QRL Weekly, 2026-October-16

Weekly Development Snapshot

Status

• September 18th: QRL Release Verifier audit complete
• September 11th: Ledger app audit and remediation complete
• August 4th: Audit results published for go-qrllib
• April 3rd: Audit complete of 2 cryptographic libraries
• March 31st: QRL 2.0 Testnet V2 released
• Audits & Remediation: 60%

QRL 2.0 Testnet V3 remaining checklist:

• [80%] Config parameters
• [70%] Testnet V2 scoped internal audits (goqrl, qrysm remaining)
• [40%] QRL v1.0 -> v2.0 migration testing (added)
• Note: No ETA, but watch this space, things are getting close.

QRL v2.0

rust-qrllib

• Added a Falcon-1024 signature primitive in Rust with ACVP signature verification, added ML-DSA sigVer to CI, enabled SHAKE zeroization, expanded Rustdoc, and released v0.1.6. Subsequent CI/dependency work restricted Codecov uploads appropriately and refreshed Vite/setup-node.

go-qrllib

• Follow-up Falcon testing fixed the zero-padding test so signatures are regenerated until sufficient padding space exists. CI also received an SBOM action update.

qrypto.js

• Updated nine dependencies plus Turbo and the Anchore SBOM action, keeping the JavaScript crypto stack and CI/tooling current.

go-qrl

• regenerate stale gencodec output
• fix: count new-account password attempts from 1
• accounts/abi/bind/backends: price calls with the executing block’s base fee
• Update tests
• Ported upstream fixes
• Removed unused code, comment & deprecated APIs
• Name related fixes
• Migration code currently being implemented

qrysm

• fix(slasher): report double votes found before a span-loading failure
• fix(slasher,db,node): keep slasher progress atomic and evidence intact, validate the archive interval
• fix(db,stategen,blockchain,slasher): persist migration progress, make restore and deletes safe, verify checkpoint identity
• fix(db,stategen,slasher): persist the migration cursor, make restore replace-safe, migrate slasher record keys

QRL v1.0 -> v2.0 Migration

QRL v1 archive

• Archive work moved from scaffolding into implementation and large-scale rehearsal. Added a qrl-archive CLI for exact-byte block export and structural verification, pinned protobuf schema/binding/descriptor digests with mainnet API fixtures, ran a 1,620,000-block testnet rehearsal, and added native-node recovery work.

QRL v1 archive explorer

• Integrated the 1,620,000-block rehearsal into the explorer work and added the archive shard format, advancing the read-only explorer from placeholder/rehearsal UI toward consuming the actual archive structure.

QRL v1.0

qrl-wallet

• Significant wallet maintenance around the Meteor 3 branch: upgraded to qrllib 1.3.2 and synchronised WASM assets, pinned dependencies and bumped the wallet to 1.9.2, improved malformed wallet-file error handling, added the ability to re-download a wallet JSON from the recovery tool, fixed CRLF/LF handling for web-libjsqrl.js, and disabled passphrase input while wallet generation is running.

integration_tests

• Modernised the QRL v1 integration-test infrastructure: updated qrllib, upgraded CircleCI config to 2.1, aligned master CI with the bionic-old image, increased Fastnet block-addition timeouts and stopped running tests_fastnet_long on master where it already runs against noble-work-in-progress.

qrllib

• Restored the v1.2.4 address-validity behaviour in addressIsValid, preventing newer descriptor hardening from changing legacy QRL v1 validity semantics. Also improved release reliability by making npm/PyPI publishing idempotent and allowing more time for post-publish verification.

QRL node

• Pinned the address-validity rule directly into QRL and upgraded pyqrllib to 1.3.2, ensuring the legacy node retains expected v1 mainnet address behaviour independently of library changes.

webtools

• Development dependencies and actions/setup-node were updated.

Misc

qrlft

• Hardened file signing/verification semantics: verify now checks every supplied path, while both signing and verification read the entire file contents rather than risking partial processing. The change touched 8 files with 483 additions / 33 deletions.

actions-MLDSA-sign

• Updated the GitHub Action to use the newer qrlft release and Go 1.25, then refreshed the action definition and README. This keeps the reusable ML-DSA signing workflow aligned with the hardened qrlft behaviour.