Joystream / Joystream/joystream
Runtime upgrade with hash vs WASM image
- Dominant language
- Rust
- Stars
- 1.4k
- Forks
- 116
- PR merge metrics
- No merged PRs in 30d
Description
# Background
Currently, runtime upgrades require submitting the WASM image as part of creating the proposal. This means that, if an upgrade must be done to solve a sensitive security problem - where it may be in the interest of the DAO to perform the upgrade without revealing the source in advance, then anyone will be able review the WASM image and work out the vulnerability. With a high constitutionality, currently of 4, this leaves many months of time to perform such an analysis.
# Background
Introduce a new runtime "secret" runtime ugprade where only hash is submitted upon creation, and actual upgrade can be performed in a designated time window after the proposal is executed by sending a new extrinsic, with the WASM blob as payload that must be preimage of hash. There probably should only ever be one such hash commitment for an upgrade in flight at any given time, so any prior active commitment must be overwritten.
# TODO
- [ ] prepare rough specification, get feedback at `idea` stage of JIP
- [ ] create upgrade JIP
- [ ] write reference implementation & tests (unit+integration)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.