Skip to content

Backport release/v6.7: feat(seidb): Add JSON output to evm-logical-digest and inspect a FlatKV migration in flight #4255

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
seidroid wants to merge 1 commit into
base: release/v6.7
Choose a base branch
from
+1,083 −169
Draft

Backport release/v6.7: feat(seidb): Add JSON output to evm-logical-digest and inspect a FlatKV migration in flight #4255

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,31 @@ Ref: https://keepachangelog.com/en/1.0.0/

# Changelog

<<<<<<< HEAD
=======
## Unreleased

### Improvements
* [#4166](https://github.com/sei-protocol/sei-chain/pull/4166) feat(seidb): `evm-logical-digest` can emit both digest and inspect reports as one JSON object on stdout, while progress and warnings go to stderr. Inspect mode now supports the mid-migration composite EVM view and semantic memiavl replay, so operators can shard and locate mismatched EVM keys during a FlatKV drain. Digest replay opens memiavl read-only without changelog repair, so an observer cannot truncate a live node's changelog. `seidb` now reports a failing command on stderr rather than stdout, so a refused `--json` run leaves stdout empty instead of putting a bare error line where the report belongs.
* [#4009](https://github.com/sei-protocol/sei-chain/pull/4009) Bound `/store/*/subspace` ABCI queries with pair/byte caps, empty-prefix rejection, SS-path concurrency limits, and context-aware iteration to prevent memory-exhaustion DoS.
* [#4032](https://github.com/sei-protocol/sei-chain/pull/4032) fix(config): the default `telemetry.prometheus-retention-time` drops from `7200` to `0`, so neither app.toml-generation pipeline (`seid init`, or the file a node writes for itself on any other subcommand) starts the Prometheus metrics sink unless an operator sets a positive retention. Freshly generated nodes keep the bounded in-memory telemetry sink used by SIGUSR1 dumps. Existing `app.toml` files are unchanged.
* [#4021](https://github.com/sei-protocol/sei-chain/pull/4021) feat(grpc): per-IP rate-limit admission for the gRPC plane, off by default behind `[grpc] rate-limiting-enabled` (new `ip-rate-limit-rps` / `ip-rate-limit-burst` / `trusted-proxy-cidrs`, defaults 10 rps / 20 burst / trust no proxy). Native gRPC (:9090) is admitted by a tap handler and gRPC-Web (:9091) by HTTP middleware, both before the request is protobuf-decoded, so a throttled caller cannot spend the decoder; streams pay one token to establish and one per inbound message. Both planes draw from the same per-IP buckets. Over-budget callers get `ResourceExhausted` on :9090 and HTTP 429 on :9091, counted by `rpc_rate_limit_rejected_total{plane="grpc", method_namespace}`.
* [#4078](https://github.com/sei-protocol/sei-chain/pull/4078) feat(grpc): bound concurrent in-flight RPCs and open connections per IP on the gRPC query plane. New `[grpc] max-connections-per-ip` and `[grpc-web] max-connections-per-ip` (default 0, unlimited) optionally cap one address's share of the global connection budget on :9090 and :9091, regardless of `rate-limiting-enabled`. New `[grpc] max-in-flight-per-ip` (default 100) caps concurrent RPCs per address when `rate-limiting-enabled = true`: the slot is taken at the HTTP/2 HEADERS frame and returned when the RPC ends. Both planes draw from the same per-IP pool. Concurrency rejections return `ResourceExhausted` on :9090 and HTTP 429 on :9091, counted by `rpc_inflight_rejected_total{plane, method_namespace}`; refused connections are counted by `rpc_connection_rejected_total{plane}`.
* [#4117](https://github.com/sei-protocol/sei-chain/pull/4117) chore(giga): remove the unused evmone/evmc execution path from the Giga executor. The Giga executor's production path already ran on go-ethereum's native interpreter; evmone was only reachable through a best-effort VM init that nothing consumed. Release images no longer ship `libevmone.*.so`/`.dylib` under `/usr/lib`, and the `SEI_EVMONE_LIB_DIR` operator override is removed.
* [#4098](https://github.com/sei-protocol/sei-chain/pull/4098) chore: upgrade the Go toolchain to 1.27.1 and golangci-lint to v2.13.2. The multistore state-sync snapshot format is bumped from `1` to `2` because the new toolchain's `compress/flate` emits a different (still valid) zlib stream, so snapshots of the same height are no longer byte-identical to those produced by earlier binaries. Nodes on this release restore both format `1` and format `2` snapshots.
* [#4191](https://github.com/sei-protocol/sei-chain/pull/4191) chore(docs): remove the embedded swagger UI and the `docs/rfc` folder. The API server no longer serves `/swagger/`; the `api.swagger` key in `app.toml` is now a no-op kept for sei-cosmos config compatibility.

### State Machine Breaking
* [#4098](https://github.com/sei-protocol/sei-chain/pull/4098) `CommitSig.FromProto` now rejects a `block_id_flag` outside `ABSENT`/`COMMIT`/`NIL` at decode time instead of truncating it to `uint8`; a flag such as `257` that previously wrapped to `ABSENT` is now a decode error.

### Upgrade guide
* [#4098](https://github.com/sei-protocol/sei-chain/pull/4098) **State-sync snapshot format bump (`1` → `2`).** Nodes running this release produce format `2` snapshots. Nodes still on an earlier release respond `REJECT_FORMAT` to every snapshot offered by an upgraded peer, so during a rolling upgrade they can only state-sync from peers that have not yet upgraded. Upgraded nodes accept both formats, so they can still bootstrap from old peers. **Operators should upgrade state-sync RPC providers last, or keep at least one pre-upgrade snapshot provider available until the rest of the fleet has moved.**
* [#4032](https://github.com/sei-protocol/sei-chain/pull/4032) **The Prometheus telemetry sink is off by default.** A node whose `app.toml` is generated by this release gets `prometheus-retention-time = 0`, which leaves the sink uncreated even though `telemetry.enabled` stays `true`. `GET /metrics?format=prometheus` on the app API server (:1317) then returns `prometheus metrics are not enabled`, and the `seid` process exports no application Prometheus series. **Operators who scrape application metrics should set a positive `[telemetry] prometheus-retention-time` in `app.toml` (the previous default was `7200`) before generating a new configuration file.** Nodes that already have `prometheus-retention-time` written in `app.toml` are unaffected.
* [#4021](https://github.com/sei-protocol/sei-chain/pull/4021) **gRPC per-IP rate limiting defaults are deliberately conservative.** Admission stays off unless `[grpc] rate-limiting-enabled = true`, but the defaults it enables are 10 rps / 20 burst per IP. Streams pay one token to establish and one per inbound message, so at the default burst a client that sends more than ~20 messages in a burst is cut off mid-stream with `ResourceExhausted`. Operators enabling admission should size `ip-rate-limit-rps` / `ip-rate-limit-burst` against their heaviest streaming client, and set `trusted-proxy-cidrs` to their ingress CIDRs so callers are not all bucketed under the proxy's IP.
* [#4078](https://github.com/sei-protocol/sei-chain/pull/4078) **Optional per-IP connection and in-flight RPC caps on :9090 and :9091.** `max-connections-per-ip` defaults to 0 (unlimited) on both planes; set a positive value to cap one address's share of the global connection budget. The cap keys on the TCP peer that opened the socket and is unaffected by `trusted-proxy-cidrs`, which needs a request to read `X-Forwarded-For` from and so cannot apply at accept time: everything reaching the node over `127.0.0.1` shares one allowance, as does every client behind a proxy or load balancer, and IPv6 peers share per /64. **Operators exposing public gRPC query endpoints directly may want to set `[grpc] max-connections-per-ip` and `[grpc-web] max-connections-per-ip` (for example to 100, a tenth of the default global budget); on a node behind an ingress, size it against that ingress's total concurrent connections rather than one client's, or leave it at 0.** The companion `[grpc] max-in-flight-per-ip` (default 100 concurrent RPCs per address) only takes effect when `rate-limiting-enabled = true`; size it against your heaviest client's concurrency.
* [#4009](https://github.com/sei-protocol/sei-chain/pull/4009) **`/store/*/subspace` scans are now capped.** Wide prefix scans that previously returned unbounded KV pairs now fail with `subspace result exceeds limit` once they would exceed the default caps of 1,000 pairs or 4 MiB of accumulated key+value bytes. Empty prefixes are rejected. Indexers and tooling that issue wide `/subspace` queries must narrow their prefixes, shard by sub-prefix, or raise `[state-commit] sc-subspace-max-pairs` and `sc-subspace-max-bytes` before upgrading. Values `<= 0` resolve to these defaults; there is no unlimited setting.

>>>>>>> 29139f2 (feat(seidb): Add JSON output to evm-logical-digest and inspect a FlatKV migration in flight (#4166))
## v6.7

### Improvements
Expand Down
4 changes: 3 additions & 1 deletion sei-db/tools/cmd/seidb/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,9 @@ func main() {
operations.EvmLogicalDigestCmd(),
operations.HashLogCmd())
if err := rootCmd.Execute(); err != nil {
fmt.Println(err)
// Subcommands with a --json mode make stdout a machine-readable channel, so a
// bare error line there would corrupt the report a caller is parsing.
fmt.Fprintln(os.Stderr, err)
os.Exit(1)
}
}
Loading
Loading