessing from
+  the first character, so testnet bech32 and signet addresses now work.
+- Amounts come from the transactions that created each UTXO, and each one is
+  checked against the txid requested, so the Esplora server cannot inflate the
+  reported total.
+- Confirmation depth is configurable in the UI, still defaulting to 3.
+- `bdk-reserves` comes from crates.io (3.0.0) now that its bdk_wallet 1.0 port
+  has been merged upstream, instead of a git branch on a fork. That brings
+  `bdk_wallet` 3 and `bitcoinconsensus` 0.105, so signatures are checked by the
+  script interpreter from Bitcoin Core 25.1, and lifts the minimum Rust
+  version to 1.85.
+- SEBA Bank is AMINA Bank now, and the branding follows. The example proof's
+  message still names SEBA, because it is signed into the proof and cannot
+  change.
+- The page has a "Load example" button that fills in a real testnet proof,
+  along with a note explaining that its UTXOs have since been spent.
+- Verification failures are explained in plain language rather than only as the
+  enum variant `bdk-reserves` returns. The raw message is still shown.
+- The build output is a folder of static files, so `make serve` is enough to
+  run it locally and any static host can serve it. The Dockerfile and the
+  Heroku deployment are gone.
+
+### Fixed
+
+- Confirmation depth was off by one. The block a UTXO is mined in counts as its
+  first confirmation, but the old rule treated it as the zeroth, so asking for
+  3 confirmations quietly required 4.
+
+### Added
+
+- A GitHub Pages workflow that publishes the site on every push to `master`,
+  gated on the test suite passing.
+
+### Removed
+
+- The actix-web HTTP service and its `/proof` endpoint.
+- The `libc` stand-in crate for the wasm build. `bitcoinconsensus` 0.105 does
+  not need it, and without the patch the wasm build no longer rewrites
+  `Cargo.lock`.
 
 ## [v0.1.10]