Adds 8 new hardened checkpoints at heights 2206500-2214400, verified
against the canonical chain. Closes the 8,400-block unverified gap
between the last hardcoded checkpoint (2206004) and the live tip
(2,214,476).
Without these, a fresh node syncing from zero with NO snapshot has
zero finality protection above height 2206004. A peer feeding fork
blocks at heights 2206005-2214400 could trick the IBD node into
accepting a divergent chain, because CheckHardened() only fires at
the exact heights in mapCheckpoints.
With continuous pins every 1000 blocks, any divergence >1000 blocks
is rejected at AcceptBlock time with DoS=100, protecting from-zero
sync against low-trust forks.
Two bugs in the anti-spam heuristic at src/main.cpp:
1. Inverted comparison: condition was bnNewBlock > bnRequired paired with
"too little proof-of-stake" error message. The condition triggers when
the block has MORE difficulty than required (harder than allowed),
but the message claims the OPPOSITE. Honest blocks during legitimate
time-warps (fork recovery, chain catchup) get mislabelled.
2. Misbehaving(100) was a single-shot instant ban: banscore threshold
defaults to 100, so the FIRST anti-spam violation triggered a 24-hour
ban on every honest peer feeding us blocks during fork divergence.
This is what caused the 2026-06-23 DNS2 clearnet-fork incident:
peers got banned before we could determine which chain was canonical.
Fix: condition now correctly says bnNewBlock < bnRequired (block too
easy = reject), and Misbehaving score dropped from 100 to 5 (needs
~20 anti-spam violations before the 100 banscore threshold). Anti-spam
is a soft signal, not a hard ban trigger.
GCC 11+ on Intel CI runners (Skylake-X, Ice Lake, Sapphire Rapids)
emits AVX-512/AVX10 instructions for std::string / memcpy inlining
that crash with SIGILL on AMD EPYC and older Intel without those
extensions. Root cause: libstdc++ is statically linked into the
binary, so the build host's instruction set becomes a hard runtime
requirement.
The CI binary crashed immediately on DNS2/DNS3 (AMD EPYC Milan) with:
traps: trianglesd[...] trap invalid opcode ip:...e432 error:0
in trianglesd[...+af3000]
Disassembly of the crash site (file offset 0x15b432):
62 f1 7f 08 6f 41 ff vmovdqu8 -0x10(%rcx), %xmm0
This is an AVX10/AVX-512 instruction emitted inside
std::basic_string::basic_string (statically linked libstdc++).
Fix: -march=x86-64-v2 -mtune=generic for all Linux x86_64 builds.
v2 baseline (SSE4.2 + POPCNT + CMPXCHG16B) is from 2009 Nehalem and
supported on every x86_64 CPU we ship to. Override-able via
-DCMAKE_X86_64_BASELINE=OFF if a CPU-specific build is needed.
Adds v3 snapshot format that includes the last 5000 PoS block
(prevoutStake, nStakeTime) pairs so a snapshot-loaded node has its
stake-collision set restored without walking the block index.
v2 readers still load v3 snapshots (the extra field is past numBlocks
and the loader checks version >= 3 to read numStakeSeen).
Bumps version to 6.1.1.
SQLite wallet (default), RocksDB chaindb (default), Boost removal
from common link, I2P startup performance fix (180s→27ms).
Migration is automatic and non-destructive:
- Wallet: BDB → SQLite on first open (original preserved as .bdb.bak)
- ChainDB: LevelDB → RocksDB on next start (via -chaindb flag)
cpp20 modernization made SQLite the default wallet backend
(find_package(SQLite3 REQUIRED)). The windows-qt job got it
transitively via Qt5-base, but the daemon job had no such
dependency → CMake configure failure.
The cpp20 rebase removed all Boost includes from init.cpp but left
this orphaned using-directive. It compiled on Linux daemon (I2P
embedded transitively provides the boost namespace) but broke every
Qt/Windows/macOS build in CI with: 'boost' is not a namespace-name.
i2p::api::StartI2P() calls NetDb::Start() which triggers Reseed() — a
blocking HTTPS download from public I2P reseed servers. On first run
(empty netDb), this blocks for up to 180s, freezing the GUI splash
screen on "Starting embedded I2P router..." indefinitely.
Fix: Move StartI2P + client::context.Start + SOCKS/SAM readiness polling
into a detached background thread. InitI2P (fast, <1s) remains
synchronous. The main init thread proceeds immediately — Tor-only mode
works while I2P bootstraps asynchronously (1-5 min for first run).
Verified: i2p_start startup perf dropped from 180s+ to 27ms on first run
with empty netDb. Reseed + tunnel building continues in background.
Live-validation of the CWalletDB rebase (preserved snapshot wallet from
DNS2's 2026-04-23 recovery, copied to /tmp/cpp20-validate, run with the
new build) revealed that after MaybeMigrateBerkeleyWalletToSQLite()
converts wallet.dat from Berkeley DB to SQLite, the next block of init
code still calls bitdb.Verify() on the now-SQLite file. BDB cannot open
a SQLite file, so Verify returns RECOVER_FAIL, which init treats as a
fatal InitError ("wallet.dat corrupt, salvage failed"). The migration
itself succeeds and produces a valid SQLite wallet.dat + a
wallet.dat.bdb.bak copy of the original, but the daemon refuses to
continue past Step 5.
Fix: snapshot IsSQLiteFile(walletPath) AFTER the migration hook, then
gate the entire BDB-only Step 5 path (bitdb.Open, salvagewallet,
zapwallettxes, bitdb.Verify) on the snapshot. Once the wallet is SQLite
— whether by migration or because it was born that way — the BDB
verify/salvage steps are skipped; SQLiteDatabase::Open() already runs
PRAGMA integrity_check during connection setup, so the wallet is
validated against the SQLite schema before any handle is constructed.
The verify_db performance log now includes wallet_is_sqlite=N for
observability.
Validation: full migration cycle completed in the test datadir, RPC
getwalletinfo/getaddressesbyaccount returned valid data matching the
pre-migration BDB wallet exactly (5 unique HD-derived addresses,
keypoolsize=101, keypoololdest=1781772890, walletversion=60000).
Move CWalletDB off the Berkeley CDB base class and onto the typed batch
seam introduced by walletdb-batch.h / walletdb-{factory,sqlite}.{h,cpp}.
Build seam
----------
* CWalletDB now derives from CWalletBatchTyped. The typed Read/Write/
Erase/Exists templates come from the seam; their bodies (WriteTx,
WriteKey, WriteMasterKey, ReadPool, WriteSetting, ...) are unchanged
because only the base class swapped — the call signatures resolve to
the same templates.
* CWalletBatchTyped takes ownership of the WalletDatabase so the
underlying connection outlives any batch issued by it (SQLiteBatch
holds a reference, not a value). The two-phase Open() pattern lets
CWalletDB hand the freshly opened database to the base class after
MakeWalletDatabase() returns.
* MakeWalletDatabase (walletdb-factory.cpp) routes -walletdb=sqlite to
SQLiteDatabase, returning nullptr with a clear error for the
unfinished Berkeley branch. The CWalletDB constructor surfaces that
error string on failure.
Cursor sites (the only Berkeley-specific call sites)
---------------------------------------------------
Three sites used GetCursor()/ReadAtCursor() directly:
* LoadWallet — full scan, now uses StartCursor()/NextRecord()
* ListAccountCreditDebit — used DB_SET_RANGE + DB_NEXT loop; replaced
with full keyspace scan + filter-in-loop (SQLite cursor does not
support keyed range seeks). Behaviour matches Berkeley: terminates
when strType changes or, in single-account mode, when
acentry.strAccount differs.
* ZapWalletTx — moved to BerkeleyZapWalletTx (see below) because it
operates on raw Berkeley Db/Dbc/Dbt now that CWalletDB is on the
seam.
The 3 unused public methods on the old CWalletDB (GetAtCursor /
GetTxnCursor / GetAtActiveTxn) had no callers outside walletdb.{h,cpp}
(verified by grep) and were removed.
Berkeley-only escape hatches
----------------------------
Recover(CDBEnv&,...) and ZapWalletTx(...) became BerkeleyRecoverWallet
and BerkeleyZapWalletTx in a new walletdb-recover.{h,cpp} pair. They
operate directly on DbEnv/Db/Dbc/Dbt because CDB's members are
protected (free functions cannot use the wrapper). The recovery logic
duplicates a BDB-only ReadKeyValue variant locally to avoid pulling
the typed batch seam into a Berkeley-only file.
Init.cpp uses these via:
* -salvagewallet -> BerkeleyRecoverWallet(bitdb, ..., fOnlyKeys=true)
* -zapwallettxes -> BerkeleyZapWalletTx(...)
* bitdb.Verify -> BerkeleyRecoverWallet as the recover callback
Wallet migration hook
---------------------
After the Berkeley verify/salvage/zap steps and before CWalletDB is
opened for the live wallet, init.cpp now calls:
if (ResolveWalletDbKind() == SQLite &&
!IsSQLiteFile(walletPath))
MaybeMigrateBerkeleyWalletToSQLite(walletPath, err)
The migration code (walletmigrate.{h,cpp}) is unchanged — it opens a
private Berkeley environment over the wallet directory, copies every
record verbatim (raw key/value bytes) into a fresh SQLite file,
verifies the row count, then atomically renames the BDB original to
"<name>.bdb.bak" and the SQLite file into place. On any failure the
BDB original is left exactly as it was. Errors surface through
InitError so the daemon refuses to start with a corrupt wallet rather
than silently falling back to Berkeley.
No working Berkeley fallback
----------------------------
MakeWalletDatabase returns nullptr for the Berkeley branch, so
-walletdb=bdb no longer opens a working wallet through the seam. This
is intentional for this release — the migration hook handles existing
BDB wallets at first startup, after which the on-disk file is SQLite
and the BDB code path becomes pure recovery glue.
Header fallout
--------------
walletdb.h no longer pulls in db.h (which would drag <db_cxx.h> into
every TU that includes the wallet API). Forward decls added for
CWalletTx, CBlockLocator, CWallet, CPubKey, CScript, CMasterKey,
uint160, uint256. nWalletDBUpdated is now extern-declared in
walletdb.h and defined in db.cpp (was previously declared in db.h).
Validation
----------
Build: GREEN with USE_TOR_EMBEDDED=ON USE_I2P_EMBEDDED=ON. 6 binaries:
trianglesd, triangles-cli, test_triangles, test_chaindb_runtime,
test_chaindb_equivalence, test_snapshotnet.
Tests: 107/107 + 10/10 + 5/5 = byte-identical to the 5d9da84
baseline. wallet_tests and accounting_tests inside test_triangles now
exercise the SQLite path for the first time — their pass is the
de-facto wallet-migration validation at the test-suite level.
Modernizes triangles.conf parsing to use plain stdlib instead of
boost::program_options::detail::config_file_iterator.
Supports the syntax that actual triangles.conf files use:
- key=value or key = value (whitespace around = is ignored)
- # comments and blank lines are skipped
- Surrounding double quotes are stripped from values
- Same InterpretNegativeSetting semantics
- Command-line settings still take precedence (don't overwrite existing)
Intentionally NOT supported (different from Boost):
- Backslash line continuations
- Escape sequences inside quoted values
- Section headers ([section])
After this change, triangles_common no longer uses Boost.ProgramOptions
directly. The Boost.ProgramOptions link inside the USE_I2P_EMBEDDED block
remains because i2pd-src/libi2pd/Config.cpp uses it internally.
Verified:
- Build with -DUSE_I2P_EMBEDDED=ON succeeds
- Build with -DUSE_I2P_EMBEDDED=OFF succeeds
- Without i2p, ldd on trianglesd shows NO libboost_program_options dep
Merge left StopI2P() (duplicated StopEmbeddedI2P), StartI2P(),
CI2PProcess::GetInstance(), and I2P_DEFAULT_SAM_PORT references from
the SAMI-PC process-based I2P. Replaced with the v6 embedded I2P API:
- shutdown: single StopEmbeddedI2P() (was called twice plus StopI2P)
- startup: single StartEmbeddedI2P() which reads its own args
- removed manual SAM host/port resolution (StartEmbeddedI2P handles it)
Merge left residual references to the SAMI-PC process-based I2P API
(CI2PSession, fI2P) in files that now compile against the v6 embedded
I2P (CI2PEmbedded). Fixed:
- net.cpp ConnectNode: removed fI2P/CI2PSession blocks, restored
v6 SOCKS-proxy connection path (I2P routing handled in netbase)
- CMakeLists.txt: removed i2p.cpp/i2p_process.cpp from build (not
part of embedded I2P; kept in tree as reference only)
- rpcnet.cpp: CI2PSession → CI2PEmbedded (IsRunning/GetI2PAddress)
- rpcwallet.cpp: same API migration
- init.cpp: same API migration for startup address print
Merges the HD wallet work and process-based I2P integration from the
SAMI-PC hd-wallet branch into v6 master. Conflict resolution keeps
v6 embedded I2P (CI2PEmbedded) as primary, includes process-I2P
files for reference, preserves FastImportBlockFile() from hd-wallet,
and keeps v6 version numbers (6.0.0) and wAddressStack Qt layout.
i2pHostname was cleared on Start() but never populated, so
GetI2PAddress() always returned empty and the Qt status bar never
showed the I2P address even when the router was running.
Now queries i2p::context.GetRouterInfo().GetIdentHash().ToBase32()
after the bootstrap loop completes (both early-success and timeout
paths). The address appears as <hash>.b32.i2p in the status bar.
libboost_system-mt.a doesn't exist on MSYS2 (header-only in newer
Boost). find_library auto-discovers the actual filenames and skips
any that don't exist. Resolves both the missing-file error and the
naming ambiguity.
MSYS2 MinGW doesn't create CMake imported targets for Boost, so
Boost::filesystem etc. silently don't link. i2pd's own Makefile.mingw
solves this by referencing full paths like /mingw64/lib/libboost_*.a.
We do the same — auto-detect MINGW_PREFIX (/mingw64) and link the
exact .a files for boost_filesystem, boost_program_options,
boost_system, openssl, and zlib.
The linker needs to see i2pd archives, then Boost/zlib to resolve
their symbols, then i2pd archives AGAIN to resolve any remaining
references. Added raw -l fallbacks for MinGW where Boost:: CMake
imported targets may not exist even though libs are installed.
Windows: Replace --start-group/--end-group (CMake mis-orders them
with Ninja generator) with double-listing of i2pd static archives.
Linker resolves circular deps in two left-to-right passes.
macOS: Boost 1.90 via Homebrew doesn't provide filesystem/system as
separate COMPONENTS. Use OPTIONAL_COMPONENTS so find_package doesn't
fail, then guard the target_link_libraries with if(TARGET Boost::...).
The Boost::filesystem and Boost::system targets don't exist unless
find_package(Boost COMPONENTS ...) explicitly lists them. I2P's link
section references them but they were never found, breaking all
platforms.
libi2pd.a references boost::filesystem::detail::status, exists,
create_directories, etc. These are in boost_filesystem, which the
I2P link section was missing. Added Boost::filesystem and
Boost::system.
Windows: MinGW's rpcndr.h #defines 'interface' as 'struct' (COM
support). i2pd's I2CP.h uses it as a parameter name, causing
parse errors. Add #undef interface before i2pd includes.
macOS: i2pd Makefile.homebrew hardcodes openssl@3.5 but Homebrew
installs openssl@3. build-libi2pd.sh now detects the actual path
and passes SSLROOT=<path> to make, which overrides the Makefile
assignment.
Adds libi2pd static library build step and -DUSE_I2P_EMBEDDED=ON to
all 5 build jobs (Windows Qt, Windows daemon, Linux Qt, Linux daemon,
macOS). Previously I2P compiled as stubs — wallet shipped without
.b32.i2p address support. macOS uses HOMEBREW=1 for correct i2pd
Makefile include paths.
The CF Open overload had the same DB** vs unique_ptr<DB>* API drift
as the non-CF version, but was calling rocksdb::DB::Open directly
instead of through the SFINAE wrapper. On MSYS2 MinGW (Windows CI)
the unique_ptr-only overload causes a compile error. Added
OpenRocksDBCF with the same int/long SFINAE pattern.
Replaces the single label_onion item inside the wStatusBar layout with a
vertical group (wAddressStack) containing two rows:
row 1: [I2P] <.b32.i2p address>
row 2: [Tor] <.onion address>
Both address labels now copy their text to the clipboard on click via
the existing eventFilter pattern (extended to handle labelI2PAddress in
addition to labelOnionAddress). The label_i2p, label_i2p_icon, and new
label_tor_icon widgets live in mainwindow.ui so they share the same
layout stretch and ordering as the rest of the status bar; the
QWidget/QVBoxLayout/QHBoxLayout nesting keeps the stack compact and
centered on the existing 37px -> 52px status bar height bump.
Tooltips updated to "Click to copy" for both addresses (no longer
"Selectable - right-click to copy") to match the actual behaviour.
Tooltip wording for [Tor] chip matches the existing [V3] chip.
Add Ed25519 signature support to snapshot manifests. Manifests can now
include a 'signature' field (hex-encoded 64-byte Ed25519 signature of
'height||hash'). VerifyManifest checks it against a compiled-in pubkey.
- Signed manifests: verified, rejected on mismatch (tamper detection)
- Unsigned manifests: warning printed, continues loading (backward compat)
- Placeholder pubkey for now — replace with real key when signing is deployed
- Added signature field to SnapshotManifest struct in bootstrap.h
This closes the 'loading WITHOUT signature verification' security gap
that was printed during every bootstrap download.
Add .b32.i2p address display alongside existing Tor .onion address
in the wallet status bar. Purple [I2P] indicator shows router state:
- Purple: I2P active with valid destination
- Yellow: router running, building tunnels
- Hidden: I2P not active
Updates every 5s via timer, parallel to updateOnionAddress().
BIP152 Compact Blocks (main.cpp, net.cpp, protocol.h):
- SipHash-2-4 short IDs (48-bit) for transaction identification
- Compact block relay with mempool reconstruction
- Merkle root verification before acceptance
- Graceful fallback to full block on any mismatch
- Collision detection for ambiguous short IDs
RocksDB Column Families (txdb-rocksdb.cpp/h):
- 5 CFs: default, blockindex, txindex, utxo, addrindex
- Per-CF tuning: UTXO optimized for point lookups, addrindex for scans
- Backward-compatible: falls back to default CF for pre-migration data
- Prefix-based routing in ReadRaw/WriteRaw/EraseRaw/ExistsRaw
Fork Detector (main.cpp, net.cpp, net.h):
- Background thread checks local tip vs peer median every 60s post-IBD
- Alerts on divergence > forkthreshold (default 5 blocks)
- Optional auto-rebuild trigger on severe divergence
Cross-Network Tor↔I2P Discovery (net.cpp, init.cpp):
- I2P seed addresses loaded into addrman alongside onion seeds
- Address relay bridges .onion and .b32.i2p between networks
- IsI2PAddr/IsOnionAddr helpers for network-type detection
Configurable Outbound Connections (net.cpp, init.cpp):
- -maxoutboundconnections flag (range 4-32, default 8)
Mempool Fee-Priority Boost (miner.cpp):
- 2x fee weight in PoS block assembly for higher staking rewards
SAM v3 Direct Streaming (i2p/i2p_embedded.cpp/h):
- CI2PSamSocket class with full SAM v3 protocol
- SESSION CREATE + STREAM CONNECT handshake
- Factory method on CI2PEmbedded for native I2P connections
- SAM bridge readiness check in bootstrap loop
RocksDB's install-shared writes a rocksdb.pc with both:
-isystem third-party/gtest-1.8.1/fused-src
-std=c++17
The previous PR fix scrubbed the bad include path but left -std=c++17.
pkg-config consumers inherit that flag via INTERFACE_COMPILE_OPTIONS,
which propagates to CMake imported targets as a compile option.
Result: Triangles' configure sets CXX_STANDARD 20, but the compile
command line ends up with '-std=c++20 ... -std=c++17' (rocksdb.pc's
flag comes last and wins). GCC reports:
error: defaulted 'bool operator!=...' only available with
'-std=c++20' or '-std=gnu++20'
Strip -std=c++17 from Cflags. Triangles sets its own standard via
CMake; the flag from rocksdb.pc was never useful anyway (consumers
should choose their own standard).
This bug only surfaced now because we replaced librocksdb-dev 6.11.4
with a locally-built RocksDB 8.9.1 — the system package's .pc didn't
have this -std flag, the freshly-built one does.
The previous sed expression had \${prefix} in a double-quoted string,
which bash was expanding to a literal prefix variable lookup. With
`set -euo pipefail` and unbound variables causing exit, the entire
script aborted right after `make install-shared`, before ldconfig
and the sanity check ran.
Use single quotes around the sed expression so bash leaves the
\${prefix} alone for sed to interpret.
Discovered via:
scripts/ci/build-rocksdb.sh: line 57: prefix: unbound variable
RocksDB's Makefile unconditionally appends `-isystem third-party/
gtest-1.8.1/fused-src` to the generated rocksdb.pc Cflags. That path
is relative to the build directory, so when the installed .pc file
ends up in /usr/local/lib/pkgconfig/, Triangles' CMake configure
errors out with:
CMake Error in src/CMakeLists.txt:
Imported target 'PkgConfig::RocksDB' includes non-existent path
'third-party/gtest-1.8.1/fused-src'
Modern CMake (>= 3.27) refuses imported targets with relative paths
in INTERFACE_INCLUDE_DIRECTORIES. Replace the bad flag with an
absolute path to the installed include dir so pkg-config consumers
get a real on-disk path.
Discovered while debugging the second CI failure on PR #10
(Configure succeeded but generation failed because PkgConfig::RocksDB
referenced a path that didn't exist).
Same fix as build-all.yml: lint.yml's clang-tidy job also installed
librocksdb-dev from Ubuntu 22.04's apt (6.11.4), which CMakeLists.txt
now refuses to configure against. Drop the apt package, add the
shared scripts/ci/build-rocksdb.sh step.
The previous sanity check matched against `librocksdb.so.${ROCKSDB_VERSION}`
(full semver like 8.9.1), but `ldconfig -p` only prints major.minor
(e.g. `librocksdb.so.8.9`). The library was correctly installed but
the check failed, killing the CI job before Configure could run.
Check the versioned file on disk first (definitive), then ldconfig with
the major.minor pattern (sanity for runtime linker). Both must pass.
Discovered when investigating CI failure on PR #10.
sami7777
Krystie