Merge release/2025.16-halloumi to develop

.github/workflows/publish-nym-binaries.yml

@@ -30,13 +30,11 @@ jobs:
       release_date: ${{ fromJSON(steps.create-release.outputs.assets)[0].published_at }}
       client_hash: ${{ steps.binary-hashes.outputs.client_hash }}
       nymvisor_hash: ${{ steps.binary-hashes.outputs.nymvisor_hash }}
-      nymnode_hash: ${{ steps.binary-hashes.outputs.nymnode_hash }}
       socks5_hash: ${{ steps.binary-hashes.outputs.socks5_hash }}
       netreq_hash: ${{ steps.binary-hashes.outputs.netreq_hash }}
       cli_hash: ${{ steps.binary-hashes.outputs.cli_hash }}
       client_version: ${{ steps.binary-versions.outputs.client_version }}
       nymvisor_version: ${{ steps.binary-versions.outputs.nymvisor_version }}
-      nymnode_version: ${{ steps.binary-versions.outputs.nymnode_version }}
       socks5_version: ${{ steps.binary-versions.outputs.socks5_version }}
       netreq_version: ${{ steps.binary-versions.outputs.netreq_version }}
       cli_version: ${{ steps.binary-versions.outputs.cli_version }}
@@ -56,7 +54,7 @@ jobs:
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
-          toolchain: 1.86.0
+          toolchain: 1.88.0
           override: true
 
       - name: Build all binaries
@@ -76,7 +74,6 @@ jobs:
             target/release/nym-network-requester
             target/release/nym-cli
             target/release/nymvisor
-            target/release/nym-node
           retention-days: 30
 
       - id: create-release
@@ -91,7 +88,6 @@ jobs:
             target/release/nym-network-requester
             target/release/nym-cli
             target/release/nymvisor
-            target/release/nym-node
 
   push-release-data-client:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-binaries-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}

CHANGELOG.md

@@ -4,6 +4,48 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2025.16-halloumi] (2025-09-16)
+
+- Backport metadata endpoint ([#6010])
+- bugfix: make sure tables are removed in correct order to not trigger FK constraint issue ([#5987])
+- chore: move authenticator into gateway crate ([#5982])
+- Fix the ns api ci workflow ([#5981])
+- Remove freshness check on testrun submit ([#5977])
+- Update sysinfo to the latest ([#5976])
+- bugfix: manually calculate per node work on rewarded set changes ([#5972])
+- fixing the ci for ns agent ([#5965])
+- Feature/testing utils ([#5963])
+- bugfix: fix ci-build for linux (and use updated runner) ([#5958])
+- chore: updated refs to cheddar rev of nym repo ([#5955])
+- http api client adjustment ([#5953])
+- chore: fix rust 1.89 clippy issues ([#5944])
+- Wireguard metadata client library ([#5943])
+- chore: remove unused import ([#5942])
+- feat: introduce additional checks when attempting to send to bounded channels ([#5941])
+- Move credential verifier in peer controller ([#5938])
+- change PK/FK on expiration date signatures tables ([#5934])
+- Wireguard private metadata ([#5915])
+
+[#6010]: https://github.com/nymtech/nym/pull/6010
+[#5987]: https://github.com/nymtech/nym/pull/5987
+[#5982]: https://github.com/nymtech/nym/pull/5982
+[#5981]: https://github.com/nymtech/nym/pull/5981
+[#5977]: https://github.com/nymtech/nym/pull/5977
+[#5976]: https://github.com/nymtech/nym/pull/5976
+[#5972]: https://github.com/nymtech/nym/pull/5972
+[#5965]: https://github.com/nymtech/nym/pull/5965
+[#5963]: https://github.com/nymtech/nym/pull/5963
+[#5958]: https://github.com/nymtech/nym/pull/5958
+[#5955]: https://github.com/nymtech/nym/pull/5955
+[#5953]: https://github.com/nymtech/nym/pull/5953
+[#5944]: https://github.com/nymtech/nym/pull/5944
+[#5943]: https://github.com/nymtech/nym/pull/5943
+[#5942]: https://github.com/nymtech/nym/pull/5942
+[#5941]: https://github.com/nymtech/nym/pull/5941
+[#5938]: https://github.com/nymtech/nym/pull/5938
+[#5934]: https://github.com/nymtech/nym/pull/5934
+[#5915]: https://github.com/nymtech/nym/pull/5915
+
 ## [2025.15-gruyere] (2025-08-20)
 
 - Migrate strum to 0.27.2 ([#5960])

Cargo.toml

@@ -102,6 +102,10 @@ members = [
     "common/wasm/storage",
     "common/wasm/utils",
     "common/wireguard",
+    "common/wireguard-private-metadata/client",
+    "common/wireguard-private-metadata/server",
+    "common/wireguard-private-metadata/shared",
+    "common/wireguard-private-metadata/tests",
     "common/wireguard-types",
     "common/zulip-client",
     "documentation/autodoc",

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.61"
+version = "1.1.62"
 authors = ["Dave Hrycyszyn <[email protected]>", "Jędrzej Stuczyński <[email protected]>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.61"
+version = "1.1.62"
 authors = ["Dave Hrycyszyn <[email protected]>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

common/credential-storage/migrations/20250805120000_expiration_date_signatures_epoch_fix.sql

@@ -110,14 +110,14 @@ FROM ecash_ticketbook;
 
 -- 6. finally swap out the old tables
 -- drop old tables
-DROP TABLE expiration_date_signatures;
 DROP TABLE pending_issuance;
 DROP TABLE ecash_ticketbook;
+DROP TABLE expiration_date_signatures;
 
 -- rename new tables
-ALTER TABLE expiration_date_signatures_new
-    RENAME TO expiration_date_signatures;
 ALTER TABLE pending_issuance_new
     RENAME TO pending_issuance;
 ALTER TABLE ecash_ticketbook_new
-    RENAME TO ecash_ticketbook;
+    RENAME TO ecash_ticketbook;
+ALTER TABLE expiration_date_signatures_new
+    RENAME TO expiration_date_signatures;

common/credential-verification/src/lib.rs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 use crate::ecash::traits::EcashManager;
+use async_trait::async_trait;
 use bandwidth_storage_manager::BandwidthStorageManager;
 use nym_credentials::ecash::utils::{cred_exp_date, ecash_today, EcashTime};
 use nym_credentials_interface::{Bandwidth, ClientTicket, TicketType};
@@ -139,3 +140,18 @@ impl CredentialVerifier {
             .await)
     }
 }
+
+#[async_trait]
+pub trait TicketVerifier {
+    /// Verify that the ticket is valid and cryptographically correct.
+    /// If the verification succeeds, also increase the bandwidth with the ticket's
+    /// amount and return the latest available bandwidth
+    async fn verify(&mut self) -> Result<i64>;
+}
+
+#[async_trait]
+impl TicketVerifier for CredentialVerifier {
+    async fn verify(&mut self) -> Result<i64> {
+        self.verify().await
+    }
+}

common/http-api-client/src/lib.rs

@@ -136,6 +136,7 @@
 //! ```
 #![warn(missing_docs)]
 
+pub use reqwest::ClientBuilder as ReqwestClientBuilder;
 pub use reqwest::StatusCode;
 
 use crate::path::RequestPath;

common/network-defaults/src/constants.rs

@@ -47,7 +47,8 @@ pub mod nyx {
 pub mod wireguard {
     use std::net::{Ipv4Addr, Ipv6Addr};
 
-    pub const WG_PORT: u16 = 51822;
+    pub const WG_TUNNEL_PORT: u16 = 51822;
+    pub const WG_METADATA_PORT: u16 = 51830;
 
     // The interface used to route traffic
     pub const WG_TUN_BASE_NAME: &str = "nymwg";

common/wireguard-private-metadata/client/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "nym-wireguard-private-metadata-client"
+version = "1.0.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[dependencies]
+async-trait = { workspace = true }
+tracing = { workspace = true }
+nym-http-api-client = { path = "../../http-api-client" }
+nym-wireguard-private-metadata-shared = { path = "../shared" }
+
+[lints]
+workspace = true

common/wireguard-private-metadata/client/src/lib.rs

@@ -0,0 +1,58 @@
+// Copyright 2025 - Nym Technologies SA <[email protected]>
+// SPDX-License-Identifier: Apache-2.0
+
+use async_trait::async_trait;
+use tracing::instrument;
+
+use nym_http_api_client::{ApiClient, Client, HttpClientError, NO_PARAMS};
+
+use nym_wireguard_private_metadata_shared::{
+    routes, Version, {ErrorResponse, Request, Response},
+};
+
+pub type WireguardMetadataApiClientError = HttpClientError<ErrorResponse>;
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+pub trait WireguardMetadataApiClient: ApiClient {
+    #[instrument(level = "debug", skip(self))]
+    async fn version(&self) -> Result<Version, WireguardMetadataApiClientError> {
+        let version: u64 = self
+            .get_json(
+                &[routes::V1_API_VERSION, routes::BANDWIDTH, routes::VERSION],
+                NO_PARAMS,
+            )
+            .await?;
+        Ok(version.into())
+    }
+
+    #[instrument(level = "debug", skip(self))]
+    async fn available_bandwidth(
+        &self,
+        request_body: &Request,
+    ) -> Result<Response, WireguardMetadataApiClientError> {
+        self.post_json(
+            &[routes::V1_API_VERSION, routes::BANDWIDTH, routes::AVAILABLE],
+            NO_PARAMS,
+            request_body,
+        )
+        .await
+    }
+
+    #[instrument(level = "debug", skip(self, request_body))]
+    async fn topup_bandwidth(
+        &self,
+        request_body: &Request,
+    ) -> Result<Response, WireguardMetadataApiClientError> {
+        self.post_json(
+            &[routes::V1_API_VERSION, routes::BANDWIDTH, routes::TOPUP],
+            NO_PARAMS,
+            request_body,
+        )
+        .await
+    }
+}
+
+#[cfg_attr(target_arch = "wasm32", async_trait(?Send))]
+#[cfg_attr(not(target_arch = "wasm32"), async_trait)]
+impl WireguardMetadataApiClient for Client {}