build(l1,l2): resolve Cargo.lock updates under a 14-day publish-age cooldown

.cargo/config.toml

@@ -3,3 +3,16 @@ rustflags = [
     "-Ctarget-cpu=x86-64-v3",
     "-Ctarget-feature=+avx2,+sse2,+ssse3,+sse4.1,+sse4.2,+bmi1,+lzcnt,+pclmulqdq",
 ]
+
+# Supply-chain cooldown for dependency resolution (unstable min-publish-age,
+# tracking issue rust-lang/cargo#17009): crate versions published less than
+# 14 days ago are excluded when the resolver runs on a nightly cargo.
+# Stable cargo ignores these tables silently, so builds from the committed
+# Cargo.lock files are unaffected; `make update-cargo-lock` resolves under the
+# policy. When the feature stabilizes, drop the [unstable] table and the
+# nightly resolver pin in the Makefile: the policy then binds all resolution.
+[unstable]
+min-publish-age = true
+
+[registry]
+global-min-publish-age = "14 days"

CONTRIBUTING.md

@@ -7,6 +7,11 @@ Thank you for your interest in contributing to ethrex! Please read the following
 1. Fork the repository and create your branch from `main`.
 2. Make your changes, following the code style guidelines below.
 3. Run tests locally to ensure nothing is broken.
+   If you changed a dependency in any `Cargo.toml`, refresh the lockfiles with `make update-cargo-lock`
+   rather than a plain `cargo update`: it resolves under a 14-day publish-age cooldown
+   (`.cargo/config.toml`) that skips freshly published crate versions as a supply-chain precaution.
+   For an urgent bump to a version younger than that, prefix the command with
+   `CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow` and review the whole lockfile diff.
 4. Open a pull request with a descriptive title (see PR naming rules below).
 5. Fill in the PR template if available, and link related issues.
 

Makefile

@@ -259,22 +259,35 @@ docs: mermaid-init.js mermaid.min.js ## 📚 Generate the documentation
 docs-serve: mermaid-init.js mermaid.min.js ## 📚 Generate and serve the documentation
 	mdbook serve --open
 
-update-cargo-lock: ## 📦 Update Cargo.lock files
-	cargo tree
-	cargo tree --manifest-path crates/guest-program/bin/sp1/Cargo.toml
+# Used ONLY to resolve lockfile updates: the publish-age cooldown in
+# .cargo/config.toml (versions published less than 14 days ago are excluded) is
+# nightly-only; everything else runs on the stable toolchain in rust-toolchain.toml.
+# Resolution done on stable (`cargo add`, plain `cargo update`, an unlocked build
+# after a manifest edit) is NOT covered; this target is the intended path. Git
+# dependencies have no publish age and are refreshed WITHOUT any cooldown: review
+# their lockfile rev changes manually. Escape hatch for an urgent bump to a
+# version younger than the cooldown, applied to the WHOLE resolution:
+#   CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow make update-cargo-lock
+RESOLVER_TOOLCHAIN := nightly-2026-06-21
+CARGO_RESOLVE := cargo +$(RESOLVER_TOOLCHAIN) -Z min-publish-age tree
+
+update-cargo-lock: ## 📦 Update Cargo.lock files under the publish-age cooldown
+	rustup toolchain install $(RESOLVER_TOOLCHAIN) --profile minimal > /dev/null 2>&1
+	$(CARGO_RESOLVE)
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/bin/sp1/Cargo.toml
 	# risc0 temporarily skipped: c-kzg 2.1.8 floor exceeds the highest risc0 c-kzg fork tag
 	# (v2.1.7-risczero.0), so its lockfile can't resolve. Re-add once a >=2.1.8 tag exists.
-	cargo tree --manifest-path crates/guest-program/bin/zisk/Cargo.toml
-	cargo tree --manifest-path crates/guest-program/bin/openvm/Cargo.toml
-	cargo tree --manifest-path crates/guest-program/stateless-validator/Cargo.toml
-	cargo tree --manifest-path crates/guest-program/stateless-validator/bin/sp1/Cargo.toml
-	cargo tree --manifest-path crates/guest-program/stateless-validator/bin/zisk/Cargo.toml
-	cargo tree --manifest-path crates/guest-program/stateless-validator/bin/openvm/Cargo.toml
-	cargo tree --manifest-path crates/l2/tee/quote-gen/Cargo.toml
-	cargo tree --manifest-path crates/vm/levm/bench/revm_comparison/Cargo.toml
-	cargo tree --manifest-path tooling/zkevm_bench/Cargo.toml
-	cargo tree --manifest-path tooling/Cargo.toml
-	cargo tree --manifest-path tooling/ef_tests/state/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/bin/zisk/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/bin/openvm/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/stateless-validator/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/stateless-validator/bin/sp1/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/stateless-validator/bin/zisk/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/stateless-validator/bin/openvm/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/l2/tee/quote-gen/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/vm/levm/bench/revm_comparison/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path tooling/zkevm_bench/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path tooling/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path tooling/ef_tests/state/Cargo.toml
 
 check-cargo-lock: ## 🔍 Check Cargo.lock files are up to date
 	cargo metadata --locked > /dev/null