Skip to content

fix(crypto): remove vendored secp256k1 to drop duplicate symbols at link#4

Merged
nebojsa94 merged 1 commit into
release-20260512141429from
fix-secp256k1-duplicate-symbols
May 18, 2026
Merged

fix(crypto): remove vendored secp256k1 to drop duplicate symbols at link#4
nebojsa94 merged 1 commit into
release-20260512141429from
fix-secp256k1-duplicate-symbols

Conversation

@nebojsa94
Copy link
Copy Markdown
Member

Why

When tenderly-core links a binary that pulls in both nitro's libstylus.a and other modules that vendor secp256k1 (e.g. zksync-go), the macOS linker errors with ~50 duplicate _secp256k1_* symbols because two different cgo-compiled .o files each embed the full libsecp256k1 implementation:

duplicate symbol '_secp256k1_ec_pubkey_serialize' in:
    /tmp/go-link-…/000003.o
    /tmp/go-link-…/000030.o
… (×51)

On Linux CI this was masked by -Wl,--allow-multiple-definition in tenderly-core's BUILD_FLAGS, but newer macOS ld doesn't accept that flag, so local macOS builds fail outright.

This drops nitro's own vendored libsecp256k1 + Go wrappers under go-ethereum/crypto/secp256k1/ (185 files, ~70K deletions) and switches the two consumer sites (go-ethereum/crypto/signature_cgo.go, tests/fuzzers/secp256k1/secp_test.go, system_tests/timeboost_test.go) to upstream github.com/ethereum/go-ethereum/crypto/secp256k1. MVS in the consumer binary then keeps a single copy.

The Rust side (libstylus.a) is unchanged — only Go imports/files moved.

Tests

  • go mod tidy in net-nitro succeeds after the import-path renames; it auto-adds github.com/ethereum/go-ethereum v1.10.26 (MVS will pick the higher tenderly-core pin v1.17.2 at consumer build time).
  • The nitro static-library artifacts (nitro-d3ca07605e9b-{linux,macos}.tar.gz) were republished by gsutil cp from d7575265ccc0 — byte-identical Rust output.

Services affected

Any tenderly-core service that links nitro into a binary together with another secp256k1-vendoring module (zksync, etc.). Concretely: tenderly-server, node-server services, anything building from cmd/*.

When nitro's libstylus.a and other modules (zksync-go etc.) are linked
into the same binary, the macOS linker errors out with ~50 duplicate
`_secp256k1_*` symbols because two different cgo-compiled .o files each
embed the full libsecp256k1 implementation. On Linux this was masked by
`-Wl,--allow-multiple-definition`, but newer macOS ld doesn't accept
that flag.

Drops nitro's own vendored libsecp256k1 + Go wrappers under
`go-ethereum/crypto/secp256k1/` and switches the two import sites
(`go-ethereum/crypto/signature_cgo.go`, fuzz/system test) to upstream
`github.com/ethereum/go-ethereum/crypto/secp256k1`. MVS in the consumer
binary then keeps a single copy of secp256k1.

The Rust side (libstylus.a) is unchanged — only Go imports/files moved.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@nebojsa94 nebojsa94 merged commit 0687160 into release-20260512141429 May 18, 2026
2 of 16 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant