feat: Add validator-keys to xrpld project

.github/scripts/strategy-matrix/linux.json

@@ -50,15 +50,17 @@
       {
         "compiler": ["gcc"],
         "build_type": ["Release"],
-        "arch": ["amd64"]
+        "arch": ["amd64"],
+        "extra_cmake_args": "-Dvalidator_keys=ON"
       }
     ],
 
     "rhel": [
       {
         "compiler": ["gcc"],
         "build_type": ["Release"],
-        "arch": ["amd64"]
+        "arch": ["amd64"],
+        "extra_cmake_args": "-Dvalidator_keys=ON"
       }
     ]
   },

.github/workflows/on-pr.yml

@@ -67,6 +67,7 @@ jobs:
             .github/workflows/reusable-package.yml
             .github/workflows/reusable-strategy-matrix.yml
             .github/workflows/reusable-test.yml
+            .github/workflows/reusable-test-conan-package.yml
             .github/workflows/reusable-upload-recipe.yml
             .clang-tidy
             .codecov.yml
@@ -77,6 +78,7 @@ jobs:
             include/**
             src/**
             tests/**
+            validator-keys-tool/**
             CMakeLists.txt
             conanfile.py
             conan.lock
@@ -145,10 +147,16 @@ jobs:
     if: ${{ needs.should-run.outputs.go == 'true' }}
     uses: ./.github/workflows/reusable-package.yml
 
+  test-conan-package:
+    needs: should-run
+    if: ${{ needs.should-run.outputs.go == 'true' }}
+    uses: ./.github/workflows/reusable-test-conan-package.yml
+
   upload-recipe:
     needs:
       - should-run
       - build-test
+      - test-conan-package
     # Only run when committing to a PR that targets a release branch.
     if: ${{ github.repository == 'XRPLF/rippled' && needs.should-run.outputs.go == 'true' && github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release') }}
     uses: ./.github/workflows/reusable-upload-recipe.yml
@@ -180,6 +188,7 @@ jobs:
       - clang-tidy
       - build-test
       - package
+      - test-conan-package
       - upload-recipe
       - notify-clio
     runs-on: ubuntu-latest

.github/workflows/on-tag.yml

@@ -16,8 +16,13 @@ defaults:
     shell: bash
 
 jobs:
+  test-conan-package:
+    if: ${{ github.repository == 'XRPLF/rippled' }}
+    uses: ./.github/workflows/reusable-test-conan-package.yml
+
   upload-recipe:
     if: ${{ github.repository == 'XRPLF/rippled' }}
+    needs: test-conan-package
     uses: ./.github/workflows/reusable-upload-recipe.yml
     secrets:
       remote_username: ${{ secrets.CONAN_REMOTE_USERNAME }}

.github/workflows/on-trigger.yml

@@ -24,6 +24,7 @@ on:
       - ".github/workflows/reusable-package.yml"
       - ".github/workflows/reusable-strategy-matrix.yml"
       - ".github/workflows/reusable-test.yml"
+      - ".github/workflows/reusable-test-conan-package.yml"
       - ".github/workflows/reusable-upload-recipe.yml"
       - ".clang-tidy"
       - ".codecov.yml"
@@ -34,6 +35,7 @@ on:
       - "include/**"
       - "src/**"
       - "tests/**"
+      - "validator-keys-tool/**"
       - "CMakeLists.txt"
       - "conanfile.py"
       - "conan.lock"
@@ -91,8 +93,13 @@ jobs:
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
+  test-conan-package:
+    uses: ./.github/workflows/reusable-test-conan-package.yml
+
   upload-recipe:
-    needs: build-test
+    needs:
+      - build-test
+      - test-conan-package
     # Only run when pushing to the develop branch.
     if: ${{ github.repository == 'XRPLF/rippled' && github.event_name == 'push' && github.ref == 'refs/heads/develop' }}
     uses: ./.github/workflows/reusable-upload-recipe.yml

.github/workflows/reusable-build-test-config.yml

@@ -235,6 +235,9 @@ jobs:
         run: |
           loader="$(/tmp/loader-path.sh)"
           patchelf --set-interpreter "${loader}" --remove-rpath "${{ env.BUILD_DIR }}/xrpld"
+          if [ -x "${{ env.BUILD_DIR }}/validator-keys" ]; then
+              patchelf --set-interpreter "${loader}" --remove-rpath "${{ env.BUILD_DIR }}/validator-keys"
+          fi
 
       # We're only running aarch64 Linux builds in Ubuntu-based images, so this is kept simple
       - name: Install libatomic (Linux aarch64)
@@ -253,12 +256,21 @@ jobs:
               curl ${CCACHE_REMOTE_STORAGE%|*}/status || true
           fi
 
+      - name: Stage binary artifacts (Linux)
+        if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
+        run: |
+          mkdir -p "${BUILD_DIR}/artifacts"
+          cp "${BUILD_DIR}/xrpld" "${BUILD_DIR}/artifacts/xrpld"
+          if [ -x "${BUILD_DIR}/validator-keys" ]; then
+              cp "${BUILD_DIR}/validator-keys" "${BUILD_DIR}/artifacts/validator-keys"
+          fi
+
       - name: Upload the binary (Linux)
         if: ${{ github.event.repository.visibility == 'public' && runner.os == 'Linux' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: xrpld-${{ inputs.config_name }}
-          path: ${{ env.BUILD_DIR }}/xrpld
+          path: ${{ env.BUILD_DIR }}/artifacts/*
           retention-days: 3
           if-no-files-found: error
 

.github/workflows/reusable-package.yml

@@ -77,8 +77,8 @@ jobs:
           name: ${{ matrix.artifact_name }}
           path: ${{ env.BUILD_DIR }}
 
-      - name: Make binary executable
-        run: chmod +x "${BUILD_DIR}/xrpld"
+      - name: Make binaries executable
+        run: chmod +x "${BUILD_DIR}/xrpld" "${BUILD_DIR}/validator-keys"
 
       - name: Build package
         env:

.github/workflows/reusable-test-conan-package.yml

@@ -0,0 +1,35 @@
+# Build the Conan package and run the consumer test package.
+name: Test Conan package
+
+# This workflow can only be triggered by other workflows.
+on:
+  workflow_call:
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  test-conan-package:
+    runs-on: ubuntu-latest
+    container: ghcr.io/xrplf/xrpld/nix-ubuntu:sha-63ffdc3
+    timeout-minutes: 90
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+
+      - name: Set up Conan
+        uses: ./.github/actions/setup-conan
+
+      - name: Export Conan package under test
+        run: conan export . --version=head
+
+      - name: Run Conan package test
+        working-directory: tests/conan
+        run: |
+          conan test . xrpl/head \
+              --profile:all ci \
+              --build=missing \
+              --settings:all build_type=Release \
+              --conf:all tools.build:jobs="$(nproc)"

CMakeLists.txt

@@ -133,9 +133,9 @@ endif()
 
 include(XrplCore)
 include(XrplProtocolAutogen)
+include(XrplValidatorKeys)
 include(XrplInstall)
 include(XrplPackaging)
-include(XrplValidatorKeys)
 
 if(tests)
     include(CTest)

cmake/XrplPackaging.cmake

@@ -25,6 +25,19 @@ if(NOT (RPMBUILD_EXECUTABLE OR DPKG_BUILDPACKAGE_EXECUTABLE))
     return()
 endif()
 
+if(NOT TARGET xrpld)
+    message(STATUS "xrpld=ON is required; 'package' target not available")
+    return()
+endif()
+
+if(NOT TARGET validator-keys)
+    message(
+        STATUS
+        "validator_keys=ON is required; 'package' target not available"
+    )
+    return()
+endif()
+
 set(package_env
     SRC_DIR=${CMAKE_SOURCE_DIR}
     BUILD_DIR=${CMAKE_BINARY_DIR}
@@ -38,7 +51,7 @@ add_custom_target(
         ${CMAKE_COMMAND} -E env ${package_env}
         ${CMAKE_SOURCE_DIR}/package/build_pkg.sh
     WORKING_DIRECTORY ${CMAKE_BINARY_DIR}
-    DEPENDS xrpld
+    DEPENDS xrpld validator-keys
     COMMENT "Building Linux package (deb/rpm inferred from host tooling)"
     VERBATIM
 )

cmake/XrplValidatorKeys.cmake

@@ -1,26 +1,22 @@
 option(
     validator_keys
-    "Enables building of validator-keys tool as a separate target (imported via FetchContent)"
+    "Enables building of the vendored validator-keys tool as a separate target"
     OFF
 )
 
 if(validator_keys)
-    git_branch(current_branch)
-    # default to tracking VK master branch unless we are on release
-    if(NOT (current_branch STREQUAL "release"))
-        set(current_branch "master")
-    endif()
-    message(STATUS "Tracking ValidatorKeys branch: ${current_branch}")
+    include(GNUInstallDirs)
 
-    FetchContent_Declare(
-        validator_keys
-        GIT_REPOSITORY https://github.com/ripple/validator-keys-tool.git
-        GIT_TAG "${current_branch}"
+    add_subdirectory(
+        "${CMAKE_SOURCE_DIR}/validator-keys-tool"
+        "${CMAKE_BINARY_DIR}/validator-keys-tool"
     )
-    FetchContent_MakeAvailable(validator_keys)
     set_target_properties(
         validator-keys
         PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_BINARY_DIR}"
     )
-    install(TARGETS validator-keys RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})
+    install(
+        TARGETS validator-keys
+        RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" COMPONENT runtime
+    )
 endif()

package/README.md

@@ -1,6 +1,7 @@
 # Linux Packaging
 
-This directory contains all files needed to build RPM and Debian packages for `xrpld`.
+This directory contains all files needed to build RPM and Debian packages for
+`xrpld`. The packages also include the `validator-keys` utility.
 
 ## Directory layout
 
@@ -48,16 +49,17 @@ To print the exact image tags for the current `linux.json`:
 Caller workflows (`on-pr.yml`, `on-tag.yml`, `on-trigger.yml`) call
 `reusable-strategy-matrix.yml` with `mode: packaging` to generate the matrix of
 `{artifact_name, os}` entries, then fan out to
-`reusable-package.yml` per entry. That workflow downloads the pre-built `xrpld`
-binary artifact, detects the package format from the container, and calls
-`build_pkg.sh` directly — no CMake configure or build step is needed inside
-the packaging job.
+`reusable-package.yml` per entry. That workflow downloads the pre-built binary
+artifact containing `xrpld` and `validator-keys`, detects the package format
+from the container, and calls `build_pkg.sh` directly — no CMake configure or
+build step is needed inside the packaging job.
 
 ### Locally (mirrors CI)
 
-With an `xrpld` binary already built at `build/xrpld`, run the packaging step
-inside the same container CI uses. The image tag is derived from `linux.json`
-so you don't need to hardcode a SHA.
+With `xrpld` and `validator-keys` binaries already built at `build/xrpld` and
+`build/validator-keys`, run the packaging step inside the same container CI
+uses. The image tag is derived from `linux.json` so you don't need to hardcode a
+SHA.
 
 ```bash
 # From the repo root. Pick any image flagged with `"package": true` in
@@ -91,6 +93,7 @@ needed, but the host toolchain replaces the pinned CI image:
 ```bash
 cmake \
     -Dxrpld=ON \
+    -Dvalidator_keys=ON \
     -Dxrpld_version=2.4.0-local \
     -Dtests=OFF \
     ..
@@ -110,13 +113,13 @@ to FHS-standard paths (`/usr/bin`, `/etc/xrpld`, etc.) regardless of
 environment variable. Flags override env vars; env vars override the built-in
 defaults. Run `./package/build_pkg.sh --help` for the same table:
 
-| Flag                       | Env var             | Default                       | Purpose                             |
-| -------------------------- | ------------------- | ----------------------------- | ----------------------------------- |
-| `--src-dir DIR`            | `SRC_DIR`           | `$PWD`                        | repo root                           |
-| `--build-dir DIR`          | `BUILD_DIR`         | `$PWD/build`                  | directory holding pre-built `xrpld` |
-| `--pkg-version STR`        | `PKG_VERSION`       | parsed from `xrpld --version` | version string, e.g. `3.2.0-b1`     |
-| `--pkg-release N`          | `PKG_RELEASE`       | `1`                           | package release number              |
-| `--source-date-epoch SECS` | `SOURCE_DATE_EPOCH` | latest git commit ctime       | reproducibility timestamp           |
+| Flag                       | Env var             | Default                       | Purpose                              |
+| -------------------------- | ------------------- | ----------------------------- | ------------------------------------ |
+| `--src-dir DIR`            | `SRC_DIR`           | `$PWD`                        | repo root                            |
+| `--build-dir DIR`          | `BUILD_DIR`         | `$PWD/build`                  | directory holding pre-built binaries |
+| `--pkg-version STR`        | `PKG_VERSION`       | parsed from `xrpld --version` | version string, e.g. `3.2.0-b1`      |
+| `--pkg-release N`          | `PKG_RELEASE`       | `1`                           | package release number               |
+| `--source-date-epoch SECS` | `SOURCE_DATE_EPOCH` | latest git commit ctime       | reproducibility timestamp            |
 
 The package format (`deb` or `rpm`) is inferred from the host's package
 manager (`apt-get` -> deb, `dnf`/`yum` -> rpm). Hosts without one of those
@@ -141,7 +144,7 @@ into the staging area, and invokes the platform build tool.
 ### DEB
 
 1. Creates a staging source tree at `debbuild/source/` inside the build directory.
-2. Stages the binary, configs, `README.md`, and `LICENSE.md`.
+2. Stages the binaries, configs, `README.md`, and `LICENSE.md`.
 3. Copies `package/debian/` control files into `debbuild/source/debian/`.
 4. Copies shared service/sysusers/tmpfiles into `debian/` where `dh_installsystemd`, `dh_installsysusers`, and `dh_installtmpfiles` pick them up automatically.
 5. Generates a minimal `debian/changelog` (pre-release versions use `~` instead of `-`).

package/build_pkg.sh

@@ -1,7 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# Build an RPM or Debian package from a pre-built xrpld binary.
+# Build an RPM or Debian package from pre-built xrpld and validator-keys
+# binaries.
 #
 # Flags override env vars; env vars override defaults. Env vars are intended
 # for CMake/systemd/CI integration; flags are for explicit invocation.
@@ -12,7 +13,7 @@ Usage: build_pkg.sh [options]
 
 Options (each can also be set via the env var shown):
   --src-dir DIR             repo root                  [SRC_DIR;           default: $PWD]
-  --build-dir DIR           directory holding xrpld    [BUILD_DIR;         default: $PWD/build]
+  --build-dir DIR           directory holding binaries [BUILD_DIR;         default: $PWD/build]
   --pkg-version STR         version, e.g. 3.2.0-b1     [PKG_VERSION;       default: parsed from xrpld --version]
   --pkg-release N           package release number     [PKG_RELEASE;       default: 1]
   --source-date-epoch SECS  reproducibility timestamp  [SOURCE_DATE_EPOCH; default: latest git commit ctime]
@@ -134,6 +135,7 @@ stage_common() {
     mkdir -p "${dest}"
 
     cp "${BUILD_DIR}/xrpld" "${dest}/xrpld"
+    cp "${BUILD_DIR}/validator-keys" "${dest}/validator-keys"
     cp "${SRC_DIR}/cfg/xrpld-example.cfg" "${dest}/xrpld.cfg"
     cp "${SRC_DIR}/cfg/validators-example.txt" "${dest}/validators.txt"
     cp "${SRC_DIR}/LICENSE.md" "${dest}/LICENSE.md"

package/debian/control

@@ -20,4 +20,5 @@ Depends:
 Description: XRP Ledger daemon
  Reference implementation of the XRP Ledger protocol.
  Participates in the peer-to-peer network, processes transactions,
- and maintains a local ledger copy.
+ and maintains a local ledger copy. Includes validator-keys for
+ validator key management.

package/debian/rules

@@ -18,6 +18,7 @@ override_dh_installsysusers:
 
 override_dh_install:
 	install -D -m 0755 xrpld            debian/xrpld/usr/bin/xrpld
+	install -D -m 0755 validator-keys   debian/xrpld/usr/bin/validator-keys
 	install -D -m 0644 xrpld.cfg        debian/xrpld/etc/xrpld/xrpld.cfg
 	install -D -m 0644 validators.txt   debian/xrpld/etc/xrpld/validators.txt