add v1.9.1 upgrade + app_pubkey plumbing + hermes ICA test updates

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 ---
 
+## 1.9.1
+
+Changes included since `v1.9.0` (range: `v1.9.0..v1.9.1`).
+
+.- Action/ICA: persist `app_pubkey` on new actions, expose `app_pubkey` in action query responses, and regenerate action protobufs.
+- Action/crypto: refreshed signature verification paths (ADR-36 fallback, DER→RS64) and added coverage for app_pubkey validation/caching + query output.
+- Devnet/Hermes: added ICA cascade flow tests and IBC helpers; updated Hermes configs/scripts and devnet setup scripts; removed legacy `devnet/tests/test-channel.sh`.
+- Dependencies/docs: updated devnet and root Go module files and refreshed `readme.md`.
+
+---
+
 ## 1.9.0
 
 Changes included since `v1.8.5` (range: `v1.8.5..v1.9.0`).
@@ -18,7 +29,7 @@ Changes included since `v1.8.5` (range: `v1.8.5..v1.9.0`).
 
 ## 1.8.5
 
-Changes included since `v1.8.4` (range: `v1.8.4..HEAD`).
+Changes included since `v1.8.4` (range: `v1.8.4..v1.8.5`).
 
 - Register every upgrade handler at startup (before Load) so state-sync nodes always have handlers available, even without an on-disk plan.
 - Fixed x/upgrade downgrade verification panics on state-synced nodes that already applied v1.8.4 but lacked a registered handler.
@@ -30,7 +41,7 @@ Changes included since `v1.8.4` (range: `v1.8.4..HEAD`).
 
 ## 1.8.4
 
-Changes included since `v1.8.0` (range: `v1.8.0..HEAD`).
+Changes included since `v1.8.0` (range: `v1.8.0..v1.8.4`).
 
 - Added a legacy type URL aliasing framework (`internal/legacyalias`) and wired it into module registration so pre-versioned Action/Supernode messages stored on-chain continue to decode after the versioned protobuf migration. AutoCLI now wraps the codec resolvers with the legacy-aware resolver to keep CLI and REST queries seamless.
 - Introduced a protobuf enum bridge (`internal/protobridge`) that double-registers enum descriptors with both gogoproto and the standard protobuf runtime, eliminating REST/GRPC mismatches when the gateway still consults the legacy registry.
@@ -47,7 +58,7 @@ Changes included since `v1.8.0` (range: `v1.8.0..HEAD`).
 
 ## 1.8.0
 
-Changes included since `v1.7.2` (range: `v1.7.2..HEAD`).
+Changes included since `v1.7.2` (range: `v1.7.2..v1.8.0`).
 
 🚀 This release delivers major upgrades across Lumera’s blockchain core, IBC, CosmWasm, Ignite CLI, governance automation, and devnet infrastructure — improving performance, reliability, and developer experience.
 
@@ -148,12 +159,12 @@ IBC v2.0 brings improved cross‑chain routing and middleware support, laying th
 - `start.sh` supports`auto`,`bootstrap`,`run`, and`wait` modes.
 - Auto-installs binaries, monitors height, coordinates services.
 
-* Enable/disable each component via flags or environment variables when bringing up the devnet (kept generic here to avoid locking to specific flag names).
-* **Optional service installers**: add-on installation toggles for**Supernode**,**Network‑Maker**, and**SN Client** (enable via flags/env when bringing up the devnet). Network‑Maker installation on a selected validator is driven by the`network-maker` flag in`validators.json`.
+- Enable/disable each component via flags or environment variables when bringing up the devnet (kept generic here to avoid locking to specific flag names).
+- **Optional service installers**: add-on installation toggles for**Supernode**,**Network‑Maker**, and**SN Client** (enable via flags/env when bringing up the devnet). Network‑Maker installation on a selected validator is driven by the`network-maker` flag in`validators.json`.
 
 #### 📋 Devnet Architecture Overview
 
-```
+```go
 ┌─────────────────────────────────────────────────────────────┐
 │                    Lumera Devnet Architecture               │
 ├─────────────────────────────────────────────────────────────┤
@@ -182,7 +193,7 @@ IBC v2.0 brings improved cross‑chain routing and middleware support, laying th
 
 ## 1.7.2
 
-Changes included since `v1.7.0` (range: `v1.7.0..HEAD`).
+Changes included since `v1.7.0` (range: `v1.7.0..v1.7.2`).
 
 Added
 

Makefile.devnet

@@ -1,4 +1,4 @@
-.PHONY: devnet-build devnet-up devnet-reset devnet-up-detach devnet-down devnet-stop devnet-clean devnet-deploy-tar devnet-upgrade devnet-new devnet-start
+.PHONY: devnet-build devnet-tests-build devnet-up devnet-reset devnet-up-detach devnet-down devnet-stop devnet-clean devnet-deploy-tar devnet-upgrade devnet-new devnet-start
 .PHONY: devnet-build-default _check-devnet-default-cfg devnet-upgrade-binaries devnet-upgrade-binaries-default devnet-update-scripts
 
 ##### Devnet Makefile ########################################
@@ -31,6 +31,7 @@ COMPOSE_FILE := devnet/docker-compose.yml
 DEVNET_BUILD_LUMERA ?= 1      # 1 = build lumerad for devnet setup, 0 = skip
 # directory to take lumerad/supernode/network-maker/sncli binaries from
 DEVNET_BIN_DIR ?= devnet/bin
+DEVNET_BIN_DIR_ABS := $(abspath $(DEVNET_BIN_DIR))
 
 # Default paths for configuration files
 DEFAULT_CONFIG_JSON := config/config.json
@@ -41,6 +42,14 @@ DEFAULT_GENESIS_FILE := devnet/default-config/devnet-genesis.json
 DEFAULT_CLAIMS_FILE := claims.csv # relative to devnet
 ORIG_GENESIS_FILE := devnet/default-config/devnet-genesis-orig.json
 
+devnet-tests-build:
+	@mkdir -p "${DEVNET_BIN_DIR_ABS}"
+	@echo "Building devnet test binaries..."
+	@cd devnet && \
+		$(GO) test -c -o "${DEVNET_BIN_DIR_ABS}/ibc_validator" ./tests/validator && \
+		$(GO) test -c -o "${DEVNET_BIN_DIR_ABS}/ibc_hermes" ./tests/hermes
+	@echo "Devnet test binaries built successfully"
+
 devnet-build:
 	@mkdir -p "$(SHARED_RELEASE_DIR)"; \
 	if [ -n "$(EXTERNAL_GENESIS_FILE)" ] && [ -f "$(EXTERNAL_GENESIS_FILE)" ]; then \
@@ -78,6 +87,7 @@ devnet-build:
 			echo "${DEVNET_BIN_DIR}/libwasmvm.x86_64.so library not found..."; \
 			exit 1; \
 		fi; \
+		$(MAKE) devnet-tests-build DEVNET_BIN_DIR="${DEVNET_BIN_DIR}"; \
         cp -f "${DEVNET_BIN_DIR}/lumerad" "${SHARED_RELEASE_DIR}/"; \
         cp -f "${DEVNET_BIN_DIR}/libwasmvm.x86_64.so" "${SHARED_RELEASE_DIR}/"; \
 		cd devnet && \
@@ -205,6 +215,7 @@ devnet-upgrade:
 		echo "${DEVNET_BIN_DIR}/libwasmvm.x86_64.so library not found..."; \
 		exit 1; \
 	fi; \
+	$(MAKE) devnet-tests-build DEVNET_BIN_DIR="${DEVNET_BIN_DIR}"; \
 	cp -f "${DEVNET_BIN_DIR}/lumerad" "${SHARED_RELEASE_DIR}/"; \
 	cp -f "${DEVNET_BIN_DIR}/libwasmvm.x86_64.so" "${SHARED_RELEASE_DIR}/"; \
 	cd devnet && \

app/upgrades/upgrades.go

@@ -28,6 +28,7 @@ import (
 // | v1.8.4 | standard | mainnet: add PFM, drop NFT        | Store upgrade gated to mainnet; handler is migrations only
 // | v1.8.5 | standard | none                              | Migrations only
 // | v1.9.0 | custom   | none                              | Backfills action/supernode secondary indices
+// | v1.9.1 | standard | none                              | Migrations only
 // ======================================================================================================================
 
 type UpgradeConfig struct {
@@ -40,6 +41,7 @@ const (
 	upgradeNameV170 = "v1.7.0"
 	upgradeNameV172 = "v1.7.2"
 	upgradeNameV185 = "v1.8.5"
+	upgradeNameV191 = "v1.9.1"
 )
 
 var upgradeNames = []string{
@@ -50,6 +52,7 @@ var upgradeNames = []string{
 	upgrade_v1_8_4.UpgradeName,
 	upgradeNameV185,
 	upgrade_v1_9_0.UpgradeName,
+	upgradeNameV191,
 }
 
 var NoUpgradeConfig = UpgradeConfig{
@@ -100,6 +103,10 @@ func SetupUpgrades(upgradeName string, params appParams.AppUpgradeParams) (Upgra
 		return UpgradeConfig{
 			Handler: upgrade_v1_9_0.CreateUpgradeHandler(params),
 		}, true
+	case upgradeNameV191:
+		return UpgradeConfig{
+			Handler: standardUpgradeHandler(upgradeNameV191, params),
+		}, true
 
 	// add future upgrades here
 	default:

app/upgrades/upgrades_test.go

@@ -27,6 +27,7 @@ func TestUpgradeNamesOrder(t *testing.T) {
 		upgrade_v1_8_4.UpgradeName,
 		upgradeNameV185,
 		upgrade_v1_9_0.UpgradeName,
+		upgradeNameV191,
 	}
 	require.Equal(t, expected, upgradeNames, "upgradeNames should stay in ascending order")
 }

devnet/go.mod

@@ -1,10 +1,190 @@
 module gen
 
-go 1.24.4
+go 1.25.5
 
-require gopkg.in/yaml.v2 v2.4.0
+require (
+	cosmossdk.io/api v0.9.2
+	cosmossdk.io/math v1.5.3
+	github.com/LumeraProtocol/lumera v1.9.0
+	github.com/LumeraProtocol/sdk-go v1.0.3
+	github.com/cosmos/cosmos-sdk v0.53.0
+	github.com/cosmos/gogoproto v1.7.0
+	github.com/cosmos/ibc-go/v10 v10.3.0
+	github.com/stretchr/testify v1.11.1
+	gopkg.in/yaml.v2 v2.4.0
+)
+
+replace (
+	github.com/LumeraProtocol/lumera => ..
+	github.com/LumeraProtocol/sdk-go => ../../sdk-go
+	github.com/LumeraProtocol/supernode/v2 => ../../supernode
+	github.com/cosmos/cosmos-sdk => github.com/cosmos/cosmos-sdk v0.50.14
+	github.com/envoyproxy/protoc-gen-validate => github.com/bufbuild/protoc-gen-validate v1.3.0
+	github.com/lyft/protoc-gen-validate => github.com/envoyproxy/protoc-gen-validate v1.3.0
+	github.com/syndtr/goleveldb => github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7
+	nhooyr.io/websocket => github.com/coder/websocket v1.8.7
+)
 
 require (
+	cosmossdk.io/collections v1.3.0 // indirect
+	cosmossdk.io/core v0.11.3 // indirect
+	cosmossdk.io/depinject v1.2.0 // indirect
+	cosmossdk.io/errors v1.0.2 // indirect
+	cosmossdk.io/log v1.6.0 // indirect
+	cosmossdk.io/schema v1.1.0 // indirect
+	cosmossdk.io/store v1.1.2 // indirect
+	cosmossdk.io/x/tx v0.14.0 // indirect
+	cosmossdk.io/x/upgrade v0.2.0 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
+	github.com/99designs/keyring v1.2.2 // indirect
+	github.com/DataDog/datadog-go v4.8.3+incompatible // indirect
+	github.com/DataDog/zstd v1.5.7 // indirect
+	github.com/LumeraProtocol/rq-go v0.2.1 // indirect
+	github.com/LumeraProtocol/supernode/v2 v2.4.10 // indirect
+	github.com/Masterminds/semver/v3 v3.3.1 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/bgentry/speakeasy v0.2.0 // indirect
+	github.com/bytedance/gopkg v0.1.3 // indirect
+	github.com/bytedance/sonic v1.14.1 // indirect
+	github.com/bytedance/sonic/loader v0.3.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cloudwego/base64x v0.1.6 // indirect
+	github.com/cockroachdb/errors v1.12.0 // indirect
+	github.com/cockroachdb/fifo v0.0.0-20240616162244-4768e80dfb9a // indirect
+	github.com/cockroachdb/logtags v0.0.0-20241215232642-bb51bb14a506 // indirect
+	github.com/cockroachdb/pebble v1.1.5 // indirect
+	github.com/cockroachdb/redact v1.1.6 // indirect
+	github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06 // indirect
+	github.com/cometbft/cometbft v0.38.18 // indirect
+	github.com/cometbft/cometbft-db v0.14.1 // indirect
+	github.com/cosmos/btcutil v1.0.5 // indirect
+	github.com/cosmos/cosmos-db v1.1.2 // indirect
+	github.com/cosmos/cosmos-proto v1.0.0-beta.5 // indirect
+	github.com/cosmos/go-bip39 v1.0.0 // indirect
+	github.com/cosmos/gogogateway v1.2.0 // indirect
+	github.com/cosmos/iavl v1.2.4 // indirect
+	github.com/cosmos/ics23/go v0.11.0 // indirect
+	github.com/cosmos/ledger-cosmos-go v0.14.0 // indirect
+	github.com/danieljoos/wincred v1.2.2 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
+	github.com/desertbit/timer v1.0.1 // indirect
+	github.com/dgraph-io/badger/v4 v4.2.0 // indirect
+	github.com/dgraph-io/ristretto v0.1.1 // indirect
+	github.com/dgraph-io/ristretto/v2 v2.2.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/dvsekhvalnov/jose2go v1.7.0 // indirect
+	github.com/emicklei/dot v1.6.2 // indirect
+	github.com/ethereum/go-ethereum v1.15.11 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/getsentry/sentry-go v0.32.0 // indirect
+	github.com/go-errors/errors v1.5.1 // indirect
+	github.com/go-kit/kit v0.13.0 // indirect
+	github.com/go-kit/log v0.2.1 // indirect
+	github.com/go-logfmt/logfmt v0.6.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/godbus/dbus v0.0.0-20190726142602-4481cbc300e2 // indirect
+	github.com/gogo/googleapis v1.4.1 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/glog v1.2.5 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/mock v1.6.0 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/golang/snappy v0.0.5-0.20231225225746-43d5d4cd4e0e // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/flatbuffers v24.3.25+incompatible // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
+	github.com/google/orderedcode v0.0.1 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/gorilla/handlers v1.5.2 // indirect
+	github.com/gorilla/mux v1.8.1 // indirect
+	github.com/gorilla/websocket v1.5.3 // indirect
+	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway v1.16.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
+	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
+	github.com/hashicorp/go-hclog v1.6.3 // indirect
+	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
+	github.com/hashicorp/go-metrics v0.5.4 // indirect
+	github.com/hashicorp/go-plugin v1.6.3 // indirect
+	github.com/hashicorp/golang-lru v1.0.2 // indirect
+	github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
+	github.com/hdevalence/ed25519consensus v0.2.0 // indirect
+	github.com/holiman/uint256 v1.3.2 // indirect
+	github.com/huandu/skiplist v1.2.1 // indirect
+	github.com/iancoleman/strcase v0.3.0 // indirect
+	github.com/improbable-eng/grpc-web v0.15.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/jmhodges/levigo v1.0.0 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.10 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/lib/pq v1.10.9 // indirect
+	github.com/linxGnu/grocksdb v1.9.8 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/minio/highwayhash v1.0.3 // indirect
+	github.com/mtibben/percent v0.2.1 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/oasisprotocol/curve25519-voi v0.0.0-20230904125328-1f23a7beb09a // indirect
+	github.com/oklog/run v1.1.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/petermattis/goid v0.0.0-20240813172612-4fcff4a6cae7 // indirect
+	github.com/pkg/errors v0.9.1 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_golang v1.22.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.63.0 // indirect
+	github.com/prometheus/procfs v0.15.1 // indirect
+	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
+	github.com/rogpeppe/go-internal v1.14.1 // indirect
+	github.com/rs/cors v1.11.1 // indirect
+	github.com/rs/zerolog v1.34.0 // indirect
+	github.com/sagikazarmark/locafero v0.11.0 // indirect
+	github.com/sasha-s/go-deadlock v0.3.5 // indirect
+	github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect
+	github.com/spf13/afero v1.15.0 // indirect
+	github.com/spf13/cast v1.10.0 // indirect
+	github.com/spf13/cobra v1.10.1 // indirect
+	github.com/spf13/pflag v1.0.10 // indirect
+	github.com/spf13/viper v1.21.0 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
+	github.com/tendermint/go-amino v0.16.0 // indirect
+	github.com/tidwall/btree v1.7.0 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/zondax/hid v0.9.2 // indirect
+	github.com/zondax/ledger-go v0.14.3 // indirect
+	go.etcd.io/bbolt v1.4.0-alpha.1 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	go.uber.org/mock v0.6.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/arch v0.15.0 // indirect
+	golang.org/x/crypto v0.43.0 // indirect
+	golang.org/x/exp v0.0.0-20250819193227-8b4c13bb791b // indirect
+	golang.org/x/net v0.46.1-0.20251013234738-63d1a5100f82 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.37.0 // indirect
+	golang.org/x/term v0.36.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
+	google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20251022142026-3a174f9686a8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251022142026-3a174f9686a8 // indirect
+	google.golang.org/grpc v1.77.0 // indirect
+	google.golang.org/protobuf v1.36.10 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	gotest.tools/v3 v3.5.2 // indirect
+	lukechampine.com/blake3 v1.4.1 // indirect
+	nhooyr.io/websocket v1.8.17 // indirect
+	pgregory.net/rapid v1.2.0 // indirect
+	sigs.k8s.io/yaml v1.4.0 // indirect
 )