Build(deps): Upgrade libsecp256k1 version 0.3.5 => 0.7.0

[RomanHodulak]

This resolves security issues with Signature::parse functions

See paritytech/libsecp256k1@b525d5d

Closes https://app.clickup.com/t/2c7n5yy

[joshuajbouw]

Just note that this only fixes it for local precompiles, not whats currently on NEAR. Those too would need to be looked at on nearcore as we use its host function in production.

[RomanHodulak]

@joshuajbouw Ok, good to know.

Right now I'm dealing with an issue that upgrading libsecp256k1 to 0.7.0 triggers some error that looks as if some dependency was dependent on std even with the std feature turned off.

error[E0152]: found duplicate lang item `panic_impl`
  --> engine/src/lib.rs:39:1
   |
39 | pub unsafe fn on_panic(info: &::core::panic::PanicInfo) -> ! {
   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   |
   = note: the lang item is first defined in crate `std` (which `subtle` depends on)
   = note: first definition in `std` loaded from /root/.rustup/toolchains/nightly-2022-01-26-x86_64-unknown-linux-gnu/lib/rustlib/wasm32-unknown-unknown/lib/libstd-c1c1fd00f07a7995.rlib
   = note: second definition in the local crate (`aurora_engine`)

error[E0152]: found duplicate lang item `oom`
  --> engine/src/lib.rs:62:1
   |
62 | pub unsafe fn on_alloc_error(_: core::alloc::Layout) -> ! {
   | ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   |
   = note: the lang item is first defined in crate `std` (which `subtle` depends on)
   = note: first definition in `std` loaded from /root/.rustup/toolchains/nightly-2022-01-26-x86_64-unknown-linux-gnu/lib/rustlib/wasm32-unknown-unknown/lib/libstd-c1c1fd00f07a7995.rlib
   = note: second definition in the local crate (`aurora_engine`)

[joshuajbouw]

yes the library is non-std, so you would need to disable it in the Cargo.toml.

[RomanHodulak]

Yes but I mean even when std feature of the crate is disabled

[RomanHodulak]

I'm certain that the issue is within aurora-blake2 dependencies.

One of which is crypto-mac.

And that is dependent on subtle and that is somehow being dependent on the std.

Looking at the crypto-mac repository, this crate has been discontinued and superseded by the digest crate.

Update

The cause of the issue was libsecp256k1 having a build.rs script dependent on std, which made the resolver use std feature also for the final build. The solution is to use resolver = "2" which resolves features individually per target, so build gets different features, such as std, but the same dependency then gets used without std in the final build. This fix is included in this PR.

I've updated aurora-blake2 in this PR aurora-is-near/aurora-blake2#1

[RomanHodulak]

Ready for review.

[joshuajbouw]

I'm updating the status to being blocked in favour of moving to std lib first. This should be done rather urgently.

See: #200

[birchmd]

LGTM
If it compiles without std then I don't see why we would wait on merging this. Unless there is some other drawback to resolver = 2 I am unaware of?

[joshuajbouw]

Needs rebasing