release: v1.2.3-alpha2 — community security and stability fixes

.dockerignore

@@ -0,0 +1 @@
+cluster-artifacts/

.github/actions/parallel-ctest-containers/main.mjs

@@ -15,6 +15,12 @@ const test_timeout = core.getInput('test-timeout', {required: true});
 const repo_name = process.env.GITHUB_REPOSITORY.split('/')[1];
 
 try {
+   // Defensively remove any leftover container from a prior/interrupted run. On a
+   // persistent self-hosted runner the Docker daemon survives between jobs, and the
+   // per-test containers below use fixed names with no --rm, so an orphan would block
+   // name reuse with "container name already in use". (ENF's ephemeral runners get a
+   // fresh daemon each job and never hit this.)
+   child_process.spawnSync("docker", ["rm", "-f", "base"], {stdio:"ignore"});
    if(child_process.spawnSync("docker", ["run", "--name", "base", "-v", `${process.cwd()}/build.tar.zst:/build.tar.zst`, "--workdir", `/__w/${repo_name}/${repo_name}`, container, "sh", "-c", "zstdcat /build.tar.zst | tar x"], {stdio:"inherit"}).status)
       throw new Error("Failed to create base container");
    if(child_process.spawnSync("docker", ["commit", "base", "baseimage"], {stdio:"inherit"}).status)
@@ -27,14 +33,34 @@ try {
       throw new Error("Failed to discover tests with label")
    const tests = JSON.parse(test_query_result.stdout).tests;
 
-   let subprocesses = [];
-   tests.forEach(t => {
-      subprocesses.push(new Promise(resolve => {
-         child_process.spawn("docker", ["run", "--security-opt", "seccomp=unconfined", "-e", "GITHUB_ACTIONS=True", "--name", t.name, "--init", "baseimage", "bash", "-c", `cd build; ctest --output-on-failure -R '^${t.name}$' --timeout ${test_timeout}`], {stdio:"inherit"}).on('close', code => resolve(code));
-      }));
-   });
+   // Run the test containers with BOUNDED concurrency. The nonparallelizable_tests and
+   // long_running_tests suites are heavy multi-nodeos integration tests; launching one
+   // container per test all at once (the original behaviour) starves CPU/RAM/ports on a
+   // modest self-hosted runner and makes them fail en masse. Cap how many run at a time
+   // (override with the CTEST_CONTAINER_CONCURRENCY env var; default 4). results[i] stays
+   // aligned with tests[i] so the failure-log extraction below is unchanged.
+   const parsed_concurrency = parseInt(process.env.CTEST_CONTAINER_CONCURRENCY, 10);
+   const max_concurrency = Number.isNaN(parsed_concurrency) ? 4 : Math.max(1, parsed_concurrency);
+   console.log(`Running ${tests.length} '${tests_label}' test(s), up to ${max_concurrency} container(s) at a time`);
 
-   const results = await Promise.all(subprocesses);
+   const results = new Array(tests.length);
+   let next_test = 0;
+   async function run_worker() {
+      while(next_test < tests.length) {
+         const i = next_test++;
+         const t = tests[i];
+         // Clear any orphaned container of this name before reusing it (see note above).
+         child_process.spawnSync("docker", ["rm", "-f", t.name], {stdio:"ignore"});
+         results[i] = await new Promise(resolve => {
+            child_process.spawn("docker", ["run", "--security-opt", "seccomp=unconfined", "-e", "GITHUB_ACTIONS=True", "--name", t.name, "--init", "baseimage", "bash", "-c", `cd build; ctest --output-on-failure -R '^${t.name}$' --timeout ${test_timeout}`], {stdio:"inherit"})
+               .on('close', code => resolve(code))
+               // If docker can't even be spawned, 'close' may never fire — resolve as a
+               // failure so the pool doesn't hang and the test is reported as failed.
+               .on('error', err => { console.error(`Failed to spawn docker for ${t.name}: ${err.message}`); resolve(1); });
+         });
+      }
+   }
+   await Promise.all(Array.from({length: Math.min(max_concurrency, tests.length)}, run_worker));
 
    for(let i = 0; i < results.length; ++i) {
       if(results[i] === 0)

.gitignore

@@ -98,4 +98,10 @@ snapshots
 
 # reproducible build artifacts dropped in the repo root by `docker build ... -o .`
 /antelope-spring*.deb
-/antelope-spring*.tar.*
+/antelope-spring*.tar.*
+/SHA256SUMS.txt
+
+# test & agent artifacts
+/cluster-artifacts/
+/config-dir/
+/.agents/

CMakeLists.txt

@@ -16,7 +16,7 @@ set( CXX_STANDARD_REQUIRED ON)
 set(VERSION_MAJOR 1)
 set(VERSION_MINOR 2)
 set(VERSION_PATCH 3)
-set(VERSION_SUFFIX alpha1)
+set(VERSION_SUFFIX alpha2)
 
 if(VERSION_SUFFIX)
     set(VERSION_FULL "${VERSION_MAJOR}.${VERSION_MINOR}.${VERSION_PATCH}-${VERSION_SUFFIX}")
@@ -80,7 +80,7 @@ if(ENABLE_OC AND CMAKE_SIZEOF_VOID_P EQUAL 8 AND NOT WIN32)
       # #578: support legacy ORCv1 (LLVM 7-11) AND modern RuntimeDyld path (LLVM 14+, for Ubuntu 24.04/26.04).
       # 12-13 intentionally unsupported (transitional opaque-pointer era, untested for consensus codegen).
       if(LLVM_VERSION_MAJOR VERSION_LESS 7 OR (LLVM_VERSION_MAJOR VERSION_GREATER_EQUAL 12 AND LLVM_VERSION_MAJOR VERSION_LESS 14))
-	      message(FATAL_ERROR "Spring requires an LLVM version 7 through 11")
+	      message(FATAL_ERROR "Spring requires LLVM 7-11 or 14+ (LLVM 12/13 are intentionally unsupported); on Ubuntu 24.04/26.04 install llvm-18-dev")
       endif()
    endif()
 endif()

LICENSE

@@ -1,105 +1,7 @@
-License text copyright (c) 2023 MariaDB plc, All Rights Reserved. "Business
-Source License" is a trademark of MariaDB plc.
-
-Parameters
-
-Licensor:              EOS NETWORK FOUNDATION ("ENF")
-
-Licensed Work:         SPRING v.1 Canadian Copyright Registration No.
-                       1212238, 2024, All Rights Reserved
-
-Additional Use Grant:  Licensee (You) is granted, free of charge, to deal in
-                       the Licensed Work without restriction, including
-                       without limitation the rights to use, copy, modify,
-                       merge, publish, distribute, sublicense, and/or sell
-                       copies of the Licensed Work, and to permit persons to
-                       whom the Licensed Work is furnished to do so, subject
-                       to the following conditions:
-
-                       Your use of the Licensed Work is Directly in Service
-                       of or Materially Dependent on the EOS Blockchain
-                       Network
-
-                       The copyright notice and this permission notice shall
-                       be included in all copies or substantial portions of
-                       the Software.
-
-                       For the purposes of this license:
-
-                       "EOS Blockchain Network" is defined as any blockchain
-                       network created with the EOSIO, or Antelope,
-                       protocols, or any future protocols derived
-                       substantially from them whose genesis block id as
-                       defined by the Licensed Work is 00000001405147477ab2f5...
-                       f51cda427b638191c66d2c59aa392d5c2c98076cb0 
-
-                       "Directly in Service" is defined as any use which is
-                       necessary for the EOS Blockchain to persist and
-                       continue operations including but not limited to
-                       hosting network nodes, archives, RPC endpoints, and
-                       integration with 3rd party services.
-
-                       "Materially Dependent" is defined as use that would
-                       cease to operate effectively or economically if the
-                       EOS blockchain component was removed temporarily or
-                       permanently.
-
-Change Date:           Four years from the date the Licensed Work is published
-
-Change License:        MIT 2.0
-
-For information about alternative licensing arrangements for the Licensed Work,
-please contact licensing@eosnetwork.com.
-
-Notice
-
-Business Source License 1.1
-
-Terms
-
-The Licensor hereby grants you the right to copy, modify, create derivative
-works, redistribute, and make non-production use of the Licensed Work. The
-Licensor may make an Additional Use Grant, above, permitting limited production
-use.
-
-Effective on the Change Date, or the fourth anniversary of the first publicly
-available distribution of a specific version of the Licensed Work under this
-License, whichever comes first, the Licensor hereby grants you rights under
-the terms of the Change License, and the rights granted in the paragraph
-above terminate.
-
-If your use of the Licensed Work does not comply with the requirements
-currently in effect as described in this License, you must purchase a
-commercial license from the Licensor, its affiliated entities, or authorized
-resellers, or you must refrain from using the Licensed Work.
-
-All copies of the original and modified Licensed Work, and derivative works
-of the Licensed Work, are subject to this License. This License applies
-separately for each version of the Licensed Work and the Change Date may vary
-for each version of the Licensed Work released by Licensor.
-
-You must conspicuously display this License on each original or modified copy
-of the Licensed Work. If you receive the Licensed Work in original or
-modified form from a third party, the terms and conditions set forth in this
-License apply to your use of that work.
-
-Any use of the Licensed Work in violation of this License will automatically
-terminate your rights under this License for the current and all other
-versions of the Licensed Work.
-
-This License does not grant you any right in any trademark or logo of
-Licensor or its affiliates (provided that you may use a trademark or logo of
-Licensor as expressly required by this License).
-
-TO THE EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSED WORK IS PROVIDED ON
-AN "AS IS" BASIS. LICENSOR HEREBY DISCLAIMS ALL WARRANTIES AND CONDITIONS,
-EXPRESS OR IMPLIED, INCLUDING (WITHOUT LIMITATION) WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, AND TITLE.
-
-Additional Notice
-
-This software contains code from EOSIO/eos. That inclusion is under the
-following license:
+AntelopeIO/spring
+Copyright (c) 2025-2025 Vaulta Foundation (VF) and its contributors.  All rights reserved. 
+Copyright (c) 2021-2025 EOS Network Foundation (ENF) and its contributors.  All rights reserved. 
+This Vaulta software is based upon:
 
 EOSIO/eos
 Copyright (c) 2017-2021 block.one and its contributors.  All rights reserved.