Version v0.1.23+beta

.github/workflows/protect-main.yaml

@@ -0,0 +1,26 @@
+name: Protect main
+
+on:
+  pull_request:
+    branches:
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - edited
+
+jobs:
+  require-development:
+    name: Require development source branch
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check source branch
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: |
+          if [ "$HEAD_REF" != "development" ]; then
+            echo "::error::PRs targeting main must come from the development branch (got '$HEAD_REF'). Open this PR against development instead, then promote development to main."
+            exit 1
+          fi
+          echo "PR is from development → main. OK."

.github/workflows/release.yml

@@ -94,6 +94,9 @@ jobs:
         with:
           ref: ${{ github.ref }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
@@ -103,18 +106,25 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Build and push
+      - name: Prepare tags
+        id: prep
         run: |
           TAG=${{ needs.validate.outputs.tag }}
           DOCKER_TAG=${TAG//+/-}
-          docker build \
-            -t canopynetwork/canopy:${DOCKER_TAG} \
-            -t canopynetwork/canopy:latest \
-            --build-arg BRANCH=${TAG} \
-            --build-arg BUILD_PATH=cmd/cli \
-            ./.docker/auto-update/
-          docker push canopynetwork/canopy:${DOCKER_TAG}
-          docker push canopynetwork/canopy:latest
+          echo "docker_tag=${DOCKER_TAG}" >> $GITHUB_OUTPUT
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./.docker/auto-update/
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            canopynetwork/canopy:${{ steps.prep.outputs.docker_tag }}
+            canopynetwork/canopy:latest
+          build-args: |
+            BRANCH=${{ github.event.inputs.tag }}
+            BUILD_PATH=cmd/cli
 
   docker-go:
     name: Docker - Go Plugin
@@ -127,6 +137,9 @@ jobs:
         with:
           ref: ${{ github.ref }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -136,19 +149,26 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Build and push
+      - name: Prepare tags
+        id: prep
         run: |
           TAG=${{ needs.validate.outputs.tag }}
           DOCKER_TAG=${TAG//+/-}
-          docker build \
-            -t canopynetwork/canopy:go-${DOCKER_TAG} \
-            -t canopynetwork/canopy:go-latest \
-            --build-arg BRANCH=${TAG} \
-            --build-arg BUILD_PATH=cmd/cli \
-            -f ./.docker/auto-update/Dockerfile.go \
-            ./.docker/auto-update/
-          docker push canopynetwork/canopy:go-${DOCKER_TAG}
-          docker push canopynetwork/canopy:go-latest
+          echo "docker_tag=${DOCKER_TAG}" >> $GITHUB_OUTPUT
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./.docker/auto-update/
+          file: ./.docker/auto-update/Dockerfile.go
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            canopynetwork/canopy-plugin-go:${{ steps.prep.outputs.docker_tag }}
+            canopynetwork/canopy-plugin-go:latest
+          build-args: |
+            BRANCH=${{ github.event.inputs.tag }}
+            BUILD_PATH=cmd/cli
 
   docker-python:
     name: Docker - Python Plugin
@@ -161,6 +181,9 @@ jobs:
         with:
           ref: ${{ github.ref }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -170,19 +193,26 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Build and push
+      - name: Prepare tags
+        id: prep
         run: |
           TAG=${{ needs.validate.outputs.tag }}
           DOCKER_TAG=${TAG//+/-}
-          docker build \
-            -t canopynetwork/canopy:python-${DOCKER_TAG} \
-            -t canopynetwork/canopy:python-latest \
-            --build-arg BRANCH=${TAG} \
-            --build-arg BUILD_PATH=cmd/cli \
-            -f ./.docker/auto-update/Dockerfile.python \
-            ./.docker/auto-update/
-          docker push canopynetwork/canopy:python-${DOCKER_TAG}
-          docker push canopynetwork/canopy:python-latest
+          echo "docker_tag=${DOCKER_TAG}" >> $GITHUB_OUTPUT
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./.docker/auto-update/
+          file: ./.docker/auto-update/Dockerfile.python
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            canopynetwork/canopy-plugin-python:${{ steps.prep.outputs.docker_tag }}
+            canopynetwork/canopy-plugin-python:latest
+          build-args: |
+            BRANCH=${{ github.event.inputs.tag }}
+            BUILD_PATH=cmd/cli
 
   docker-typescript:
     name: Docker - TypeScript Plugin
@@ -195,6 +225,9 @@ jobs:
         with:
           ref: ${{ github.ref }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -204,19 +237,26 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Build and push
+      - name: Prepare tags
+        id: prep
         run: |
           TAG=${{ needs.validate.outputs.tag }}
           DOCKER_TAG=${TAG//+/-}
-          docker build \
-            -t canopynetwork/canopy:typescript-${DOCKER_TAG} \
-            -t canopynetwork/canopy:typescript-latest \
-            --build-arg BRANCH=${TAG} \
-            --build-arg BUILD_PATH=cmd/cli \
-            -f ./.docker/auto-update/Dockerfile.typescript \
-            ./.docker/auto-update/
-          docker push canopynetwork/canopy:typescript-${DOCKER_TAG}
-          docker push canopynetwork/canopy:typescript-latest
+          echo "docker_tag=${DOCKER_TAG}" >> $GITHUB_OUTPUT
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./.docker/auto-update/
+          file: ./.docker/auto-update/Dockerfile.typescript
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            canopynetwork/canopy-plugin-typescript:${{ steps.prep.outputs.docker_tag }}
+            canopynetwork/canopy-plugin-typescript:latest
+          build-args: |
+            BRANCH=${{ github.event.inputs.tag }}
+            BUILD_PATH=cmd/cli
 
   docker-kotlin:
     name: Docker - Kotlin Plugin
@@ -229,6 +269,9 @@ jobs:
         with:
           ref: ${{ github.ref }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -238,19 +281,26 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Build and push
+      - name: Prepare tags
+        id: prep
         run: |
           TAG=${{ needs.validate.outputs.tag }}
           DOCKER_TAG=${TAG//+/-}
-          docker build \
-            -t canopynetwork/canopy:kotlin-${DOCKER_TAG} \
-            -t canopynetwork/canopy:kotlin-latest \
-            --build-arg BRANCH=${TAG} \
-            --build-arg BUILD_PATH=cmd/cli \
-            -f ./.docker/auto-update/Dockerfile.kotlin \
-            ./.docker/auto-update/
-          docker push canopynetwork/canopy:kotlin-${DOCKER_TAG}
-          docker push canopynetwork/canopy:kotlin-latest
+          echo "docker_tag=${DOCKER_TAG}" >> $GITHUB_OUTPUT
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./.docker/auto-update/
+          file: ./.docker/auto-update/Dockerfile.kotlin
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            canopynetwork/canopy-plugin-kotlin:${{ steps.prep.outputs.docker_tag }}
+            canopynetwork/canopy-plugin-kotlin:latest
+          build-args: |
+            BRANCH=${{ github.event.inputs.tag }}
+            BUILD_PATH=cmd/cli
 
   docker-csharp:
     name: Docker - C# Plugin
@@ -263,6 +313,9 @@ jobs:
         with:
           ref: ${{ github.ref }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -272,16 +325,23 @@ jobs:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
 
-      - name: Build and push
+      - name: Prepare tags
+        id: prep
         run: |
           TAG=${{ needs.validate.outputs.tag }}
           DOCKER_TAG=${TAG//+/-}
-          docker build \
-            -t canopynetwork/canopy:csharp-${DOCKER_TAG} \
-            -t canopynetwork/canopy:csharp-latest \
-            --build-arg BRANCH=${TAG} \
-            --build-arg BUILD_PATH=cmd/cli \
-            -f ./.docker/auto-update/Dockerfile.csharp \
-            ./.docker/auto-update/
-          docker push canopynetwork/canopy:csharp-${DOCKER_TAG}
-          docker push canopynetwork/canopy:csharp-latest
+          echo "docker_tag=${DOCKER_TAG}" >> $GITHUB_OUTPUT
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ./.docker/auto-update/
+          file: ./.docker/auto-update/Dockerfile.csharp
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: |
+            canopynetwork/canopy-plugin-csharp:${{ steps.prep.outputs.docker_tag }}
+            canopynetwork/canopy-plugin-csharp:latest
+          build-args: |
+            BRANCH=${{ github.event.inputs.tag }}
+            BUILD_PATH=cmd/cli

CONTRIBUTING.md

@@ -84,9 +84,10 @@ discuss your intended approach for solving the problem in the comments for an ex
 - **Update the CHANGELOG** for all enhancements and bug fixes. Include the corresponding date, issue
   number if one exists and current version if any. Check the format of the [CHANGELOG](.docs/CHANGELOG.md).
 
-- **Use the repo's default main branch.** Branch from and
+- **Target the `development` branch.** The repo's default branch is still `main`, but do **not**
+  open pull requests against `main`. Branch from and
   [submit your pull request](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/creating-a-pull-request-from-a-fork)
-  to the repo's default branch `main`.
+  to `development`.
 
 -
   **[Resolve any merge conflicts](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/resolving-a-merge-conflict-on-github)**

bft/bft.go

@@ -155,12 +155,9 @@ func (b *BFT) Start() {
 			func() {
 				b.Controller.Lock()
 				defer b.Controller.Unlock()
-				// calculate time since
-				since := time.Since(resetBFT.StartTime)
-				// allow if 'since' is less than 1 block old
-				if int(since.Milliseconds()) < b.Config.BlockTimeMS() {
+				processTime = validProcessTime(resetBFT.StartTime, time.Duration(b.Config.BlockTimeMS())*time.Millisecond)
+				if processTime != 0 {
 					b.log.Infof("Using included timestamp to calculate process time: %s", resetBFT.StartTime.Format(time.StampMilli))
-					processTime = since
 				}
 				// if is a root-chain update reset back to round 0 but maintain locks to prevent 'fork attacks'
 				// else increment the height and don't maintain locks
@@ -185,6 +182,13 @@ func (b *BFT) Start() {
 	}
 }
 
+func validProcessTime(start time.Time, maxAge time.Duration) time.Duration {
+	if since := time.Since(start); since > 0 && since < maxAge {
+		return since
+	}
+	return 0
+}
+
 // HandlePhase() is the main BFT Phase stepping loop
 func (b *BFT) HandlePhase() {
 	stopTimers := func() { b.PhaseTimer.Stop() }
@@ -609,8 +613,8 @@ func (b *BFT) Pacemaker() bool {
 			continue
 		}
 		totalVotedPower += validator.VotingPower
-		// if totalVotePower >= +33%, it's safe to advance to that round
-		if totalVotedPower >= lib.Uint64ReducePercentage(b.ValidatorSet.MinimumMaj23, 50) {
+		// if totalVotePower > 1/3, it's safe to advance to that round
+		if totalVotedPower > b.ValidatorSet.TotalPower/3 {
 			pacemakerRound = vote.Qc.Header.Round // set the highest round where +1/3rds have been
 			break
 		}

bft/bft_test.go

@@ -89,6 +89,12 @@ func TestStartElectionPhase(t *testing.T) {
 	}
 }
 
+func TestValidProcessTimeRejectsFutureTimestamp(t *testing.T) {
+	require.Zero(t, validProcessTime(time.Now().Add(time.Hour), time.Second))
+	require.Zero(t, validProcessTime(time.Now().Add(-time.Hour), time.Second))
+	require.Positive(t, validProcessTime(time.Now().Add(-time.Millisecond), time.Second))
+}
+
 func TestStartElectionVotePhase(t *testing.T) {
 	tests := []struct {
 		name                 string
@@ -745,6 +751,19 @@ func TestPacemaker(t *testing.T) {
 	}
 }
 
+func TestPacemakerRequiresMoreThanOneThird(t *testing.T) {
+	c := newTestConsensus(t, Propose, 2)
+	c.bft.ValidatorSet.ValidatorSet.ValidatorSet[0].VotingPower = 67
+	c.bft.ValidatorSet.ValidatorSet.ValidatorSet[1].VotingPower = 33
+	c.bft.ValidatorSet.TotalPower = 100
+	msg := &Message{Qc: &QC{Header: c.view(RoundInterrupt, 3)}}
+	require.NoError(t, msg.Sign(c.valKeys[1]))
+	require.NoError(t, c.bft.HandleMessage(msg))
+
+	c.bft.Pacemaker()
+	require.Equal(t, uint64(1), c.bft.Round)
+}
+
 func TestScheduleForceRound(t *testing.T) {
 	c := newTestConsensus(t, Election, 1)
 	c.bft.Round = 2