fix(core, docker, scripts): robust genesis compat handling, isolate local avalanchego, sort comm inputs

- core/genesis:
    - Persist upgrade bytes only when height == 0, otherwise write after compatibility check passes.
    - Reconcile precompile-only incompatibilities by persisting upgrade metadata and proceeding.
- docker:
    - Only move and replace local avalanchego when it’s a standalone module (./avalanchego/go.mod), avoiding accidental source flattening.
- scripts:
    - Sort right-hand inputs to comm in build_test.sh and lint_allowed_eth_imports.sh to eliminate “comm: input is not in sorted order”.

Author: powerslider

Dockerfile

@@ -16,10 +16,9 @@ RUN go mod download
 # Copy the code into the container
 COPY . .
 
-# If a local avalanchego source directory is present in the repository (manual CI case),
-# move it outside the module root and update the replace directive to point to it so
-# avalanchego sources are not flattened into this module's package tree.
-RUN if [ -d ./avalanchego ]; then \
+# If a local avalanchego module is present, move it out of the module tree and
+# point the replace directive at it to avoid flattening into this module's packages.
+RUN if [ -f ./avalanchego/go.mod ]; then \
   mkdir -p /third_party && \
   mv ./avalanchego /third_party/avalanchego && \
   go mod edit -replace github.com/ava-labs/avalanchego=./third_party/avalanchego && \

core/genesis.go

@@ -32,6 +32,7 @@ import (
 	"errors"
 	"fmt"
 	"math/big"
+	"strings"
 	"time"
 
 	"github.com/ava-labs/avalanchego/vms/evm/sync/customrawdb"
@@ -177,33 +178,25 @@ func SetupGenesisBlock(
 		return genesis.Config, common.Hash{}, &GenesisMismatchError{stored, hash}
 	}
 	// Get the existing chain configuration.
-	newcfg := genesis.Config
-	if err := newcfg.CheckConfigForkOrder(); err != nil {
-		return newcfg, common.Hash{}, err
+	newCfg := genesis.Config
+	if err := newCfg.CheckConfigForkOrder(); err != nil {
+		return newCfg, common.Hash{}, err
 	}
 
 	// Read stored config into a local extras copy to avoid mutating the
 	// caller's attached extras (which may be concurrently accessed in tests).
 	// We'll persist the new config (including upgrade bytes) using the attached
 	// extras below to ensure on-disk state is up to date.
-	readExtra := *params.GetExtra(newcfg)
+	readExtra := *params.GetExtra(newCfg)
 	storedCfg := customrawdb.ReadChainConfig(db, stored, &readExtra)
 	// If there is no previously stored chain config, write the chain config to disk.
 	if storedCfg == nil {
 		// Note: this can happen since we did not previously write the genesis block and chain config in the same batch.
 		log.Warn("Found genesis block without chain config")
-		customrawdb.WriteChainConfig(db, stored, newcfg, *params.GetExtra(newcfg))
-		return newcfg, stored, nil
+		customrawdb.WriteChainConfig(db, stored, newCfg, *params.GetExtra(newCfg))
+		return newCfg, stored, nil
 	}
 
-	// Persist the new chain config (and upgrade bytes) to disk now to avoid
-	// spurious compatibility failures due to missing upgrade bytes on older databases.
-	customrawdb.WriteChainConfig(db, stored, newcfg, *params.GetExtra(newcfg))
-
-	// Re-read stored config into a fresh extras copy for a clean comparison.
-	compareExtra := *params.GetExtra(newcfg)
-	storedCfg = customrawdb.ReadChainConfig(db, stored, &compareExtra)
-
 	// Notes on the following line:
 	// - this is needed in coreth to handle the case where existing nodes do not
 	//   have the Berlin or London forks initialized by block number on disk.
@@ -222,24 +215,31 @@ func SetupGenesisBlock(
 	// when we start syncing from scratch, the last accepted block
 	// will be genesis block
 	if lastBlock == nil {
-		return newcfg, common.Hash{}, errors.New("missing last accepted block")
+		return newCfg, common.Hash{}, errors.New("missing last accepted block")
 	}
 	height := lastBlock.NumberU64()
 	timestamp := lastBlock.Time()
-	if skipChainConfigCheckCompatible {
-		log.Info("skipping verifying activated network upgrades on chain config")
-	} else {
-		compatErr := storedCfg.CheckCompatible(newcfg, height, timestamp)
-		if compatErr != nil && ((height != 0 && compatErr.RewindToBlock != 0) || (timestamp != 0 && compatErr.RewindToTime != 0)) {
-			storedData, _ := params.ToWithUpgradesJSON(storedCfg).MarshalJSON()
-			newData, _ := params.ToWithUpgradesJSON(newcfg).MarshalJSON()
-			log.Error("found mismatch between config on database vs. new config", "storedConfig", string(storedData), "newConfig", string(newData), "err", compatErr)
-			return newcfg, stored, compatErr
+
+	// If the chain hasn't advanced past genesis (height 0), persist the new
+	// chain config (including upgrade bytes) before compatibility checks so
+	// subsequent restarts see the updated upgrades and do not flag them as
+	// retroactive enables.
+	if height == 0 {
+		storedCfg = persistChainConfigAndReload(db, stored, newCfg)
+	}
+
+	if !skipChainConfigCheckCompatible {
+		if _, err := reconcileCompatibility(db, stored, storedCfg, newCfg, height, timestamp); err != nil {
+			logCompatibilityMismatch(storedCfg, newCfg, err)
+			return newCfg, stored, err
 		}
+	} else {
+		log.Info("skipping verifying activated network upgrades on chain config")
 	}
-	// Chain config has already been written above.
-	// Write is idempotent but not required here.
-	return newcfg, stored, nil
+
+	// Persist the new chain config (including upgrade bytes) now that compatibility is verified.
+	customrawdb.WriteChainConfig(db, stored, newCfg, *params.GetExtra(newCfg))
+	return newCfg, stored, nil
 }
 
 // IsVerkle indicates whether the state is already stored in a verkle
@@ -468,3 +468,54 @@ func ReadBlockByHash(db ethdb.Reader, hash common.Hash) *types.Block {
 	}
 	return rawdb.ReadBlock(db, hash, *blockNumber)
 }
+
+// reconcileCompatibility checks compatibility between the stored and new chain configs.
+// If the only incompatibility is missing precompile upgrade metadata, it persists the
+// new config (including upgrade bytes) and returns a refreshed stored config view.
+// Otherwise, it returns the compatibility error.
+func reconcileCompatibility(
+	db ethdb.Database,
+	genesisHash common.Hash,
+	storedCfg *params.ChainConfig,
+	newCfg *params.ChainConfig,
+	height uint64,
+	timestamp uint64,
+) (*params.ChainConfig, error) {
+	compatErr := storedCfg.CheckCompatible(newCfg, height, timestamp)
+	needsRewind := compatErr != nil && ((height != 0 && compatErr.RewindToBlock != 0) || (timestamp != 0 && compatErr.RewindToTime != 0))
+	if !needsRewind {
+		return storedCfg, nil
+	}
+	if !isPrecompileUpgradeOnlyIncompatibility(compatErr) {
+		return nil, compatErr
+	}
+	// Only precompile upgrade metadata differs: write upgrades and proceed.
+	refreshed := persistChainConfigAndReload(db, genesisHash, newCfg)
+	return refreshed, nil
+}
+
+// persistChainConfigAndReload writes the provided chain config (including upgrade bytes)
+// and returns a fresh view of the stored config using a separate extras copy.
+func persistChainConfigAndReload(db ethdb.Database, genesisHash common.Hash, cfg *params.ChainConfig) *params.ChainConfig {
+	customrawdb.WriteChainConfig(db, genesisHash, cfg, *params.GetExtra(cfg))
+	refreshedExtra := *params.GetExtra(cfg)
+	return customrawdb.ReadChainConfig(db, genesisHash, &refreshedExtra)
+}
+
+// isPrecompileUpgradeOnlyIncompatibility returns true if the compatibility error
+// pertains exclusively to precompile upgrade activation metadata being absent on disk.
+// In such cases, persisting the new chain config (including upgrade bytes) resolves
+// the mismatch without requiring a rewind.
+func isPrecompileUpgradeOnlyIncompatibility(err *ethparams.ConfigCompatError) bool {
+	if err == nil {
+		return false
+	}
+	return strings.Contains(err.What, "PrecompileUpgrade[")
+}
+
+// logCompatibilityMismatch emits a structured error comparing stored and new configs.
+func logCompatibilityMismatch(storedCfg, newCfg *params.ChainConfig, err error) {
+	storedData, _ := params.ToWithUpgradesJSON(storedCfg).MarshalJSON()
+	newData, _ := params.ToWithUpgradesJSON(newCfg).MarshalJSON()
+	log.Error("found mismatch between config on database vs. new config", "storedConfig", string(storedData), "newConfig", string(newData), "err", err)
+}

scripts/build_test.sh

@@ -34,15 +34,15 @@ do
     if [[ ${command_status:-0} == 0 ]]; then
         rm test.out
         exit 0
-    else 
+    else
         unset command_status # Clear the error code for the next run
     fi
 
     # If the test failed, print the output
     unexpected_failures=$(
         # First grep pattern corresponds to test failures, second pattern corresponds to test panics due to timeouts
         (grep "^--- FAIL" test.out | awk '{print $3}' || grep -E '^\s+Test.+ \(' test.out | awk '{print $1}') |
-        sort -u | comm -23 -  <(sed 's/\r$//' ./scripts/known_flakes.txt)
+        sort -u | comm -23 -  <(sed 's/\r$//' ./scripts/known_flakes.txt | sort -u)
     )
     if [ -n "${unexpected_failures}" ]; then
         echo "Unexpected test failures: ${unexpected_failures}"
@@ -56,4 +56,4 @@ do
 done
 
 # If we reach here, we have failed all retries
-exit 1
+exit 1

scripts/lint_allowed_eth_imports.sh

@@ -15,7 +15,7 @@ extra_imports=$(find . -type f \( -name "*.go" \) ! -name "mocks.go" ! -path "si
   grep -v 'eth\w\+ "' |
   grep -v '_ "' |
   grep -o "${libevm_regexp}" |
-  sort -u | comm -23 - ./scripts/eth-allowed-packages.txt)
+  sort -u | comm -23 - <(sort -u ./scripts/eth-allowed-packages.txt))
 if [ -n "${extra_imports}" ]; then
     echo "new ethereum imports should be added to ./scripts/eth-allowed-packages.txt to prevent accidental imports:"
     echo "${extra_imports}"