Skip to content

penumbra-1 recovery — pd 2.0.9

Choose a tag to compare

View all tags
@hitchho hitchho released this 06 Sep 17:03
v2.0.9
136c4aa

penumbra-1 coordinated restart — pd 2.0.9 (migrate-restart)

penumbra-1 halted at height 12598600. This continues the same
chain-id — all balances and delegations preserved — by disabling the
two departed validators (iqlusion, polkachu) and keeping the other 14.

Verify, do not trust. The cross-check is that your own
pd migrate-restart reproduces the exact genesis hash below — not this
binary. Reproduce the binary: cargo build --release --locked -p pd on
this tag. Built on ubuntu-22.04 (glibc 2.35). Every code change versus
stock v2.0.6: v2.0.6...v2.0.9

Restart height is 12598602. Every validator that was online at the
halt already signed height 12598601 on the halted chain, and CometBFT
will not sign those rounds again, so a restart at 12598601 can never
produce a block (reproduced on a copy of the real halt state). The
migration executes an empty application block 12598601 itself and
starts CometBFT at 12598602; your signing state is raised to 12598602
by the migration. There is no CometBFT block 12598601. Earlier builds
(v2.0.8, the 2.0.6 branch builds) must not be used.

  • genesis sha256: c099ccb02a2136d5071fb22b1511eeec1588ad09676e0a0532d072f28b433ed4
  • app_hash / post_root: 1db72ab20c0babdb8696f361d5b08d790abd8032ac64d762b138ddc80f0f99f7

What each validator does

The script restart/penumbra-restart.sh walks all of this as confirmed
steps (detects your homes, refuses on mismatch). Manual equivalent:

# 0. Get pd 2.0.9 (this release's binary, or build from source above).
#    STOP your old pd AND cometbft. Do NOT start any old-chain node again.
# 1. Snapshot / full copy of node0 (rollback point). Do not touch
#    priv_validator_key.json or priv_validator_state.json.
cp -a node0 node0.pre-restart
# 2. Migrate (ulimit -n high; ~30s):
ulimit -n 1048576
pd migrate-restart --home node0/pd --comet-home node0/cometbft \
  --remove 3969C0511C6ABE474757FEAB7C1B4004796D7E72 \
  --remove 9B2D4391131198750FF28EE73EC953ECFCFD06EF \
  --disable
# 3. VERIFY the produced genesis — MUST equal the sha above, or stop:
sha256sum node0/cometbft/config/genesis.json
# 4. Check signing state: must read "height": "12598602", round 0, step 0
cat node0/cometbft/data/priv_validator_state.json
# 5. config.toml: persistent_peers = KEEP validators only, pex = false (first blocks).
# 6. Start pd (this binary), then cometbft, in the go-window.

Only hard rule: stop your old node before starting the migrated one
(running both = double-sign = tombstone). If you're late, just do
steps 0–6 whenever and your node will sync to the tip and resume signing —
you don't need to hit the go-window exactly. RPC/full nodes run steps 0–3
to follow the chain.

The first block is 12598602 once more than two thirds of the kept set is
online; round timeouts before that are expected. See restart/README.md.

Assets 6
Loading