Repository navigation
manifest: pilotctl that deletes app state on upgrade refuses this version (0.4.1) - #50
Merged
Merged
Conversation
…sion (0.4.1) pilotctl v1.13.0-v1.13.9 delete an app's dir on `appstore upgrade`, which the updater runs hourly as `upgrade --all`. Publishing 0.4.0 would have deleted 0.3.3 wallets' EVM keys on those nodes before 0.4.0 ever ran, so there is no copy to restore (tested with real builds of v1.13.0, v1.13.5 and v1.13.9). The manifest now declares identity.verify, which app-store v1.0.3 (pilotctl v1.13.10, the first that carries state forward) added. Older validators reject it, so those pilotctl versions refuse the upgrade before touching the install and the key stays on disk; v1.13.10 and later upgrade and keep it. The wallet does not use the capability. TestManifestRefusedByPilotctlThatDeletesState keeps the grant in. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
TeoSlayer
added a commit
to pilot-protocol/app-template
that referenced
this pull request
Oct 8, 2026
pilot-app validated manifests with a June app-store pseudo-version, older than v1.0.3, which added the identity.verify capability. Wallet 0.4.1 declares it (pilot-protocol/wallet#50) so pilotctl that deletes app state on upgrade refuses the version; without this bump the review gate, and so the submission CI and publish-on-merge, reject the wallet. The go directive follows app-store to 1.25.10; every workflow uses the latest 1.25 or go.mod. Generated adapters keep their own app-store pin. Co-authored-by: Teo Calin <calinteodor@Teos-MacBook-Pro.local> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
TeoSlayer
added a commit
to pilot-protocol/app-template
that referenced
this pull request
Oct 8, 2026
Replaces 0.4.0, which was never in the catalogue: pilotctl v1.13.0-v1.13.9 would have deleted 0.3.3 wallets' EVM keys while upgrading to it. 0.4.1's manifest declares identity.verify, which those versions do not know, so they refuse the upgrade and the key stays (pilot-protocol/wallet#50). The four bundles are the wallet v0.4.1 release assets, signed with the rotated publisher key. Co-authored-by: Teo Calin <calinteodor@Teos-MacBook-Pro.local> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
pilotctl v1.13.0–v1.13.9 delete an app's dir on
appstore upgrade, and the updater runs that hourly asupgrade --all. State carry-forward first shipped in v1.13.10 (pilotprotocol#467).Publishing 0.4.0 would have deleted 0.3.3 wallets' EVM keys on those nodes. The delete happens before 0.4.0 ever runs, so there is no copy for it to restore. This was tested with real builds of v1.13.0, v1.13.5 and v1.13.9; 0.4.0 came up with a new key each time. Its catalogue PR (pilotprotocol#529) was closed unmerged.
Fix
identity.verify. app-store v1.0.3 added this capability, and v1.0.3 is what pilotctl v1.13.10 ships.upgradecommand.TestManifestRefusedByPilotctlThatDeletesStatefails if every grant's cap is known to v1.13.0–v1.13.9. It fails with the grant removed.Tested
A bundle with this manifest and the released 0.4.0 binary went through catalogue install 0.3.3 → upgrade → uninstall → reinstall, with 0.3.3 and the new version signed by different publisher keys:
grants[21].cap "identity.verify" is not a known capability🤖 Generated with Claude Code