MANTRA Chain v8.6.0-pre.1 — Coordinated Security Upgrade

🚨‼️ DO NOT BUILD FROM SOURCE ‼️🚨

📦 BINARY PACKAGE ONLY: TAGGED AS v8.6.0-pre.1 📦

This is a mandatory security release for all validators and full-node operators. It is distributed as prebuilt, verified binaries only as part of a coordinated security response. Source code and full technical details will be published after an internal coordination window closes.

This is a consensus-breaking upgrade recommended for the entire validator set. It delivers security hardening across the chain's state-processing layer, including the embedded Cosmos components, along with associated dependency and module maintenance.

Aspart of a coordinated security response, the binaries for this release are distributed in prebuilt, signed form and the source is being withheld until the public disclosure window closes. Operators should upgrade using only the official signed binaries and must not build from source. The fix is complete, verified, and has no known regressions; the objective of this proposal is simply to move the network to the patched version at a single agreed height.

Action Required

• Do NOT build from source. Use only the official signed binaries attached below.
• Verify checksums (and signatures) before running — see below.

Verifying the Release

You can verify the integrity of the release artifacts using the following SHA-256 checksums:

967797f49ec5b431dec9bdb34ef469a5acbd9b1f4ebdce019db30b25d6970fc4  mantrachaind-8.6.0-pre.1-darwin-amd64
b8d34d188f83abce2584f578458ea89a7249d6cd1efb993902175e9956734c11  mantrachaind-8.6.0-pre.1-darwin-amd64.tar.gz
ffb418e3411b8957de4de11d6b0c057c6237f211c5ff6ce986186090dc28f0d4  mantrachaind-8.6.0-pre.1-darwin-arm64
29083c36782eb6f159fc86f3ee8e5994a07d077bac2ec46001c634c792ccbf3a  mantrachaind-8.6.0-pre.1-darwin-arm64.tar.gz
4a5bb0ea4b80cec3ae8241e444a8548c33f392aa03369f79734788eb67104d53  mantrachaind-8.6.0-pre.1-linux-amd64
a2dd494e0c37f3c8cacb4a529e501106f1d5510f7b61c6f3b43515dd9a7d9ae4  mantrachaind-8.6.0-pre.1-linux-amd64.tar.gz
6706a9a843d1be2e387b4e93f699b4b9d324773378813fc2514eec7734e45c12  mantrachaind-8.6.0-pre.1-linux-arm64
00e62dff6d4e64a1a0d462511b8598e2472962b3381c2a3bd00a0028bbfc4c90  mantrachaind-8.6.0-pre.1-linux-arm64.tar.gz

This IS a consensus-breaking change. All validators must be running v8.6.0-pre.1 at the coordinated upgrade height for their network:

• Dukong (Testnet): 16555555
• Mainnet: 17971888

Verify sha256sum.txt.sig

gpg --recv-keys7CE02F9E5D2971D8A9579433504367809BC3452F
gpg --verify sha256sum.txt.sig sha256sum.txt

Assets

Located at https://pkg.mantrachain.io/mantrachaind/v8.6.0-pre.1/{binary or tar}

• https://pkg.mantrachain.io/mantrachaind/v8.6.0-pre.1/mantrachaind-8.6.0-pre.1-darwin-amd64
• https://pkg.mantrachain.io/mantrachaind/v8.6.0-pre.1/mantrachaind-8.6.0-pre.1-darwin-amd64.tar.gz
• https://pkg.mantrachain.io/mantrachaind/v8.6.0-pre.1/mantrachaind-8.6.0-pre.1-darwin-arm64
• https://pkg.mantrachain.io/mantrachaind/v8.6.0-pre.1/mantrachaind-8.6.0-pre.1-darwin-arm64.tar.gz
• https://pkg.mantrachain.io/mantrachaind/v8.6.0-pre.1/mantrachaind-8.6.0-pre.1-linux-amd64
• https://pkg.mantrachain.io/mantrachaind/v8.6.0-pre.1/mantrachaind-8.6.0-pre.1-linux-amd64.tar.gz
• https://pkg.mantrachain.io/mantrachaind/v8.6.0-pre.1/mantrachaind-8.6.0-pre.1-linux-arm64
• https://pkg.mantrachain.io/mantrachaind/v8.6.0-pre.1/mantrachaind-8.6.0-pre.1-linux-arm64.tar.gz
• https://pkg.mantrachain.io/mantrachaind/v8.6.0-pre.1/sha256sum.txt.sig
• https://pkg.mantrachain.io/mantrachaind/v8.6.0-pre.1/sha256sum.txt

Docker Container Registry

https://github.com/MANTRA-Chain/mantrachain/pkgs/container/mantrachain?tag=v8.6.0-pre.1

What's Changed

• wasmvm v3.0.7, which carries the overflows fix from cosmwasm 3.0.6
• fix: build release binaries as static PIE
• feat: refuse to start without PIE and full ASLR