Add snapshot test of privacy bootloader program hash

[YairVaknin-starkware]

Type

• feature
• bugfix
• dev (no functional changes, no API changes)
• fmt (formatting, renaming)
• build
• docs
• testing

Description

Breaking changes?

• yes
• no

---

Note

Low Risk
Low risk: adds test-only coverage and a new dev dependency without changing runtime behavior. Potential risk is minor CI churn if the embedded bootloader bytes/program hashing changes.

Overview
Adds a new unit snapshot test in privacy-prove that computes the privacy bootloader’s stripped-program hash (Blake) and asserts it against a pinned expected value, including a comment pointing to the source commit for the compiled artifact.

Introduces expect-test as a workspace dependency and as a privacy-prove dev-dependency to support the snapshot assertion.

^{Written by Cursor Bugbot for commit 6988ac0. This will update automatically on new commits. Configure here.}

---

This change is 

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.39%. Comparing base (19996f1) to head (a44db8c).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #335   +/-   ##
=======================================
  Coverage   53.39%   53.39%           
=======================================
  Files          35       35           
  Lines        5291     5291           
=======================================
  Hits         2825     2825           
  Misses       2466     2466           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[yuvalsw]

@yuvalsw reviewed 1 file and all commit messages, and made 2 comments.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on Yael-Starkware and YairVaknin-starkware).

---

crates/privacy_circuit_verify/src/consts.rs line 30 at r1 (raw file):

// branch: "dev"
// commit: "f65af209cc2a245a7d1c90711b49555ade65dd8c"
pub const PRIVACY_BOOTLOADER_BYTES: &[u8] = include_bytes!(

Please add md5sum of the json (so that we know the comment refers to the right binary and not obsolete)

[YairVaknin-starkware]

@YairVaknin-starkware made 1 comment.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on Yael-Starkware and yuvalsw).

---

crates/privacy_circuit_verify/src/consts.rs line 30 at r1 (raw file):

Previously, yuvalsw wrote…

Please add md5sum of the json (so that we know the comment refers to the right binary and not obsolete)

See my comment in slack. debug data is pretty dynamic, so md5sum won't help here. We can add the program hash and specify how to calculate it.

[yuvalsw]

@yuvalsw made 1 comment.
Reviewable status: 0 of 4 files reviewed, 1 unresolved discussion (waiting on Yael-Starkware and YairVaknin-starkware).

---

crates/privacy_circuit_verify/src/consts.rs line 30 at r1 (raw file):

Previously, YairVaknin-starkware wrote…

See my comment in slack. debug data is pretty dynamic, so md5sum won't help here. We can add the program hash and specify how to calculate it.

md5sum of the json added to the repo. The idea is - if you change the file but forget to change this comment (hopefully won't happen), when you read it next time you realize that this happened and don't wonder why it doesn't produce the same program.

[yuvalsw]

@yuvalsw made 1 comment.
Reviewable status: 0 of 4 files reviewed, 2 unresolved discussions (waiting on Yael-Starkware and YairVaknin-starkware).

---

crates/privacy_prove/src/tests.rs line 14 at r2 (raw file):

    // Source code for the compiled privacy bootloader producing the following hash can be found at
    // Starkware's internal main repo at commit "f65af209cc2a245a7d1c90711b49555ade65dd8c".

Can you add the compiler version/hash that was used to compile and the exact command to compile it?

[YairVaknin-starkware]

@YairVaknin-starkware made 2 comments and resolved 1 discussion.
Reviewable status: 0 of 4 files reviewed, 1 unresolved discussion (waiting on Yael-Starkware and yuvalsw).

---

crates/privacy_prove/src/tests.rs line 14 at r2 (raw file):

Previously, yuvalsw wrote…

Can you add the compiler version/hash that was used to compile and the exact command to compile it?

Done

---

crates/privacy_circuit_verify/src/consts.rs line 30 at r1 (raw file):

Previously, yuvalsw wrote…

md5sum of the json added to the repo. The idea is - if you change the file but forget to change this comment (hopefully won't happen), when you read it next time you realize that this happened and don't wonder why it doesn't produce the same program.

"md5sum of the json added to the repo." Added already you mean? Where? No sure I get the meaning of this sentence. But what I mean is we can have the file be different if compiled on different machine or from a different path, but from the same commit, so the comment shouldn't change. Do you still want it there just so we are mindful of that if for any reason this scenario occurs?
The test I added should take care of the program segment, so we know of any changes to the bytecode.

[YairVaknin-starkware]

@YairVaknin-starkware reviewed 4 files and all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on Yael-Starkware and yuvalsw).