mirror of
https://github.com/logos-blockchain/logos-execution-zone.git
synced 2026-08-25 11:21:12 +00:00
Marvin Jones
8fb81be6e3
Extend the loader beyond one-shot segmented deploy to support real upgrades: an authorized update_auth can rewrite a program's bytecode and later rotate that authority, all without moving the program's address. ProgramData splits genesis (image_id/update_auth chosen once at first Deploy, the fixed input to header/segment PDA address derivation) from current (mutable current_image_id/update_auth/program_version). loader_core::Instruction gains Finalize and RotateUpdateAuth alongside Deploy. A fresh, self-contained, single-transaction deploy still finalizes atomically with no signature; every other write - a partial fresh batch or any write once a header exists - requires the real current update_auth's signature and resets current_image_id to a sentinel until Finalize runs again. V03State::get_program trusts a non-sentinel current_image_id directly instead of re-deriving it from segments on every dispatch. New test coverage: atomic single-tx finalization, multi-batch deploys left correctly unfinalized, Finalize authorization and version bumping, a full upgrade flow (deploy v1, finalize, dispatch, upgrade to v2, confirm undispatchable mid-upgrade via a real dispatch attempt - not just a state read - finalize v2, confirm new bytecode live), RotateUpdateAuth co-signing (including rejecting a single-party signature and confirming the rotated-away authority can no longer authorize writes), and rejecting an unauthorized party touching an existing header or segment.