More consensus rules in block verification (paritytech#28)

* Revisit max_sig_ops check

* Check block height in coinbase

* Check witness commitment

* Check header version

* Add height to Coin

* Check PrematureSpendOfCoinbase

* Move get_legacy_sig_op_count() into tx_verify module

* Check total_sig_ops_cost

* Use secrets.GITHUB_TOKEN instead of github.token

* Fix clippy

* Fix test

* Update docs

* Docs

.github/workflows/docker.yml

@@ -51,7 +51,7 @@ jobs:
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
-          password: ${{ github.token }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Extract Docker metadata
         id: meta

crates/pallet-bitcoin/src/lib.rs

@@ -20,6 +20,8 @@ use frame_support::dispatch::DispatchResult;
 use frame_support::weights::Weight;
 use scale_info::TypeInfo;
 use sp_core::H256;
+use sp_runtime::traits::BlockNumberProvider;
+use sp_runtime::SaturatedConversion;
 use sp_std::prelude::*;
 use sp_std::vec::Vec;
 use subcoin_runtime_primitives::Coin;
@@ -156,6 +158,7 @@ pub mod pallet {
                         is_coinbase: true,
                         amount: txout.value.to_sat(),
                         script_pubkey: txout.script_pubkey.clone().into_bytes(),
+                        height: 0u32,
                     };
                     Coins::<T>::insert(txid.clone(), index as u32, coin);
                 });
@@ -197,6 +200,8 @@ impl<T: Config> Pallet<T> {
         let txid = tx.compute_txid();
         let is_coinbase = tx.is_coinbase();
 
+        let height = frame_system::Pallet::<T>::current_block_number();
+
         let new_coins = tx
             .output
             .into_iter()
@@ -210,6 +215,7 @@ impl<T: Config> Pallet<T> {
                     is_coinbase,
                     amount: txout.value.to_sat(),
                     script_pubkey: txout.script_pubkey.into_bytes(),
+                    height: height.saturated_into(),
                 };
 
                 (out_point, coin)

crates/sc-consensus-nakamoto/src/block_executor.rs

@@ -4,6 +4,7 @@ use sc_client_api::{AuxStore, Backend, BlockBackend, HeaderBackend, StorageProvi
 use sc_consensus::{BlockImport, BlockImportParams, ImportResult, StateAction, StorageChanges};
 use sp_api::{ApiExt, CallApiAt, CallContext, Core, ProvideRuntimeApi};
 use sp_runtime::traits::{Block as BlockT, HashingFor, Header as HeaderT};
+use sp_runtime::SaturatedConversion;
 use sp_state_machine::{StorageKey, StorageValue};
 use std::marker::PhantomData;
 use std::sync::Arc;
@@ -312,6 +313,7 @@ fn apply_extrinsics_off_runtime<
 >(
     extrinsics: Vec<Block::Extrinsic>,
     coin_storage_key: &Arc<dyn CoinStorageKey>,
+    height: u32,
 ) -> Vec<(Vec<StorageEntry>, Option<u32>)> {
     use codec::Encode;
 
@@ -338,6 +340,7 @@ fn apply_extrinsics_off_runtime<
                     is_coinbase,
                     amount: txout.value.to_sat(),
                     script_pubkey: txout.script_pubkey.into_bytes(),
+                    height,
                 };
 
                 changes.push((storage_key, Some(coin.encode())));
@@ -418,9 +421,17 @@ where
         exec_details.pre = t.elapsed().as_nanos();
 
         let t = std::time::Instant::now();
+        let parent_number: u32 = self
+            .client
+            .number(parent_hash)
+            .ok()
+            .flatten()
+            .expect("Parent block must exist; qed")
+            .saturated_into();
         let block_storage_changes = apply_extrinsics_off_runtime::<Block, TransactionAdapter>(
             extrinsics,
             &self.coin_storage_key,
+            parent_number + 1,
         );
         exec_details.apply = t.elapsed().as_nanos();