deps(bump): zcash_primitives, zcash_note_encryption, zcash_encoding, orchard, and zcash_script

[oxarbitrage]

Motivation

We want to bump this 3 dependencies at the same time. This PR will replace the other 3 if we go this way:

• build(deps): bump zcash_primitives from 0.7.0 to 0.8.1 #5497
• build(deps): bump zcash_note_encryption from 0.1.0 to 0.2.0 #5498
• build(deps): bump orchard from 0.2.0 to 0.3.0 #5500

It also works around the fact that address() is now private.

I am pushing this now as we might want to add it to the release candidate.

Close #3831 (removing all duplicate ECC dependencies, not just zcash_proofs)

Solution

• Upgrade the 4 ECC dependencies.
• Upgrade zcash_script.
• Fix address issue.

Review

Reviewer Checklist

• Will the PR name make sense to users?
  • Does it need extra CHANGELOG info? (new features, breaking changes, large changes)
• Are the PR labels correct?
• Does the code do what the ticket and PR says?
• How do you know it works? Does it have tests?

[codecov]

Codecov Report

Merging #5505 (9a8e061) into main (161bb80) will decrease coverage by 0.03%.
The diff coverage is 78.57%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5505      +/-   ##
==========================================
- Coverage   79.25%   79.22%   -0.04%     
==========================================
  Files         305      305              
  Lines       37873    37885      +12     
==========================================
- Hits        30018    30016       -2     
- Misses       7855     7869      +14     

[upbqdn]

This PR looks great. I was working on a similar one, but my workaround for address() wasn't as smooth.

@oxarbitrage I have updates that make Zebra compatible with ZcashFoundation/zcash_script#41, should I push them as a PR into this one, or would it be better to make a standalone PR?

[oxarbitrage]

This PR looks great. I was working on a similar one, but my workaround for address() wasn't as smooth.

Apologies for working on something you were already working on. I didn't saw #5500 (comment)

@oxarbitrage I have updates that make Zebra compatible with ZcashFoundation/zcash_script#41, should I push them as a PR into this one, or would it be better to make a standalone PR?

That is great, i think we might want to have all the ECC or our own dependencies up to date in the release candidate but i am not totally sure if it is that important.

If your changes are not too big i think we can try to push to this one and merge all the dependencies alltogether.

[upbqdn]

@oxarbitrage I have updates that make Zebra compatible with ZcashFoundation/zcash_script#41, should I push them as a PR into this one, or would it be better to make a standalone PR?

I just realized it would be best if we wait until we merge ZcashFoundation/zcash_script#41, and then do the rest of the updates in Zebra, so a standalone PR will be a better solution.

[upbqdn]

Apologies for working on something you were already working on.

No worries at all, the only blocker was the address() function being private.

[upbqdn]

I just realized it would be best if we wait until we merge ZcashFoundation/zcash_script#41, and then do the rest of the updates in Zebra, so a standalone PR will be a better solution.

I actually pushed a draft PR with the updates #5506 without ZcashFoundation/zcash_script#41 being merged so that we can see what changes are needed.

[teor2345]

Just want to tweak a version number

[teor2345]

I have a suggestion, but it's not a blocker.

[teor2345]

I am pushing this now as we might want to add it to the release candidate.

Yes, we do, using outdated or duplicate cryptographic dependencies is a security vulnerability. (And it's a pain to audit.)

[teor2345]

error: linking with cc failed: exit status: 1
https://github.com/ZcashFoundation/zebra/actions/runs/3357475081/jobs/5563308196#step:15:463

This is only happening in the GitHub Actions Linux build, so I cleared this PR's GitHub Actions caches, and the main branch GitHub Actions caches.