fix: call bitcoin query API on the mainnet (#3668)

* add e2e tests

* refactor

* turn off verify_query_signatures for bitcoin query

* fix

* warning query management canister

* fix

* changelog

* upgrade agent and simplify

* improve warning

* improve changelog

* update agent-rs rev

* improve e2e

* tracking TODO with Jira ticket

* shellcheck

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 # UNRELEASED
 
+### fix: call management canister Bitcoin query API without replica-signed query
+
+`dfx canister call --query` defaults to use "Replica-signed query" feature.
+
+It doesn't work with bitcoin query calls to the management canister because the Boundary Nodes cannot route the `read_state` call.
+
+Only for these particular queries, `dfx` will make the query calls without checking the replica signatures.
+
+If the response reliability is a concern, you can make update calls to the secure alternatives.
+
 ### feat(beta): enable cycles ledger support
 
 If the environment variable `DFX_CYCLES_LEDGER_SUPPORT_ENABLE` is set and no cycles wallet is configured, then dfx will try to use the cycles ledger to perform any operation that the cycles wallet usually is used for.
@@ -24,15 +34,15 @@ See also: https://github.com/dfinity/idl2json
 
 Added commas in between fields, and newlines to improve formatting.
 
-### fix canister status output to be grep compatible
+### fix: canister status output to be grep compatible
 
 `dfx canister status` now outputs to `stdout`, rather than `stderr`, so that its output is `grep` compatible.
 
-### fix fetching canister logs to be grep & tail compatible
+### fix: fetching canister logs to be grep & tail compatible
 
 `dfx canister logs` now outputs to stdout, rather than stderr, so that its output is `grep` and `tail` compatible.
 
-### fix fetching canister logs
+### fix: fetching canister logs
 
 The management canister method `fetch_canister_logs` can be called only as a query, not as an update call. Therefore, `dfx canister logs <canister_id>` now uses a query call for this purpose.
 

Cargo.toml

@@ -21,11 +21,11 @@ license = "Apache-2.0"
 [workspace.dependencies]
 candid = "0.10.4"
 candid_parser = "0.1.4"
-ic-agent = { git = "https://github.com/dfinity/agent-rs.git", rev = "7869e06b048a69210849bd43ed939fe0c67df564" }
+ic-agent = { git = "https://github.com/dfinity/agent-rs.git", rev = "8c39e26236e3e3db6db51ffa71e34140c19d207e" }
 ic-asset = { path = "src/canisters/frontend/ic-asset" }
 ic-cdk = "0.13.1"
-ic-identity-hsm = { git = "https://github.com/dfinity/agent-rs.git", rev = "7869e06b048a69210849bd43ed939fe0c67df564" }
-ic-utils = { git = "https://github.com/dfinity/agent-rs.git", rev = "7869e06b048a69210849bd43ed939fe0c67df564" }
+ic-identity-hsm = { git = "https://github.com/dfinity/agent-rs.git", rev = "8c39e26236e3e3db6db51ffa71e34140c19d207e" }
+ic-utils = { git = "https://github.com/dfinity/agent-rs.git", rev = "8c39e26236e3e3db6db51ffa71e34140c19d207e" }
 
 aes-gcm = "0.10.3"
 anyhow = "1.0.56"

e2e/tests-dfx/bitcoin.bash

@@ -207,7 +207,8 @@ set_local_network_bitcoin_enabled() {
     min_confirmations = opt (1 : nat32);
   }
 )'
-  assert_eq "(0 : nat64)"
+  # shellcheck disable=SC2154
+  assert_eq "(0 : nat64)" "$stdout"
 
   # bitcoin_get_balance_query
   assert_command dfx canister call --query aaaaa-aa --candid bitcoin.did bitcoin_get_utxos_query '(

e2e/tests-dfx/call.bash

@@ -236,3 +236,49 @@ teardown() {
   assert_command dfx canister call "$CANISTER_ID" greet '("you")'
   assert_match '("Hello, you!")'
 }
+
+@test "call management canister - bitcoin query API on the IC mainnet" {
+  WARNING="call to the management canister cannot be benefit from the \"Replica Signed Queries\" feature.
+The response might not be trustworthy.
+If you want to get reliable result, you can make an update call to the secure alternative:"
+  # bitcoin_get_balance_query
+  ## bitcoin mainnet
+  assert_command dfx canister call --network ic --query aaaaa-aa bitcoin_get_balance_query '(
+  record {
+    network = variant { mainnet };
+    address = "bcrt1qu58aj62urda83c00eylc6w34yl2s6e5rkzqet7";
+  }
+)'
+  # shellcheck disable=SC2154
+  assert_contains "bitcoin_get_balance_query $WARNING bitcoin_get_balance" "$stderr"
+  ## bitcoin testnet
+  assert_command dfx canister call --network ic --query aaaaa-aa bitcoin_get_balance_query '(
+  record {
+    network = variant { testnet };
+    address = "bcrt1qu58aj62urda83c00eylc6w34yl2s6e5rkzqet7";
+  }
+)'
+  # shellcheck disable=SC2154
+  assert_contains "bitcoin_get_balance_query $WARNING bitcoin_get_balance" "$stderr"
+
+  # bitcoin_get_utxos_query
+  ## bitcoin mainnet
+  assert_command dfx canister call --network ic --query aaaaa-aa bitcoin_get_utxos_query '(
+  record {
+    network = variant { mainnet };
+    address = "bcrt1qu58aj62urda83c00eylc6w34yl2s6e5rkzqet7";
+  }
+)'
+  # shellcheck disable=SC2154
+  assert_contains "bitcoin_get_utxos_query $WARNING bitcoin_get_utxos" "$stderr"
+
+  ## bitcoin testnet
+  assert_command dfx canister call --network ic --query aaaaa-aa bitcoin_get_utxos_query '(
+  record {
+    network = variant { testnet };
+    address = "bcrt1qu58aj62urda83c00eylc6w34yl2s6e5rkzqet7";
+  }
+)'
+  # shellcheck disable=SC2154
+  assert_contains "bitcoin_get_utxos_query $WARNING bitcoin_get_utxos" "$stderr"
+}