Skip to content

Sync vendored ComputeRequest.Hash with confidential-compute: Version only for legacy#2171

Open
nadahalli wants to merge 2 commits into
mainfrom
tejaswi/sync-computerequest-hash-version
Open

Sync vendored ComputeRequest.Hash with confidential-compute: Version only for legacy#2171
nadahalli wants to merge 2 commits into
mainfrom
tejaswi/sync-computerequest-hash-version

Conversation

@nadahalli

Copy link
Copy Markdown
Contributor

confidential-compute #360 made Version conditional in ComputeRequest.Hash: it is hashed only when Version == ServiceConfidentialComputeVersionLegacy, as CC migrates Version out of the hash. The vendored copy here still hashed Version unconditionally.

They agree today (version 0.0.6 == legacy), so relay-DON F+1 verification works. But once the enclave moves past the legacy version, CC stops hashing Version while this copy keeps hashing it, so the relay would compute a different ComputeRequest.Hash than the Workflow DON signed and silently reject every valid secrets request.

Mirror the conditional and vendor the legacy-version const. PRIV-433.

confidential-compute #360 made Version conditional in ComputeRequest.Hash (hashed only
when Version == ServiceConfidentialComputeVersionLegacy, as it migrates Version out of
the hash). The vendored copy here still hashed Version unconditionally. They agree today
(version 0.0.6 == legacy), but would diverge the moment the enclave moves past the legacy
version, silently breaking relay-DON F+1 verification. Mirror the conditional and vendor
the legacy-version const.
@nadahalli nadahalli requested a review from a team as a code owner June 18, 2026 15:08
Copilot AI review requested due to automatic review settings June 18, 2026 15:08
@github-actions

Copy link
Copy Markdown

👋 nadahalli, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

@github-actions

github-actions Bot commented Jun 18, 2026

Copy link
Copy Markdown

📊 API Diff Results

No changes detected for module github.com/smartcontractkit/chainlink-common

View full report

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the vendored ComputeRequest.Hash implementation in chainlink-common to match the behavior in confidential-compute, where the Version field is hashed only for the legacy confidential compute version. This prevents future hash divergence (and resulting signature verification failures) once enclaves move beyond the legacy version.

Changes:

  • Added a vendored legacy version constant and made ComputeRequest.Hash conditionally include Version only when it equals that legacy value.
  • Updated the test fixture to use the legacy version by default.
  • Added a unit test asserting that non-legacy Version values do not affect the hash, while the legacy version remains bound into the hash.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
pkg/capabilities/v2/actions/confidentialrelay/computerequest.go Conditioned Version hashing on a vendored legacy version constant to stay compatible with confidential-compute.
pkg/capabilities/v2/actions/confidentialrelay/computerequest_test.go Updated sample request to legacy version and added a test to lock in the conditional hashing behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants