build(solidity): remove external sortition dependencies

.github/workflows/contracts-ecdsa.yml

@@ -209,20 +209,9 @@ jobs:
   # intentional, regenerate the baseline locally and commit
   # solidity/ecdsa/export-baseline.sha256 alongside the change.
   #
-  # Note: the manifest covers the full export/ tree, including artifacts
-  # of external dependencies deployed onto the local test network
-  # (@keep-network/random-beacon, @keep-network/sortition-pools,
-  # @openzeppelin/*, @thesis/*, @threshold-network/*). This is safe from
-  # upstream-publish flakiness: install-yarn-deps runs `yarn install
-  # --immutable` against the committed yarn.lock, which pins each of
-  # these to a concrete resolved version (e.g. `@keep-network/
-  # random-beacon@npm:development` resolves to a fixed `2.1.0-dev.18` in
-  # yarn.lock, not whatever the "development" dist-tag currently points
-  # to upstream) - external artifacts only change when yarn.lock itself
-  # changes. So a diff under export/artifacts/@* means a dependency
-  # version bump landed in this PR/branch; regenerate the baseline as
-  # part of that same change, the same way as any other intentional
-  # export-shape change described above.
+  # The manifest includes the frozen legacy contracts and remaining external
+  # artifacts. Vendored sources/artifacts are committed; yarn.lock pins the
+  # installed dependencies. Regenerate this baseline when either changes.
   contracts-export-byte-identity:
     needs: contracts-detect-changes
     if: github.event_name != 'pull_request' || needs.contracts-detect-changes.outputs.path-filter == 'true'
@@ -253,15 +242,42 @@ jobs:
         run: |
           set -e
           sha256sum export.json > /tmp/manifest.txt
-          find export -type f | sort | xargs sha256sum >> /tmp/manifest.txt
+          # Sort paths consistently across developer machines and CI locales.
+          find export -type f | LC_ALL=C sort | xargs sha256sum >> /tmp/manifest.txt
           if ! diff -q export-baseline.sha256 /tmp/manifest.txt > /dev/null; then
             echo "::error::export.json / export/ artifacts differ from the committed baseline (solidity/ecdsa/export-baseline.sha256)."
-            echo "::error::If this change is intentional, regenerate the baseline locally (yarn deploy:test --network hardhat --export export.json && yarn prepack, then hash export.json and export/) and commit solidity/ecdsa/export-baseline.sha256 alongside it."
+            echo "::error::If this change is intentional, regenerate the baseline locally (yarn deploy:test --network hardhat --export export.json && yarn prepack, then sha256sum export.json > export-baseline.sha256 && find export -type f | LC_ALL=C sort | xargs sha256sum >> export-baseline.sha256) and commit solidity/ecdsa/export-baseline.sha256 alongside it."
             diff export-baseline.sha256 /tmp/manifest.txt || true
             exit 1
           fi
           echo "export byte-identity OK"
 
+  # Verifies that the committed artifact JSONs in solidity/ecdsa/external/random-beacon-export/artifacts/
+  # match the recorded SHA256 hashes in VENDOR.json. This closes the gap left by artifactSha256 which
+  # records the pristine pre-stripping upstream hash (by design) and cannot verify the committed files.
+  contracts-random-beacon-export-artifacts-byte-identity:
+    needs: contracts-detect-changes
+    if: github.event_name != 'pull_request' || needs.contracts-detect-changes.outputs.path-filter == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - name: Verify random beacon export artifact byte-identity
+        run: |
+          set -e
+          MISMATCH=0
+          while IFS= read -r line; do
+            KEY=$(echo "$line" | cut -d':' -f1)
+            EXPECTED=$(echo "$line" | cut -d':' -f2)
+            ACTUAL=$(sha256sum "solidity/ecdsa/external/random-beacon-export/artifacts/$KEY" 2>/dev/null | cut -d' ' -f1)
+            if [ "$ACTUAL" != "$EXPECTED" ]; then
+              echo "::error::Artifact $KEY mismatch: expected $EXPECTED, got $ACTUAL"
+              MISMATCH=1
+            fi
+          done < <(jq -r '.committedSha256 | to_entries | .[] | "\(.key):\(.value)"' solidity/ecdsa/external/random-beacon-export/VENDOR.json)
+          if [ $MISMATCH -ne 0 ]; then
+            exit 1
+          fi
+          echo 'committed artifact byte-identity OK'
   contracts-deployment-testnet:
     needs: [contracts-build-and-test]
     # The ethers v6 deployment exports break existing ethers v5 consumers.
@@ -299,22 +315,11 @@ jobs:
           upstream-builds: ${{ github.event.inputs.upstream_builds }}
           query: |
             threshold-contracts-version = github.com/threshold-network/solidity-contracts#version
-            random-beacon-version = github.com/keep-network/keep-core/random-beacon#version
 
       - name: Resolve latest contracts
         run: |
           yarn up \
-            @threshold-network/solidity-contracts@${{ steps.upstream-builds-query.outputs.threshold-contracts-version }} \
-            @keep-network/random-beacon@${{ steps.upstream-builds-query.outputs.random-beacon-version }} \
-            @keep-network/sortition-pools
-
-      # TODO: Remove this step. We replace sortition pools for deployment on testnet
-      # with forked contracts that were tweaked to make operators joining the pool
-      # easier. This should never be used outside of the test environment. On
-      # test environment it should be used temporarily only.
-      - name: Use Sortition Pool forked contracts
-        run: |
-          yarn up @keep-network/sortition-pools@github:keep-network/sortition-pools#test-fork
+            @threshold-network/solidity-contracts@${{ steps.upstream-builds-query.outputs.threshold-contracts-version }}
 
       - name: Configure tenderly
         env:
@@ -405,14 +410,11 @@ jobs:
           upstream-builds: ${{ github.event.inputs.upstream_builds }}
           query: |
             threshold-contracts-version = github.com/threshold-network/solidity-contracts#version
-            random-beacon-version = github.com/keep-network/keep-core/random-beacon#version
 
       - name: Resolve latest contracts
         run: |
           yarn up \
-            @threshold-network/solidity-contracts@${{ steps.upstream-builds-query.outputs.threshold-contracts-version }} \
-            @keep-network/random-beacon@${{ steps.upstream-builds-query.outputs.random-beacon-version }} \
-            @keep-network/sortition-pools
+            @threshold-network/solidity-contracts@${{ steps.upstream-builds-query.outputs.threshold-contracts-version }}
 
       - name: Deploy contracts
         env:

.github/workflows/contracts-random-beacon.yml

@@ -204,20 +204,9 @@ jobs:
   # regenerate solidity/random-beacon/export-baseline.sha256 with the
   # same commands below and commit it alongside the change.
   #
-  # Note: the manifest covers the full export/ tree, including artifacts
-  # of external dependencies deployed onto the local test network
-  # (@keep-network/sortition-pools, @openzeppelin/*, @thesis/*,
-  # @threshold-network/*). This is safe from upstream-publish flakiness:
-  # install-yarn-deps runs `yarn install --immutable` against the
-  # committed yarn.lock, which pins each of these to a concrete resolved
-  # version (e.g. `@keep-network/sortition-pools@npm:^2.0.0-pre.16`
-  # resolves to a fixed `2.0.0-pre.16` in yarn.lock, not whatever the
-  # range currently resolves to upstream) - external artifacts only
-  # change when yarn.lock itself changes. So a diff under
-  # export/artifacts/@* means a dependency version bump landed in this
-  # PR/branch; regenerate the baseline as part of that same change, the
-  # same way as any other intentional export-shape change described
-  # above.
+  # The manifest includes the frozen legacy contracts and remaining external
+  # artifacts. Vendored sources/artifacts are committed; yarn.lock pins the
+  # installed dependencies. Regenerate this baseline when either changes.
   contracts-export-byte-identity:
     needs: contracts-detect-changes
     if: github.event_name != 'pull_request' || needs.contracts-detect-changes.outputs.path-filter == 'true'
@@ -249,7 +238,8 @@ jobs:
         run: |
           set -e
           sha256sum export.json > /tmp/manifest.txt
-          find export -type f | sort | xargs sha256sum >> /tmp/manifest.txt
+          # Sort paths consistently across developer machines and CI locales.
+          find export -type f | LC_ALL=C sort | xargs sha256sum >> /tmp/manifest.txt
           if ! diff -q export-baseline.sha256 /tmp/manifest.txt > /dev/null; then
             echo '::error::export.json/export/ artifact byte-identity mismatch against solidity/random-beacon/export-baseline.sha256.'
             echo '::error::If this change is intentional, regenerate the baseline locally (see the job comment above) and commit it alongside this change.'
@@ -305,7 +295,7 @@ jobs:
           cp export/utils/wait-for-confirmations.js "$staging/utils/"
           cp export/tasks/initialize.js export/tasks/unlock-eth-accounts.js "$staging/tasks/"
           cp export/tasks/utils/*.js "$staging/tasks/utils/"
-          if ! diff -r --exclude=README.md "$staging" "$bundle"; then
+          if ! diff -r --exclude=README.md --exclude=LICENSE --exclude=VENDOR.json --exclude=artifacts "$staging" "$bundle"; then
             echo '::error::solidity/ecdsa/external/random-beacon-export/ is stale - it no longer matches solidity/random-beacon/export/.'
             echo '::error::Regenerate it with the commands documented in solidity/ecdsa/external/random-beacon-export/README.md and commit the result alongside this change.'
             exit 1
@@ -353,16 +343,7 @@ jobs:
       - name: Resolve latest contracts
         run: |
           yarn up \
-            @threshold-network/solidity-contracts@${{ steps.upstream-builds-query.outputs.threshold-contracts-version }} \
-            @keep-network/sortition-pools
-
-      # TODO: Remove this step. We replace sortition pools for deployment on testnet
-      # with forked contracts that were tweaked to make operators joining the pool
-      # easier. This should never be used outside of the test environment. On
-      # test environment it should be used temporarily only.
-      - name: Use Sortition Pool forked contracts
-        run: |
-          yarn up @keep-network/sortition-pools@github:keep-network/sortition-pools#test-fork
+            @threshold-network/solidity-contracts@${{ steps.upstream-builds-query.outputs.threshold-contracts-version }}
 
       - name: Configure tenderly
         env:
@@ -457,8 +438,7 @@ jobs:
       - name: Resolve latest contracts
         run: |
           yarn up \
-            @threshold-network/solidity-contracts@${{ steps.upstream-builds-query.outputs.threshold-contracts-version }} \
-            @keep-network/sortition-pools
+            @threshold-network/solidity-contracts@${{ steps.upstream-builds-query.outputs.threshold-contracts-version }}
 
       - name: Deploy contracts
         env:

solidity/ecdsa/.gitattributes

@@ -0,0 +1,4 @@
+external/random-beacon-export/artifacts/** linguist-generated=true
+tasks/legacy-random-beacon/** linguist-generated=true
+# Preserve the upstream generated task's bytes, including its trailing space.
+tasks/legacy-random-beacon/initialize.js whitespace=-blank-at-eol

solidity/ecdsa/.gitignore

@@ -6,9 +6,12 @@ external/npm
 hardhat-dependency-compiler/
 export.json
 gasReporterOutput.json
+.yarn/install-state.gz
 
 # Contract artifacts
 artifacts/
+!external/random-beacon-export/artifacts/
+!external/random-beacon-export/artifacts/**
 deployments/*
 !deployments/mainnet
 !deployments/sepolia

solidity/ecdsa/.prettierignore

@@ -9,4 +9,6 @@ typechain/
 docgen-templates/
 export.json
 gasReporterOutput.json
+contracts/legacy/
+tasks/legacy-random-beacon/
 .hardhat/

solidity/ecdsa/.solhintignore

@@ -1,2 +1,3 @@
 hardhat-dependency-compiler/
 node_modules/
+contracts/legacy/

solidity/ecdsa/contracts/EcdsaDkgValidator.sol

@@ -23,8 +23,8 @@
 pragma solidity 0.8.17;
 
 import "@openzeppelin/contracts/utils/cryptography/ECDSA.sol";
-import "@keep-network/random-beacon/contracts/libraries/BytesLib.sol";
-import "@keep-network/sortition-pools/contracts/SortitionPool.sol";
+import "./legacy/random-beacon/libraries/BytesLib.sol";
+import "./legacy/sortition/SortitionPool.sol";
 import "./libraries/EcdsaDkg.sol";
 
 /// @title DKG result validator

solidity/ecdsa/contracts/WalletRegistry.sol

@@ -23,12 +23,12 @@ import {EcdsaDkg as DKG} from "./libraries/EcdsaDkg.sol";
 import {EcdsaInactivity as Inactivity} from "./libraries/EcdsaInactivity.sol";
 import {EcdsaDkgValidator as DKGValidator} from "./EcdsaDkgValidator.sol";
 
-import "@keep-network/sortition-pools/contracts/SortitionPool.sol";
-import "@keep-network/random-beacon/contracts/api/IRandomBeacon.sol";
-import "@keep-network/random-beacon/contracts/api/IRandomBeaconConsumer.sol";
-import "@keep-network/random-beacon/contracts/Reimbursable.sol";
-import "@keep-network/random-beacon/contracts/ReimbursementPool.sol";
-import "@keep-network/random-beacon/contracts/Governable.sol";
+import "./legacy/sortition/SortitionPool.sol";
+import "./legacy/random-beacon/api/IRandomBeacon.sol";
+import "./legacy/random-beacon/api/IRandomBeaconConsumer.sol";
+import "./legacy/random-beacon/Reimbursable.sol";
+import "./legacy/random-beacon/ReimbursementPool.sol";
+import "./legacy/random-beacon/Governable.sol";
 
 import "@threshold-network/solidity-contracts/contracts/staking/IApplication.sol";
 import "@threshold-network/solidity-contracts/contracts/staking/IStaking.sol";

solidity/ecdsa/contracts/WalletRegistryGovernance.sol

@@ -16,10 +16,10 @@ pragma solidity 0.8.17;
 
 import "./WalletRegistry.sol";
 import "@openzeppelin/contracts/access/Ownable.sol";
-import "@keep-network/random-beacon/contracts/ReimbursementPool.sol";
+import "./legacy/random-beacon/ReimbursementPool.sol";
 
 import {IWalletOwner} from "./api/IWalletOwner.sol";
-import {IRandomBeacon} from "@keep-network/random-beacon/contracts/api/IRandomBeacon.sol";
+import {IRandomBeacon} from "./legacy/random-beacon/api/IRandomBeacon.sol";
 
 /// @title Wallet Registry Governance
 /// @notice Owns the `WalletRegistry` contract and is responsible for updating

solidity/ecdsa/contracts/legacy/random-beacon/Governable.sol

@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: GPL-3.0-only
+//
+// ▓▓▌ ▓▓ ▐▓▓ ▓▓▓▓▓▓▓▓▓▓▌▐▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▄
+// ▓▓▓▓▓▓▓▓▓▓ ▓▓▓▓▓▓▓▓▓▓▌▐▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
+//   ▓▓▓▓▓▓    ▓▓▓▓▓▓▓▀    ▐▓▓▓▓▓▓    ▐▓▓▓▓▓   ▓▓▓▓▓▓     ▓▓▓▓▓   ▐▓▓▓▓▓▌   ▐▓▓▓▓▓▓
+//   ▓▓▓▓▓▓▄▄▓▓▓▓▓▓▓▀      ▐▓▓▓▓▓▓▄▄▄▄         ▓▓▓▓▓▓▄▄▄▄         ▐▓▓▓▓▓▌   ▐▓▓▓▓▓▓
+//   ▓▓▓▓▓▓▓▓▓▓▓▓▓▀        ▐▓▓▓▓▓▓▓▓▓▓         ▓▓▓▓▓▓▓▓▓▓         ▐▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓
+//   ▓▓▓▓▓▓▀▀▓▓▓▓▓▓▄       ▐▓▓▓▓▓▓▀▀▀▀         ▓▓▓▓▓▓▀▀▀▀         ▐▓▓▓▓▓▓▓▓▓▓▓▓▓▓▀
+//   ▓▓▓▓▓▓   ▀▓▓▓▓▓▓▄     ▐▓▓▓▓▓▓     ▓▓▓▓▓   ▓▓▓▓▓▓     ▓▓▓▓▓   ▐▓▓▓▓▓▌
+// ▓▓▓▓▓▓▓▓▓▓ █▓▓▓▓▓▓▓▓▓ ▐▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓  ▓▓▓▓▓▓▓▓▓▓
+// ▓▓▓▓▓▓▓▓▓▓ ▓▓▓▓▓▓▓▓▓▓ ▐▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ ▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓  ▓▓▓▓▓▓▓▓▓▓
+//
+//                           Trust math, not hardware.
+
+pragma solidity 0.8.17;
+
+/// @notice Governable contract.
+/// @dev A constructor is not defined, which makes the contract compatible with
+///      upgradable proxies. This requires calling explicitly `_transferGovernance`
+///      function in a child contract.
+abstract contract Governable {
+    // Governance of the contract
+    // The variable should be initialized by the implementing contract.
+    // slither-disable-next-line uninitialized-state
+    address public governance;
+
+    // Reserved storage space in case we need to add more variables,
+    // since there are upgradeable contracts that inherit from this one.
+    // See https://docs.openzeppelin.com/contracts/4.x/upgradeable#storage_gaps
+    // slither-disable-next-line unused-state
+    uint256[49] private __gap;
+
+    event GovernanceTransferred(address oldGovernance, address newGovernance);
+
+    modifier onlyGovernance() virtual {
+        require(governance == msg.sender, "Caller is not the governance");
+        _;
+    }
+
+    /// @notice Transfers governance of the contract to `newGovernance`.
+    function transferGovernance(address newGovernance)
+        external
+        virtual
+        onlyGovernance
+    {
+        require(
+            newGovernance != address(0),
+            "New governance is the zero address"
+        );
+        _transferGovernance(newGovernance);
+    }
+
+    function _transferGovernance(address newGovernance) internal virtual {
+        address oldGovernance = governance;
+        governance = newGovernance;
+        emit GovernanceTransferred(oldGovernance, newGovernance);
+    }
+}