feat: SNARK-friendly certificate chain

CHANGELOG.md

@@ -25,6 +25,7 @@ As a minor extension, we have adopted a slightly different versioning convention
 - **UNSTABLE**:
   - Support for **DMQ consumer deduplication** to prevent processing the same message multiple times upon reconnection to the DMQ server.
   - Support for SNARK-friendly signer registration.
+  - Support for SNARK-friendly certificate chain.
 
 | Crate | Version |
 | ----- | ------- |

docs/runbook/genesis-manually/README.md

@@ -32,6 +32,7 @@ export NETWORK_MAGIC=**NETWORK_MAGIC**
 export DATA_STORES_DIRECTORY=**DATA_STORES_DIRECTORY**
 export CARDANO_NODE_SOCKET_PATH=**CARDANO_NODE_SOCKET_PATH**
 export CHAIN_OBSERVER_TYPE=**CHAIN_OBSERVER_TYPE**
+export MITHRIL_ERA=**MITHRIL_ERA**
 ```
 
 And create genesis dir:
@@ -49,9 +50,11 @@ docker exec -it mithril-aggregator bash
 Once connected to the aggregator container, export the genesis payload to sign:
 
 ```bash
-/app/bin/mithril-aggregator -vvv genesis export --target-path /mithril-aggregator/mithril/genesis/genesis-payload-to-sign.txt
+/app/bin/mithril-aggregator -vvv genesis export --target-path /mithril-aggregator/mithril/genesis/genesis-payload-to-sign.txt [--mithril-era $MITHRIL_ERA]
 ```
 
+> The `--mithril-era` parameter is optional when only one era exists, and required when multiple eras are supported. It specifies which Mithril era to use for the genesis certificate (e.g. `pythagoras`, `lagrange`).
+
 Then disconnect from the aggregator container:
 
 ```bash

docs/website/root/manual/develop/nodes/mithril-aggregator.md

@@ -550,27 +550,31 @@ Here is a list of the available parameters for the serve command:
 
 `genesis bootstrap` command:
 
-| Parameter                  | Command line (long) | Command line (short) | Environment variable       | Description                                                        | Default value | Example                            |     Mandatory      |
-| -------------------------- | ------------------- | :------------------: | -------------------------- | ------------------------------------------------------------------ | ------------- | ---------------------------------- | :----------------: |
-| `genesis_secret_key`       | -                   |          -           | `GENESIS_SECRET_KEY`       | Genesis secret key, :warning: for test only                        | -             | -                                  | :heavy_check_mark: |
-| `data_stores_directory`    | -                   |          -           | `DATA_STORES_DIRECTORY`    | Directory to store aggregator databases                            | -             | `./mithril-aggregator/stores`      | :heavy_check_mark: |
-| `cardano_node_socket_path` | -                   |          -           | `CARDANO_NODE_SOCKET_PATH` | Path of the socket opened by the Cardano node                      | -             | `/ipc/node.socket`                 | :heavy_check_mark: |
-| `cardano_cli_path`         | -                   |          -           | `CARDANO_CLI_PATH`         | Cardano CLI tool path                                              | -             | `cardano-cli`                      |         -          |
-| `chain_observer_type`      | -                   |          -           | `CHAIN_OBSERVER_TYPE`      | Chain observer type that can be `cardano-cli`, `pallas` or `fake`. | `pallas`      | -                                  | :heavy_check_mark: |
-| `network`                  | -                   |          -           | `NETWORK`                  | Cardano network                                                    | -             | `mainnet` or `preprod` or `devnet` | :heavy_check_mark: |
-| `network_magic`            | -                   |          -           | `NETWORK_MAGIC`            | Cardano network magic number (for `testnet` and `devnet`)          | -             | `1097911063` or `42`               |         -          |
+| Parameter                  | Command line (long)    | Command line (short) | Environment variable       | Description                                                                            | Default value | Example                            |     Mandatory      |
+| -------------------------- | ---------------------- | :------------------: | -------------------------- | -------------------------------------------------------------------------------------- | ------------- | ---------------------------------- | :----------------: |
+| `genesis_secret_key`       | `--genesis-secret-key` |          -           | `GENESIS_SECRET_KEY`       | Genesis Secret Key (test only)                                                         | -             | -                                  | :heavy_check_mark: |
+| `mithril_era`              | `--mithril-era`        |          -           | -                          | Mithril era to use for the genesis certificate                                         | -             | -                                  |         -          |
+| `help`                     | `--help`               |         `-h`         | -                          | Print help (see more with '--help')                                                    | -             | -                                  |         -          |
+| `cardano_cli_path`         | -                      |          -           | `CARDANO_CLI_PATH`         | Cardano CLI tool path                                                                  | -             | `cardano-cli`                      |         -          |
+| `cardano_node_socket_path` | -                      |          -           | `CARDANO_NODE_SOCKET_PATH` | Path of the socket opened by the Cardano node                                          | -             | `/ipc/node.socket`                 | :heavy_check_mark: |
+| `network_magic`            | -                      |          -           | `NETWORK_MAGIC`            | Cardano Network Magic number<br/><br/>useful for TestNet & DevNet                      | -             | `1097911063` or `42`               |         -          |
+| `network`                  | -                      |          -           | `NETWORK`                  | Cardano network                                                                        | -             | `mainnet` or `preprod` or `devnet` | :heavy_check_mark: |
+| `chain_observer_type`      | -                      |          -           | `CHAIN_OBSERVER_TYPE`      | Cardano chain observer type                                                            | -             | -                                  | :heavy_check_mark: |
+| `data_stores_directory`    | -                      |          -           | `DATA_STORES_DIRECTORY`    | Directory to store aggregator data (Certificates, Snapshots, Protocol Parameters, ...) | -             | `./mithril-aggregator/stores`      | :heavy_check_mark: |
 
 `genesis export` command:
 
-| Parameter                  | Command line (long) | Command line (short) | Environment variable       | Description                                                        | Default value | Example                            |     Mandatory      |
-| -------------------------- | ------------------- | :------------------: | -------------------------- | ------------------------------------------------------------------ | ------------- | ---------------------------------- | :----------------: |
-| `target_path`              | `--target-path`     |          -           | -                          | Path of the file to export the payload to.                         | -             | -                                  | :heavy_check_mark: |
-| `data_stores_directory`    | -                   |          -           | `DATA_STORES_DIRECTORY`    | Directory to store aggregator databases                            | -             | `./mithril-aggregator/stores`      | :heavy_check_mark: |
-| `cardano_node_socket_path` | -                   |          -           | `CARDANO_NODE_SOCKET_PATH` | Path of the socket opened by the Cardano node                      | -             | `/ipc/node.socket`                 | :heavy_check_mark: |
-| `cardano_cli_path`         | -                   |          -           | `CARDANO_CLI_PATH`         | Cardano CLI tool path                                              | -             | `cardano-cli`                      |         -          |
-| `chain_observer_type`      | -                   |          -           | `CHAIN_OBSERVER_TYPE`      | Chain observer type that can be `cardano-cli`, `pallas` or `fake`. | `pallas`      | -                                  | :heavy_check_mark: |
-| `network`                  | -                   |          -           | `NETWORK`                  | Cardano network                                                    | -             | `mainnet` or `preprod` or `devnet` | :heavy_check_mark: |
-| `network_magic`            | -                   |          -           | `NETWORK_MAGIC`            | Cardano network magic number (for `testnet` and `devnet`)          | -             | `1097911063` or `42`               |         -          |
+| Parameter                  | Command line (long) | Command line (short) | Environment variable       | Description                                                                            | Default value | Example                            |     Mandatory      |
+| -------------------------- | ------------------- | :------------------: | -------------------------- | -------------------------------------------------------------------------------------- | ------------- | ---------------------------------- | :----------------: |
+| `target_path`              | `--target-path`     |          -           | -                          | Target path                                                                            | -             | -                                  | :heavy_check_mark: |
+| `mithril_era`              | `--mithril-era`     |          -           | -                          | Mithril era to use for the genesis certificate                                         | -             | -                                  |         -          |
+| `help`                     | `--help`            |         `-h`         | -                          | Print help (see more with '--help')                                                    | -             | -                                  |         -          |
+| `cardano_cli_path`         | -                   |          -           | `CARDANO_CLI_PATH`         | Cardano CLI tool path                                                                  | -             | `cardano-cli`                      |         -          |
+| `cardano_node_socket_path` | -                   |          -           | `CARDANO_NODE_SOCKET_PATH` | Path of the socket opened by the Cardano node                                          | -             | `/ipc/node.socket`                 | :heavy_check_mark: |
+| `network_magic`            | -                   |          -           | `NETWORK_MAGIC`            | Cardano Network Magic number<br/><br/>useful for TestNet & DevNet                      | -             | `1097911063` or `42`               |         -          |
+| `network`                  | -                   |          -           | `NETWORK`                  | Cardano network                                                                        | -             | `mainnet` or `preprod` or `devnet` | :heavy_check_mark: |
+| `chain_observer_type`      | -                   |          -           | `CHAIN_OBSERVER_TYPE`      | Cardano chain observer type                                                            | -             | -                                  | :heavy_check_mark: |
+| `data_stores_directory`    | -                   |          -           | `DATA_STORES_DIRECTORY`    | Directory to store aggregator data (Certificates, Snapshots, Protocol Parameters, ...) | -             | `./mithril-aggregator/stores`      | :heavy_check_mark: |
 
 `genesis import` command:
 

mithril-aggregator/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mithril-aggregator"
-version = "0.8.33"
+version = "0.8.34"
 description = "A Mithril Aggregator server"
 authors = { workspace = true }
 edition = { workspace = true }

mithril-aggregator/src/commands/genesis_command.rs

@@ -12,7 +12,7 @@ use mithril_common::{
     crypto_helper::{
         ProtocolGenesisSecretKey, ProtocolGenesisSigner, ProtocolGenesisVerificationKey,
     },
-    entities::{HexEncodedGenesisSecretKey, HexEncodedGenesisVerificationKey},
+    entities::{HexEncodedGenesisSecretKey, HexEncodedGenesisVerificationKey, SupportedEra},
 };
 use mithril_doc::{Documenter, StructDoc};
 
@@ -21,6 +21,27 @@ use crate::{
     extract_all, tools::GenesisTools,
 };
 
+/// Resolve the Mithril era for the genesis command.
+///
+/// If the era is explicitly provided, it is returned as-is.
+/// If not provided and only one era exists, that era is used automatically.
+/// If not provided and multiple eras exist, an error is returned.
+fn resolve_mithril_era(mithril_era: Option<SupportedEra>) -> StdResult<SupportedEra> {
+    match mithril_era {
+        Some(era) => Ok(era),
+        None => {
+            let eras = SupportedEra::eras();
+            if eras.len() == 1 {
+                Ok(eras[0])
+            } else {
+                Err(anyhow::anyhow!(
+                    "Multiple Mithril eras are supported ({eras:?}), please specify which era to use with --mithril-era"
+                ))
+            }
+        }
+    }
+}
+
 #[derive(Debug, Clone, Deserialize, Documenter)]
 pub struct GenesisCommandConfiguration {
     /// Cardano CLI tool path
@@ -163,6 +184,12 @@ pub struct ExportGenesisSubCommand {
     /// Target path
     #[clap(long)]
     target_path: PathBuf,
+
+    /// Mithril era to use for the genesis certificate
+    ///
+    /// Optional when only one era exists, required when multiple eras are supported.
+    #[clap(long)]
+    mithril_era: Option<SupportedEra>,
 }
 
 impl ExportGenesisSubCommand {
@@ -181,11 +208,15 @@ impl ExportGenesisSubCommand {
             "Genesis export payload to sign to {}",
             self.target_path.display()
         );
+        let mithril_era = resolve_mithril_era(self.mithril_era)?;
         let mut dependencies_builder =
             DependenciesBuilder::new(root_logger.clone(), Arc::new(config.clone()));
-        let dependencies = dependencies_builder.create_genesis_container().await.with_context(
-            || "Dependencies Builder can not create genesis command dependencies container",
-        )?;
+        let dependencies = dependencies_builder
+            .create_genesis_container(mithril_era)
+            .await
+            .with_context(
+                || "Dependencies Builder can not create genesis command dependencies container",
+            )?;
 
         let genesis_tools = GenesisTools::from_dependencies(dependencies)
             .await
@@ -228,11 +259,15 @@ impl ImportGenesisSubCommand {
             "Genesis import signed payload from {}",
             self.signed_payload_path.to_string_lossy()
         );
+        let mithril_era = resolve_mithril_era(None)?;
         let mut dependencies_builder =
             DependenciesBuilder::new(root_logger.clone(), Arc::new(config.clone()));
-        let dependencies = dependencies_builder.create_genesis_container().await.with_context(
-            || "Dependencies Builder can not create genesis command dependencies container",
-        )?;
+        let dependencies = dependencies_builder
+            .create_genesis_container(mithril_era)
+            .await
+            .with_context(
+                || "Dependencies Builder can not create genesis command dependencies container",
+            )?;
 
         let genesis_tools = GenesisTools::from_dependencies(dependencies)
             .await
@@ -296,6 +331,12 @@ pub struct BootstrapGenesisSubCommand {
     /// Genesis Secret Key (test only)
     #[clap(long, env = "GENESIS_SECRET_KEY")]
     genesis_secret_key: HexEncodedGenesisSecretKey,
+
+    /// Mithril era to use for the genesis certificate
+    ///
+    /// Optional when only one era exists, required when multiple eras are supported.
+    #[clap(long)]
+    mithril_era: Option<SupportedEra>,
 }
 
 impl BootstrapGenesisSubCommand {
@@ -311,11 +352,15 @@ impl BootstrapGenesisSubCommand {
             .with_context(|| "configuration deserialize error")?;
         debug!(root_logger, "BOOTSTRAP GENESIS command"; "config" => format!("{config:?}"));
         println!("Genesis bootstrap for test only!");
+        let mithril_era = resolve_mithril_era(self.mithril_era)?;
         let mut dependencies_builder =
             DependenciesBuilder::new(root_logger.clone(), Arc::new(config.clone()));
-        let dependencies = dependencies_builder.create_genesis_container().await.with_context(
-            || "Dependencies Builder can not create genesis command dependencies container",
-        )?;
+        let dependencies = dependencies_builder
+            .create_genesis_container(mithril_era)
+            .await
+            .with_context(
+                || "Dependencies Builder can not create genesis command dependencies container",
+            )?;
 
         let genesis_tools = GenesisTools::from_dependencies(dependencies)
             .await
@@ -372,6 +417,24 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn resolve_mithril_era_returns_provided_era() {
+        let era = resolve_mithril_era(Some(SupportedEra::Lagrange)).unwrap();
+        assert_eq!(SupportedEra::Lagrange, era);
+    }
+
+    #[test]
+    fn resolve_mithril_era_returns_error_when_multiple_eras_and_none_provided() {
+        let eras = SupportedEra::eras();
+        if eras.len() > 1 {
+            let result = resolve_mithril_era(None);
+            assert!(
+                result.is_err(),
+                "Should error when multiple eras exist and none is provided"
+            );
+        }
+    }
+
     #[tokio::test]
     async fn create_container_does_not_panic() {
         let config = GenesisCommandConfiguration {
@@ -386,7 +449,7 @@ mod tests {
             DependenciesBuilder::new(TestLogger::stdout(), Arc::new(config));
 
         dependencies_builder
-            .create_genesis_container()
+            .create_genesis_container(SupportedEra::Pythagoras)
             .await
             .expect("Expected container creation to succeed without panicking");
     }

mithril-aggregator/src/database/migration.rs

@@ -302,5 +302,13 @@ alter table signer_registration add column verification_key_for_snark text;
 alter table signer_registration add column verification_key_signature_for_snark text;
         "#,
         ),
+        // Migration 41
+        // Add `aggregate_verification_key_snark` column to `certificate` table.
+        SqlMigration::new(
+            41,
+            r#"
+alter table certificate add column aggregate_verification_key_snark text;
+        "#,
+        ),
     ]
 }