The Agoric OpCo engineering team is pleased to publish the agoric-upgrade-22a patch release. This release is a security fix to address GHSA-hrhf-2vcr-ghch. It can be applied without a coordinated upgrade.
The full set of changes in this release can be found at #12099. And reviewed in detail at agoric-upgrade-22...agoric-upgrade-22a.
Cosmos Upgrade Handler Name
As a patch, this release does not contain a new upgrade handler name. It should be applied without a governance proposal.
Tags
Below is the git information related to this software release. Note the git tag does not always match the cosmos upgrade handler name.
Please note that the @agoric/cosmos package version did not change in this patch release.
Git Tag: agoric-upgrade-22a
Git Commit: 4e121c2c81e2dc188fd700abf4a7f88c3f096d2f
@agoric/cosmos package version: v0.35.0-u22.1
Docker: ghcr.io/agoric/agoric-sdk:68
As shown in go.mod this release is based on:
ibc-go v8.7.0
cosmos-sdk v0.50.14
cometbft v0.38.17
How to upgrade
Validators should use this agoric-upgrade-22a version of the software instead of agoric-upgrade-22 for any chains that upgrade to the agoric-upgrade-22 upgrade name.
Validators should start using this agoric-upgrade-22a software for any chains that are already running the agoric-upgrade-22 upgrade.
Prerequisites
Install supported versions of Go, Node.js, and a compiler such as gcc or clang as documented in the README.
Make sure that the environment running the agd service has the same Node.js version as the environment used for building. In particular, if using nvm to manage Node.js version, the service environment should enable nvm and use the same version.
Building
# (stop the agd service)
cd agoric-sdk
git fetch --all
git checkout agoric-upgrade-22a
git clean -xdf && git submodule foreach --recursive git clean -xdf
./bin/agd build
# (start the agd service)
Do not copy the agd script or Go binary to another location. If you would like to have an executable agd in another location, then create a symlink in that location pointing to agoric-sdk/bin/agd.
Troubleshooting module ... was compiled against a different Node.js version and SyntaxError issues
The agd service is not using the same version of Node.js as the one used when building. The most likely cause is that nvm was used to manage the Node.js version in the shell when building. Either install the required version of Node.js globally using the system's package manager, or enable nvm in the environment of the agd service.
Troubleshooting repoconfig.sh: No such file or directory
Unlike typical cosmos-sdk chains where the daemon is a single executable file, Agoric's use of cosmos-sdk depends on many components of agoric-sdk at runtime. Copying agd to /usr/local/bin or the like is unlikely to produce a working installation. For more detail, see: #7825
Troubleshooting yarn: command not found or error This project's package.json defines "packageManager": "yarn@4.9.x". However the current global version of Yarn is 1.22.22
Generally, running corepack enable before running yarn install will resolve this issue. But if the issue persists, following corepack enable with corepack prepare yarn@4.9.x --activate helps resolve the issue. Replace 4.9.x with the actual version.
Troubleshooting Cannot find dependency ... in systemd
If you have LimitNOFILE=4096 in your systemd unit file, change it to LimitNOFILE=65536. For more detail, see #7817