From 18d3a3eccec64120953ad629d15ac5d531e0ac15 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1s=20Gr=C3=BCner?=
 <47506558+MegaRedHand@users.noreply.github.com>
Date: Tue, 26 May 2026 15:18:30 -0300
Subject: [PATCH 1/3] chore(deps): bump leanSpec to 825bec6, rename fork to
 Lstar

The pinned leanSpec commit (18fe71f, 2026-04-29) predates two upstream
changes that together broke `make test`:

- PR #725 (f12000b) renamed the key JSON schema from
  `attestation_public` / `proposal_public` to
  `attestation_keypair.public_key` / `proposal_keypair.public_key`.
  The released test keys at the `latest` tag use the new schema,
  so fixture generation fails with `KeyError: 'attestation_public'`.
- PR #745 (825bec6) fixes a tempfile buffer bug where the gzip writer
  wasn't closed before tar read, causing intermittent download
  truncation that surfaces as a misleading click `Aborted!` message
  (EOFError caught by click's top-level handler).

Also rename `--fork devnet` to `--fork Lstar` to match the upstream
fork rename.
---
 Makefile | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Makefile b/Makefile
index 74901c8d..8568d137 100644
--- a/Makefile
+++ b/Makefile
@@ -24,15 +24,15 @@ docker-build: ## 🐳 Build the Docker image
 		-t ghcr.io/lambdaclass/ethlambda:$(DOCKER_TAG) .
 	@echo
 
-# 2026-04-29
-LEAN_SPEC_COMMIT_HASH:=18fe71fee49f8865a5c8a4cb8b1787b0cbc9e25b
+# 2026-05-21
+LEAN_SPEC_COMMIT_HASH:=825bec6bf278920cfc56730d64a7c90522a0bb6c
 
 leanSpec:
 	git clone https://github.com/leanEthereum/leanSpec.git --single-branch
 	cd leanSpec && git checkout $(LEAN_SPEC_COMMIT_HASH)
 
 leanSpec/fixtures: leanSpec
-	cd leanSpec && uv run fill --fork devnet -n auto --scheme=prod -o fixtures
+	cd leanSpec && uv run fill --fork Lstar -n auto --scheme prod -o fixtures
 
 lean-quickstart:
 	git clone https://github.com/blockblaz/lean-quickstart.git --depth 1 --single-branch

From aaf28a7c4b343b18094d84c3dfc691b7a01ec0b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1s=20Gr=C3=BCner?=
 <47506558+MegaRedHand@users.noreply.github.com>
Date: Tue, 26 May 2026 15:28:44 -0300
Subject: [PATCH 2/3] ci: rename fork from Devnet to Lstar in fixture
 generation

Match the upstream leanSpec fork rename, parallel to the Makefile change.
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a0c70608..60638e44 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -120,7 +120,7 @@ jobs:
       - name: Generate test fixtures
         if: steps.cache-fixtures.outputs.cache-hit != 'true'
         working-directory: leanSpec
-        run: uv run fill --fork=Devnet --scheme prod -o fixtures -n auto
+        run: uv run fill --fork=Lstar --scheme prod -o fixtures -n auto
 
       # Save fixtures even if a later step fails, so a re-run does not
       # have to regenerate them. See: https://github.com/actions/cache/tree/main/save#always-save-cache

From 5b76190cf1785f8138e77d315926ab71a8fb3360 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tom=C3=A1s=20Gr=C3=BCner?=
 <47506558+MegaRedHand@users.noreply.github.com>
Date: Wed, 27 May 2026 13:31:07 -0300
Subject: [PATCH 3/3] fix(deps): pin leanSpec to f12000b (pre-devnet5) to keep
 make test green

Pinning to 825bec6 unintentionally pulled in leanSpec's devnet5 aggregated
proof wire format (PR #717, an unavoidable ancestor of the download fix
#745). That format requires the full crypto-stack migration tracked in the
devnet5 PRs (#378/#370) and is not yet on main, so the forkchoice spec
tests failed with AggregateVerificationFailed(DeserializationFailed).

Repoint to f12000b (PR #725), the commit just before devnet5. It carries
the key-schema rename that unbreaks fixture generation against the released
`latest` test keys, while staying on the old proof format that the current
leanMultisig@5eba3b1 still understands. The proofData -> proof field rename
is therefore not needed and is reverted.

f12000b predates the download fix (#745), whose download_keys reads the
still-open download tempfile and intermittently aborts with EOFError. Work
around it in both the Makefile and CI by fetching+extracting the prod keys
with curl+tar before `fill`, so the buggy code path is skipped. Both blocks
are flagged for removal once the pin moves past #745.

Verified against freshly regenerated f12000b fixtures: forkchoice 84/0,
signatures 11/0, full workspace 421/0.
---
 .github/workflows/ci.yml | 13 ++++++++++++-
 Makefile                 | 18 +++++++++++++++---
 2 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 60638e44..df8c131c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,10 +98,21 @@ jobs:
           path: leanSpec/packages/testing/src/consensus_testing/test_keys/prod_scheme
           key: prod-keys-${{ steps.prod-keys-url.outputs.hash }}
 
+      # Download + extract the keys ourselves rather than via
+      # `consensus_testing.keys --download`. The pinned leanSpec commit predates
+      # leanSpec PR #745, whose `download_keys` reads the still-open (unflushed)
+      # download tempfile, intermittently truncating the gzip tail and aborting
+      # with EOFError. curl+tar fully writes the archive before reading it.
+      # Remove once the pin moves past PR #745.
       - name: Download production keys
         if: steps.cache-fixtures.outputs.cache-hit != 'true' && steps.cache-prod-keys.outputs.cache-hit != 'true'
         working-directory: leanSpec
-        run: uv run python -m consensus_testing.keys --download --scheme prod
+        run: |
+          KEYS_URL=$(uv run python -c "from consensus_testing.keys import KEY_DOWNLOAD_URLS; print(KEY_DOWNLOAD_URLS['prod'])")
+          KEYS_DIR=packages/testing/src/consensus_testing/test_keys
+          mkdir -p "$KEYS_DIR"
+          curl -sSL "$KEYS_URL" -o /tmp/prod_scheme.tar.gz
+          tar -xzf /tmp/prod_scheme.tar.gz -C "$KEYS_DIR"
 
       # Save production keys even if a later step fails, so a re-run does
       # not have to re-download. See: https://github.com/actions/cache/tree/main/save#always-save-cache
diff --git a/Makefile b/Makefile
index 8568d137..d1234c3f 100644
--- a/Makefile
+++ b/Makefile
@@ -24,15 +24,27 @@ docker-build: ## 🐳 Build the Docker image
 		-t ghcr.io/lambdaclass/ethlambda:$(DOCKER_TAG) .
 	@echo
 
-# 2026-05-21
-LEAN_SPEC_COMMIT_HASH:=825bec6bf278920cfc56730d64a7c90522a0bb6c
+# 2026-05-17
+LEAN_SPEC_COMMIT_HASH:=f12000bd68a9640cffdfbd9a07503c9112d32bee
 
 leanSpec:
 	git clone https://github.com/leanEthereum/leanSpec.git --single-branch
 	cd leanSpec && git checkout $(LEAN_SPEC_COMMIT_HASH)
 
+# Pre-download the prod keys ourselves before `fill`. The pinned leanSpec
+# commit predates leanSpec PR #745, whose `download_keys` reads the still-open
+# (unflushed) download tempfile, intermittently truncating the gzip tail and
+# aborting with EOFError. A plain curl+tar fully writes the archive before
+# reading it, sidestepping the bug. `fill` then sees the keys already present
+# and skips its own download. Remove once the pin moves past PR #745.
 leanSpec/fixtures: leanSpec
-	cd leanSpec && uv run fill --fork Lstar -n auto --scheme prod -o fixtures
+	cd leanSpec && \
+		KEYS_URL=$$(uv run python -c "from consensus_testing.keys import KEY_DOWNLOAD_URLS; print(KEY_DOWNLOAD_URLS['prod'])") && \
+		KEYS_DIR=packages/testing/src/consensus_testing/test_keys && \
+		mkdir -p $$KEYS_DIR && \
+		curl -sSL "$$KEYS_URL" -o /tmp/prod_scheme.tar.gz && \
+		tar -xzf /tmp/prod_scheme.tar.gz -C $$KEYS_DIR && \
+		uv run fill --fork Lstar -n auto --scheme prod -o fixtures
 
 lean-quickstart:
 	git clone https://github.com/blockblaz/lean-quickstart.git --depth 1 --single-branch