Improves security by updating blst to version 0.3.12. Closes #3079

[vtamara]

Why this should be merged

• Improves security. Closes Update blst to 0.3.12 #3079
• Advances porting avalanchego to OpenBSD/adJ Support OpenBSD/adJ #2782

How this works

With updated sources I just ran:

go get github.com/supranational/blst@v0.3.12
go mod tidy

How this was tested

Tested with avalanchego 1.11.10 ported to OpenBSD/adJ 7.5, running a node validating in testnet (see below comment of 31st July).

Details about the port of avalanchego 1.11.10 to OpenBSD/adJ that includes updating blst to version 0.3.12 at https://github.com/vtamara/avalanchego/wiki/Porting-avalanchego-1.11.10-to-OpenBSD-adJ-7.5

I also proposed and tested updating blst to vesion 0.3.12 in coreth, subnet-evm, avalanche-network-runner, and proposed updating in avalanche-cli.

[StephenButtolph]

I think you'll need to run:

go mod tidy

to fix the CI issue

[vtamara]

I think you'll need to run:

go mod tidy

to fix the CI issue

Thank you. Done.

[StephenButtolph]

I think we're going to need to look into this a bit more closely... (this library feels like a bit of a wildcard). So this might take a little bit to merge. But thank you for opening this.

[github-actions]

This PR has become stale because it has been open for 30 days with no activity. Adding the lifecycle/frozen label will cause this PR to ignore lifecycle events.

[vtamara]

I want to inform that I have been testing the port of avalanchego (and other ava-labs tools) to OpenBSD/adJ, that uses the library blst 0.3.12 on a system that is validating in testnet fuji. Three days ago I did validation for one day with succes, and yesterday I started a validation for one month.

Transaction: https://subnets-test.avax.network/p-chain/tx/keQmoqe86iVJw2mf1uxrM6GuxBTwPJdoB2BKc9wFyofcNezTP

How it looks in test.core.app:

How it looks in OpenBSD/adJ:

I made a (long) video showing how to install OpenBSD/adJ 7.5 in a virtual machine and how to start an avalanchego node with the ported tools: https://www.youtube.com/watch?v=vLL4V66ymP4

[vtamara]

I want to inform that I have been testing the port of avalanchego (and other ava-labs tools) to OpenBSD/adJ, that uses the library blst 0.3.12 on a system that is validating in testnet fuji. Three days ago I did validation for one day with succes, and yesterday I started a validation for one month...

The goal of my test (running a validator in testnet 30 days) is to confirm if updating to blst version 0.3.12 and using OpenBSD/adJ doesn´t decrease stability or functionality, but my current lack of experience operating a validator is not helping.

Several days ago I solved an issue with memory (increasing memory limit solved the problem) and few days ago the machine blocked (it could have relation with low disk space). Today I moved the validator to a different machine running OpenBSD/adJ 7.5 and with more disk space, since the new machine is behind a firewall I had to "discover" after long time the option --public-ip. I documented in more detail in points 2 and 4 of https://github.com/vtamara/avalanchego/wiki/Porting-avalanchego-1.11.10-to-OpenBSD-adJ-7.5

Also today I discovered https://subnets-test.avax.network/validators/NodeID-6d4VNVPxnk8g4NHfFR2ombAz1W23454pw?validatorTab=health_check and how useful it is to diagnose some problems with a validator. Since I didn´t know several details needed to operate a validator the performance of my node doesn't look good:

To improve the situation from the configuration/operation points of view is there a document that presents for example (1) need to use --public-ip behind a firewall, (2) tools and procedures to diagnose a node, (3) the importance of opening port 9651 and 9650 (I opened both to the public), (3) security considerations (should I open those ports to just certain machines) and (4) other very practical details about the operation of a validator?

[vtamara]

1. I started another month as validator in testnet
2. According to my interpretation of https://raw.githubusercontent.com/ava-labs/avalanche-docs/master/scripts/avalanchego-installer.sh for a validator, the port 9651 should be open to the public while the port 9650 should be closed (open just to administrators).

Just starting as validator, now https://subnets-test.avax.network/validators/NodeID-6d4VNVPxnk8g4NHfFR2ombAz1W23454pw?validatorTab=health_check looks very good:

[vtamara]

Hi, now after 15 days my node keeps looking good:

I even have a delegator:

Seems very stable on adJ/OpenBSD, I wonder how to increase the load to test more.

[vtamara]

The stability during one month was very good:

[github-actions]

This PR has become stale because it has been open for 30 days with no activity. Adding the lifecycle/frozen label will cause this PR to ignore lifecycle events.