Struct CertBySenderVerifier 

pub struct CertBySenderVerifier<T: NodeType, C: Verifiable<T>> {
    tasks: JoinMap<T::SignatureKey, ((ViewNumber, EpochNumber), Option<ValidCert<C::Output>>)>,
    in_flight: BTreeMap<(ViewNumber, EpochNumber), T::SignatureKey>,
    parked: BTreeMap<(ViewNumber, EpochNumber), HashMap<T::SignatureKey, C>>,
    pending: HashMap<T::SignatureKey, C>,
    completed: BTreeSet<(ViewNumber, EpochNumber)>,
    completion: Completion,
    lower_bound: ViewNumber,
    membership: EpochMembershipCoordinator<T>,
    upgrade_lock: UpgradeLock<T>,
    invalid_certs: u64,
}

Verifies certificates off the main coordinator thread.

Unlike CertVerifier, these certificates are keyed by sender key instead of view/epoch, helping a lagging node jump to the frontier. A sender’s submission is dropped while its previous one is still being verified, and only one verification runs per CompletionKey: copies of an in-flight certificate from other senders are parked and tried in turn only if the in-flight one proves invalid.

Memory is bounded by the committee, not by the view space. A copy is only parked while its key is in flight (parked.keys() ⊆ in_flight.keys()) and in_flight holds at most one key per sender, so at most committee_size keys are parked at once, each holding at most committee_size copies. A single peer occupies its own in-flight slot plus at most one parked slot per other in-flight key. The subset relation holds because every path that removes an in_flight entry also clears or re-fills the key’s parked entry: the three arms of Self::next, Self::mark_completed and Self::gc.

Fields

tasks: JoinMap<T::SignatureKey, ((ViewNumber, EpochNumber), Option<ValidCert<C::Output>>)>

in_flight: BTreeMap<(ViewNumber, EpochNumber), T::SignatureKey>

The sender whose copy is being verified, per key. A sender has at most one entry at a time, since Self::verify drops its submissions while it has a task; the Err arm of Self::next relies on that to find a panicked task’s key.

parked: BTreeMap<(ViewNumber, EpochNumber), HashMap<T::SignatureKey, C>>

Copies of an in-flight certificate from other senders, waiting on it.

pending: HashMap<T::SignatureKey, C>

completed: BTreeSet<(ViewNumber, EpochNumber)>

completion: Completion

lower_bound: ViewNumber

membership: EpochMembershipCoordinator<T>

upgrade_lock: UpgradeLock<T>

invalid_certs: u64

Implementations

impl<T: NodeType, C: Verifiable<T> + Send + 'static> CertBySenderVerifier<T, C>

where C::Output: HasViewNumber,

pub fn new( membership: EpochMembershipCoordinator<T>, upgrade_lock: UpgradeLock<T>, completion: Completion, ) -> Self

pub fn verify( &mut self, sender: T::SignatureKey, cert: C, ) -> Option<EpochNumber>

Submit an item received from sender for verification.

Dropped if the sender’s previous submission is still being verified; parked if the same certificate is already being verified for another sender. If the epoch’s membership isn’t ready the item is held and its epoch returned so the caller can drive that epoch’s catchup.

pub fn mark_completed(&mut self, view: ViewNumber, epoch: EpochNumber)

Record that this view’s item was completed by other means, in epoch.

This can happen locally from votes for example.

pub fn retry_pending(&mut self) -> Vec<EpochNumber>

Re-attempt any items deferred because their epoch stake table wasn’t available. Returns the epochs whose stake table is still missing so the caller can keep driving their catchup.

pub async fn next(&mut self) -> Option<ValidCert<C::Output>>

pub fn gc(&mut self, view: ViewNumber)

fn completion_key( &self, view: ViewNumber, epoch: EpochNumber, ) -> (ViewNumber, EpochNumber)

What a completed item is remembered by.

pub fn num_invalid_certs(&self) -> u64

fn promote_parked(&mut self, key: (ViewNumber, EpochNumber))

Try key’s parked copies, in random order, until one spawns.

The order is random so that a Byzantine sender whose copies always prove invalid can’t be first in line every time and delay the honest copies behind it. A copy whose sender is now busy on another key is dropped rather than re-parked, and a copy deferred for a missing stake table lands in pending without its epoch being requested here: the table was available when the in-flight copy spawned, so Self::retry_pending recovers it. Either way the key stays incomplete and the next rebroadcast spawns afresh.

fn next_parked_sender( &mut self, key: (ViewNumber, EpochNumber), ) -> Option<(T::SignatureKey, C)>