9 posts tagged with "spo"

Mithril snapshots for Cardano database could be compromised by an adversary​

The Mithril team has published a security advisory for users running the Mithril client on the mainnet infrastructure:

• Identifier: GHSA-qv97-5qr8-2266
• Title: Mithril snapshots for Cardano database could be compromised by an adversary
• Location: GHSA-qv97-5qr8-2266
• Severity: Moderate (4.9/10).

curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/input-output-hk/mithril/refs/heads/main/mithril-install.sh | sh -s -- -c mithril-client -d 2517.1 -p $(pwd)

For any inquiries or assistance, contact the team on the Discord channel.

Announcing the decommissioning of the testing‑sanchonet network​

The testing-sanchonet Mithril network was introduced a year ago to allow the community to test experimental features and provide feedback to the Mithril team. In particular, it has been a valuable tool for testing the transition to the Conway era.

The Mithril team sincerely appreciates the Mithril pioneer stake pool operators for participating in testing and providing valuable feedback!

The Cardano SanchoNet network is now being sunset, having served its purpose of introducing governance features from CIP-1694 in a controlled testnet environment.

In this context, the Mithril team has decided to decommission the testing-sanchonet network:

• the aggregator will be terminated by February 21, 2025
• the network will be removed from the Mithril explorer
• the repository code will be cleaned up.

If you are running a Mithril signer on this network, you can safely terminate your node and remove the testing-sanchonet configuration from your setup.

Available Mithril networks are listed on the Network configurations page of the documentation website.

For any inquiries or assistance, contact the team on the Discord channel.

Mithril certificate chain could be manipulated by an adversarial signer (security advisory)​

The Mithril team has published a security advisory for users running the Mithril client on the mainnet infrastructure:

• Identifier: GHSA-724h-fpm5-4qvr
• Title: Mithril certificate chain could be manipulated by an adversarial signer
• Location: GHSA-724h-fpm5-4qvr
• Severity: High (5.3/10).

curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/input-output-hk/mithril/refs/heads/main/mithril-install.sh | sh -s -- -c mithril-client -d 2506.0 -p $(pwd)

For any inquiries or assistance, feel free to contact the team on the Discord channel.

The release of the Mithril SanchoNet testing network​

The Mithril team has released the new testing-sanchonet Mithril network.

Mithril pioneer stake pool operators (SPOs) are welcome to run a Mithril signer on this network, with configuration parameters available here.

It's important to note that this network will serve as the primary platform for experimenting with unstable features of the Mithril networks in the future, such as the Cardano transactions set signatures or peer-to-peer (P2P) networking.

The unstable features are consistently developed and deployed to the SanchoNet testing network directly from the main branch of the Mithril repository. Therefore, Mithril nodes operating on this network must be either built from the main branch or use pre-built binaries from the unstable release. Failure to update Mithril nodes to the latest unstable version or encountering a bug during development could result in operational disruptions.

Note that the testing-sanchonet network undergoes continuous monitoring, and its availability status is reported on this status page.

For any inquiries or assistance, don't hesitate to reach out to the team on the Discord channel.

The Mithril signer node service recommended configuration is updated​

PR: Fix signer service recommended configuration #1419

Issue: Fix signer node service setup #1404

The previous recommended configuration proposed a service restart frequency which was too high. When the service was restarted, and if the Cardano node was not ready yet, the service tried to restart too many times in a short period: thus the service just failed and the service had to be started manually after the Cardano node is up and ready. This lead to some SPOs skipping registrations for some epochs.

The duration before restarting the service is increased to 60s: RestartSec=60.

Below is the new recommended configuration:

[Unit]
Description=Mithril signer service
StartLimitIntervalSec=0

[Service]
Type=simple
Restart=always
RestartSec=60
User=cardano
EnvironmentFile=/opt/mithril/mithril-signer.env
ExecStart=/opt/mithril/mithril-signer -vvv

[Install]
WantedBy=multi-user.target
EOF'

We highly recommend to update your existing configuration file (/etc/systemd/system/mithril-signer.service) with the values specified in the guide

⚠️ Following this modification, the service needs to be restarted with the following command:

sudo systemctl restart mithril-signer

Feel free to reach out to us on the Discord channel for questions and/or help.

Mithril client library is open to developers on crates.io​

The Mithril team has published the first release (v0.5.7) of its mithril-client library on crates.io.

The Mithril client library allows developers to use all the tooling necessary to manipulate Mithril certified types from a Mithril Aggregator directly in their (Rust) applications and to develop their own Mithril clients!

Here are some useful documentation that can be used by developers:

• Developer documentation: https://docs.rs/mithril-client/0.5.7/mithril_client/
• Example of implementations:https://github.com/input-output-hk/mithril/blob/main/examples/
• Mithril client repository: https://github.com/input-output-hk/mithril/tree/main/mithril-client
• Crates.io: https://crates.io/crates/mithril-client

Feel free to reach out to us on the Discord channel for questions and/or help.

Mithril relay could expose Cardano block producer internal IP when updated (Security Advisory)​

The Mithril team has published a security advisory to destination of SPOs running a Mithril signer/relay on the mainnet infrastructure:

• Identifier: GHSA-9m3h-72xj-x2gq
• Title: Mithril relay could expose Cardano block producer internal IP when updated
• Location: https://github.com/input-output-hk/mithril/security/advisories/GHSA-9m3h-72xj-x2gq
• Severity: High (7.2/10)

Feel free to reach out to us on the Discord channel for questions and/or help.

Update 2023/07/30: The first certificates and snapshots have been produced by the release-mainnet network!

Update 2023/07/25: The Genesis certificate of the release-mainnet network has been successfully created.

Mithril Protocol’s Mainnet Beta is launched 🚀​

The Mithril team is thrilled to announce that the Mithril Protocol’s Mainnet Beta is launched 🎉

Here are the next steps that we will follow in order to get the release-mainnet network producing its first certificates:

1. Open the first signers registrations on the release-mainnet network (1 epoch).
2. Create the genesis certificate of the release-mainnet network (1 epoch).
3. Wait for the first certificates to be produced by the release-mainnet network.

This is an expected timeline, in case of modification, we will amend this post with a new one.

Also, the documentation has been updated with the configuration of the release-mainnet network. It is available here.

Feel free to reach out to us on the Discord channel for questions and/or help.

The new Mithril Signer Deployment Models for SPOs will be introduced soon​

Epic: Prepare Mithril Signer deployment model for SPO #862

⚠️ The Mithril Signer Deployment Models is not deployed yet to the pre-release-preview and release-preprod network. A special announcement will be made on the ask-mithril Discord channel when a new release candidate distribution is ready.

All these information will be available at the updated Run a Mithril Signer node (SPO) guide. In the mean time, a preview of the Mithril signer setup with the production deployment model is available here. In the new production deployment model, a new Mithril Relay has been introduced and requires an extra setup effort versus the naive deployment model that is currently ran by the pioneer SPOs on the Mithril test networks.

Here is the schema of the production deployment for the mainnet:

and the schema of the naive deployment only for the testnet:

Feel free to reach out to us on the Discord channel for questions and/or help.