[adecaro]

Summary

Adds operator tooling for zkatsnark public parameters, and the open-policy deployment check that zkatdlog has. Until now, zkatsnark PPs could only be generated through the NWO integration generator. tokengen could not generate them, update their issuers or auditors, or print them.

This PR is part of the series of zkatsnark-vs-zkatdlog parity PRs against feature/zkat-snark-driver (#2590, #2591, #2592, and others).

Changes

• PublicParams.ValidateForDeployment (new file pp/deployment.go): mirrors zkatdlog and returns an open-policy-mode error when IssuerIdentities is empty.
• setup.GeneratePublicParams (new file setup/generate.go): a shared builder that applies defaults, then overrides, then runs Validate and SetupAll. It comes with ParseProofSystem and ParseCurve. It rejects:
  • MaxBits outside 1..64;
  • a precision greater than MaxBits;
  • a missing idemix key;
  • an unknown proof system or curve.
• NWO generator refactor. integration/nwo/token/generators/pp/zkatsnarkv1 now uses the shared builder, so the generation logic is no longer duplicated. This is in its own commit.
• New tokengen pp gen zkatsnark.v1 and tokengen pp update zkatsnark.v1 subcommands:
  • gen takes the proof system (groth16/plonk/plonkfri), curve, MaxBits, precision, idemix key, issuers, auditors and output path. It prints a notice about the chosen proof system's setup trust model, and a warning in open-policy mode, matching the existing drivers.
  • update replaces issuers and auditors, or appends them with deduplication, without regenerating keys. It checks that the input is a zkatsnark.v* PP, and it refuses a PP without circuit keys.
  • printpp now knows the zkatsnark format.
• Docs: docs/drivers/zkatsnark.md, docs/public_parameters.md, cmd/tokengen/README.md.
• Base-branch fix. A separate chore commit syncs golang.org/x/net in the zkatsnark go.mod. Without it, the module does not build on the base branch. Other parity branches carry the same commit.

Testing

• Unit tests:
  • pp/deployment_test.go and setup/generate_test.go;
  • cmd/tokengen/cobra/pp/zkatsnarkv1 gen/update tests, including a zkatdlog PP rejected with the identifier-mismatch error, a keyless PP rejected, append deduplication, and circuit keys preserved;
  • printpp and pp_test.go.
• TestZKATSNARKGenUpdatePrint: a gexec end-to-end test in cmd/tokengen/main_test.go that runs gen, then update, then print.
• The tests use the smallest valid parameters. No multi-MB PP testdata is committed.

The plan and the implementation were each reviewed by an independent agent.

Notes

• CI gap (pre-existing): cmd/tokengen is not in GO_PACKAGES, so the new tokengen tests do not run in CI. They were run locally.
• Open-policy messages: the zkatdlog and fabtoken gen commands still print their own inline open-policy message instead of calling ValidateForDeployment. Aligning them is left as a follow-up.

🤖 Generated with Claude Code