Use new Orchard version

Cargo.toml

@@ -127,4 +127,4 @@ codegen-units = 1
 [patch.crates-io]
 zcash_note_encryption = { version = "0.4", git = "https://github.com/QED-it/zcash_note_encryption", branch = "zsa1" }
 sapling = { package = "sapling-crypto", version = "0.1.3", git = "https://github.com/QED-it/sapling-crypto", branch = "zsa1" }
-orchard = { version = "0.8.0", git = "https://github.com/QED-it/orchard", rev = "3dbdbc52c6e2ffeca015ae6eb80ad7f1c870384d" }
+orchard = { version = "0.8.0", git = "https://github.com/QED-it/orchard", rev = "b62f72a8ebebe0faf81764260ea961011066aba5" }

zcash_primitives/src/transaction/builder.rs

@@ -59,10 +59,13 @@ use orchard::{
     issuance,
     issuance::{IssueBundle, IssueInfo},
     keys::{IssuanceAuthorizingKey, IssuanceValidatingKey},
+    note::Nullifier,
     orchard_flavor::OrchardZSA,
 };
 #[cfg(zcash_unstable = "nu6" /* TODO nu7 */ )]
 use rand_core::OsRng;
+#[cfg(zcash_unstable = "nu6" /* TODO nu7 */ )]
+use std::io;
 
 /// Since Blossom activation, the default transaction expiry delta should be 40 blocks.
 /// <https://zips.z.cash/zip-0203#changes-for-blossom>
@@ -329,7 +332,7 @@ pub struct Builder<'a, P, U: sapling::builder::ProverProgress> {
     sapling_builder: Option<sapling::builder::Builder>,
     orchard_builder: Option<orchard::builder::Builder>,
     #[cfg(zcash_unstable = "nu6" /* TODO nu7 */ )]
-    issuance_builder: Option<IssueBundle<issuance::Unauthorized>>,
+    issuance_builder: Option<IssueBundle<issuance::AwaitingNullifier>>,
     // TODO: In the future, instead of taking the spending keys as arguments when calling
     // `add_sapling_spend` or `add_orchard_spend`, we will build an unauthorized, unproven
     // transaction, and then the caller will be responsible for using the spending keys or their
@@ -972,6 +975,7 @@ impl<'a, P: consensus::Parameters, U: sapling::builder::ProverProgress> Builder<
         #[cfg(zcash_unstable = "nu6" /* TODO nu7 */ )]
         let issue_bundle = unauthed_tx
             .issue_bundle
+            .map(|b| b.update_rho(first_nullifier(&orchard_bundle).unwrap()))
             .map(|b| b.prepare(*shielded_sig_commitment.as_ref()))
             .map(|b| b.sign(self.issuance_isk.as_ref().unwrap()))
             .map(|b| b.unwrap());
@@ -1017,6 +1021,23 @@ where
         .map_err(Error::OrchardBuild)
 }
 
+#[cfg(zcash_unstable = "nu6" /* TODO nu7 */ )]
+fn first_nullifier(
+    orchard_bundle: &Option<OrchardBundle<Authorized>>,
+) -> Result<&Nullifier, io::Error> {
+    match orchard_bundle {
+        Some(OrchardBundle::OrchardVanilla(_)) => Err(io::Error::new(
+            io::ErrorKind::Other,
+            "Incorrect bundle type",
+        )),
+        Some(OrchardBundle::OrchardZSA(b)) => Ok(b.actions().first().nullifier()),
+        None => Err(io::Error::new(
+            io::ErrorKind::Other,
+            "Missing Orchard bundle",
+        )),
+    }
+}
+
 #[cfg(zcash_unstable = "zfuture")]
 impl<'a, P: consensus::Parameters, U: sapling::builder::ProverProgress> ExtensionTxBuilder<'a>
     for Builder<'a, P, U>
@@ -1647,11 +1668,11 @@ mod tests {
         let asset_desc: Vec<u8> = "asset_desc".into();
 
         builder
-            .init_issuance_bundle::<FeeError>(iak, asset_desc.clone(), None, false)
+            .init_issuance_bundle::<FeeError>(iak, asset_desc.clone(), None, true)
             .unwrap();
 
         builder
-            .add_recipient::<FeeError>(&asset_desc, address, NoteValue::from_raw(42), true)
+            .add_recipient::<FeeError>(&asset_desc, address, NoteValue::from_raw(42), false)
             .unwrap();
 
         let binding = builder.mock_build_no_fee(OsRng).unwrap().into_transaction();

zcash_primitives/src/transaction/mod.rs

@@ -334,7 +334,7 @@ impl Authorization for Unauthorized {
     type OrchardAuth = orchard::builder::InProgress<Unproven, orchard::builder::Unauthorized>;
 
     #[cfg(zcash_unstable = "nu6" /* TODO nu7 */ )]
-    type IssueAuth = orchard::issuance::Unauthorized;
+    type IssueAuth = orchard::issuance::AwaitingNullifier;
 
     #[cfg(zcash_unstable = "zfuture")]
     type TzeAuth = tze::builder::Unauthorized;