Replace blst with gnark-crypto, simplify builds

[metachris]

📝 Summary

Replacing blst with gnark-crypto, an audited, non-cgo BLS12-381 implementation.

Follow-up to initial work from @jtraglia at

• Replace blst with kilic go-boost-utils#56
• Replace kilic with gnark-crypto go-boost-utils#62

No more portable/static builds needed either! Non-cgo builds are static by default.

---

✅ I have run these commands

• make lint
• make test-race
• go mod tidy

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 68.64%. Comparing base (3b7f08b) to head (97f359c).

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #479   +/-   ##
=======================================
  Coverage   68.64%   68.64%           
=======================================
  Files           8        8           
  Lines        1263     1263           
=======================================
  Hits          867      867           
  Misses        346      346           
  Partials       50       50           

Flag	Coverage Δ
unittests	68.64% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[jtraglia]

I pushed a few commits that explicitly disables cgo in more places (like tests). It needs to be enabled with the -race flag though, but I think that's fine. Also, one extra change is the removal of -v (verbose) from the builds; I don't think it's all that useful anymore. I think we should have another review from someone else before merging this.

[metachris]

Nice commits, thanks @jtraglia! ⭐

Love how this simplifies the building significantly.

[jtraglia]

Please wait to merge this until we fully consider the security/performance implications.

• IIRC, kilic has not been audited, but neither has go-ethereum/crypto/bls12381.
  • Would we still feel safer using geth's implementation, which is based off an old version of kilic?
• Do the EL/CL clients double check critical signatures?
  • They wouldn't check relay signatures, is that critical?
• How much of a performance penalty does this cost?
  • I fully expect blst to be faster, but is that worth the extra complexity?

[metachris]

Thanks, good considerations!

I like the PR flashbots/go-boost-utils#62 to replace it with /~https://github.com/ConsenSys/gnark-crypto -- seems like a great replacement, and should certainly be an improvement over /~https://github.com/supranational/blst

They wouldn't check relay signatures, is that critical?

It's not, that was a responsibility solely on mev-boost side.

[jtraglia]

@metachris Have you double-checked that the goreleaser changes are good?

[jtraglia]

Updating go-ole to the latest version (v1.2.6) fixes the Windows/ARM64 build issue.

The errors from previous version:

$ GOOS=windows GOARCH=arm64 go build
../../../go/pkg/mod/github.com/go-ole/go-ole@v1.2.5/com.go:238:21: undefined: VARIANT
../../../go/pkg/mod/github.com/go-ole/go-ole@v1.2.5/com.go:247:22: undefined: VARIANT
../../../go/pkg/mod/github.com/go-ole/go-ole@v1.2.5/connect.go:79:72: undefined: VARIANT
../../../go/pkg/mod/github.com/go-ole/go-ole@v1.2.5/connect.go:90:76: undefined: VARIANT
../../../go/pkg/mod/github.com/go-ole/go-ole@v1.2.5/connect.go:105:69: undefined: VARIANT
../../../go/pkg/mod/github.com/go-ole/go-ole@v1.2.5/connect.go:115:73: undefined: VARIANT
../../../go/pkg/mod/github.com/go-ole/go-ole@v1.2.5/connect.go:129:69: undefined: VARIANT
../../../go/pkg/mod/github.com/go-ole/go-ole@v1.2.5/connect.go:139:73: undefined: VARIANT
../../../go/pkg/mod/github.com/go-ole/go-ole@v1.2.5/connect.go:173:84: undefined: VARIANT
../../../go/pkg/mod/github.com/go-ole/go-ole@v1.2.5/idispatch.go:26:90: undefined: VARIANT
../../../go/pkg/mod/github.com/go-ole/go-ole@v1.2.5/idispatch.go:26:90: too many errors

[metachris]

very cool!

btw, added a commit to ignore gomoddirectives, which makes the linter work again

[metachris]

created a release based on this branch and state, to test in testnets before merging:

• /~https://github.com/flashbots/mev-boost/releases/tag/v1.5.2-alpha2
• Docker image: flashbots/mev-boost:1.5.2-alpha2

[metachris]

Asked @parithosh to help test in some of the testnets

[jtraglia]

btw, added a commit to ignore gomoddirectives, which makes the linter work again

Ah thank you, I didn't notice that the linter failed CI checks. I just made a change to your fix. Instead of disabling that linter check, add gnark-crypto to the replace-allow-list so that specific one is allowed.

Also, I've checked out the release and it looks good! Running 1.5.2-alpha2 via docker with my setup now.

[jtraglia]

Sorry to flip-flop again, but I think we should be using the latest version of gnark-crypto instead of the audited version. I think it's beneficial to get all of the minor improvements & bug fixes that the newer versions include.

Updated this PR accordingly.

[metachris]

Thanks for keeping an eye on the details! <3

[jtraglia]

I'm a bit biased, but LGTM 👍 I'm happy with this PR!