@agoric/cosmos 0.35.0-u11.0 → 0.35.0-u12.0

package/CHANGELOG.md

@@ -3,6 +3,34 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [0.35.0-u12.0](https://github.com/Agoric/agoric-sdk/compare/@agoric/cosmos@0.35.0-u11wf.0...@agoric/cosmos@0.35.0-u12.0) (2023-11-10)
+
+
+### ⚠ BREAKING CHANGES
+
+* **vstorage:** Enforce path validation
+
+### Features
+
+* **cosmos:** Lower `BlockParams.MaxBytes` to 5MB ([84908e5](https://github.com/Agoric/agoric-sdk/commit/84908e5a5a181e3f64da0e298d0105fedb97570a))
+
+### Bug Fixes
+
+* **vibc:** accommodate ibc-go v3 breaking changes ([f582901](https://github.com/Agoric/agoric-sdk/commit/f582901fb3835d95d493c777aac6a63fc3ee4681))
+* **vibc:** put extraneous `CounterpartyChannelID` in `Counterparty` struct ([9469971](https://github.com/Agoric/agoric-sdk/commit/946997192cec0ed6b07fdaa18d8f380f460ab004))
+* **vstorage:** Enforce path validation ([d8db331](https://github.com/Agoric/agoric-sdk/commit/d8db3310fb21a8546388694752889f3563733010)), closes [#8337](https://github.com/Agoric/agoric-sdk/issues/8337)
+* **cosmos:** Update cosmos-sdk with fix for state-sync restore of large payloads ([e04b398](https://github.com/Agoric/agoric-sdk/commit/e04b398bf16d884fa4708c16d4c03b39cc4e0f1b)), closes [#8325](https://github.com/Agoric/agoric-sdk/issues/8325)
+
+
+
+## [0.35.0-u11wf.0](https://github.com/Agoric/agoric-sdk/compare/@agoric/cosmos@0.35.0-u11.0...@agoric/cosmos@0.35.0-u11wf.0) (2023-09-23)
+
+**Note:** Version bump only for package @agoric/cosmos
+
+
+
+
+
 ## [0.35.0-u11.0](https://github.com/Agoric/agoric-sdk/compare/@agoric/cosmos@0.34.1...@agoric/cosmos@0.35.0-u11.0) (2023-08-24)
 
 

package/Makefile

@@ -32,13 +32,18 @@ ldflags = -X github.com/cosmos/cosmos-sdk/version.Name=$(VersionName) \
 		-X "github.com/cosmos/cosmos-sdk/version.BuildTags=$(build_tags_comma_sep)"
 
 gcflags =
+shared_ldflags = $(ldflags)
 
 ifneq ($(GO_DEBUG),)
 ldflags += -compressdwarf=false
 gcflags += -N -l
+else ifeq ($(shell uname -s 2>/dev/null),Darwin)
+# Darwin's latest ld crashes with https://github.com/Agoric/agoric-sdk/issues/8367
+shared_ldflags += -w
 endif
 
 BUILD_FLAGS := -tags "$(build_tags)" -gcflags '$(gcflags)' -ldflags '$(ldflags)'
+SHARED_BUILD_FLAGS := -tags "$(build_tags)" -gcflags '$(gcflags)' -ldflags '$(shared_ldflags)'
 
 all: compile-chain
 
@@ -69,7 +74,8 @@ compile-gyp:
 	rm -f binding.gyp
 
 compile-libdaemon: go-mod-cache
-	go build -v $(MOD_READONLY) $(BUILD_FLAGS) -buildmode=c-shared -o build/libagcosmosdaemon.so ./cmd/libdaemon/main.go
+	go build -v $(MOD_READONLY) $(SHARED_BUILD_FLAGS) -buildmode=c-shared \
+		-o build/libagcosmosdaemon.so ./cmd/libdaemon/main.go
 
 go-mod-cache: go.sum
 	@echo "--> Download go modules to local cache"

package/app/app.go

@@ -103,6 +103,7 @@ import (
 	"github.com/tendermint/tendermint/libs/log"
 	tmos "github.com/tendermint/tendermint/libs/os"
 	tmproto "github.com/tendermint/tendermint/proto/tendermint/types"
+	tmtypes "github.com/tendermint/tendermint/types"
 	dbm "github.com/tendermint/tm-db"
 
 	gaiaappparams "github.com/Agoric/agoric-sdk/golang/cosmos/app/params"
@@ -790,13 +791,18 @@ func NewAgoricApp(
 	app.SetBeginBlocker(app.BeginBlocker)
 	app.SetEndBlocker(app.EndBlocker)
 
+	const (
+		upgradeName     = "agoric-upgrade-12"
+		upgradeNameTest = "agorictest-upgrade-12"
+	)
+
 	app.UpgradeKeeper.SetUpgradeHandler(
 		upgradeName,
-		upgrade11Handler(app, upgradeName),
+		upgrade12Handler(app, upgradeName),
 	)
 	app.UpgradeKeeper.SetUpgradeHandler(
 		upgradeNameTest,
-		upgrade11Handler(app, upgradeNameTest),
+		upgrade12Handler(app, upgradeNameTest),
 	)
 
 	if loadLatest {
@@ -819,107 +825,17 @@ func NewAgoricApp(
 	return app
 }
 
-type swingStoreMigrationEventHandler struct {
-	swingStore sdk.KVStore
-}
-
-func (eventHandler swingStoreMigrationEventHandler) OnExportStarted(height uint64, retrieveSwingStoreExport func() error) error {
-	return retrieveSwingStoreExport()
-}
-
-func (eventHandler swingStoreMigrationEventHandler) OnExportRetrieved(provider swingsetkeeper.SwingStoreExportProvider) (err error) {
-	exportDataReader, err := provider.GetExportDataReader()
-	if err != nil {
-		return err
-	}
-	defer exportDataReader.Close()
-
-	var hasExportData bool
-
-	for {
-		entry, err := exportDataReader.Read()
-		if err == io.EOF {
-			break
-		} else if err != nil {
-			return err
-		}
-		hasExportData = true
-		if !entry.HasValue() {
-			return fmt.Errorf("no value for export data key %s", entry.Key())
-		}
-		eventHandler.swingStore.Set([]byte(entry.Key()), []byte(entry.StringValue()))
-	}
-	if !hasExportData {
-		return fmt.Errorf("export data had no entries")
-	}
-	return nil
-}
-
-// upgrade11Handler performs standard upgrade actions plus custom actions for upgrade-11.
-func upgrade11Handler(app *GaiaApp, targetUpgrade string) func(sdk.Context, upgradetypes.Plan, module.VersionMap) (module.VersionMap, error) {
+// upgrade12Handler performs standard upgrade actions plus custom actions for upgrade-12.
+func upgrade12Handler(app *GaiaApp, targetUpgrade string) func(sdk.Context, upgradetypes.Plan, module.VersionMap) (module.VersionMap, error) {
 	return func(ctx sdk.Context, plan upgradetypes.Plan, fromVm module.VersionMap) (module.VersionMap, error) {
 		app.CheckControllerInited(false)
 		// Record the plan to send to SwingSet
 		app.upgradePlan = &plan
 
-		// Perform swing-store migrations. We do this in the app upgrade handler
-		// since it involves multiple modules (x/vstorage and x/swingset) which
-		// don't strictly have a version change on their own.
-
-		// We are at the begining of the upgrade block, so all stores are commited
-		// as of the end of the previous block
-		savedBlockHeight := uint64(ctx.BlockHeight() - 1)
-
-		// First, repair swing-store metadata in case this node was previously
-		// initialized from a state-sync snapshot. This is done with a check on the
-		// block height to catch early any hangover related mismatch.
-		// Only entries related to missing historical metadata are imported, but we
-		// don't know what these look like here, so we provide it all.
-		getSwingStoreExportDataFromVstorage := func() (reader agorictypes.KVEntryReader, err error) {
-			return agorictypes.NewVstorageDataEntriesReader(
-				app.VstorageKeeper.ExportStorageFromPrefix(ctx, swingsetkeeper.StoragePathSwingStore),
-			), nil
-		}
-
-		// We're not restoring any artifact to swing-store, nor have any to provide
-		readNoArtifact := func() (artifact swingsettypes.SwingStoreArtifact, err error) {
-			return artifact, io.EOF
-		}
-
-		err := app.SwingStoreExportsHandler.RestoreExport(
-			swingsetkeeper.SwingStoreExportProvider{
-				BlockHeight:         savedBlockHeight,
-				GetExportDataReader: getSwingStoreExportDataFromVstorage,
-				ReadNextArtifact:    readNoArtifact,
-			},
-			swingsetkeeper.SwingStoreRestoreOptions{
-				ArtifactMode:   swingsetkeeper.SwingStoreArtifactModeNone,
-				ExportDataMode: swingsetkeeper.SwingStoreExportDataModeRepairMetadata,
-			},
-		)
-		if err != nil {
-			return nil, err
-		}
-
-		// Then migrate the swing-store shadow copy:
-		// 1. Remove the swing-store "export data" shadow-copy entries from vstorage.
-		// 2. Export swing-store "export-data" (as of the previous block) through a
-		//    handler that writes every entry into the swingset module's new Store.
-		app.VstorageKeeper.RemoveEntriesWithPrefix(ctx, swingsetkeeper.StoragePathSwingStore)
-		err = app.SwingStoreExportsHandler.InitiateExport(
-			savedBlockHeight,
-			swingStoreMigrationEventHandler{swingStore: app.SwingSetKeeper.GetSwingStore(ctx)},
-			swingsetkeeper.SwingStoreExportOptions{
-				ArtifactMode:   swingsetkeeper.SwingStoreArtifactModeNone,
-				ExportDataMode: swingsetkeeper.SwingStoreExportDataModeAll,
-			},
-		)
-		if err == nil {
-			err = swingsetkeeper.WaitUntilSwingStoreExportDone()
-		}
-		if err != nil {
-			return nil, err
-		}
+		// Reflect default BlockParams.MaxBytes change to current params
+		cp := app.BaseApp.GetConsensusParams(ctx)
+		cp.Block.MaxBytes = tmtypes.DefaultBlockParams().MaxBytes
+		app.BaseApp.StoreConsensusParams(ctx, cp)
 
 		// Always run module migrations
 		mvm, err := app.mm.RunMigrations(ctx, app.configurator, fromVm)

package/git-revision.txt

@@ -1 +1 @@
-92b6cd724
+ee5a5fdad

package/go.mod

@@ -15,6 +15,7 @@ require (
 	github.com/rakyll/statik v0.1.7
 	github.com/spf13/cast v1.5.0
 	github.com/spf13/cobra v1.6.0
+	github.com/spf13/viper v1.13.0
 	github.com/stretchr/testify v1.8.0
 	github.com/tendermint/tendermint v0.34.23
 	github.com/tendermint/tm-db v0.6.7
@@ -105,7 +106,6 @@ require (
 	github.com/spf13/afero v1.8.2 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
-	github.com/spf13/viper v1.13.0 // indirect
 	github.com/subosito/gotenv v1.4.1 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
 	github.com/tendermint/btcd v0.1.1 // indirect
@@ -142,10 +142,10 @@ replace google.golang.org/grpc => google.golang.org/grpc v1.33.2
 
 // At least until post-v0.34.14 is released with
 // https://github.com/tendermint/tendermint/issue/6899 resolved.
-replace github.com/tendermint/tendermint => github.com/agoric-labs/tendermint v0.34.23-alpha.agoric.3
+replace github.com/tendermint/tendermint => github.com/agoric-labs/tendermint v0.34.23-alpha.agoric.4
 
 // We need a fork of cosmos-sdk until all of the differences are merged.
-replace github.com/cosmos/cosmos-sdk => github.com/agoric-labs/cosmos-sdk v0.45.11-alpha.agoric.3
+replace github.com/cosmos/cosmos-sdk => github.com/agoric-labs/cosmos-sdk v0.45.11-alpha.agoric.4
 
 replace github.com/cosmos/gaia/v7 => github.com/Agoric/ag0/v7 v7.0.2-alpha.agoric.1
 

package/go.sum

@@ -80,12 +80,12 @@ github.com/Zilliqa/gozilliqa-sdk v1.2.1-0.20201201074141-dd0ecada1be6/go.mod h1:
 github.com/adlio/schema v1.3.3 h1:oBJn8I02PyTB466pZO1UZEn1TV5XLlifBSyMrmHl/1I=
 github.com/aead/siphash v1.0.1/go.mod h1:Nywa3cDsYNNK3gaciGTWPwHt0wlpNV15vwmswBAUSII=
 github.com/afex/hystrix-go v0.0.0-20180502004556-fa1af6a1f4f5/go.mod h1:SkGFH1ia65gfNATL8TAiHDNxPzPdmEL5uirI2Uyuz6c=
-github.com/agoric-labs/cosmos-sdk v0.45.11-alpha.agoric.3 h1:CMWOJYFHoRpKnNt2l90e5tEMy9phxkDEjQKfsCUHtgU=
-github.com/agoric-labs/cosmos-sdk v0.45.11-alpha.agoric.3/go.mod h1:fdXvzy+wmYB+W+N139yb0+szbT7zAGgUjmxm5DBrjto=
+github.com/agoric-labs/cosmos-sdk v0.45.11-alpha.agoric.4 h1:OU1rRq0qS+5KNe7eF7ceXPpHeXWj+JSbUpHgiQTml2E=
+github.com/agoric-labs/cosmos-sdk v0.45.11-alpha.agoric.4/go.mod h1:fdXvzy+wmYB+W+N139yb0+szbT7zAGgUjmxm5DBrjto=
 github.com/agoric-labs/cosmos-sdk/ics23/go v0.8.0-alpha.agoric.1 h1:2jvHI/2d+psWAZy6FQ0vXJCHUtfU3ZbbW+pQFL04arQ=
 github.com/agoric-labs/cosmos-sdk/ics23/go v0.8.0-alpha.agoric.1/go.mod h1:E45NqnlpxGnpfTWL/xauN7MRwEE28T4Dd4uraToOaKg=
-github.com/agoric-labs/tendermint v0.34.23-alpha.agoric.3 h1:aq6F1r3RQkKUYNeMNjRxgGn3dayvKnDK/R6gQF0WoFs=
-github.com/agoric-labs/tendermint v0.34.23-alpha.agoric.3/go.mod h1:rXVrl4OYzmIa1I91av3iLv2HS0fGSiucyW9J4aMTpKI=
+github.com/agoric-labs/tendermint v0.34.23-alpha.agoric.4 h1:NWqGDUk5UkkXxsEVRtCWFpMeuCtu2MyRtC0Cib7sKH8=
+github.com/agoric-labs/tendermint v0.34.23-alpha.agoric.4/go.mod h1:rXVrl4OYzmIa1I91av3iLv2HS0fGSiucyW9J4aMTpKI=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agoric/cosmos",
-  "version": "0.35.0-u11.0",
+  "version": "0.35.0-u12.0",
   "description": "Connect JS to the Cosmos blockchain SDK",
   "parsers": {
     "js": "mjs"
@@ -35,5 +35,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "92b6cd72484079b0349d8ccfa4510aeb820e8d67"
+  "gitHead": "ee5a5fdad9187a6b1b7b26b772b6564c0db3062e"
 }

package/x/vibc/ibc.go

@@ -228,7 +228,6 @@ type channelOpenAckEvent struct {
 	Event                 string                    `json:"event"` // channelOpenAck
 	PortID                string                    `json:"portID"`
 	ChannelID             string                    `json:"channelID"`
-	CounterpartyChannelID string                    `json:"counterpartyChannelID"`
 	CounterpartyVersion   string                    `json:"counterpartyVersion"`
 	Counterparty          channeltypes.Counterparty `json:"counterparty"`
 	ConnectionHops        []string                  `json:"connectionHops"`
@@ -247,12 +246,12 @@ func (im IBCModule) OnChanOpenAck(
 	// returns an empty channel object that we can still use without crashing.
 	channel, _ := im.keeper.GetChannel(ctx, portID, channelID)
 
+	channel.Counterparty.ChannelId = counterpartyChannelID
 	event := channelOpenAckEvent{
 		Type:                  "IBC_EVENT",
 		Event:                 "channelOpenAck",
 		PortID:                portID,
 		ChannelID:             channelID,
-		CounterpartyChannelID: counterpartyChannelID,
 		CounterpartyVersion:   counterpartyVersion,
 		Counterparty:          channel.Counterparty,
 		ConnectionHops:        channel.ConnectionHops,

package/x/vibc/keeper/keeper.go

@@ -92,13 +92,7 @@ func (k Keeper) ChanOpenInit(ctx sdk.Context, order channeltypes.Order, connecti
 		return err
 	}
 
-	// We need to emit a channel event to notify the relayer.
-	ctx.EventManager().EmitEvents(sdk.Events{
-		sdk.NewEvent(
-			sdk.EventTypeMessage,
-			sdk.NewAttribute(sdk.AttributeKeyModule, channeltypes.AttributeValueCategory),
-		),
-	})
+	k.channelKeeper.WriteOpenInitChannel(ctx, portID, channelID, order, connectionHops, counterparty, version)
 	return nil
 }
 
@@ -157,14 +151,6 @@ func (k Keeper) ChanCloseInit(ctx sdk.Context, portID, channelID string) error {
 	if err != nil {
 		return err
 	}
-
-	// We need to emit a channel event to notify the relayer.
-	ctx.EventManager().EmitEvents(sdk.Events{
-		sdk.NewEvent(
-			sdk.EventTypeMessage,
-			sdk.NewAttribute(sdk.AttributeKeyModule, channeltypes.AttributeValueCategory),
-		),
-	})
 	return nil
 }
 

package/x/vibc/types/expected_keepers.go

@@ -16,7 +16,8 @@ type ChannelKeeper interface {
 	WriteAcknowledgement(ctx sdk.Context, channelCap *capability.Capability, packet ibcexported.PacketI, acknowledgement ibcexported.Acknowledgement) error
 	ChanOpenInit(ctx sdk.Context, order channel.Order, connectionHops []string, portID string,
 		portCap *capability.Capability, counterparty channel.Counterparty, version string) (string, *capability.Capability, error)
-
+	WriteOpenInitChannel(ctx sdk.Context, portID, channelID string, order channel.Order,
+		connectionHops []string, counterparty channel.Counterparty, version string)
 	ChanCloseInit(ctx sdk.Context, portID, channelID string, chanCap *capability.Capability) error
 	TimeoutExecuted(ctx sdk.Context, channelCap *capability.Capability, packet ibcexported.PacketI) error
 }

package/x/vstorage/keeper/querier.go

@@ -1,8 +1,6 @@
 package keeper
 
 import (
-	"strings"
-
 	abci "github.com/tendermint/tendermint/abci/types"
 
 	"github.com/cosmos/cosmos-sdk/codec"
@@ -18,14 +16,36 @@ const (
 	QueryChildren = "children"
 )
 
-// NewQuerier is the module level router for state queries
+// getVstorageEntryPath validates that a request URL path represents a valid
+// entry path with no extra data, and returns the path of that vstorage entry.
+func getVstorageEntryPath(urlPathSegments []string) (string, error) {
+	if len(urlPathSegments) != 1 || types.ValidatePath(urlPathSegments[0]) != nil {
+		return "", sdkerrors.Wrap(sdkerrors.ErrInvalidRequest, "invalid vstorage entry path")
+	}
+	return urlPathSegments[0], nil
+}
+
+// NewQuerier returns the function for handling queries routed to this module.
+// It performs its own routing based on the first slash-separated URL path
+// segment (e.g., URL path `/data/foo.bar` is a request for the value associated
+// with vstorage path "foo.bar", and `/children/foo.bar` is a request for the
+// child path segments immediately underneath vstorage path "foo.bar" which may
+// be used to extend it to a vstorage path such as "foo.bar.baz").
 func NewQuerier(keeper Keeper, legacyQuerierCdc *codec.LegacyAmino) sdk.Querier {
-	return func(ctx sdk.Context, path []string, req abci.RequestQuery) (res []byte, err error) {
-		switch path[0] {
+	return func(ctx sdk.Context, urlPathSegments []string, req abci.RequestQuery) (res []byte, err error) {
+		switch urlPathSegments[0] {
 		case QueryData:
-			return queryData(ctx, strings.Join(path[1:], "/"), req, keeper, legacyQuerierCdc)
+			entryPath, entryPathErr := getVstorageEntryPath(urlPathSegments[1:])
+			if entryPathErr != nil {
+				return nil, entryPathErr
+			}
+			return queryData(ctx, entryPath, req, keeper, legacyQuerierCdc)
 		case QueryChildren:
-			return queryChildren(ctx, strings.Join(path[1:], "/"), req, keeper, legacyQuerierCdc)
+			entryPath, entryPathErr := getVstorageEntryPath(urlPathSegments[1:])
+			if entryPathErr != nil {
+				return nil, entryPathErr
+			}
+			return queryChildren(ctx, entryPath, req, keeper, legacyQuerierCdc)
 		default:
 			return nil, sdkerrors.Wrap(sdkerrors.ErrUnknownRequest, "unknown vstorage query endpoint")
 		}
@@ -36,12 +56,12 @@ func NewQuerier(keeper Keeper, legacyQuerierCdc *codec.LegacyAmino) sdk.Querier
 func queryData(ctx sdk.Context, path string, req abci.RequestQuery, keeper Keeper, legacyQuerierCdc *codec.LegacyAmino) (res []byte, err error) {
 	entry := keeper.GetEntry(ctx, path)
 	if !entry.HasValue() {
-		return nil, sdkerrors.Wrap(sdkerrors.ErrUnknownRequest, "could not get vstorage path")
+		return nil, sdkerrors.Wrap(sdkerrors.ErrNotFound, "no data for vstorage path")
 	}
 
-	bz, err2 := codec.MarshalJSONIndent(legacyQuerierCdc, types.Data{Value: entry.StringValue()})
-	if err2 != nil {
-		return nil, sdkerrors.Wrap(sdkerrors.ErrJSONMarshal, err2.Error())
+	bz, marshalErr := codec.MarshalJSONIndent(legacyQuerierCdc, types.Data{Value: entry.StringValue()})
+	if marshalErr != nil {
+		return nil, sdkerrors.Wrap(sdkerrors.ErrJSONMarshal, marshalErr.Error())
 	}
 
 	return bz, nil

package/x/vstorage/types/path_keys.go

@@ -7,9 +7,17 @@ import (
 	"strings"
 )
 
-// - A "path" is a sequence of zero or more dot-separated nonempty strings of
-// 7-bit non-nul, non-dot ASCII characters. So `""`, `"foo"`, and
-// `"foo.bar.baz"` are paths but `"."`, "foo.", and "fo\0o" are not.
+// - A "path" is a sequence of zero or more dot-separated nonempty segments
+// using a restricted alphabet of ASCII alphanumerics plus underscore and dash,
+// consistent with packages/internal/src/lib-chainStorage.js but not currently
+// enforcing a length restriction on path segments.
+// So `""`, `"foo"`, and `"foo.bar__baz.qux--quux"` are paths but `"."`,
+// `"foo/bar"`, `"fo\to"`, and `"foö"` are not.
+// This alphabet might be expanded in the future, but such expansion SHOULD NOT
+// include control characters (including those that are not ASCII, such as
+// U+202E RIGHT-TO-LEFT OVERRIDE), slash `/` (which separates ABCI request path
+// segments in e.g. `custom/vstorage/data/foo`), or backslash `\` (which should
+// be reserved for adding escape sequences).
 //
 // - An encoded key for a path is the path prefixed with its length (in ASCII
 // digits), separated by nul, followed by the path with dots replaced with nul.
@@ -42,22 +50,26 @@ func EncodedKeyToPath(key []byte) string {
 	return string(pathBytes)
 }
 
-var pathPattern = regexp.MustCompile(`[-a-zA-Z0-9_` + PathSeparator + `]*`)
+var pathSegmentPattern = `[a-zA-Z0-9_-]+`
+var pathSeparatorPattern = `\` + PathSeparator
+var pathPattern = fmt.Sprintf(`^$|^%[1]s(%[2]s%[1]s)*$`, pathSegmentPattern, pathSeparatorPattern)
+var pathMatcher = regexp.MustCompile(pathPattern)
 
 func ValidatePath(path string) error {
-	if !pathPattern.MatchString(path) {
-		return fmt.Errorf("path %q contains invalid characters", path)
-	}
-	if strings.Contains(path, PathSeparator+PathSeparator) {
-		return fmt.Errorf("path %q contains doubled separators", path)
+	if pathMatcher.MatchString(path) {
+		return nil
 	}
+	// Rescan the string to give a useful error message.
 	if strings.HasPrefix(path, PathSeparator) {
 		return fmt.Errorf("path %q starts with separator", path)
 	}
 	if strings.HasSuffix(path, PathSeparator) {
 		return fmt.Errorf("path %q ends with separator", path)
 	}
-	return nil
+	if strings.Contains(path, PathSeparator+PathSeparator) {
+		return fmt.Errorf("path %q contains doubled separators", path)
+	}
+	return fmt.Errorf("path %q contains invalid characters", path)
 }
 
 // PathToEncodedKey converts a path to a byte slice key

package/x/vstorage/types/path_keys_test.go

@@ -2,40 +2,106 @@ package types
 
 import (
 	"bytes"
+	"fmt"
+	"strings"
 	"testing"
 )
 
 func Test_Key_Encoding(t *testing.T) {
 	tests := []struct {
-		name     string
-		childStr string
-		key      []byte
+		name        string
+		path        string
+		key         []byte
+		errContains string
 	}{
 		{
-			name:     "empty key is prefixed",
-			childStr: "",
-			key:      []byte("0\x00"),
+			name: "empty path",
+			path: "",
+			key:  []byte("0\x00"),
 		},
 		{
-			name:     "some key string",
-			childStr: "some",
-			key:      []byte("1\x00some"),
+			name: "single-segment path",
+			path: "some",
+			key:  []byte("1\x00some"),
 		},
 		{
-			name:     "dot-separated",
-			childStr: "some.child.grandchild",
-			key:      []byte("3\x00some\x00child\x00grandchild"),
+			name: "multi-segment path",
+			path: "some.child.grandchild",
+			key:  []byte("3\x00some\x00child\x00grandchild"),
+		},
+		{
+			name: "non-letters",
+			path: "-_0_-",
+			key:  []byte("1\x00-_0_-"),
+		},
+		{
+			name:        "lone dot",
+			path:        ".",
+			errContains: "starts with separator",
+		},
+		{
+			name:        "starts with dot",
+			path:        ".foo",
+			errContains: "starts with separator",
+		},
+		{
+			name:        "ends with dot",
+			path:        "foo.",
+			errContains: "ends with separator",
+		},
+		{
+			name:        "empty path segment",
+			path:        "foo..bar",
+			errContains: "doubled separators",
+		},
+		{
+			name:        "invalid path character U+0000 NUL",
+			path:        "foo\x00bar",
+			errContains: "invalid character",
+		},
+		{
+			name:        "invalid path character U+002F SOLIDUS",
+			path:        "foo/bar",
+			errContains: "invalid character",
+		},
+		{
+			name:        "invalid path character U+005C REVERSE SOLIDUS",
+			path:        "foo\\bar",
+			errContains: "invalid character",
+		},
+		{
+			name:        "invalid path character U+007C VERTICAL LINE",
+			path:        "foo|bar",
+			errContains: "invalid character",
 		},
 	}
 
 	for _, tt := range tests {
+		if tt.key != nil {
+			t.Run(tt.name, func(t *testing.T) {
+				if key := PathToEncodedKey(tt.path); !bytes.Equal(key, tt.key) {
+					t.Errorf("pathToKey(%q) = []byte(%q), want []byte(%q)", tt.path, key, tt.key)
+				}
+				if path := EncodedKeyToPath(tt.key); path != tt.path {
+					t.Errorf("keyToPath([]byte(%q)) = %q, want %q", tt.key, path, tt.path)
+				}
+			})
+			continue
+		}
+		expect := tt.errContains
 		t.Run(tt.name, func(t *testing.T) {
-			if key := PathToEncodedKey(tt.childStr); !bytes.Equal(key, tt.key) {
-				t.Errorf("pathToKey(%q) = %v, want %v", tt.childStr, key, tt.key)
-			}
-			if childStr := EncodedKeyToPath(tt.key); childStr != tt.childStr {
-				t.Errorf("keyToString(%v) = %q, want %q", tt.key, childStr, tt.childStr)
-			}
+			var key []byte
+			defer func() {
+				if err := recover(); err != nil {
+					errStr := fmt.Sprintf("%v", err)
+					if !strings.Contains(errStr, expect) {
+						t.Errorf("pathToKey(%q) = error %q, want error %v", tt.path, errStr, expect)
+					}
+				} else {
+					t.Errorf("pathToKey(%q) = []byte(%q), want error %v", tt.path, key, expect)
+				}
+			}()
+			key = PathToEncodedKey(tt.path)
 		})
 	}
 }

package/app/const.go

@@ -1,6 +0,0 @@
-package gaia
-
-const (
-	upgradeName     = "agoric-upgrade-11"
-	upgradeNameTest = "agorictest-upgrade-11"
-)