Keystone in CRIB (#14326)

* Add node api wrapper for ergonomic cmd usage

* Add streams trigger template

* Add mock external adapter for v03 mercury

* First pass of streams trigger provisioning

* WIP: Add capabilities registry provisioner script

* Update nix flake

* Fixup provisioning scripts

* Change default chainid to be 1337

* Add nil check for balances

* Add ability to skip tls verification for local dev

* Gently fail on not loading contracts for ocr job deletion

* fixup! Change default chainid to be 1337

* Formatting

* Change ocr file flag default

* Allow for multiple OCR2KB selection in key fetching

* Support on/offchain transmitter OCR3 config generation

* Properly reset clientmethod on each invocation

* Add mercury contract deployment feature

* Get oracles to successfully connect to each other

* Keep OCR3 and OCR2 config separate

* Add goreleaser setup for mock ea

* Add support for updating bridges

* Add UpdateBridge CLI command

* Cleanup comments

* Fix typo

* Add revert detection and revert reason extraction

* Add missing env field to CR struct

* Fix CR deployment bugs

* Fix trigger capability typo

* Add external registry and capability p2p config gen

* Add redial support for logging in

* Fix capability registration

* HACK: Add keystone workflow deployment to streams trigger cmd

* Typo

* Log ocr3 config more extensively

* Set isPublic to false for all-in-one DON

* Use nodeapi for deleting ocr3 jobs

* Have mock EA return consistent prices every 10 sec

* Remove pluginconfig to properly enable trigger

* Add additional logging

* Fix rebase errors

* Shim ksdeploy types

* Fix goreleaser config for mock ea

* Dont depend on cgo for mock EA

* Handle aptos key creation

* Tune mercury OCR rounds to be less freq

* Use deployments rather than pods

* Overhaul node host + url handling

* Add dummy encryption public key to nodes

* Add missing ctx

* Initial multidon support

* Fix ingress generation for postprevision

* Fix argument ordering

* Fix nodelist sorting and evmconfig.workflow configuration

* Update tests

* Assign keystone workflows to workflow nodes

* Expose capabilities on WorkflowDON

* Skip bootstrap node for keystone workflows

* Refactor nodelists + pubkeys -> nodesets

* Skip adding bootstrap nodes to capability registry

* Skip bootstrap node for mercury OCR config

* Formatting

* Fix stale print statement

* Bump nodeset size to minimum 5 since > 2F+1

* Use service name for DNS resolution

* Update tests

* Fix missing / incorrect fields for keystone workflow

* Update gomods

* Simplify node key handling

* Formatting

* Add test mocks

* Refactor - Use single entrypoint for provisiong keystone in CRIB

* Add OCR3 caching

* Refactor provisioning flags and improve argument validation in keystone script

* Refactor: Remove stale references and fix refactor related bugs

* Create artefacts dir if it doesnt exist

* Simplify jobspec and bridge handling

* Remove unneeded token transfer calls

* Refactor: Cleanup logging, add more tx caching

* Fix post-rebase errors

* Fix OCR3 digest comparison

* Remove extra cmd cruft

* Remove unused func

* Undo transmitter changes

* Revert "Add test mocks"

This reverts commit 75cafe9.

* Fix caching

* Remove deprecated assertion call

* Update gomod

* Fix linter warns

* Add changeset

* Add additional logging around node sets and key fetching

* Run gomodtidy

* Fix additional lints

* Harden API request logic

* Readme WIP

* Clean up lints, remove old readme

* Increase retry interval

* Update goreleaser to 2.4.4-pro

* Handle non postfix path

* Resolve darwin shell hook from git root

* Bump streams trigger cap to 1.1.0

* Create toolkit sub-cli

* Cleanup toolkit

* Reverse URLs for nodelists

* Update snapshots

* Remove unneeded gosec ignore

* Update gomods

* Log when we set ocr3 config

* Cleanup argument parsing

* Fix nodes list parsing

* Fix lints + address feedback

* Update gomods to point to this branches pseudo version

* Update gomods to point to this branches pseudo version

* Bump wrappers to 1.1.0

* fix test indentation, quoting

* revert bad merge to main; workflow.go, cap_encoder*

* linter

---------

Co-authored-by: Justin Kaseman <justinkaseman@live.com>
Co-authored-by: krehermann <16602512+krehermann@users.noreply.github.com>

.changeset/loud-birds-remain.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+#internal Add unexposed shell cmd for updating a bridge

core/cmd/bridge_commands.go

@@ -128,6 +128,29 @@ func (s *Shell) CreateBridge(c *cli.Context) (err error) {
 	return s.renderAPIResponse(resp, &BridgePresenter{})
 }
 
+func (s *Shell) UpdateBridge(c *cli.Context) (err error) {
+	if !c.Args().Present() {
+		return s.errorOut(errors.New("must pass the name of the bridge to be updated"))
+	}
+	bridgeName := c.Args().First()
+	buf, err := getBufferFromJSON(c.Args().Get(1))
+	if err != nil {
+		return s.errorOut(err)
+	}
+
+	resp, err := s.HTTP.Patch(s.ctx(), "/v2/bridge_types/"+bridgeName, buf)
+	if err != nil {
+		return s.errorOut(err)
+	}
+	defer func() {
+		if cerr := resp.Body.Close(); cerr != nil {
+			err = multierr.Append(err, cerr)
+		}
+	}()
+
+	return s.renderAPIResponse(resp, &BridgePresenter{})
+}
+
 // RemoveBridge removes a specific Bridge by name.
 func (s *Shell) RemoveBridge(c *cli.Context) (err error) {
 	if !c.Args().Present() {

core/cmd/bridge_commands_test.go

@@ -3,6 +3,7 @@ package cmd_test
 import (
 	"bytes"
 	"flag"
+	"fmt"
 	"testing"
 	"time"
 
@@ -191,3 +192,44 @@ func TestShell_RemoveBridge(t *testing.T) {
 	assert.Equal(t, bt.URL.String(), p.URL)
 	assert.Equal(t, bt.Confirmations, p.Confirmations)
 }
+func TestShell_UpdateBridge(t *testing.T) {
+	t.Parallel()
+
+	app := startNewApplicationV2(t, nil)
+	client, _ := app.NewShellAndRenderer()
+	name := testutils.RandomizeName("updatebridge")
+
+	bt := &bridges.BridgeType{
+		Name:          bridges.MustParseBridgeName(name),
+		URL:           cltest.WebURL(t, "https://testing.com/bridges"),
+		Confirmations: 0,
+	}
+	require.NoError(t, app.BridgeORM().CreateBridgeType(testutils.Context(t), bt))
+	tests := []struct {
+		name    string
+		args    []string
+		errored bool
+	}{
+		{"NoArgs", []string{}, true},
+		{"OnlyName", []string{name}, true},
+		{"ValidUpdate", []string{name, fmt.Sprintf(`{ "name": "%s", "url": "http://localhost:3000/updated" }`, name)}, false},
+		{"InvalidJSON", []string{name, `{ "url": "http://localhost:3000/updated"`}, true},
+	}
+
+	for _, tt := range tests {
+		test := tt
+		t.Run(test.name, func(t *testing.T) {
+			set := flag.NewFlagSet("bridge", 0)
+			flagSetApplyFromAction(client.UpdateBridge, set, "")
+
+			require.NoError(t, set.Parse(test.args))
+
+			c := cli.NewContext(nil, set, nil)
+			if test.errored {
+				assert.Error(t, client.UpdateBridge(c))
+			} else {
+				assert.NoError(t, client.UpdateBridge(c))
+			}
+		})
+	}
+}

core/scripts/common/helpers.go

@@ -3,10 +3,12 @@ package common
 import (
 	"context"
 	"crypto/ecdsa"
+	"crypto/tls"
 	"encoding/hex"
 	"flag"
 	"fmt"
 	"math/big"
+	"net/http"
 	"os"
 	"strconv"
 	"strings"
@@ -69,11 +71,17 @@ func SetupEnv(overrideNonce bool) Environment {
 		panic("need account key")
 	}
 
-	ec, err := ethclient.Dial(ethURL)
-	PanicErr(err)
-
-	jsonRPCClient, err := rpc.Dial(ethURL)
+	insecureSkipVerify := os.Getenv("INSECURE_SKIP_VERIFY") == "true"
+	tr := &http.Transport{
+		// User enables this at their own risk!
+		// #nosec G402
+		TLSClientConfig: &tls.Config{InsecureSkipVerify: insecureSkipVerify},
+	}
+	httpClient := &http.Client{Transport: tr}
+	rpcConfig := rpc.WithHTTPClient(httpClient)
+	jsonRPCClient, err := rpc.DialOptions(context.Background(), ethURL, rpcConfig)
 	PanicErr(err)
+	ec := ethclient.NewClient(jsonRPCClient)
 
 	chainID, err := strconv.ParseInt(chainIDEnv, 10, 64)
 	PanicErr(err)

core/scripts/go.mod

@@ -34,14 +34,18 @@ require (
 	github.com/shopspring/decimal v1.4.0
 	github.com/smartcontractkit/chainlink-automation v0.8.1
 	github.com/smartcontractkit/chainlink-common v0.4.1-0.20250108194320-2ebd63bbb16e
+	github.com/smartcontractkit/chainlink-data-streams v0.1.1-0.20241216163550-fa030d178ba3
+	github.com/smartcontractkit/chainlink-testing-framework/lib v1.50.13
 	github.com/smartcontractkit/libocr v0.0.0-20241223215956-e5b78d8e3919
 	github.com/spf13/cobra v1.8.1
 	github.com/spf13/viper v1.19.0
 	github.com/stretchr/testify v1.10.0
 	github.com/umbracle/ethgo v0.1.3
 	github.com/umbracle/fastrlp v0.0.0-20220527094140-59d5dd30e722
 	github.com/urfave/cli v1.22.14
+	go.uber.org/zap v1.27.0
 	google.golang.org/protobuf v1.35.1
+	gopkg.in/yaml.v3 v3.0.1
 	k8s.io/api v0.31.1
 	k8s.io/apimachinery v0.31.1
 	k8s.io/client-go v0.31.1
@@ -309,14 +313,12 @@ require (
 	github.com/smartcontractkit/chainlink-ccip v0.0.0-20250110181647-9dba278f2103 // indirect
 	github.com/smartcontractkit/chainlink-ccip/chains/solana v0.0.0-20250103152858-8973fd0c912b // indirect
 	github.com/smartcontractkit/chainlink-cosmos v0.5.2-0.20241202195413-82468150ac1e // indirect
-	github.com/smartcontractkit/chainlink-data-streams v0.1.1-0.20241216163550-fa030d178ba3 // indirect
 	github.com/smartcontractkit/chainlink-feeds v0.1.1 // indirect
 	github.com/smartcontractkit/chainlink-framework/multinode v0.0.0-20241220173418-09e17ddbeb20 // indirect
 	github.com/smartcontractkit/chainlink-protos/job-distributor v0.6.0 // indirect
 	github.com/smartcontractkit/chainlink-protos/orchestrator v0.4.0 // indirect
 	github.com/smartcontractkit/chainlink-solana v1.1.1-0.20250110142550-e2a9566d39f3 // indirect
 	github.com/smartcontractkit/chainlink-starknet/relayer v0.1.1-0.20241202202529-2033490e77b8 // indirect
-	github.com/smartcontractkit/chainlink-testing-framework/lib v1.50.13 // indirect
 	github.com/smartcontractkit/grpc-proxy v0.0.0-20240830132753-a7e17fec5ab7 // indirect
 	github.com/smartcontractkit/tdh2/go/ocr2/decryptionplugin v0.0.0-20241009055228-33d0c0bf38de // indirect
 	github.com/smartcontractkit/tdh2/go/tdh2 v0.0.0-20241009055228-33d0c0bf38de // indirect
@@ -381,7 +383,6 @@ require (
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/ratelimit v0.3.1 // indirect
-	go.uber.org/zap v1.27.0 // indirect
 	golang.org/x/arch v0.11.0 // indirect
 	golang.org/x/crypto v0.31.0 // indirect
 	golang.org/x/exp v0.0.0-20241210194714-1829a127f884 // indirect
@@ -405,7 +406,6 @@ require (
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20240709000822-3c01b740850f // indirect
 	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect

core/scripts/keystone/main.go

@@ -15,13 +15,9 @@ type command interface {
 
 func main() {
 	commands := []command{
-		src.NewDeployContractsCommand(),
-		src.NewDeployJobSpecsCommand(),
-		src.NewGenerateCribClusterOverridesCommand(),
-		src.NewDeleteJobsCommand(),
+		src.NewProvisionKeystoneCommand(),
 		src.NewDeployAndInitializeCapabilitiesRegistryCommand(),
-		src.NewDeployWorkflowsCommand(),
-		src.NewDeleteWorkflowsCommand(),
+		src.NewToolkit(),
 	}
 
 	commandsList := func(commands []command) string {