From 193d35f4a008385a966abf3589787d255c61c42d Mon Sep 17 00:00:00 2001 From: GeorgianDusk Date: Mon, 14 Sep 2026 14:13:57 +0400 Subject: [PATCH 1/3] =?UTF-8?q?Add=20developer=20update=20for=20September?= =?UTF-8?q?=207=E2=80=9314,=202026?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../developer/2026-09-07-to-2026-09-14.md | 73 +++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 src/content/docs/updates/developer/2026-09-07-to-2026-09-14.md diff --git a/src/content/docs/updates/developer/2026-09-07-to-2026-09-14.md b/src/content/docs/updates/developer/2026-09-07-to-2026-09-14.md new file mode 100644 index 0000000..e2b8e98 --- /dev/null +++ b/src/content/docs/updates/developer/2026-09-07-to-2026-09-14.md @@ -0,0 +1,73 @@ +--- +title: "September 7–14, 2026" +description: "Verified Dusk engineering progress from the previous seven days, with disclosure-safe summaries and public source links." +sidebar: + hidden: true +--- + +[← Developer Updates](/updates/developer/) + +This update covers qualifying public-repository engineering activity during the previous seven days. Links to public changes appear directly beside the summaries they support. + +## Typed-data + +Added a shared typed-data package and expanded signing rules, compatibility tests and integration exports for consistent wallet and application behavior. +- Specified complete, digest-matching approval details before signing, including schema, defaults and original text, with refusal when full disclosure was unavailable. ([PR #5](https://github.com/dusk-network/typed-data/pull/5)) +- Separated signer resource policy into its own import and exposed unchanged BLS signing fixtures through public package paths. ([PR #3](https://github.com/dusk-network/typed-data/pull/3)) +- Required explicit chain and origin policy for signature verification and returned structured results containing the verified digest and outcome. ([PR #1](https://github.com/dusk-network/typed-data/pull/1)) +- Pinned typed-data signatures to Dusk's V2 scheme and added cross-language byte-for-byte signing tests against Rust, including controls for incorrect scheme selection. ([Commit 913fd04e](https://github.com/dusk-network/typed-data/commit/913fd04e9f21650cce8bd69d592600b0da6a1188), [Commit d043e242](https://github.com/dusk-network/typed-data/commit/d043e242fde01428c29236a08bf8dc6a1700514a), [Commit c20140f7](https://github.com/dusk-network/typed-data/commit/c20140f7a223c59f40d3ea65ab1b09bea910f5ca), [Commit 95f49264](https://github.com/dusk-network/typed-data/commit/95f49264eb3e1ff380daba63b5d65ee00c6a7f3b)) +- Extracted the shared protocol package for npm and JSR, preserving implementation history and recording its repository metadata and changelog. ([Commit b7de57a6](https://github.com/dusk-network/typed-data/commit/b7de57a65fbb96b6c3b9827a92d3d4a70c6a15ac), [Commit 975f6a1d](https://github.com/dusk-network/typed-data/commit/975f6a1df12f424ffc1d4fc315a3a2bd8463005f), [Commit efb5e131](https://github.com/dusk-network/typed-data/commit/efb5e1315a050f15cf4e2f52f1732226e6d23566)) +- Specified validation of referenced types, tested unused-type handling and aligned error reporting across hashing entry points when inputs violated multiple rules. ([Commit 2f0940e8](https://github.com/dusk-network/typed-data/commit/2f0940e8debd86b31bdb95247d5f4c94ee6e2706), [Commit 1b3a0f0f](https://github.com/dusk-network/typed-data/commit/1b3a0f0f445a670713e02c741c897fae09c4d6c7), [Commit 59adae9e](https://github.com/dusk-network/typed-data/commit/59adae9ea3f3d2420ece02406bf05bfa44350f48)) +- Pinned cryptographic dependencies to exact versions so fresh installs retained the behavior checked by the signing fixtures. ([Commit 3af197df](https://github.com/dusk-network/typed-data/commit/3af197df8dbb6cae5fb1fc8ee486c59a8f50bf2f)) +- Reused frozen-corpus checks and shared byte helpers while retaining digest, encoding and rejection boundaries. ([Commit 5e960d21](https://github.com/dusk-network/typed-data/commit/5e960d2129ccab1e65870b4a87c9297fb7547549)) +- Rejected ambiguous field names and invalid Unicode encodings, and aligned optional API exports across npm and JSR. ([Commit 5a257cd5](https://github.com/dusk-network/typed-data/commit/5a257cd548f1b59f08fad145290e8defbb64e16f)) + +## Safe + +Strengthened SAFE's cryptographic sponge lifecycle and input handling while preserving valid encryption output. +- Removed whole-sponge equality from the Rust API and documented migration for callers that compared internal state. ([PR #40](https://github.com/dusk-network/safe/pull/40)) +- Made failed or cleared sponge instances unusable, tightened input-pattern limits and added cleanup for growing output buffers. ([PR #38](https://github.com/dusk-network/safe/pull/38)) +- Returned a consistent error for empty ciphertext instead of panicking when arithmetic overflow checks were enabled. ([PR #36](https://github.com/dusk-network/safe/pull/36)) + +## Plonk + +Strengthened proof and verifier decoding, with clearer input checks and additional tests for serialized circuit limits. +- Replaced handwritten structural archive checks for proofs and verifier keys with generated validation, preserving their stored format and required semantic checks. ([PR #972](https://github.com/dusk-network/plonk/pull/972)) +- Derived compressed-circuit size limits from their encoding components and tested exact-capacity boundaries, malformed headers and over-capacity rejection. ([PR #969](https://github.com/dusk-network/plonk/pull/969)) +- Checked serialized lengths before integer conversion and reported arithmetic overflow as invalid data, preserving distinct errors for genuinely short inputs. ([PR #968](https://github.com/dusk-network/plonk/pull/968)) +- Validated verifier input positions and size metadata, rejecting duplicate, unordered or out-of-range entries and undeclared trailing bytes. ([PR #961](https://github.com/dusk-network/plonk/pull/961)) + +## Jubjub + +Improved Jubjub scalar and curve-point validation while preserving supported encodings. +- Rejected noncanonical archived scalar values and added fixed layout tests for scalar and point representations in both byte orders. ([PR #170](https://github.com/dusk-network/jubjub/pull/170)) +- Corrected integer carry handling when recoding scalars for multiplication, with independent reconstruction tests and a fixed compatibility example. ([PR #171](https://github.com/dusk-network/jubjub/pull/171)) +- Checked extended curve-point coordinates directly, rejecting invalid representations while retaining acceptance of valid equivalent points. ([PR #167](https://github.com/dusk-network/jubjub/pull/167)) + +## Bls12\_381 + +Added raw-point decoding checks to reject invalid G1 curve points before accepting serialized data. ([PR #179](https://github.com/dusk-network/bls12_381/pull/179)) + +## Duskevm-genesis + +Added a DuskEVM bundle manifest that checked artifact hashes, matching chain settings and compatible component versions before release-candidate acceptance. ([PR #15](https://github.com/dusk-network/duskevm-genesis/pull/15)) + +## PLONK and Dusk Merlin + +Updated PLONK's transcript dependency and Dusk Merlin's maintenance path while retaining tested compatibility with existing proof formats. +- Adopted Dusk Merlin 4.0.0 in PLONK and added migration guidance, preserving tested V2/V3 proof compatibility while documenting Rust 1.96.1 and little-endian-only support. ([PR #967](https://github.com/dusk-network/plonk/pull/967), [PR #14](https://github.com/dusk-network/merlin/pull/14)) +- Documented maintenance commands and verification against fixed upstream transcript and random-number test vectors. ([PR #12](https://github.com/dusk-network/merlin/pull/12)) +- Added cleanup for temporary randomness during normal returns and error unwinding, preserving the transcript sequence. ([PR #13](https://github.com/dusk-network/merlin/pull/13)) + +## Docs + +Expanded developer progress coverage and refocused the privacy overview on Dusk's capabilities and selective disclosure. +- Updated the privacy overview around Phoenix, Hedger, Citadel 2 and XSC, with links to component documentation and questions about verification and auditing. ([PR #149](https://github.com/dusk-network/docs/pull/149)) +- Added the August 31 to September 7 developer update, placing source links beside the changes they support and its entry first in the index. ([PR #148](https://github.com/dusk-network/docs/pull/148)) + +## Poseidon252 + +Expanded Poseidon encryption compatibility tests to detect changes in exact ciphertext output across short and longer messages. +- Added fixed ciphertext examples and independent decryption checks, including a five-element message spanning more than one sponge input block. ([PR #299](https://github.com/dusk-network/Poseidon252/pull/299), [PR #297](https://github.com/dusk-network/Poseidon252/pull/297)) + +[← Back to Developer Updates](/updates/developer/) From 233056a43540cd186fb726e01bcab5189650de75 Mon Sep 17 00:00:00 2001 From: GeorgianDusk Date: Mon, 14 Sep 2026 14:14:04 +0400 Subject: [PATCH 2/3] =?UTF-8?q?Index=20the=20September=207=E2=80=9314=20de?= =?UTF-8?q?veloper=20update?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/content/docs/updates/developer/index.mdx | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/content/docs/updates/developer/index.mdx b/src/content/docs/updates/developer/index.mdx index d4d2fe6..8ee3cd1 100644 --- a/src/content/docs/updates/developer/index.mdx +++ b/src/content/docs/updates/developer/index.mdx @@ -5,6 +5,10 @@ description: Browse periodic Dusk engineering updates by publication date and co Developer updates summarize engineering work over a stated interval. Updates are listed newest first. +## [September 7–14, 2026](/updates/developer/2026-09-07-to-2026-09-14/) + +Verified engineering progress across 9 public repositories. + ## [August 31–September 7, 2026](/updates/developer/2026-08-31-to-2026-09-07/) Verified engineering progress across 11 public repositories. From e9feb84d7c2524f8057e17d6e52d94f964ab39c2 Mon Sep 17 00:00:00 2001 From: GeorgianDusk Date: Mon, 14 Sep 2026 18:37:40 +0400 Subject: [PATCH 3/3] Clarify private pull request exclusion in developer update --- src/content/docs/updates/developer/2026-09-07-to-2026-09-14.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/content/docs/updates/developer/2026-09-07-to-2026-09-14.md b/src/content/docs/updates/developer/2026-09-07-to-2026-09-14.md index e2b8e98..af5a283 100644 --- a/src/content/docs/updates/developer/2026-09-07-to-2026-09-14.md +++ b/src/content/docs/updates/developer/2026-09-07-to-2026-09-14.md @@ -7,7 +7,7 @@ sidebar: [← Developer Updates](/updates/developer/) -This update covers qualifying public-repository engineering activity during the previous seven days. Links to public changes appear directly beside the summaries they support. +This update covers qualifying public-repository engineering activity during the previous seven days. Private pull requests are excluded for security reasons. Links to public changes appear directly beside the summaries they support. ## Typed-data