v1.13

Secret Network v1.13 Instructions

⚠️ IMPORTANT NOTES ⚠️

• All coordination efforts will be done in the "SN Validators" Telegram group.

• Make sure to backup your validator before making any changes.

• Please read carefully before you begin the upgrade.

⚠️ Cosmovisor tool may NOT be used with this upgrade. This is due to the following facts:

• Various prerequisites should be installed and configured

• After the installation, the secret node should perform an additional step, BEFORE the actual network upgrade (more on this later).

Upgrading Manually

There are 9 steps to be performed. Steps 1-4 inclusive can be performed BEFORE the upgrade height is reached (or before the upgrade is even proposed). We recommend doing so, i.e. perform those steps in advance, to minimize the downtime during the upgrade.

Technically the DCAP attestation isn't required. If your node is already registered on the network then the attestation during the upgrade isn't necessary, and we still support EPID attestation anwayay. But we strongly recommend making sure it works nevertheless. The EPID would be phased-out by Intel on April 2025.

1. Make sure you have the latest SGX DCAP driver

# 1. Make sure the SGX driver is installed. The following devices should appear:
# /dev/sgx_enclave
# /dev/sgx_provision

# If your kernel version if 5.11 or higher, then you probably already have the SGX driver installed.
# Otherwise - please update the kernel version.

# Also make sure that the user under which the node is supposed to run has privileges to access SGX
sudo groupadd sgx_prv
sudo usermod -a -G sgx_prv $USER

# Check if the above has effect, by the following command
groups

# The sgx_prv should appear. If it does not - Logout and re-login may be needed, for the change to take effect.

2. Install the DCAP runtime and AESM service

curl -fsSL https://download.01.org/intel-sgx/sgx_repo/ubuntu/intel-sgx-deb.key | sudo apt-key add -
. /etc/os-release; VERSION_CODENAME=${VERSION_CODENAME}
sudo add-apt-repository "deb https://download.01.org/intel-sgx/sgx_repo/ubuntu $VERSION_CODENAME main"
sudo apt-get update
sudo apt-get install -y \
    libsgx-aesm-launch-plugin \
    libsgx-enclave-common \
    libsgx-epid \
    libsgx-launch \
    libsgx-quote-ex \
    libsgx-uae-service \
    libsgx-qe3-logic \
    libsgx-pce-logic \
    libsgx-aesm-pce-plugin \
    libsgx-dcap-ql \
    libsgx-dcap-quote-verify \
    libsgx-urts \
    sgx-aesm-service \
    libsgx-aesm-ecdsa-plugin \
    libsgx-aesm-quote-ex-plugin \
    libsgx-ae-qve \
    libsgx-dcap-default-qpl	

sudo apt upgrade

If your system has 5th Gen Intel® Xeon® Scalable Processor(s)

For the DCAP attestation to work, you'll need to register your platform with Intel. This is achieved by the following:

sudo apt-get install -y sgx-ra-service

You can check the file /var/log/mpa_registration.log, to see if the platform is registered successfully.

3. Configure Quote Provider

The Quote Provider library is needed to provide the data for DCAP attestation. It should be installed by now (by the previous section), but before using it should be configured. The configuration file should be here:

/etc/sgx_default_qcnl.conf

If you're running a physical machine

The simplest would be to use the PCCS run by SecretLabs. Modify the following parameters in the file:

//PCCS server address
"pccs_url": "https://pccs.scrtlabs.com/sgx/certification/v4/"

You can set this parameter by the following command:

sudo cp /etc/sgx_default_qcnl.conf /etc/sgx_default_qcnl.conf.BKP
sudo sed -s -i 's/localhost:8081/pccs.scrtlabs.com/' /etc/sgx_default_qcnl.conf

Cloud computers

For cloud computers, the cloud service providers may provide their own PCCS. Please see their documentation

Note: You'll need to restart the AESMD service each time the configuration is changed

# Restart the AESMD service
sudo systemctl restart aesmd.service

4. Use check-hw to test the DCAP attestation (Optional step)

Download and run the check-hw tool (included in the Release package). You should see the following:

DCAP attestation ok
Platform verification successful! You are able to run a mainnet Secret node

That would mean all the above steps are ok, and you're good to go.

In case you see some error messages, but at the end the following:

Platform Okay!
Platform verification successful! You are able to run a mainnet Secret node

That would mean there's a problem with DCAP attestation. However the EPID attestation still works. Although you may technically run the node, it's strongly recommended to fix this. The EPID will be phased-out by Intel on April 2025.

To get a more detailed error info, run check-hw --testnet

5. Wait till the upgrade height is reached

When the network reaches the halt height you'll see this message in your node's log (journalctl -fu secret-node):

2:00PM ERR UPGRADE "v1.13" NEEDED at height: ...
2:00PM ERR CONSENSUS FAILURE!!! err="UPGRADE \"v1.13\" NEEDED at height: ...

Then, follow those steps to upgrade for v1.13: :warning: Note: The below instructions assume default installation. DO NOT COPY-PASTE if config.toml is not in ~/.secretd/config/config.toml or if you modified /etc/systemd/system/secret-node.service. If you have modified /etc/systemd/system/secret-node.service, you will need to re-apply those changes post installation and pre service restart.

6. Backup files, and install the new version

# Backup your node's SGX secrets
cp -a /opt/secret/.sgx_secrets ~/sgx_secrets_backup
mkdir 112backup
cp ~/.secretd/.node/* 112backup/


# Get the v1.13 binaries
wget "https://github.com/scrtlabs/SecretNetwork/releases/download/v1.13.0/secretnetwork_1.13.0_mainnet_goleveldb_amd64.deb"

# Stop the v1.12 node
sudo systemctl stop secret-node

# Install the v1.13 binaries
sudo apt install -y "./secretnetwork_1.13.0_mainnet_goleveldb_amd64.deb"

7. Migrate your local sealed files

This step must be done manually, before the Node automatic upgrade

# IMPORTANT: Upgrade sealed files to the newer SGX format
secretd migrate_sealing

8. Verify the DCAP attestation is working (Optional step)

This node version supports both EPID (older) and DCAP (newer) attestation schemes. Before proceeding, it's recommended to verify that DCAP attestation works properly. Though it's not mandatory if your node is already registered on the network.

# Retrieve DCAP-only attestation
secretd init-enclave --no-epid

The above retrieves self attestation. And since --no-epid flag is specified, that should be a DCAP attestation.

You can also verify that EPID attestation works, by the following command

# Retrieve EPID-only attestation
secretd init-enclave --no-epid

# Or retrieve any (EPID or DCAP or both) attestation
secretd init-enclave

9. Finally start the node

# re-apply any systemd unit file customizations

# Restart the node
sudo systemctl restart secret-node

After restarting the node with v1.13, you should see INF applying upgrade "v1.13" at height: ... in the logs (journalctl -fu secret-node). Once 67% of voting power comes online, you'll see blocks executing again.

Details of Upgrade Time

When the network reaches the halt height, the Secret Network blockchain will be halted and validators will need to take action to upgrade the chain to the secretd v1.13 binary (be it manually or automatically).

The upgrade is anticipated to take approx 30 minutes, during which time, there will not be any on-chain activity on the network.

In Case of an Upgrade Failure

In the event of an issue at upgrade time, we should coordinate via the "SN Validators" Telegram group.

If as a result of a software bug the network fails to produce new blocks with the v1.13 binaries, the SCRT Labs team will distribute a v1.12 binary with a replacement v1.13 upgrade handler, which will allow the chain to revert to v1.12 while continuing to produce new blocks.