feat: enforce the circuit verification key registry

.github/workflows/actions/deploy-terraform-infrastructure/action.yml

@@ -125,6 +125,10 @@ inputs:
   mithril_genesis_verification_key_url:
     description: Mithril genesis verification key location.
     required: true
+  mithril_circuit_verification_key_registry_url:
+    description: Mithril signed circuit verification key registry location (only for SNARK aggregate signature types).
+    required: false
+    default: ""
   mithril_era_reader_adapter_type:
     description: Mithril era reader adapter type.
     required: false
@@ -311,6 +315,7 @@ runs:
           mithril_api_domain                                                           = "${{ inputs.mithril_api_domain }}"
           mithril_image_id                                                             = "${{ inputs.mithril_image_id }}"
           mithril_genesis_verification_key_url                                         = "${{ inputs.mithril_genesis_verification_key_url }}"
+          mithril_circuit_verification_key_registry_url                                = "${{ inputs.mithril_circuit_verification_key_registry_url }}"
           mithril_genesis_secret_key                                                   = "${{ inputs.mithril_genesis_secret_key }}"
           mithril_signers                                                              = ${{ fromJSON(inputs.mithril_signers) }}
           mithril_era_reader_adapter_type                                              = "${{ inputs.mithril_era_reader_adapter_type }}"

.github/workflows/ci.yml

@@ -814,6 +814,7 @@ jobs:
           mithril_signers: ${{ toJSON(matrix.mithril_signers) }}
           mithril_genesis_secret_key: ${{ secrets.GENESIS_SECRET_KEY }}
           mithril_genesis_verification_key_url: ${{ vars.GENESIS_VERIFICATION_KEY_URL }}
+          mithril_circuit_verification_key_registry_url: ${{ vars.CIRCUIT_VERIFICATION_KEY_REGISTRY_URL }}
           mithril_era_reader_address_url: ${{ vars.ERA_READER_ADDRESS_URL }}
           mithril_era_reader_verification_key_url: ${{ vars.ERA_READER_VERIFICATION_KEY_URL }}
           mithril_era_reader_secret_key: ${{ secrets.ERA_READER_SECRET_KEY }}

.github/workflows/pre-release.yml

@@ -282,6 +282,7 @@ jobs:
           mithril_signers: ${{ toJSON(matrix.mithril_signers) }}
           mithril_genesis_secret_key: ${{ secrets.GENESIS_SECRET_KEY }}
           mithril_genesis_verification_key_url: ${{ vars.GENESIS_VERIFICATION_KEY_URL }}
+          mithril_circuit_verification_key_registry_url: ${{ vars.CIRCUIT_VERIFICATION_KEY_REGISTRY_URL }}
           mithril_era_reader_address_url: ${{ vars.ERA_READER_ADDRESS_URL }}
           mithril_era_reader_verification_key_url: ${{ vars.ERA_READER_VERIFICATION_KEY_URL }}
           mithril_era_reader_secret_key: ${{ secrets.ERA_READER_SECRET_KEY }}

.github/workflows/release.yml

@@ -200,6 +200,7 @@ jobs:
           mithril_image_id: ${{ env.DOCKER_IMAGE_ID }}
           mithril_signers: ${{ toJSON(matrix.mithril_signers) }}
           mithril_genesis_verification_key_url: ${{ vars.GENESIS_VERIFICATION_KEY_URL }}
+          mithril_circuit_verification_key_registry_url: ${{ vars.CIRCUIT_VERIFICATION_KEY_REGISTRY_URL }}
           mithril_era_reader_address_url: ${{ vars.ERA_READER_ADDRESS_URL }}
           mithril_era_reader_verification_key_url: ${{ vars.ERA_READER_VERIFICATION_KEY_URL }}
           mithril_protocol_configuration_reader_address_url: ${{ vars.PROTOCOL_CONFIGURATION_READER_ADDRESS_URL }}

.github/workflows/test-deploy-network.yml

@@ -154,6 +154,7 @@ jobs:
           mithril_signers: ${{ toJSON(matrix.mithril_signers) }}
           mithril_genesis_secret_key: ${{ secrets.GENESIS_SECRET_KEY }}
           mithril_genesis_verification_key_url: ${{ vars.GENESIS_VERIFICATION_KEY_URL }}
+          mithril_circuit_verification_key_registry_url: ${{ vars.CIRCUIT_VERIFICATION_KEY_REGISTRY_URL }}
           mithril_era_reader_adapter_type: ${{ matrix.mithril_era_reader_adapter_type }}
           mithril_era_reader_address_url: ${{ vars.ERA_READER_ADDRESS_URL }}
           mithril_era_reader_verification_key_url: ${{ vars.ERA_READER_VERIFICATION_KEY_URL }}

docs/runbook/README.md

@@ -6,26 +6,27 @@ This page gathers the available guides to operate a Mithril network.
 
 # Guides
 
-| Operation                                    | Location                                                                                 | Description                                                                      |
-| -------------------------------------------- | ---------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- |
-| **Genesis manually**                         | [manual-genesis](./genesis-manually/README.md)                                           | Proceed to manual (re)genesis of the aggregator certificate chain.               |
-| **Era markers**                              | [era-markers](./era-markers/README.md)                                                   | Create and update era markers on the Cardano chain.                              |
-| **Protocol configuration markers**           | [protocol-configuration-markers](./protocol-configuration-markers/README.md)             | Create and update protocol configuration markers on the Cardano chain.           |
-| **Downloads statistics**                     | [downloads statistics](./statistics/README.md)                                           | Display the number of downloads per day.                                         |
-| **Signer registrations monitoring**          | [registrations-monitoring](./registrations-monitoring/README.md)                         | Gather aggregated data about signer registrations (versions, stake, ...).        |
-| **Recompute certificates hash**              | [recompute-certificates-hash](./recompute-certificates-hash/README.md)                   | Recompute the certificates hash of an aggregator.                                |
-| **Fix terraform lock**                       | [terraform-lock](./terraform-lock/README.md)                                             | Fix a terraform lock in CD workflows.                                            |
-| **Manage SSH access to infrastructure**      | [ssh-access](./ssh-access/README.md)                                                     | Manage SSH access on the VM of the infrastructure for a user.                    |
-| **Upgrade VM of infrastructure**             | [upgrade-vm](./upgrade-vm/README.md)                                                     | Upgrade the VM of the infrastructure of a Mithril network.                       |
-| **Create test Docker distribution**          | [test-docker-distribution](./test-docker-distribution/README.md)                         | Create a custom test Docker distribution.                                        |
-| **Deploy a test network manually**           | [test-deploy-network](./test-deploy-network/README.md)                                   | Manually deploy a test distribution to a test Mithril network.                   |
-| **Publish crates to crates.io manually**     | [manual-publish-crates](./manual-publish-crates/README.md)                               | Manually publish Rust crates to crates.io.                                       |
-| **Publish packages to npm manually**         | [manual-publish-npm](./manual-publish-npm/README.md)                                     | Manually publish packages to npm registry.                                       |
-| **Client multi-platform test**               | [test-client-multiplatform](./test-client-multiplatform/README.md)                       | Run multi-platform client CLI binaries, docker and WASM package tests.           |
-| **Maintain the networks configuration file** | [maintain-networks-configuration-file](./maintain-networks-configuration-file/README.md) | Maintain the `networks.json` file                                                |
-| **Aggregator metrics**                       | [aggregator-metrics](./aggregator-metrics/README.md)                                     | Display aggregator daily metrics.                                                |
-| **Upgrade Cardano node**                     | [upgrade-cardano-node](./upgrade-cardano-node/README.md)                                 | Upgrade the Cardano node of a Mithril network.                                   |
-| **Cardano node warmup**                      | [warmup-cardano-node](./warmup-cardano-node/README.md)                                   | Warm up a Cardano node from a Mithril snapshot to avoid ledger replay downtime.  |
-| **Prepare Cardano node artifacts**           | [prepare-cardano-node-artifacts](./prepare-cardano-node-artifacts/README.md)             | Prepare and publish artifacts for an unreleased Cardano node version.            |
-| **Cardano Docker bundle**                    | [cardano-docker-bundle](./cardano-docker-bundle/README.md)                               | Build and publish a Docker image bundling Cardano node with Mithril.             |
-| **Update circuits verification keys**        | [update-circuit-keys](./update-circuit-keys/README.md)                                   | Update the circuits verification keys after an intentional circuit modification. |
+| Operation                                    | Location                                                                                 | Description                                                                          |
+| -------------------------------------------- | ---------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
+| **Genesis manually**                         | [manual-genesis](./genesis-manually/README.md)                                           | Proceed to manual (re)genesis of the aggregator certificate chain.                   |
+| **Era markers**                              | [era-markers](./era-markers/README.md)                                                   | Create and update era markers on the Cardano chain.                                  |
+| **Protocol configuration markers**           | [protocol-configuration-markers](./protocol-configuration-markers/README.md)             | Create and update protocol configuration markers on the Cardano chain.               |
+| **Downloads statistics**                     | [downloads statistics](./statistics/README.md)                                           | Display the number of downloads per day.                                             |
+| **Signer registrations monitoring**          | [registrations-monitoring](./registrations-monitoring/README.md)                         | Gather aggregated data about signer registrations (versions, stake, ...).            |
+| **Recompute certificates hash**              | [recompute-certificates-hash](./recompute-certificates-hash/README.md)                   | Recompute the certificates hash of an aggregator.                                    |
+| **Fix terraform lock**                       | [terraform-lock](./terraform-lock/README.md)                                             | Fix a terraform lock in CD workflows.                                                |
+| **Manage SSH access to infrastructure**      | [ssh-access](./ssh-access/README.md)                                                     | Manage SSH access on the VM of the infrastructure for a user.                        |
+| **Upgrade VM of infrastructure**             | [upgrade-vm](./upgrade-vm/README.md)                                                     | Upgrade the VM of the infrastructure of a Mithril network.                           |
+| **Create test Docker distribution**          | [test-docker-distribution](./test-docker-distribution/README.md)                         | Create a custom test Docker distribution.                                            |
+| **Deploy a test network manually**           | [test-deploy-network](./test-deploy-network/README.md)                                   | Manually deploy a test distribution to a test Mithril network.                       |
+| **Publish crates to crates.io manually**     | [manual-publish-crates](./manual-publish-crates/README.md)                               | Manually publish Rust crates to crates.io.                                           |
+| **Publish packages to npm manually**         | [manual-publish-npm](./manual-publish-npm/README.md)                                     | Manually publish packages to npm registry.                                           |
+| **Client multi-platform test**               | [test-client-multiplatform](./test-client-multiplatform/README.md)                       | Run multi-platform client CLI binaries, docker and WASM package tests.               |
+| **Maintain the networks configuration file** | [maintain-networks-configuration-file](./maintain-networks-configuration-file/README.md) | Maintain the `networks.json` file                                                    |
+| **Aggregator metrics**                       | [aggregator-metrics](./aggregator-metrics/README.md)                                     | Display aggregator daily metrics.                                                    |
+| **Upgrade Cardano node**                     | [upgrade-cardano-node](./upgrade-cardano-node/README.md)                                 | Upgrade the Cardano node of a Mithril network.                                       |
+| **Cardano node warmup**                      | [warmup-cardano-node](./warmup-cardano-node/README.md)                                   | Warm up a Cardano node from a Mithril snapshot to avoid ledger replay downtime.      |
+| **Prepare Cardano node artifacts**           | [prepare-cardano-node-artifacts](./prepare-cardano-node-artifacts/README.md)             | Prepare and publish artifacts for an unreleased Cardano node version.                |
+| **Cardano Docker bundle**                    | [cardano-docker-bundle](./cardano-docker-bundle/README.md)                               | Build and publish a Docker image bundling Cardano node with Mithril.                 |
+| **Update circuits verification keys**        | [update-circuit-keys](./update-circuit-keys/README.md)                                   | Update the circuits verification keys after an intentional circuit modification.     |
+| **Circuit verification key registry**        | [circuit-key-registry](./circuit-key-registry/README.md)                                 | Publish, rotate and revoke circuit verification keys in the genesis-signed registry. |