5 posts tagged with "production"

Mithril certificate chain could be manipulated by an adversarial signer (security advisory)​

The Mithril team has published a security advisory for users running the Mithril client on the mainnet infrastructure:

• Identifier: GHSA-724h-fpm5-4qvr
• Title: Mithril certificate chain could be manipulated by an adversarial signer
• Location: GHSA-724h-fpm5-4qvr
• Severity: High (5.3/10).

curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/input-output-hk/mithril/refs/heads/main/mithril-install.sh | sh -s -- -c mithril-client -d 2506.0 -p $(pwd)

For any inquiries or assistance, feel free to contact the team on the Discord channel.

The Mithril signer node service recommended configuration is updated​

PR: Fix signer service recommended configuration #1419

Issue: Fix signer node service setup #1404

The previous recommended configuration proposed a service restart frequency which was too high. When the service was restarted, and if the Cardano node was not ready yet, the service tried to restart too many times in a short period: thus the service just failed and the service had to be started manually after the Cardano node is up and ready. This lead to some SPOs skipping registrations for some epochs.

The duration before restarting the service is increased to 60s: RestartSec=60.

Below is the new recommended configuration:

[Unit]
Description=Mithril signer service
StartLimitIntervalSec=0

[Service]
Type=simple
Restart=always
RestartSec=60
User=cardano
EnvironmentFile=/opt/mithril/mithril-signer.env
ExecStart=/opt/mithril/mithril-signer -vvv

[Install]
WantedBy=multi-user.target
EOF'

We highly recommend to update your existing configuration file (/etc/systemd/system/mithril-signer.service) with the values specified in the guide

⚠️ Following this modification, the service needs to be restarted with the following command:

sudo systemctl restart mithril-signer

Feel free to reach out to us on the Discord channel for questions and/or help.

Mithril relay could expose Cardano block producer internal IP when updated (Security Advisory)​

The Mithril team has published a security advisory to destination of SPOs running a Mithril signer/relay on the mainnet infrastructure:

• Identifier: GHSA-9m3h-72xj-x2gq
• Title: Mithril relay could expose Cardano block producer internal IP when updated
• Location: https://github.com/input-output-hk/mithril/security/advisories/GHSA-9m3h-72xj-x2gq
• Severity: High (7.2/10)

Feel free to reach out to us on the Discord channel for questions and/or help.

Update 2023/07/30: The first certificates and snapshots have been produced by the release-mainnet network!

Update 2023/07/25: The Genesis certificate of the release-mainnet network has been successfully created.

Mithril Protocol’s Mainnet Beta is launched 🚀​

The Mithril team is thrilled to announce that the Mithril Protocol’s Mainnet Beta is launched 🎉

Here are the next steps that we will follow in order to get the release-mainnet network producing its first certificates:

1. Open the first signers registrations on the release-mainnet network (1 epoch).
2. Create the genesis certificate of the release-mainnet network (1 epoch).
3. Wait for the first certificates to be produced by the release-mainnet network.

This is an expected timeline, in case of modification, we will amend this post with a new one.

Also, the documentation has been updated with the configuration of the release-mainnet network. It is available here.

Feel free to reach out to us on the Discord channel for questions and/or help.

The new Mithril Signer Deployment Models for SPOs will be introduced soon​

Epic: Prepare Mithril Signer deployment model for SPO #862

⚠️ The Mithril Signer Deployment Models is not deployed yet to the pre-release-preview and release-preprod network. A special announcement will be made on the ask-mithril Discord channel when a new release candidate distribution is ready.

All these information will be available at the updated Run a Mithril Signer node (SPO) guide. In the mean time, a preview of the Mithril signer setup with the production deployment model is available here. In the new production deployment model, a new Mithril Relay has been introduced and requires an extra setup effort versus the naive deployment model that is currently ran by the pioneer SPOs on the Mithril test networks.

Here is the schema of the production deployment for the mainnet:

and the schema of the naive deployment only for the testnet:

Feel free to reach out to us on the Discord channel for questions and/or help.