deps: migrate rust workspace to solana 3.0

.github/workflows/release.client.yml

@@ -32,10 +32,12 @@ jobs:
         run: ./scripts/env.sh >> $GITHUB_ENV
       - name: Install rust for cli
         uses: dtolnay/rust-toolchain@1.90.0
-      - name: Install dependencies for rpm packaging
+        with:
+          targets: x86_64-unknown-linux-musl
+      - name: Install dependencies for rpm packaging and musl static build
         run: |
           sudo apt update
-          sudo apt-get install squashfs-tools rpm -y
+          sudo apt-get install squashfs-tools rpm musl-tools -y
       - name: build client release
         uses: goreleaser/goreleaser-action@v6
         with:

.github/workflows/release.daily.yml

@@ -33,10 +33,12 @@ jobs:
         run: ./scripts/env.sh >> $GITHUB_ENV
       - name: Install rust for cli
         uses: dtolnay/rust-toolchain@1.90.0
+        with:
+          targets: x86_64-unknown-linux-musl
       - name: Install dependencies for rpm packaging
         run: |
           sudo apt update
-          sudo apt-get install squashfs-tools rpm gcc-x86-64-linux-gnu -y
+          sudo apt-get install squashfs-tools rpm gcc-x86-64-linux-gnu musl-tools -y
       - name: Set build date
         run: echo "BUILD_DATE=$(date -u +%Y%m%d%H%M%S)" >> $GITHUB_ENV
       - name: Run GoReleaser

.github/workflows/release.devnet.smartcontract.daily.yml

@@ -31,7 +31,7 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Install agave solana tools
         run: |
-          sh -c "$(curl -sSfL https://release.anza.xyz/v2.3.13/install)"
+          sh -c "$(curl -sSfL https://release.anza.xyz/v3.0.4/install)"
           echo "$HOME/.local/share/solana/install/active_release/bin" >> $GITHUB_PATH
       - name: Set up keypairs
         run: |
@@ -45,7 +45,7 @@ jobs:
           solana balance -k id.json
       - name: Build ${{ matrix.program }} program
         run: |
-          cargo build-sbf ${{ matrix.build_features }}
+          cargo build-sbf --tools-version v1.54 ${{ matrix.build_features }}
         working-directory: ${{ matrix.directory }}
       - name: Deploy ${{ matrix.program }} program to DevNet
         run: |

.github/workflows/release.pipeline.validation.yml

@@ -56,11 +56,13 @@ jobs:
       - name: Install rust toolchain
         uses: dtolnay/rust-toolchain@1.90.0
         if: contains(matrix.languages, 'rust')
+        with:
+          targets: x86_64-unknown-linux-musl
 
       - name: Install dependencies for rpm packaging
         run: |
           sudo apt update
-          sudo apt-get install build-essential pkg-config libssl-dev squashfs-tools rpm -y
+          sudo apt-get install build-essential pkg-config libssl-dev squashfs-tools rpm musl-tools -y
 
       - name: Set env vars
         run: ./scripts/env.sh >> $GITHUB_ENV

.github/workflows/rust.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Install agave solana tools
         run: |
-          sh -c "$(curl -sSfL https://release.anza.xyz/v2.3.13/install)"
+          sh -c "$(curl -sSfL https://release.anza.xyz/v3.0.4/install)"
           echo "$HOME/.local/share/solana/install/active_release/bin" >> $GITHUB_PATH
       - run: make rust-build
   rust-lint:
@@ -33,7 +33,7 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Install agave solana tools
         run: |
-          sh -c "$(curl -sSfL https://release.anza.xyz/v2.3.13/install)"
+          sh -c "$(curl -sSfL https://release.anza.xyz/v3.0.4/install)"
           echo "$HOME/.local/share/solana/install/active_release/bin" >> $GITHUB_PATH
       - run: make rust-test
   rust-validator-test:
@@ -44,24 +44,33 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Install agave solana tools
         run: |
-          sh -c "$(curl -sSfL https://release.anza.xyz/v2.3.13/install)"
+          sh -c "$(curl -sSfL https://release.anza.xyz/v3.0.4/install)"
           echo "$HOME/.local/share/solana/install/active_release/bin" >> $GITHUB_PATH
       - run: make rust-validator-test
-  # The doublezero CLI must not link aws-lc-sys (raises the glibc floor to 2.38, breaks
-  # installs on Ubuntu 22.04). It reaches the CLI only via
-  # sentinel's server-only deps, which are feature-gated off. cargo tree -i exits non-zero
-  # when the package is absent (the wanted state); exit 0 means it crept back in.
-  rust-cli-no-aws-lc:
+  # The doublezero CLI ships as a static musl binary so it loads on any Linux
+  # regardless of the host glibc version. Build it for the musl target and assert
+  # the result is fully static.
+  rust-cli-static:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
       - uses: dtolnay/rust-toolchain@1.90.0
+        with:
+          targets: x86_64-unknown-linux-musl
       - uses: Swatinem/rust-cache@v2
-      - name: Assert aws-lc-sys absent from doublezero CLI
+      - name: Install musl toolchain
+        run: sudo apt-get update && sudo apt-get install -y musl-tools
+      - name: Build CLI for musl and assert it is statically linked
+        env:
+          CC_x86_64_unknown_linux_musl: musl-gcc
+          CARGO_TARGET_X86_64_UNKNOWN_LINUX_MUSL_LINKER: musl-gcc
         run: |
-          if cargo tree -p doublezero -e normal -i aws-lc-sys >/dev/null 2>&1; then
-            echo "::error::aws-lc-sys is linked into the doublezero CLI"
-            cargo tree -p doublezero -e normal -i aws-lc-sys
+          cargo build --release -p doublezero --target x86_64-unknown-linux-musl
+          bin=target/x86_64-unknown-linux-musl/release/doublezero
+          file "$bin"
+          if file "$bin" | grep -qE "statically linked|static-pie linked"; then
+            echo "OK: $bin is statically linked"
+          else
+            echo "::error::doublezero CLI is not statically linked"
             exit 1
           fi
-          echo "OK: aws-lc-sys not in the doublezero CLI dependency tree"

CHANGELOG.md

@@ -11,10 +11,18 @@ All notable changes to this project will be documented in this file.
 
 ### Changes
 
+- Dependencies
+  - Migrate the entire Rust workspace from solana-sdk 2.3.x to the solana 3.0 line plus the granular split crates (`solana-pubkey`, `solana-instruction`, `solana-cpi`, `solana-sdk-ids`, `solana-system-interface`, `solana-commitment-config`, `solana-compute-budget-interface`), aligning with the doublezero-solana programs. Onchain account layouts are unchanged (regenerated fixtures are byte-identical), so the Go, TypeScript, and Python SDKs are unaffected. (#3830)
+- Onchain programs
+  - Adapt to the solana 3.0 APIs: `AccountInfo::realloc` becomes `resize`, system-program and BPF-upgradeable-loader IDs move to `solana-sdk-ids`, `ProgramError::BorshIoError` is now a unit variant, and `AccountInfo::new` drops its `rent_epoch` argument. Bump the programs build toolchain to Rust 1.91.
 - Client
   - Add a `-route-liveness-backoff-max` daemon flag to cap the Down-state liveness probe interval. Defaults to 60s (production behavior unchanged); the e2e harness pins a small value to avoid a probe gap that flaked the multi-client IBRL tests. (#3949)
-- E2E
+- CI
+  - Install agave v3.0.4 and build/test the SBF programs with platform-tools v1.54 (`SBF_TOOLS_VERSION`), required because the solana 3.0 dependency tree pulls edition2024 crates that need Cargo >= 1.85 (agave's default platform-tools v1.51 ships Cargo 1.84.1).
+- E2E tests
+  - Bump the e2e base image to agave v3.0.4 and build the onchain programs with platform-tools v1.54 to match the solana 3.0 migration.
   - Pin the e2e ledger `solana-test-validator` to the deploy floor (agave 2.2.16, testnet) so a green e2e proves a change actually deploys and runs on the production cluster runtime. Previously the runtime validator rode the SBF build toolchain version (2.3.13); it is now decoupled and pinned independently. The build toolchain is unchanged. (#3957)
+  - Fix a `TestE2E_Multicast` flake where the post-connect `doublezero status` check could observe only the first multicast group. After incrementally adding the second group, the test relied on `WaitForTunnelUp`, which returns immediately because the first tunnel is already up, so the single-shot status assertion could race the onchain propagation and the daemon's cached program data. Add an `Eventually` poll on `doublezero user list` for both groups before the post-connect checks.
 
 ## [v0.28.0](https://github.com/malbeclabs/doublezero/compare/client/v0.27.1...client/v0.28.0) - 2026-06-26