Integration for Node release 11.1 - #6604
Merged
Merged
Conversation
Closed
johnalotoski
force-pushed
the
f-f/prepare-11.1
branch
3 times, most recently
from
August 5, 2026 19:45
9d4da9c to
2cfc906
Compare
carbolymer
force-pushed
the
f-f/prepare-11.1
branch
3 times, most recently
from
August 13, 2026 17:45
7af30e8 to
5e5812f
Compare
koslambrou
force-pushed
the
f-f/prepare-11.1
branch
8 times, most recently
from
August 14, 2026 19:34
59b93b0 to
b93644b
Compare
…86_64-linux release artifact
… cfg, group socket use
The cardano-node and cardano-tracer service modules unconditionally emitted `--machine-readable -tcardano-node.stats -pocardano-node` in the default `profilingArgs`, regardless of `cfg.profiling`. GHC's `-tFILE` always writes the stats file on shutdown, which broke startup on read-only filesystems even though no profiling was configured. Gate the three flags on `cfg.profiling != "none" || cfg.eventlog` so the default RTS command line is empty when nothing is requested. When profiling is enabled, the same flags now consult a new option, `services.cardano-node.profilingOutputDir` (and the tracer equivalent), to prefix the output file paths. The option defaults to null, preserving today's relative-path behavior on NixOS where systemd's `WorkingDirectory` equals `cfg.stateDir`. `scripts.nix` sets it to `/logs` for the OCI script wrappers, so profile output under the read-only OCI image lands on the writable `/logs` mount. In response to #6470.
`run-node` and `run-tracer` wrote a sourceable env file to `/usr/local/bin/env` at every startup, which fails under `--read-only` / `readOnlyRootFilesystem`. The file was introduced in d9c8317 (#2801) to feed the topologyUpdate script added the same day in c652f10. topologyUpdate was removed in 56266c0 and never reintroduced; the writer was preserved by accident when 34a4796 re-created the docker context, along with a stale `# Mapping for topologyUpdater` comment. Across all branches, there is noconsumer besides the deleted topologyUpdater. The `CARDANO_*` snapshot remains useful for operators that exec into the container and want the resolved (post-defaults) config in a shell, so the writer is kept but redirected to `/tmp/cardano-env` (writable when `/tmp` is mounted as tmpfs/emptyDir). A build-time symlink at `/usr/local/bin/env -> /tmp/cardano-env` keeps the legacy path resolving in case any out-of-tree consumer depends on it. The variables that existed only for topologyUpdater are dropped from the snapshot. The README's new "Read-Only Root Filesystem" section documents the required writable mounts, the new env-snapshot path, and how custom-mode operators should direct any profile output to a writable mount. In response to #6470.
The entrypoints wrote `{{,tracer-}config,topology}-merged.json` to
`/opt/cardano/config/$NETWORK/`, which is image content owned by root.
Non-root containers and read-only-root mounts both fail on this write.
Redirect the writes to `/tmp/cardano-{{,tracer-}config,topology}-merged.json`.
The upstream network config keeps relative refs to genesis /
peer-snapshot files, all resolved relative to the config file's own
directory. Naively moving the merged output to `/tmp` would break those
refs. The jq merge now rewrites them to absolute paths anchored at
`/opt/cardano/config/$NETWORK/`. The key match uses a regex
`(test("GenesisFile$|^CheckpointsFile$"))` so future protocol-era keys
pick up the rewrite without code changes.
Both entrypoints also bail out early with a clear error message if
`/tmp` is not writable, instead of letting the failure cascade into a
less-obvious jq write error.
In response to #6484.
The mount-point directories /data, /ipc, /logs were created owned by root. When a volume was first mounted there, Docker propagated the permissions from the image, so a container running as non-root could not write. Apply `chmod g+w` to open up the permissions enough for: - Kubernetes `runAsUser` (assigns primary group 0 by default) - Docker `--user <uid>` (assigns primary group 0 by default) - OpenShift's arbitrary-UID assignment (random UID, GID 0) For the tracer image, also add `mkdir -p data` and the matching symlink at `/opt/cardano/data` for parity with the node image's convention. `run-tracer` defaults `CARDANO_STATE_DIR` to `/data/tracer` and assumed that this symlink existed. This finally makes that true. The default state dir now works under non-root without an explicit `/data` mount. In response to #6484.
…tlog for node/tracer
johnalotoski
force-pushed
the
f-f/prepare-11.1
branch
3 times, most recently
from
August 15, 2026 06:32
118eaec to
799e3dc
Compare
Package version bumps: * cardano-api: ^>= 11.3 → ^>= 11.4 * cardano-cli: ^>= 11.1 → ^>= 11.2 * cardano-crypto-class: ^>= 2.3 → ^>= 2.5 * ouroboros-consensus: ^>= 3.0.1 → ^>= 4.1 * ouroboros-network: ^>= 1.1 → ^>= 1.2 * cardano-diffusion: ^>= 1.0 → ^>= 1.1.1 * cardano-protocol: (new, ^>= 0.1) Local package bumps: cardano-node 11.0 → 11.1, trace-forward 2.4.1 → 2.5.0 LedgerDB / storage: * Remove LMDB backend (V1LMDB); only V2LSM remains * Add LSMExportPath config option for standalone LSM exports * Rework snapshot config: NumOfDiskSnapshots/SnapshotInterval fields replaced by SnapshotPolicyArgs; validate non-positive SnapshotInterval Tracing: * Fix Peras tracing: add vote-db and cert-diffusion trace namespaces (TracePerasVoteDbEvent, TraceObjectDiffusionInbound/Outbound for Peras votes and certs) * Fix SanityCheckIssue namespace wildcard match and add documentation * Fix snapshot policy sanity-check tracing (SnapshotDelayRangeInverted, SnapshotRateLimitDisabled, SnapshotNumZero, etc.) * Add NodeToClient tracing coverage for missing namespaces * Fix KESAgentClientTrace severity dispatch * Remove embeddedInitialFunds double-counting (mirror ledger behaviour) * Fix Snapshot config option parsing cardano-submit-api: * TxSubmitWebApiError simplified to a newtype over TxSubmitFail; dead constructors (TxSubmitDecodeHex, TxSubmitEmpty, etc.) removed * Replace legacy iohk-monitoring example config with new-tracing config cardano-testnet: * Migrate ping to cardano-diffusion:ping (drop hand-rolled mux impl); pingNode now returns Either PingClientException () * Thread SomeHasFS IO through foldEpochState call sites via mkNodeConfigFs * Restore compact help layout Build / compat: * GHC 9.14 support (QuickCheck 2.18, crypton-x509-system, bytestring-trie, etc.) * Add cabal-allow-newer stanzas for GHC >= 9.14 * snap-server: disable openssl flag; cardano-diffusion: enable optparse-applicative-fork Haddock / CI: * Add haddock devShell (ghc9124) for the github-page workflow * Gate broken haddock only for GHC < 9.12.3 (type data panic) * Update golden test output for new GHC Workbench: * Add fschain-6912k profiles (6.75 MiB blocks, 3000 slots) * Fix blocksize768k overlay (missing epoch_params wrapper) * Fix git commit detection in worktree checkouts Co-authored-by: Fabrizio Ferrai <fabrizio.ferrai@iohk.io> Co-authored-by: Samuel Leathers <samuel.leathers@iohk.io> Co-authored-by: Javier Sagredo <javier.sagredo@iohk.io> Co-authored-by: Erik de Castro Lopo <erikd@mega-nerd.com> Co-authored-by: Pablo Lamela <pablo.lamela@iohk.io> Co-authored-by: Adithya Kumar <adithya.kumar@tweag.io> Co-authored-by: Russoul <ruslan.feizerakhmanov@iohk.io> Co-authored-by: Jordan Millar <jordan.millar@iohk.io> Co-authored-by: kolam <kolam@posteo.me>
Two flake relocks on this branch left several pins adrift. The mithril input commit dropped haskellNix to ef52c36b, which has no ghc9124, forcing the haddock devShell to ghc9122 and breaking the Haddock workflow. The dependency bump later moved cardano-automation's hackageNix off master, and mithril's own pins stayed on 2617.0's after the tag went to 2630.0. All now match master, or upstream's 2630.0 lock for mithril, and the haddock project variant is back on ghc9124.
johnalotoski
force-pushed
the
f-f/prepare-11.1
branch
from
August 16, 2026 07:08
799e3dc to
18ee6f7
Compare
Thread shelleyGenesisHash from mkConsensusProtocol through to mkNodeKernelAccess, matching the new cardano-rpc API. Add TraceRpcQueryReadGenesisSpan and TraceRpcNodeKernelAccess to all MetaTrace methods in Rpc.hs tracing. Bump CHaP index-state and flake.lock.
There was a problem hiding this comment.
Pull request overview
This PR updates the repository to integrate the Cardano Node 11.1 release, including dependency/version bumps, configuration/schema migrations (notably tracing and ledger snapshots), and operational hardening for Nix/OCI deployments.
Changes:
- Bumped package versions and updated dependency bounds across node, tracer, submit-api, testnet, and benches to align with node 11.1 ecosystem updates.
- Migrated configs away from legacy tracing and updated LedgerDB snapshot configuration to the new
LedgerDB.Snapshotsstructure (plus added/updated validation and tests). - Improved OCI/Nix operational behavior (read-only root support, runtime dir handling, updated CLI ping usage) and refreshed NixOS/workbench tests.
Reviewed changes
Copilot reviewed 137 out of 156 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| trace-forward/trace-forward.cabal | Version bump + bounds updates |
| trace-forward/src/Trace/Forward/Forwarding.hs | Handshake codec + reconnect arg update |
| scripts/lite/mainnet-legacy-tracing.sh | Removed legacy tracing script |
| nix/workbench/service/nodes.nix | Snapshot scheduling + LedgerDB config updates |
| nix/workbench/service/healthcheck.nix | Updated cardano-cli ping invocation |
| nix/workbench/run.sh | Remove .extraConfig from genesis |
| nix/workbench/backend/nomad/cloud.sh | LSMT wording + formatting tweaks |
| nix/set-git-rev.nix | Darwin platform predicate update |
| nix/pkgs.nix | Route RTS output to writable /logs |
| nix/nixos/tests/default.nix | Add OCI read-only root test |
| nix/nixos/tests/cardano-node-edge.nix | Update ping call + add metrics/journal asserts |
| nix/nixos/tests/cardano-node-artifact.nix | Update ping call + pipefail/jq asserts |
| nix/nixos/cardano-tracer-service.nix | Profiling/eventlog args + output-dir option |
| nix/nixos/cardano-submit-api-service.nix | Service refactor + metricsPort + socket group |
| nix/haskell.nix | Remove lmdb + legacy mainnet config reference |
| nix/docker/tracer.nix | /tmp perms, mount-point perms, runtime env alias |
| nix/docker/submit-api.nix | /tmp perms + expose metrics port |
| nix/docker/default.nix | /tmp perms, remove legacy config handling, env alias |
| nix/docker/context/tracer/bin/run-tracer | Write env snapshot under runtime dir |
| nix/docker/context/tracer/bin/entrypoint | Runtime dir creation/locking + merged config to /tmp |
| nix/docker/context/node/bin/run-node | Write env snapshot under runtime dir |
| nix/docker/context/node/bin/entrypoint | Runtime dir creation/locking + merged config/topology to /tmp |
| nix/binary-release.nix | Drop legacy config artifact emission |
| flake.nix | Add pinned mithril input + include signer in release exes |
| configuration/mainnet-ci/system-start.txt | Removed |
| configuration/mainnet-ci/log-config-cluster.yaml | Removed |
| configuration/mainnet-ci/key6.sk | Removed |
| configuration/mainnet-ci/key5.sk | Removed |
| configuration/mainnet-ci/key2.sk | Removed |
| configuration/mainnet-ci/key1.sk | Removed |
| configuration/mainnet-ci/key0.sk | Removed |
| configuration/mainnet-ci/hash.txt | Removed |
| configuration/mainnet-ci/generate.sh | Removed |
| configuration/defaults/byron-testnet/topology.json | Removed |
| configuration/defaults/byron-testnet/configuration.yaml | Removed |
| configuration/cardano/update-config-files.sh | Drop legacy config copying |
| configuration/cardano/testnet-template-config.json | Move snapshots under LedgerDB.Snapshots + drop legacy tracing keys |
| configuration/cardano/testnet-template-config-legacy.json | Removed |
| configuration/cardano/mainnet-topology.json | Update useLedgerAfterSlot |
| configuration/cardano/mainnet-config.yaml | LedgerDB snapshots migration + remove legacy tracing keys + MinNodeVersion bump |
| configuration/cardano/mainnet-config.json | LedgerDB snapshots migration + remove legacy tracing keys + MinNodeVersion bump |
| configuration/cardano/mainnet-config-legacy.json | Removed |
| cardano-tracer/test/Cardano/Tracer/Test/Forwarder.hs | Handshake codec update |
| cardano-tracer/src/Cardano/Tracer/Acceptors/Server.hs | Handshake codec update |
| cardano-tracer/src/Cardano/Tracer/Acceptors/Client.hs | Handshake codec update |
| cardano-tracer/cardano-tracer.cabal | Bounds bumped (diffusion/network/trace-forward) |
| cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/Utils.hs | Minor variable rename |
| cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/SanityCheck.hs | Thread SomeHasFS via mkNodeConfigFs |
| cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/Rpc/Query.hs | Rational conversion updates + renames |
| cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/Gov/TreasuryWithdrawal.hs | Thread SomeHasFS via mkNodeConfigFs |
| cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/Gov/TreasuryGrowth.hs | Thread SomeHasFS via mkNodeConfigFs |
| cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/Gov/ProposeNewConstitutionSPO.hs | Thread SomeHasFS via mkNodeConfigFs |
| cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/Gov/ProposeNewConstitution.hs | Thread SomeHasFS via mkNodeConfigFs |
| cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/Gov/InfoAction.hs | Thread SomeHasFS via mkNodeConfigFs |
| cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/FoldEpochState.hs | Thread SomeHasFS via mkNodeConfigFs |
| cardano-testnet/test/cardano-testnet-test/Cardano/Testnet/Test/Api/TxReferenceInputDatum.hs | Adjust call-site args |
| cardano-testnet/test/cardano-testnet-golden/files/golden/version_cmd.cli | Update golden versions |
| cardano-testnet/src/Testnet/Start/Cardano.hs | Thread SomeHasFS + import tidy |
| cardano-testnet/src/Testnet/Runtime.hs | Thread SomeHasFS + import tidy |
| cardano-testnet/src/Testnet/Process/Cli/SPO.hs | Thread SomeHasFS via mkNodeConfigFs |
| cardano-testnet/src/Testnet/Ping.hs | Switch to cardano-diffusion:ping wrapper |
| cardano-testnet/src/Testnet/Filepath.hs | Add mkNodeConfigFs helper |
| cardano-testnet/src/Testnet/Defaults.hs | Add cgExtraConfig + protocol version type tweak |
| cardano-testnet/src/Testnet/Components/Query.hs | Thread SomeHasFS via mkNodeConfigFs |
| cardano-testnet/src/Testnet/ChainWatchdog.hs | Use new tracer constructor (mkTracer) |
| cardano-testnet/src/Testnet/Blockfrost.hs | Protocol minor version type tweak |
| cardano-testnet/cardano-testnet.cabal | Version + bounds updates + add fs-api |
| cardano-testnet/.changes/20260805_183139_fabrizio.ferrai_node_11_1_testnet_internals.yml | Changelog entry |
| cardano-testnet/.changes/20260714_120000_fabrizio.ferrai_node_11_1_testnet_integration.yml | Breaking-change entry |
| cardano-testnet/.changes/20260714_120000_fabrizio.ferrai_node_11_1_testnet_integration.md | Changelog markdown |
| cardano-submit-api/test/run.sh | Update rejection assertions |
| cardano-submit-api/swagger.yaml | Removed obsolete swagger |
| cardano-submit-api/src/Cardano/TxSubmit/Types.hs | Collapse web-api error type to newtype |
| cardano-submit-api/src/Cardano/TxSubmit.hs | readConfigurationWithDefault API update |
| cardano-submit-api/README.md | Rewrite docs for new tracing + cli usage |
| cardano-submit-api/config/tx-submit-mainnet-config.yaml | Replace legacy logging example with new tracing config |
| cardano-submit-api/cardano-submit-api.cabal | Version + bounds updates |
| cardano-submit-api/.changes/20260805_183138_fabrizio.ferrai_node_11_1_submit_api_integration.yml | Changelog entry |
| cardano-submit-api/.changes/20260805_183137_fabrizio.ferrai_submit_api_error_newtype.yml | Breaking-change entry |
| cardano-node/test/Test/Cardano/Node/POM.hs | Add snapshot-format parsing properties |
| cardano-node/test/Test/Cardano/Node/FilePermissions.hs | Tracer plumbing updates |
| cardano-node/test/Test/Cardano/Config/Mainnet.hs | Pass filesystem handle into initialLedgerState |
| cardano-node/src/Cardano/Node/Tracing/Tracers/Startup.hs | protocolInfo monadic + new startup trace + moved-option message |
| cardano-node/src/Cardano/Node/Tracing/Tracers/Rpc.hs | Add Sync + node-kernel-access RPC traces |
| cardano-node/src/Cardano/Node/Tracing/Tracers/NodeToClient.hs | Add ObjectDiffusion tracing metadata |
| cardano-node/src/Cardano/Node/Tracing/Tracers/LedgerMetrics.hs | Update IsLedger constraint form |
| cardano-node/src/Cardano/Node/Tracing/Render.hs | Update era dispatch + purpose constructor rename |
| cardano-node/src/Cardano/Node/Tracing/Formatting.hs | Update ConvertRawHash instance to new class shape |
| cardano-node/src/Cardano/Node/Tracing/Era/Shelley.hs | Imports/type updates + API migration |
| cardano-node/src/Cardano/Node/Tracing/Consistency.hs | FromFile config source + namespace expansions |
| cardano-node/src/Cardano/Node/Tracing/API.hs | FromFile config source + tracer imports cleanup |
| cardano-node/src/Cardano/Node/Startup.hs | Add RpcUnsupportedBlockType trace |
| cardano-node/src/Cardano/Node/Run.hs | protocolInfo monadic + node kernel access wiring |
| cardano-node/src/Cardano/Node/Protocol/Types.hs | ProtocolInfoArgs now monadic (IO) |
| cardano-node/src/Cardano/Node/Protocol/Shelley.hs | Provide genesis-rooted filesystem handle |
| cardano-node/src/Cardano/Node/Protocol/Conway.hs | Set cgExtraConfig default |
| cardano-node/src/Cardano/Node/Protocol/Checkpoints.hs | Safer hash parsing |
| cardano-node/src/Cardano/Node/Protocol/Cardano.hs | Return Shelley genesis hash + filesystem handle |
| cardano-node/src/Cardano/Node/Protocol.hs | Consensus protocol now returns Shelley genesis hash |
| cardano-node/src/Cardano/Node/Configuration/POM.hs | Snapshot parsing/validation + backend option updates |
| cardano-node/src/Cardano/Node/Configuration/LedgerDB.hs | Drop LMDB backend + extend LSM args |
| cardano-node/ChangeLog.md | Add 11.1.0 release notes |
| cardano-node/cardano-node.cabal | Version + bounds updates |
| cardano-node-chairman/cardano-node-chairman.cabal | Version + bounds updates |
| cardano-node-chairman/app/Cardano/Chairman/Commands/Run.hs | protocolInfo monadic + tracer API migration |
| cardano-node-chairman/app/Cardano/Chairman.hs | Tracer mapping tweak |
| cardano-node-chairman/.changes/20260805_183136_fabrizio.ferrai_node_11_1_chairman_integration.yml | Changelog entry |
| cabal.project | Index-state updates + extra-packages changes |
| bench/tx-generator/tx-generator.cabal | Bounds updates |
| bench/tx-generator/test/TestnetDiscoveryTest.hs | Generator type tweak |
| bench/tx-generator/test/ApiTest.hs | Handle Either in genesis fund query |
| bench/tx-generator/src/Cardano/TxGenerator/Setup/NodeConfig.hs | Adapt to new consensus protocol return type |
| bench/tx-generator/src/Cardano/TxGenerator/Setup/NixService.hs | Node address JSON shape tweak |
| bench/tx-generator/src/Cardano/TxGenerator/ProtocolParameters.hs | Minor type updates |
| bench/tx-generator/src/Cardano/TxGenerator/Genesis.hs | Support extraConfig initialFunds injection |
| bench/tx-generator/src/Cardano/Benchmarking/Tracer.hs | Rename helper for clarity |
| bench/tx-generator/src/Cardano/Benchmarking/Script/Core.hs | protocolToCodecConfig now monadic + tracer API |
| bench/tx-generator/src/Cardano/Benchmarking/Script/Action.hs | protocolToNetworkId now monadic |
| bench/tx-generator/src/Cardano/Benchmarking/OuroborosImports.hs | protocolInfo + networkId now monadic |
| bench/tx-generator/src/Cardano/Benchmarking/LogTypes.hs | Import conflict avoidance |
| bench/tx-generator/src/Cardano/Benchmarking/GeneratorTx/SubmissionClient.hs | Import conflict avoidance |
| bench/tx-generator/src/Cardano/Benchmarking/GeneratorTx/SizedMetadata.hs | Minor whitespace fix needed |
| bench/tx-generator/src/Cardano/Benchmarking/GeneratorTx/NodeToNode.hs | Add Peras-related fields for new API |
| bench/plutus-scripts-bench/plutus-scripts-bench.cabal | Version + bounds bump |
| bench/locli/locli.cabal | ouroboros-network bounds bump |
| bench/cardano-topology/cardano-topology.cabal | Version bump |
| bench/cardano-profile/cardano-profile.cabal | Version bump |
| .github/workflows/haskell.yml | Enable Windows long paths |
| .github/workflows/check-mainnet-config.yml | Drop legacy config from checks |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Jimbo4350
approved these changes
Aug 18, 2026
Contributor
|
@f-f the description needs to be updated |
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Aug 18, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Aug 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Integration for release 11.1.
Package version bumps:
^>= 11.3 → ^>= 11.4^>= 11.1 → ^>= 11.2^>= 2.3 → ^>= 2.5^>= 3.0.1 → ^>= 4.1^>= 1.1 → ^>= 1.2^>= 1.0 → ^>= 1.1.1(new, ^>= 0.1)Fixes #6588
Checklist
See Running tests for more details
CHANGELOG.mdfor affected package.cabalfiles are updatedhlint. See.github/workflows/check-hlint.ymlto get thehlintversionstylish-haskell. See.github/workflows/stylish-haskell.ymlto get thestylish-haskellversionghc-9.6andghc-9.12