cumulus: add SignedSchedulingInfo PVF verification by iulianbarbu · Pull Request #12097 · paritytech/polkadot-sdk

iulianbarbu · 2026-05-18T15:58:07Z

Description

Verifies the scheduling info payload in PVF, if formed by an author that claims its para slot at internal scheduling parent.

Closes #12152

Integration

Runtime developers that want to enable resubmissions for their parachains must configure the newly added associated type on parachain-system's Config: VerifySchedulingSignature.

Review Notes

Concerns like parachain session or para slot duration changes must be handled by the resubmission engine, as described here: #12036 (comment).

For simplicity, reasoning and efficiency.

+ Refactor/cleanup + some docs.

parents Remove per-parachain tracking of allowed relay parents in backing implicit view. Allowed relay parents are now computed per relay parent (globally) based on scheduling lookahead, rather than per parachain. Changes: - Remove `collating_for` parameter and para_id tracking from View - Update all callers to remove para_id arguments - Refactor tests with helper functions to reduce ~150 lines of duplication - Add comprehensive documentation to tests explaining expected behavior - Clarify `paths_via_relay_parent` returns full paths from oldest block to leaf This simplification aligns with the reality that all parachains share the same allowed relay parent windows at a given relay chain block.

+ Fix a typo.

# Description An intermediate PR that just adds a trait that can be used to configure whether V3 collations should be built, and how to verify scheduling signatures. ## Integration N/A ## Review Notes Addresses #12097 (comment) mostly. --------- Signed-off-by: Iulian Barbu <iulian.barbu@parity.io> Co-authored-by: cmd[bot] <41898282+github-actions[bot]@users.noreply.github.com>

iulianbarbu · 2026-05-26T15:33:25Z

Lets also do a rebase on top of #10742 please.

…g-info-verify

iulianbarbu

lgtm! good work

eskimor

Ok, this validate_block function is needlessly convoluted (pre-existing) and especially the signal handling is a bit of a mess. Hard to read/border-line wrong. Fix, that also addresses some remarks I had on this PR.

paritytech-workflow-stopper · 2026-06-03T08:20:44Z

All GitHub workflows were cancelled due to failure one of the required jobs.
Failed workflow url: https://github.com/paritytech/polkadot-sdk/actions/runs/26872213117
Failed job name: test-linux-stable-int

iulianbarbu · 2026-06-03T12:56:36Z

+	/// Returns `true` only when every step succeeds; all error paths return `false` (fail-closed)
+	/// so the PVF rejects the candidate without panicking on adversarial input.
+	///
+	/// Steps:
+	/// 1. `signed_info.payload.internal_scheduling_parent` must equal the hash of the supplied
+	///    header. The caller (`check_scheduling`) has already verified the header hashes to the
+	///    derived internal scheduling parent, so this binds the signature to that same anchor.
+	/// 2. Read the relay slot from the BABE pre-digest of the header.
+	/// 3. Convert it to a parachain slot via `relay_slot * RELAY_CHAIN_SLOT_DURATION_MILLIS /
+	///    para_slot_duration`, using checked arithmetic.
+	/// 4. Pick the eligible author as `authorities[para_slot % authorities.len()]` from the cached
+	///    Aura authority set in this pallet.
+	/// 5. Decode the 64-byte signature blob as `<T::AuthorityId as RuntimeAppPublic>::Signature`
+	///    and verify it against the SCALE-encoded `SchedulingInfoPayload`.


nit: can we shorthen this?

iulianbarbu · 2026-06-03T12:57:49Z

+		// 1. Decode relay slot from the BABE pre-digest of the internal_scheduling_parent header.
+		//    The eligible parachain author is determined by *this* slot, anchoring the signature to
+		//    a specific block (the one being submitted/resubmitted) rather than to a moving relay
+		//    tip. `check_scheduling` proves this header is the actual relay block at
+		//    internal_scheduling_parent — it can't be substituted.


nit:

Suggested change

// 1. Decode relay slot from the BABE pre-digest of the internal_scheduling_parent header.

// The eligible parachain author is determined by *this* slot, anchoring the signature to

// a specific block (the one being submitted/resubmitted) rather than to a moving relay

// tip. `check_scheduling` proves this header is the actual relay block at

// internal_scheduling_parent — it can't be substituted.

// 1. Relay slot at internal scheduling parent gives the para slot that determines the valid

// author.

iulianbarbu · 2026-06-03T12:59:13Z

+		// 2. Convert relay slot to parachain slot. Both slot durations are in milliseconds; the
+		//    relay slot duration is the global Polkadot/Kusama/Westend/Rococo value re-exported by
+		//    polkadot-primitives, and the para slot duration is read from pallet-aura. Fail closed
+		//    on overflow rather than saturating, so an out-of-range relay slot can't quietly
+		//    produce a wrong author index.


Suggested change

// 2. Convert relay slot to parachain slot. Both slot durations are in milliseconds; the

// relay slot duration is the global Polkadot/Kusama/Westend/Rococo value re-exported by

// polkadot-primitives, and the para slot duration is read from pallet-aura. Fail closed

// on overflow rather than saturating, so an out-of-range relay slot can't quietly

// produce a wrong author index.

// 2. Determine the para slot.

iulianbarbu · 2026-06-03T13:02:27Z

+	use sp_keyring::{Ed25519Keyring, Sr25519Keyring};
+	use sp_runtime::generic::Digest;
+
+	const PARA_SLOT_DURATION_MS: u64 = 6_000;


nit: worth testing with 24s slots too.

iulianbarbu · 2026-06-03T15:31:46Z

+				// parachain state, which requires externalities — only available
+				// inside this scope. Run it once per PoV (on the first block) using
+				// the same authority set the seal was verified against.
+				if block_index == 0 {


~~I realise some parachain authorities could be changed after executing each block, so a more accurate check would be after executing all blocks. I suggested initially to have this check here, sorry.~~

Actually, during block building, the older authorities (from the parent), are relevant. Same applies during execution (the right to build the block is decided at the parent). Please ignore 😅

What I'd to at most is to run the signed scheduling info verification outside of the for loop - meaning we run_with_externalities_and_recorder against the parent_header, and not have this if block_index == 0 check at every iteration.

iulianbarbu · 2026-06-03T15:43:59Z

+
+	// 5. Validate relay_parent position. relay_parent must NOT be inside the header
+	// chain — it either equals internal_scheduling_parent (initial submission) or is
+	// an ancestor of it (resubmission), but never between scheduling_parent and


Being an ancestor of the ISP is not checked here. Honest collators check it. Validators should check it too, via the ancestor_relay_parent_info calls, but not sure at which point during the backing/inclusion pipeline. TO check this.

iulianbarbu · 2026-06-03T15:50:42Z

+- audience: Runtime Dev
+  description: |-
+    Verifies the `SignedSchedulingInfo` payload inside the PVF when a candidate is a V3
+    resubmission (`relay_parent != internal_scheduling_parent`). The verifier confirms


we verify now for initial submissions too, if the info is present

iulianbarbu · 2026-06-03T15:56:27Z

+    - Concerns like parachain session or para slot duration changes must be handled by
+      the resubmission engine, not the on-chain verifier
+      (see paritytech/polkadot-sdk#12036 (comment) 4479412418).


lets remove this (it is not necessarily a useful tip, more like an implementation detail that hasn't been tought through fully, but either way, not super relevant for the verifier at this point).

I'd rather mention that enabling resubmissions should be done only after the relay-chain is enabled to support them (the CandidateReceiptV3 node feature is set on-chain & V4 collator-protocol will be used between collators and validators, after both validators & collators upgrade their node binaries to ones that support V4 collator-protocol).

iulianbarbu · 2026-06-03T15:58:11Z


+	/// Map a slot to an author index in an authority set of size `authorities_count`,
+	/// or `None` if the set is empty.
+	pub fn slot_author_index(slot: Slot, authorities_count: usize) -> Option<u32> {


shouldn't we use the authorities_len() here?

eskimor and others added 30 commits December 17, 2025 16:00

Remove redundant implicit view from prospective parachains.

dfc51e2

Move relay chain scope things to relay chain scope.

c7de64b

For simplicity, reasoning and efficiency.

Remove pointless GetMinimumRelayParents message

29276ed

+ Refactor/cleanup + some docs.

Fix tests

a7394aa

Add prdoc

c57807f

Fix statement-distribution tests

c1440a5

Fix benchmakrs + major version bumps

d268ed7

Fix backing tests.

d1dc0da

Remove performance difference note - unrelated.

61f13f5

Fix tests.

d80f3f6

Reduce bits checked for v1 identification.

44e74de

First attempt in introducing new CandidateDescriptor

d548ee6

+ Fix a typo.

Cleanup + simplerversion checking.

ec09e00

Cleanup + make it typecheck.

a640e54

Remove yet unused SchedulingInfo.

1737e88

Drop v3 candidates in the runtime.

42d5001

Code simplification + fixes.

549244a

Simplification + fixes

f9ccd1b

Better future upgrade behavior + better docs.

b2655fe

Maintain old behavior when node feature is not set.

bd9ee57

v2 cleanup + fixes for v3.

4cdf77e

Fixes

c343c3f

Fixes.

e1aaa39

Add new accessor functions

f8dfbd1

Make it typecheck

2611b50

Fix type without blowing up Debug

851f950

Compilation fixes

754eb8a

Fixes.

18af332

Fix runtime tests.

5813ea9

iulianbarbu linked an issue May 25, 2026 that may be closed by this pull request

cumulus: verify the singned scheduling payload against the right author #12152

Open

review feedback

5fc563f

iulianbarbu commented May 26, 2026

View reviewed changes

Base automatically changed from rk-cumulus-v3-integration to master May 26, 2026 19:09

mchristou added 3 commits May 27, 2026 09:06

Merge remote-tracking branch 'origin/master' into ib-signed-schedulin…

06b9862

…g-info-verify

changes from feedback

0b346e4

fixes

420846a

iulianbarbu commented May 27, 2026

View reviewed changes

address review feedback

b1f26a5

iulianbarbu commented May 28, 2026

View reviewed changes

Comment thread cumulus/pallets/aura-ext/src/test.rs Outdated

iulianbarbu mentioned this pull request May 28, 2026

cumulus: unincluded segment submission with every RC slot #12228

Draft

prdoc

aaec6c3

mchristou added the T20-low-latency for issues and PRs related to Low Latency work label May 29, 2026

mchristou reviewed May 29, 2026

View reviewed changes

Comment thread cumulus/pallets/parachain-system/src/validate_block/scheduling.rs

add ed25519 coverage to the verifier tests

89ef822

mchristou changed the title ~~[WIP] cumulus: add SignedSchedulingInfo PVF verification~~ cumulus: add SignedSchedulingInfo PVF verification May 29, 2026

mchristou marked this pull request as ready for review May 29, 2026 08:26

mchristou added 4 commits May 29, 2026 11:57

Update Cargo.lock

ab6ba86

polishing

ec17859

move the verify call into the seal-verification scope

d1f5273

remove unused dep

34dc4b3

eskimor reviewed May 30, 2026

View reviewed changes

eskimor and others added 2 commits June 3, 2026 08:55

Cleanup UMP signal handling (#12240)

0fa1474

review feedback

2cd6fe6

mchristou requested a review from a team as a code owner June 3, 2026 08:11

ci fixes

2d17025

iulianbarbu commented Jun 3, 2026

View reviewed changes

Conversation

iulianbarbu commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Integration

Review Notes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

iulianbarbu commented May 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

iulianbarbu left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

eskimor left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

paritytech-workflow-stopper Bot commented Jun 3, 2026

Uh oh!

iulianbarbu Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

iulianbarbu Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

iulianbarbu Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

iulianbarbu Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

iulianbarbu Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iulianbarbu Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

iulianbarbu Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

iulianbarbu Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

iulianbarbu Jun 3, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

iulianbarbu commented May 18, 2026 •

edited

Loading

eskimor left a comment •

edited

Loading

iulianbarbu Jun 3, 2026 •

edited

Loading

iulianbarbu Jun 3, 2026 •

edited

Loading