update canton to 20250120.12436.v51bf978a (#20616)

sdk/canton/community/app-base/src/main/scala/com/digitalasset/canton/config/CantonConfig.scala

@@ -418,6 +418,7 @@ trait CantonConfig {
         general = CantonNodeParameterConverter.general(this, domainConfig),
         protocol = CantonNodeParameterConverter.protocol(this, domainConfig.init.domainParameters),
         maxBurstFactor = domainConfig.parameters.maxBurstFactor,
+        dispatcherBatchSize = domainConfig.parameters.dispatcherBatchSize,
       )
   }
 
@@ -716,6 +717,9 @@ object CantonConfig {
       deriveReader[LedgerApiKeepAliveServerConfig]
     lazy implicit val tlsServerConfigReader: ConfigReader[TlsServerConfig] =
       deriveReader[TlsServerConfig]
+    lazy implicit val tlsServerOnlyTrustFileConfigReader
+        : ConfigReader[TlsClientConfigOnlyTrustFile] =
+      deriveReader[TlsClientConfigOnlyTrustFile]
     lazy implicit val tlsClientConfigReader: ConfigReader[TlsClientConfig] =
       deriveReader[TlsClientConfig]
     lazy implicit val initBaseIdentityConfigReader: ConfigReader[InitConfigBase.Identity] =
@@ -764,6 +768,21 @@ object CantonConfig {
       deriveReader[ApiType.Grpc.type]
     lazy implicit val apiTypeConfigReader: ConfigReader[ApiType] = deriveReader[ApiType]
     lazy implicit val clientConfigReader: ConfigReader[ClientConfig] = deriveReader[ClientConfig]
+    lazy implicit val remoteConsoleSequencerClientConfigReader
+        : ConfigReader[SequencerApiClientConfig] =
+      deriveReader[SequencerApiClientConfig]
+        // Note that transformations are applied in reverse order,
+        // so we move the deprecated before deleting the parent path
+        .deprecateConfigPath(
+          DeprecatedConfigUtils.DeprecatedConfigPath[String](
+            "custom-trust-certificates",
+            since = "2.10.0",
+            dropPath = true,
+          )
+        )
+        .moveDeprecatedField("custom-trust-certificates.pem-file", Seq("tls.trust-collection-file"))
+        .moveDeprecatedField("transport-security", Seq("tls.enabled"))
+
     lazy implicit val remoteDomainConfigReader: ConfigReader[RemoteDomainConfig] =
       deriveReader[RemoteDomainConfig]
     lazy implicit val remoteParticipantConfigReader: ConfigReader[RemoteParticipantConfig] =
@@ -863,22 +882,6 @@ object CantonConfig {
       deriveReader[PackageMetadataViewConfig]
     lazy implicit val identityConfigReader: ConfigReader[TopologyConfig] =
       deriveReader[TopologyConfig]
-    lazy implicit val sequencerConnectionConfigCertificateFileReader
-        : ConfigReader[SequencerConnectionConfig.CertificateFile] =
-      deriveReader[SequencerConnectionConfig.CertificateFile]
-    lazy implicit val sequencerConnectionConfigCertificateStringReader
-        : ConfigReader[SequencerConnectionConfig.CertificateString] =
-      deriveReader[SequencerConnectionConfig.CertificateString]
-    lazy implicit val sequencerConnectionConfigCertificateConfigReader
-        : ConfigReader[SequencerConnectionConfig.CertificateConfig] =
-      deriveReader[SequencerConnectionConfig.CertificateConfig]
-    lazy implicit val sequencerConnectionConfigGrpcReader
-        : ConfigReader[SequencerConnectionConfig.Grpc] =
-      deriveReader[SequencerConnectionConfig.Grpc]
-    lazy implicit val sequencerConnectionConfigReader: ConfigReader[SequencerConnectionConfig] =
-      deriveReader[SequencerConnectionConfig]
-        // since the big majority of users will use GRPC, default to it so that they don't need to specify `type = grpc`
-        .orElse(ConfigReader[SequencerConnectionConfig.Grpc])
     lazy implicit val communitySequencerConfigDatabaseReader
         : ConfigReader[CommunitySequencerConfig.Database] =
       deriveReader[CommunitySequencerConfig.Database]
@@ -1126,6 +1129,9 @@ object CantonConfig {
       deriveWriter[TlsServerConfig]
     lazy implicit val tlsClientConfigWriter: ConfigWriter[TlsClientConfig] =
       deriveWriter[TlsClientConfig]
+    lazy implicit val tlsClientConfigWriterOnlyTrustFile
+        : ConfigWriter[TlsClientConfigOnlyTrustFile] =
+      deriveWriter[TlsClientConfigOnlyTrustFile]
     lazy implicit val initBaseIdentityConfigWriter: ConfigWriter[InitConfigBase.Identity] =
       deriveWriter[InitConfigBase.Identity]
     lazy implicit val initConfigWriter: ConfigWriter[InitConfig] = deriveWriter[InitConfig]
@@ -1166,6 +1172,9 @@ object CantonConfig {
     lazy implicit val communityCryptoWriter: ConfigWriter[CommunityCryptoConfig] =
       deriveWriter[CommunityCryptoConfig]
     lazy implicit val clientConfigWriter: ConfigWriter[ClientConfig] = deriveWriter[ClientConfig]
+    lazy implicit val remoteConsoleSequencerClientConfigWriter
+        : ConfigWriter[SequencerApiClientConfig] =
+      deriveWriter[SequencerApiClientConfig]
     lazy implicit val remoteDomainConfigWriter: ConfigWriter[RemoteDomainConfig] =
       deriveWriter[RemoteDomainConfig]
     lazy implicit val remoteParticipantConfigWriter: ConfigWriter[RemoteParticipantConfig] =
@@ -1272,20 +1281,6 @@ object CantonConfig {
       deriveWriter[PackageMetadataViewConfig]
     lazy implicit val identityConfigWriter: ConfigWriter[TopologyConfig] =
       deriveWriter[TopologyConfig]
-    lazy implicit val sequencerConnectionConfigCertificateFileWriter
-        : ConfigWriter[SequencerConnectionConfig.CertificateFile] =
-      deriveWriter[SequencerConnectionConfig.CertificateFile]
-    lazy implicit val sequencerConnectionConfigCertificateStringWriter
-        : ConfigWriter[SequencerConnectionConfig.CertificateString] =
-      confidentialWriter[SequencerConnectionConfig.CertificateString](_.copy(pemString = "****"))
-    lazy implicit val sequencerConnectionConfigCertificateConfigWriter
-        : ConfigWriter[SequencerConnectionConfig.CertificateConfig] =
-      deriveWriter[SequencerConnectionConfig.CertificateConfig]
-    lazy implicit val sequencerConnectionConfigGrpcWriter
-        : ConfigWriter[SequencerConnectionConfig.Grpc] =
-      deriveWriter[SequencerConnectionConfig.Grpc]
-    lazy implicit val sequencerConnectionConfigWriter: ConfigWriter[SequencerConnectionConfig] =
-      deriveWriter[SequencerConnectionConfig]
     lazy implicit val communitySequencerConfigDatabaseWriter
         : ConfigWriter[CommunitySequencerConfig.Database] =
       deriveWriter[CommunitySequencerConfig.Database]

sdk/canton/community/app-base/src/main/scala/com/digitalasset/canton/console/InstanceReference.scala

@@ -315,7 +315,7 @@ trait RemoteDomainReference extends DomainReference with GrpcRemoteInstanceRefer
     consoleEnvironment.environment.config.remoteDomainsByString(name)
 
   override def sequencerConnection: SequencerConnection =
-    config.publicApi.toConnection
+    config.publicApi.toGrpcSequencerConnection
       .fold(
         err => sys.error(s"Domain $name has invalid sequencer connection config: $err"),
         identity,
@@ -354,7 +354,7 @@ trait LocalDomainReference
     consoleEnvironment.environment.config.domainsByString(name)
 
   override def sequencerConnection: SequencerConnection =
-    config.sequencerConnectionConfig.toConnection
+    config.sequencerConnectionConfig.toGrpcSequencerConnection
       .fold(
         err => sys.error(s"Domain $name has invalid sequencer connection config: $err"),
         identity,
@@ -428,7 +428,7 @@ object ExternalLedgerApiClient {
     new ExternalLedgerApiClient(
       cc.address,
       cc.port,
-      cc.tls,
+      cc.tlsConfig,
       Some(token),
     )
   }

sdk/canton/community/app-base/src/main/scala/com/digitalasset/canton/console/commands/TopologyAdministration.scala

@@ -743,10 +743,11 @@ class TopologyAdministrationGroup(
                         target.fingerprint,
                         isRootDelegation,
                         key.some,
+                        // no replace existing
                       )
                       .discard
-
                   renewNamespaceDelegations(TopologyChangeOp.Add, authorizeWith)
+                  // Note: this will remove the oldest one which is the one that existed before
                   renewNamespaceDelegations(TopologyChangeOp.Remove, filterAuthorizedKey)
 
                 case IdentifierDelegation(identifier, target) =>
@@ -757,10 +758,12 @@ class TopologyAdministrationGroup(
                         identifier,
                         target.fingerprint,
                         key.some,
+                        // no replace existing
                       )
                       .discard
 
                   renewIdentifierDelegation(TopologyChangeOp.Add, authorizeWith)
+                  // Note: this will remove the oldest one which is the one that existed before
                   renewIdentifierDelegation(TopologyChangeOp.Remove, filterAuthorizedKey)
 
                 case OwnerToKeyMapping(owner, key) =>
@@ -772,10 +775,12 @@ class TopologyAdministrationGroup(
                         key.fingerprint,
                         key.purpose,
                         nsKey.some,
+                        // no replace existing
                       )
                       .discard
 
                   renewOwnerToKeyMapping(TopologyChangeOp.Add, authorizeWith)
+                  // Note: this will remove the oldest one which is the one that existed before
                   renewOwnerToKeyMapping(TopologyChangeOp.Remove, filterAuthorizedKey)
 
                 case signedClaim: SignedLegalIdentityClaim =>
@@ -792,10 +797,12 @@ class TopologyAdministrationGroup(
                         permission,
                         trustLevel,
                         key.some,
+                        replaceExisting = false,
                       )
                       .discard
 
                   renewParticipantState(TopologyChangeOp.Add, authorizeWith)
+                  // Note: this will remove the oldest one which is the one that existed before
                   renewParticipantState(TopologyChangeOp.Remove, filterAuthorizedKey)
 
                 case MediatorDomainState(side, domain, mediator) =>
@@ -807,10 +814,12 @@ class TopologyAdministrationGroup(
                         mediator,
                         side,
                         key.some,
+                        replaceExisting = false,
                       )
                       .discard
 
                   renewMediatorState(TopologyChangeOp.Add, authorizeWith)
+                  // Note: this will remove the oldest one which is the one that existed before
                   renewMediatorState(TopologyChangeOp.Remove, filterAuthorizedKey)
 
                 case PartyToParticipant(side, party, participant, permission) =>
@@ -823,10 +832,11 @@ class TopologyAdministrationGroup(
                         side,
                         permission,
                         key.some,
+                        replaceExisting = false,
                       )
                       .discard
-
                   renewPartyToParticipant(TopologyChangeOp.Add, authorizeWith)
+                  // Note: this will remove the oldest one which is the one that existed before
                   renewPartyToParticipant(TopologyChangeOp.Remove, filterAuthorizedKey)
 
                 case VettedPackages(participant, packageIds) =>
@@ -837,10 +847,12 @@ class TopologyAdministrationGroup(
                         participant,
                         packageIds,
                         key.some,
+                        // no replace existing
                       )
                       .discard
 
                   renewVettedPackages(TopologyChangeOp.Add, authorizeWith)
+                  // Note: this will remove the oldest one which is the one that existed before
                   renewVettedPackages(TopologyChangeOp.Remove, filterAuthorizedKey)
 
                 case CheckOnlyPackages(participant, packageIds) =>
@@ -851,6 +863,7 @@ class TopologyAdministrationGroup(
                         participant,
                         packageIds,
                         key.some,
+                        // no replace existing
                       )
                       .discard
 

sdk/canton/community/app-base/src/main/scala/com/digitalasset/canton/environment/Environment.scala

@@ -297,7 +297,7 @@ trait Environment extends NamedLogging with AutoCloseable with NoTracing {
       .filter(_.config.topology.open)
     def toDomainConfig(domain: DomainNodeBootstrap): Either[StartupError, DomainConnectionConfig] =
       (for {
-        connection <- domain.config.sequencerConnectionConfig.toConnection
+        connection <- domain.config.sequencerConnectionConfig.toGrpcSequencerConnection
         name <- DomainAlias.create(domain.name.unwrap)
         sequencerConnections = SequencerConnections.single(connection)
       } yield DomainConnectionConfig(name, sequencerConnections)).leftMap(err =>