Repository navigation
Mirror the powers-of-tau file into our own bucket - #125
Merged
Merged
Conversation
The testing setup downloads powersOfTau28_hez_final_21.ptau from the Polygon
zkEVM public GCS bucket. That bucket revoked anonymous access on 2026-09-02,
and every other public Hermez mirror (hermez S3, PSE) now returns 403 as well,
so `task.sh setup procure-testing-setup` fails outright with
HTTPError: HTTP Error 403: Forbidden
This broke the internal-ops "[Keyless] e2e tests" workflow, which has failed
every 4-hourly run since 2026-09-02 20:00 UTC.
Mirror the file into gs://aptos-circuit-testing-setups (the bucket this repo
already uses as its setup cache, and which is anonymously readable, so CI needs
no credentials) and try it first, keeping upstream as a fallback in case it
comes back. Verified end-to-end: an unauthenticated urllib download of the
mirrored URL returns all 2416002200 bytes and matches PTAU_CHECKSUM.
Also fail with a clear message rather than an unhandled HTTPError traceback
when no source works.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
alinush
self-requested a review
September 3, 2026 17:25
alinush
approved these changes
Sep 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
task.sh setup procure-testing-setupdownloadspowersOfTau28_hez_final_21.ptaufrom the Polygon zkEVM public GCS bucket. That bucket revoked anonymous access on 2026-09-02, so the download now fails:Every other public Hermez mirror I could find (hermez S3
eu-west-1, PSEpse-trusted-setup-ppot) returns 403 as well — this looks like the public hosting for these files was withdrawn wholesale.This took out the internal-ops [Keyless] e2e tests workflow, which has failed every 4-hourly run since 2026-09-02 20:00 UTC (last green: 16:00 UTC, whose log shows the ptau download still succeeding at 16:05).
Fix
Mirror the file into
gs://aptos-circuit-testing-setupsand try it first, keeping upstream as a fallback in case it comes back.That bucket was chosen because it is already anonymously readable — the CI job that needs this file has no GCP credentials at all, so the mirror has to be fetchable unauthenticated. It is also already this repo's setup-cache bucket (
setups/cache.py), so the file sits with related assets rather than in new infrastructure.The
PTAU_CHECKSUMverification is unchanged and still runs regardless of which source served the file.Verification
The mirrored object was verified end-to-end, unauthenticated, through the exact
urllibpath this code uses:The source file came from our own
circuit-v4.0.0-ph2-ceremonyS3 bucket (pot/phase_1.ptau, uploaded by the ceremony script,min_power= 21). It matches both independently recorded expected values: thePTAU_CHECKSUMsha256 here, andEXPECTED_B2SUMS[21]in internal-opsscripts/keyless/utils.py.The fallback logic itself was unit-tested for three cases — mirror up (upstream never touched), mirror down/upstream up (falls through), both down (clean
exit(2)instead of an unhandled traceback).Not verified locally: the full keyless e2e suite, which needs a complete aptos-core + circuit build. That runs in the internal-ops workflow.
Related
aptos-labs/internal-ops has a companion PR fixing the same dead URL in
start_ceremony_with_p0tion.py.🤖 Generated with Claude Code