Add artifacts publishing to estimates

[askolesov]

No description provided.

[askolesov]

Verim-option-4b-by-milestones-estimate-v2.xlsx

[askolesov]

(from slack: Ankur and Alex)

1st milestone:

• Docker images for Node and CLI released via Github Packages
• Using Github Releases, publish zip/tarball, .deb targetting Ubuntu LTS
• For a PPA, I don't think it's directly possible with Github but releasing via launchpad is not hard

For later milestone:

• Either a .rpm package for latest stable RHEL in addition to above or a Snap package which works across all platforms

Deb design:

• most probably we want the new package to put new versions locally if there are any
• I see two cases when it can be valuable:
• New node bootstrapping
• The moment after the upgrade is proposed and before the upgrade condition is achieved
• In other cases it will be meaningless
• And the second question:

Also, what’s the threat models here? if someone breaks into our Ubuntu Launchpad PPA and replaces the node genesis and updates, can they effectively push out an update that perhaps rewrites the chain history?

• Cosmovisor checks only that binaries that it downloads
• Existing binaries considered trusted so it’s our responsibility to take care of pachages signing and distribution

Docker image design:

An image will contain the same versions of node as a deb package. At start:

• It will copy bundled versions to a volume (only genesis at start)
• And start cosmovisor

Use cases:

• Genesis node: image is bundled with genesis binary, it can handle updates on it’s own
• New node: has all existing updates bundled to speed up the process. Can handle future updates on it’s own
• New node can be started using outdated image as well (the same as with outdated deb). All necessary updates will be downloaded automatically.