feat(tdx-init): deliver summit's advertised consensus address - #256
Merged
Conversation
Write summit.env with SUMMIT_ADVERTISED_ADDR, this node's external_ip at the consensus port, for summit's unit to splice into --ip. An address is not part of validator identity in summit: its genesis carries the founding cohort's addresses outside the config digest, and a validator's consensus-state record holds none at all. Each node instead signs its own address and gossips that record, so the address a node declares is what the whole cohort dials it on. Nothing was delivering that declaration, which leaves it to summit's fallbacks: a founding node reads its own genesis entry, but a node joining an existing network has no entry there and resolves its address by asking public IP-echo services, then signs and gossips whatever they return. Sourcing it from [node].external_ip is what keeps the two planes agreeing on where the machine is — the same field reth advertises via --nat extip, so no second delivered address can skew from it. It also keeps a founding node truthful across an address change, which its founding-era genesis entry cannot follow (those entries are deliberately outside the config digest, so IP churn never re-founds a network). The value is a SocketAddr rather than a textually composed string: its Display brackets IPv6, which is the form summit parses. Composing "<external_ip>:<port>" would emit 2001:db8::7:18551 for an IPv6 node, which summit rejects at startup. The consensus port is named here until summit takes --ip as a bare address and pairs it with its own --port (SeismicSystems/summit#455); the constant carries a TODO to drop it and the bracketing along with it.
samlaf
added a commit
to SeismicSystems/seismic-images
that referenced
this pull request
Aug 18, 2026
Fixes SEI-219 Related to SeismicSystems/enclave#256 Load summit.env and pass --ip ${SUMMIT_ADVERTISED_ADDR}, the address tdx-init composes from the operator's POSTed external_ip. summit signs that address and gossips it as this node's peer record, so it is what the rest of the cohort dials; without it summit falls back to its own genesis entry, which only a founding node has, and a joining node resolves its address from public IP-echo services instead. It is the same address reth advertises via --nat extip, so both planes agree on where this machine is. The EnvironmentFile is required (no `-`): the Requires= chain (attestation -> tdx-init) guarantees the file exists, so a missing one is a real boot failure rather than something to tolerate. Unlike the reth-p2p.env flags, the var is spliced as a quoted expansion — it is always populated, so it needs no empty-var disappearing act. Bump the enclave pin to the tdx-init that writes summit.env. The EnvironmentFile is required, so the two have to move together: an older pin leaves the file absent and summit refuses to start. Correct the --rpc-ip TODO while here. It read as waiting on an upstream merge that has already happened; what it actually waits on is the summit pin, which predates the flag and would reject it at startup.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Write summit.env with SUMMIT_ADVERTISED_ADDR, this node's external_ip at the consensus port, for summit's unit to splice into --ip.
An address is not part of validator identity in summit: its genesis carries the founding cohort's addresses outside the config digest, and a validator's consensus-state record holds none at all. Each node instead signs its own address and gossips that record, so the address a node declares is what the whole cohort dials it on. Nothing was delivering that declaration, which leaves it to summit's fallbacks: a founding node reads its own genesis entry, but a node joining an existing network has no entry there and resolves its address by asking public IP-echo services, then signs and gossips whatever they return.
Sourcing it from [node].external_ip is what keeps the two planes agreeing on where the machine is — the same field reth advertises via --nat extip, so no second delivered address can skew from it. It also keeps a founding node truthful across an address change, which its founding-era genesis entry cannot follow (those entries are deliberately outside the config digest, so IP churn never re-founds a network).
The value is a SocketAddr rather than a textually composed string: its Display brackets IPv6, which is the form summit parses. Composing "<external_ip>:" would emit 2001:db8::7:18551 for an IPv6 node, which summit rejects at startup.
The consensus port is named here until summit takes --ip as a bare address and pairs it with its own --port
(SeismicSystems/summit#455); the constant carries a TODO to drop it and the bracketing along with it.