build(l1,l2): resolve Cargo.lock updates under a 14-day publish-age cooldown

.cargo/config.toml

@@ -3,3 +3,16 @@ rustflags = [
     "-Ctarget-cpu=x86-64-v3",
     "-Ctarget-feature=+avx2,+sse2,+ssse3,+sse4.1,+sse4.2,+bmi1,+lzcnt,+pclmulqdq",
 ]
+
+# Supply-chain cooldown for dependency resolution (unstable min-publish-age,
+# tracking issue rust-lang/cargo#17009): crate versions published less than
+# 14 days ago are excluded when the resolver runs on a nightly cargo.
+# Stable cargo ignores these tables silently, so builds from the committed
+# Cargo.lock files are unaffected; `make update-cargo-lock` resolves under the
+# policy. When the feature stabilizes, drop the [unstable] table and the
+# nightly resolver pin in the Makefile: the policy then binds all resolution.
+[unstable]
+min-publish-age = true
+
+[registry]
+global-min-publish-age = "14 days"

.github/workflows/pr-main_l1.yaml

@@ -466,12 +466,28 @@ jobs:
         run: |
           make check-cargo-lock
 
+  cooldown-check:
+    name: Check dependency cooldown
+    runs-on: ubuntu-latest
+    needs: detect-changes
+    if: ${{ needs.detect-changes.outputs.run_tests == 'true' }}
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v6
+
+      # Stable cargo ignores the publish-age cooldown in .cargo/config.toml, so a
+      # lockfile can pin too-young crates. If this fails, re-resolve the offending
+      # lockfile with `make update-cargo-lock` or wait for the crate to age out.
+      - name: Check Cargo.lock files against the publish-age cooldown
+        run: |
+          make cooldown-check
+
   # The purpose of this job is to add it as a required check in GitHub so that we don't have to add every individual job as a required check
   all-tests:
     # "Integration Test" is a required check, don't change the name
     name: Integration Test
     runs-on: ubuntu-latest
-    needs: [detect-changes, run-assertoor, run-hive, check-cargo-locks, engine-ef-tests]
+    needs: [detect-changes, run-assertoor, run-hive, check-cargo-locks, cooldown-check, engine-ef-tests]
     # Make sure this job runs even if the previous jobs failed or were skipped
     if: ${{ needs.detect-changes.outputs.run_tests == 'true' && always() && needs.run-assertoor.result != 'skipped' && needs.run-hive.result != 'skipped' }}
     steps:
@@ -487,6 +503,11 @@ jobs:
             exit 1
           fi
 
+          if [ "${{ needs.cooldown-check.result }}" != "success" ]; then
+            echo "Job Check dependency cooldown failed"
+            exit 1
+          fi
+
           # engine-ef-tests is skipped in the merge queue (merge_group), which is OK.
           if [ "${{ needs.engine-ef-tests.result }}" != "success" ] && [ "${{ needs.engine-ef-tests.result }}" != "skipped" ]; then
             echo "Job Engine EF tests failed"

CONTRIBUTING.md

@@ -7,6 +7,11 @@ Thank you for your interest in contributing to ethrex! Please read the following
 1. Fork the repository and create your branch from `main`.
 2. Make your changes, following the code style guidelines below.
 3. Run tests locally to ensure nothing is broken.
+   If you changed a dependency in any `Cargo.toml`, refresh the lockfiles with `make update-cargo-lock`
+   rather than a plain `cargo update`: it resolves under a 14-day publish-age cooldown
+   (`.cargo/config.toml`) that skips freshly published crate versions as a supply-chain precaution.
+   For an urgent bump to a version younger than that, prefix the command with
+   `CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow` and review the whole lockfile diff.
 4. Open a pull request with a descriptive title (see PR naming rules below).
 5. Fill in the PR template if available, and link related issues.
 

Makefile

@@ -259,22 +259,66 @@ docs: mermaid-init.js mermaid.min.js ## 📚 Generate the documentation
 docs-serve: mermaid-init.js mermaid.min.js ## 📚 Generate and serve the documentation
 	mdbook serve --open
 
-update-cargo-lock: ## 📦 Update Cargo.lock files
-	cargo tree
-	cargo tree --manifest-path crates/guest-program/bin/sp1/Cargo.toml
+# Used ONLY to resolve lockfile updates: the publish-age cooldown in
+# .cargo/config.toml (versions published less than 14 days ago are excluded) is
+# nightly-only; everything else runs on the stable toolchain in rust-toolchain.toml. Git
+# dependencies have no publish age and are refreshed WITHOUT any cooldown: review
+# their lockfile rev changes manually.
+RESOLVER_TOOLCHAIN := nightly-2026-06-21
+CARGO_RESOLVE := cargo +$(RESOLVER_TOOLCHAIN) -Z min-publish-age tree
+
+update-cargo-lock: ## 📦 Update Cargo.lock files under the publish-age cooldown
+	rustup toolchain install $(RESOLVER_TOOLCHAIN) --profile minimal --no-self-update > /dev/null
+	$(CARGO_RESOLVE)
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/bin/sp1/Cargo.toml
 	# risc0 temporarily skipped: c-kzg 2.1.8 floor exceeds the highest risc0 c-kzg fork tag
 	# (v2.1.7-risczero.0), so its lockfile can't resolve. Re-add once a >=2.1.8 tag exists.
-	cargo tree --manifest-path crates/guest-program/bin/zisk/Cargo.toml
-	cargo tree --manifest-path crates/guest-program/bin/openvm/Cargo.toml
-	cargo tree --manifest-path crates/guest-program/stateless-validator/Cargo.toml
-	cargo tree --manifest-path crates/guest-program/stateless-validator/bin/sp1/Cargo.toml
-	cargo tree --manifest-path crates/guest-program/stateless-validator/bin/zisk/Cargo.toml
-	cargo tree --manifest-path crates/guest-program/stateless-validator/bin/openvm/Cargo.toml
-	cargo tree --manifest-path crates/l2/tee/quote-gen/Cargo.toml
-	cargo tree --manifest-path crates/vm/levm/bench/revm_comparison/Cargo.toml
-	cargo tree --manifest-path tooling/zkevm_bench/Cargo.toml
-	cargo tree --manifest-path tooling/Cargo.toml
-	cargo tree --manifest-path tooling/ef_tests/state/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/bin/zisk/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/bin/openvm/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/stateless-validator/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/stateless-validator/bin/sp1/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/stateless-validator/bin/zisk/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/guest-program/stateless-validator/bin/openvm/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/l2/tee/quote-gen/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path crates/vm/levm/bench/revm_comparison/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path tooling/zkevm_bench/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path tooling/Cargo.toml
+	$(CARGO_RESOLVE) --manifest-path tooling/ef_tests/state/Cargo.toml
+
+# One entry per committed Cargo.lock (tooling/ef_tests/state shares tooling's;
+# risc0 is skipped for the reason above).
+COOLDOWN_MANIFESTS := Cargo.toml \
+	crates/guest-program/bin/sp1/Cargo.toml \
+	crates/guest-program/bin/zisk/Cargo.toml \
+	crates/guest-program/bin/openvm/Cargo.toml \
+	crates/guest-program/stateless-validator/Cargo.toml \
+	crates/guest-program/stateless-validator/bin/sp1/Cargo.toml \
+	crates/guest-program/stateless-validator/bin/zisk/Cargo.toml \
+	crates/guest-program/stateless-validator/bin/openvm/Cargo.toml \
+	crates/l2/tee/quote-gen/Cargo.toml \
+	crates/vm/levm/bench/revm_comparison/Cargo.toml \
+	tooling/zkevm_bench/Cargo.toml \
+	tooling/Cargo.toml
+
+# Stable cargo ignores the cooldown, so a lockfile can pin too-young crates
+# (`cargo update` on stable, or the CARGO_RESOLVER_INCOMPATIBLE_PUBLISH_AGE=allow
+# escape hatch). Re-resolve each lockfile under the cooldown without touching
+# it: a pin younger than the window shows up as a downgrade annotated with the
+# too-young version's publish date (downgrades for other reasons carry no such
+# note and are not flagged). A resolution that fails for reasons unrelated to
+# age only warns; the root workspace does today, since openvm's git deps pin
+# conflicting p3-baby-bear versions and only `cargo tree` can refresh its lock.
+cooldown-check: ## 🔍 Fail if a Cargo.lock pins crates younger than the publish-age cooldown
+	@rustup toolchain install $(RESOLVER_TOOLCHAIN) --profile minimal --no-self-update > /dev/null && \
+	status=0; \
+	for manifest in $(COOLDOWN_MANIFESTS); do \
+		if ! out=$$(cargo +$(RESOLVER_TOOLCHAIN) update --dry-run -Z min-publish-age --manifest-path $$manifest 2>&1); then \
+			echo "WARNING: publish-age cooldown probe failed for $$manifest:"; echo "$$out" | grep -v "^ *Updating " | head -20; continue; \
+		fi; \
+		hits=$$(echo "$$out" | grep -E "^ *Downgrading .*published" || true); \
+		if [ -n "$$hits" ]; then echo "ERROR: $$manifest pins crates younger than the publish-age cooldown:"; echo "$$hits"; status=1; fi; \
+	done; \
+	exit $$status
 
 check-cargo-lock: ## 🔍 Check Cargo.lock files are up to date
 	cargo metadata --locked > /dev/null