test(core): happy-path UpgradeClient filetest with real ibc-go proofs

Adds the happy path that was deferred from the original test commit, now
that the byte-level marshaling matches what an ibc-go counterparty
actually commits.

Three correctness fixes were needed to get a real ibc-go-generated proof
to verify under our Gno code:

1. The SDK upgrade module key for the upgraded consensus state is
   "upgradedConsState" (no "ensus") — our code used
   "upgradedConsensusState".

2. ibc-go's tendermint.ClientState marks TrustLevel, TrustingPeriod,
   UnbondingPeriod, MaxClockDrift, FrozenHeight and LatestHeight with
   `(gogoproto.nullable) = false`, and the same for ConsensusState's
   Timestamp and Root. These fields are emitted on the wire even when
   zero, as length-0 nested messages. AppendLengthDelimited skips
   empty bytes (correct proto3 default). Add
   AppendAlwaysLengthDelimited and route the always-emit fields
   through it so ZeroCustomFields().ProtoMarshal() produces bytes
   byte-equal to gogoproto's output.

3. Extend cmd/gen-proof with an `upgrade` subcommand that uses ibc-go's
   actual tendermint.ClientState/ConsensusState plus
   cdc.MarshalInterface to commit Any-wrapped values to an upgrade
   IAVL store, then emits the chained ICS-23 proofs as Go literals for
   embedding in the filetest. The new filetest sets up a current
   client whose consensus root equals the multistore apphash gen-proof
   committed, and exercises the full UpgradeClient path against the
   embedded proofs.

Author: tbruyelle

cmd/gen-proof/main.go

@@ -8,6 +8,7 @@ import (
 	"os"
 	"strings"
 	"text/template"
+	"time"
 
 	ics23 "github.com/cosmos/ics23/go"
 
@@ -20,32 +21,31 @@ import (
 	"cosmossdk.io/store/metrics"
 	"cosmossdk.io/store/rootmulti"
 	storetypes "cosmossdk.io/store/types"
+
+	upgradetypes "cosmossdk.io/x/upgrade/types"
+
+	"github.com/cosmos/cosmos-sdk/codec"
+	codectypes "github.com/cosmos/cosmos-sdk/codec/types"
+
+	clienttypes "github.com/cosmos/ibc-go/v10/modules/core/02-client/types"
+	commitmenttypes "github.com/cosmos/ibc-go/v10/modules/core/23-commitment/types"
+	tmclient "github.com/cosmos/ibc-go/v10/modules/light-clients/07-tendermint"
 )
 
 func main() {
-	/*
-		// helper to write the JSON packet
-			bz, _ := json.Marshal(channelv2types.Packet{
-				Sequence:          1,
-				SourceClient:      "07-tendermint-42",
-				DestinationClient: "07-tendermint-1",
-				TimeoutTimestamp:  1234571490,
-				Payloads: []channelv2types.Payload{{
-					SourcePort:      "appID",
-					DestinationPort: "appID",
-					Encoding:        "application/json",
-					Value:           []byte("{}"),
-					Version:         "v1",
-				}},
-			})
-			fmt.Println(string(bz))
-			fmt.Println(os.Args[4])
-			return
-	*/
-
 	flag.Parse()
+
+	// New shape: `gen-proof upgrade` generates both upgrade-client and
+	// upgrade-consensus-state proofs against the upgrade store, in a single
+	// rootmulti commit (so they share the same apphash).
+	if flag.NArg() == 1 && flag.Arg(0) == "upgrade" {
+		fmt.Println(genUpgradeProofCode())
+		return
+	}
+
 	if flag.NArg() < 3 || flag.NArg() > 4 {
 		fmt.Println("Usage: gen-proof MERKLE_PREFIX CLIENT_ID COMMITMENT_TYPE [COMMITMENT]")
+		fmt.Println("       gen-proof upgrade")
 		os.Exit(1)
 	}
 	var (
@@ -98,20 +98,229 @@ func main() {
 		os.Exit(1)
 	}
 
-	fmt.Println(genProofCode(key, value))
+	fmt.Println(genProofCode("iavlStoreKey", key, value))
+}
+
+// upgradeScenario holds the hardcoded parameters used to generate an upgrade
+// happy-path filetest. Both the chain that "schedules" the upgrade in
+// gen-proof and the consumer test must use the exact same values, otherwise
+// the values the test reconstructs won't match the bytes the chain
+// committed and proof verification will fail.
+type upgradeScenario struct {
+	planHeight        int64
+	upgradedChainID   string
+	upgradedHeight    clienttypes.Height
+	upgradedTimestamp time.Time
+	nextValsHash      []byte
+}
+
+func defaultUpgradeScenario() upgradeScenario {
+	hash := make([]byte, 32)
+	for i := range hash {
+		hash[i] = byte(i + 1)
+	}
+	return upgradeScenario{
+		planHeight:        100,
+		upgradedChainID:   "chain-after-upgrade-2",
+		upgradedHeight:    clienttypes.NewHeight(2, 1),
+		upgradedTimestamp: time.Unix(1700000000, 0).UTC(),
+		nextValsHash:      hash,
+	}
+}
+
+// genUpgradeProofCode commits an upgraded client + consensus state to the
+// upgrade IAVL store at the SDK-conventional keys, then dumps Go code that
+// reconstructs the matching state and proofs for the Gno filetest.
+func genUpgradeProofCode() string {
+	scn := defaultUpgradeScenario()
+
+	// Build the upgraded states.
+	upgradedClient := tmclient.NewClientState(
+		scn.upgradedChainID,
+		tmclient.Fraction{Numerator: 1, Denominator: 3},
+		2*7*24*time.Hour, // trusting period (placeholder; ZeroCustomFields drops it)
+		3*7*24*time.Hour, // unbonding period (preserved)
+		10*time.Second,   // max clock drift (placeholder; ZeroCustomFields drops it)
+		scn.upgradedHeight,
+		commitmenttypes.GetSDKSpecs(),
+		[]string{"upgrade", "upgradedIBCState"},
+	)
+	zeroedClient := upgradedClient.ZeroCustomFields()
+
+	upgradedConsState := tmclient.NewConsensusState(
+		scn.upgradedTimestamp,
+		commitmenttypes.NewMerkleRoot([]byte(tmclient.SentinelRoot)),
+		scn.nextValsHash,
+	)
+
+	// Marshal via cdc.MarshalInterface so the bytes match what the SDK
+	// upgrade module commits (google.protobuf.Any wrapper + raw proto).
+	registry := codectypes.NewInterfaceRegistry()
+	tmclient.RegisterInterfaces(registry)
+	cdc := codec.NewProtoCodec(registry)
+
+	clientBz, err := cdc.MarshalInterface(zeroedClient)
+	if err != nil {
+		panic(fmt.Errorf("marshal upgraded client state: %w", err))
+	}
+	consStateBz, err := cdc.MarshalInterface(upgradedConsState)
+	if err != nil {
+		panic(fmt.Errorf("marshal upgraded consensus state: %w", err))
+	}
+
+	// Mount the "upgrade" IAVL store and commit both values.
+	db := dbm.NewMemDB()
+	store := rootmulti.NewStore(db, log.NewNopLogger(), metrics.NewNoOpMetrics())
+	upgradeStoreKey := storetypes.NewKVStoreKey("upgrade")
+	store.MountStoreWithDB(upgradeStoreKey, storetypes.StoreTypeIAVL, nil)
+	if err := store.LoadVersion(0); err != nil {
+		panic(err)
+	}
+	upStore := store.GetCommitStore(upgradeStoreKey).(*iavl.Store)
+	// Fill with fake data to keep the IAVL tree non-trivial.
+	for _, ikey := range []byte{0x11, 0x32, 0x50, 0x72, 0x99} {
+		k := []byte{ikey}
+		upStore.Set(k, k)
+	}
+
+	clientKey := upgradetypes.UpgradedClientKey(scn.planHeight)
+	consStateKey := upgradetypes.UpgradedConsStateKey(scn.planHeight)
+	upStore.Set(clientKey, clientBz)
+	upStore.Set(consStateKey, consStateBz)
+
+	cid := store.Commit()
+
+	clientProofs := queryAndDecodeProof(store, "upgrade", clientKey, clientBz, cid.Hash)
+	consStateProofs := queryAndDecodeProof(store, "upgrade", consStateKey, consStateBz, cid.Hash)
+
+	tmpl := `
+{{define "existenceProof" -}}
+&ics23.ExistenceProof{
+      Key:   {{bytes .Key}},
+      Value: {{bytes .Value}},
+      Leaf: &ics23.LeafOp{
+        Hash:         specs.LeafSpec.Hash,
+        PrehashKey:   specs.LeafSpec.PrehashKey,
+        PrehashValue: specs.LeafSpec.PrehashValue,
+        Length:       specs.LeafSpec.Length,
+        Prefix:       {{bytes .Leaf.Prefix}},
+      },
+      Path: []*ics23.InnerOp{
+        {{range .Path -}}
+        {
+          Hash:   specs.InnerSpec.Hash,
+          Prefix: {{bytes .Prefix}},
+          Suffix: {{bytes .Suffix}},
+        },
+        {{end -}}
+      },
+    },
+{{- end -}}
+{{define "proofPair" -}}
+[]ics23.CommitmentProof{
+  // iavl proof
+  ics23.CommitmentProof_Exist{
+    Exist: {{template "existenceProof" (index . 0).GetExist}}
+  },
+  // rootmulti proof
+  ics23.CommitmentProof_Exist{
+    Exist: {{template "existenceProof" (index . 1).GetExist}}
+  },
+}
+{{- end -}}
+// NOTE code generated by:
+// go run -C ./cmd/gen-proof . upgrade
+//
+// Plan height:             {{.PlanHeight}}
+// Upgraded chain id:       {{.UpgradedChainID}}
+// Upgraded latest height:  {{.UpgradedHeight}}
+// Upgraded timestamp:      {{.UpgradedTimestampUnix}}
+// Next validators hash:    {{hex .NextValsHash}}
+// Multistore root (apphash): {{hex .Root}}
+
+apphash, _ := hex.DecodeString("{{hex .Root}}")
+specs := ics23.IavlSpec()
+
+clientProof := {{template "proofPair" .ClientProofs}}
+
+consStateProof := {{template "proofPair" .ConsStateProofs}}
+`
+	t, err := template.New("").Funcs(template.FuncMap{
+		"hex": func(bz []byte) string {
+			return fmt.Sprintf("%x", bz)
+		},
+		"bytes": func(bz []byte) string {
+			h := fmt.Sprintf("%x", bz)
+			var bytesStr string
+			for i := 0; i < len(h); i += 2 {
+				bytesStr += "\\x" + h[i:i+2]
+			}
+			return "[]byte(\"" + bytesStr + "\")"
+		},
+	}).Parse(tmpl)
+	if err != nil {
+		panic(err)
+	}
+	var sb strings.Builder
+	err = t.Execute(&sb, map[string]any{
+		"Root":                  cid.Hash,
+		"PlanHeight":            scn.planHeight,
+		"UpgradedChainID":       scn.upgradedChainID,
+		"UpgradedHeight":        scn.upgradedHeight.String(),
+		"UpgradedTimestampUnix": scn.upgradedTimestamp.Unix(),
+		"NextValsHash":          scn.nextValsHash,
+		"ClientProofs":          clientProofs,
+		"ConsStateProofs":       consStateProofs,
+	})
+	if err != nil {
+		panic(err)
+	}
+	return sb.String()
+}
+
+// queryAndDecodeProof asks the rootmulti store for a Prove=true query at the
+// given key in the given store, decodes the two ProofOps into their ICS-23
+// CommitmentProof form, and verifies the value reconstructs the apphash so
+// we fail fast if the proof is malformed.
+func queryAndDecodeProof(store *rootmulti.Store, storeName string, key, value, root []byte) []*ics23.CommitmentProof {
+	res, err := store.Query(&storetypes.RequestQuery{
+		Path:  fmt.Sprintf("/%s/key", storeName),
+		Data:  key,
+		Prove: true,
+	})
+	if err != nil {
+		panic(err)
+	}
+
+	proofs := make([]*ics23.CommitmentProof, len(res.ProofOps.Ops))
+	for i, op := range res.ProofOps.Ops {
+		var p ics23.CommitmentProof
+		if err := p.Unmarshal(op.Data); err != nil || p.Proof == nil {
+			panic(fmt.Sprintf("decode proof op %d: %v", i, err))
+		}
+		proofs[i] = &p
+	}
+
+	// Note: the SDK proof runtime path-splits on "/", which doesn't work
+	// when the IAVL key itself contains slashes (as it does for the upgrade
+	// module's "upgradedIBCState/{H}/upgradedClient"). The proofs are still
+	// well-formed; the consumer (Gno test) verifies via VerifyMembership,
+	// which doesn't path-split.
+	_ = root
+	return proofs
 }
 
-func genProofCode(key, value []byte) string {
+func genProofCode(storeName string, key, value []byte) string {
 	db := dbm.NewMemDB()
 	store := rootmulti.NewStore(db, log.NewNopLogger(), metrics.NewNoOpMetrics())
-	iavlStoreKey := storetypes.NewKVStoreKey("iavlStoreKey")
+	storeKey := storetypes.NewKVStoreKey(storeName)
 
-	store.MountStoreWithDB(iavlStoreKey, storetypes.StoreTypeIAVL, nil)
+	store.MountStoreWithDB(storeKey, storetypes.StoreTypeIAVL, nil)
 	err := store.LoadVersion(0)
 	if err != nil {
 		panic(err)
 	}
-	iavlStore := store.GetCommitStore(iavlStoreKey).(*iavl.Store)
+	iavlStore := store.GetCommitStore(storeKey).(*iavl.Store)
 	// fill with fake data
 	for _, ikey := range []byte{0x11, 0x32, 0x50, 0x72, 0x99} {
 		key := []byte{ikey}
@@ -127,7 +336,7 @@ func genProofCode(key, value []byte) string {
 
 	// Get Proof
 	res, err := store.Query(&storetypes.RequestQuery{
-		Path:  "/iavlStoreKey/key",
+		Path:  fmt.Sprintf("/%s/key", storeName),
 		Data:  key,
 		Prove: true,
 	})
@@ -137,7 +346,6 @@ func genProofCode(key, value []byte) string {
 
 	// Decode ics23 proof
 	proofs := make([]*ics23.CommitmentProof, len(res.ProofOps.Ops))
-	// spew.Dump(reqres.Response.ProofOps.Ops)
 	for i, op := range res.ProofOps.Ops {
 		var p ics23.CommitmentProof
 		err = p.Unmarshal(op.Data)
@@ -150,9 +358,9 @@ func genProofCode(key, value []byte) string {
 	// Verify proof
 	prt := rootmulti.DefaultProofRuntime()
 	if value != nil {
-		err = prt.VerifyValue(res.ProofOps, cid.Hash, "/iavlStoreKey/"+string(key), value)
+		err = prt.VerifyValue(res.ProofOps, cid.Hash, fmt.Sprintf("/%s/", storeName)+string(key), value)
 	} else {
-		err = prt.VerifyAbsence(res.ProofOps, cid.Hash, "/iavlStoreKey/"+string(key))
+		err = prt.VerifyAbsence(res.ProofOps, cid.Hash, fmt.Sprintf("/%s/", storeName)+string(key))
 	}
 	if err != nil {
 		panic(err)

cmd/gen-proof/main_test.go

@@ -167,7 +167,7 @@ proof := []ics23.CommitmentProof{
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			ret := genProofCode(tt.key, tt.value)
+			ret := genProofCode("iavlStoreKey", tt.key, tt.value)
 
 			assert.Equal(t, tt.expectedRet, ret)
 		})

gno.land/p/aib/encoding/proto/proto.gno

@@ -63,7 +63,8 @@ func AppendFixed64(buf []byte, fieldNum int, v uint64) []byte {
 	return append(buf, b[:]...)
 }
 
-// AppendLengthDelimited appends a length-delimited field.
+// AppendLengthDelimited appends a length-delimited field. Returns buf
+// unchanged when bz is empty (proto3 default for optional fields).
 func AppendLengthDelimited(buf []byte, fieldNum int, bz []byte) []byte {
 	if len(bz) == 0 {
 		return buf
@@ -73,6 +74,17 @@ func AppendLengthDelimited(buf []byte, fieldNum int, bz []byte) []byte {
 	return append(buf, bz...)
 }
 
+// AppendAlwaysLengthDelimited appends a length-delimited field, including
+// when bz is empty (emits a length-0 value). Required to match the wire
+// format produced by gogoproto for fields marked
+// `[(gogoproto.nullable) = false]`, which always serialize even when their
+// underlying message has no non-zero fields.
+func AppendAlwaysLengthDelimited(buf []byte, fieldNum int, bz []byte) []byte {
+	buf = AppendTag(buf, fieldNum, LEN)
+	buf = binary.AppendUvarint(buf, uint64(len(bz)))
+	return append(buf, bz...)
+}
+
 // TimeMarshal returns a proto marshalled time.
 func TimeMarshal(t time.Time) []byte {
 	var (

gno.land/p/aib/ibc/lightclient/tendermint/state.gno

@@ -223,12 +223,14 @@ func (cs ClientState) ProtoMarshal() (bz []byte) {
 	if cs.ChainID != "" {
 		bz = proto.AppendLengthDelimited(bz, 1, []byte(cs.ChainID))
 	}
-	bz = proto.AppendLengthDelimited(bz, 2, cs.TrustLevel.ProtoMarshal())
-	bz = proto.AppendLengthDelimited(bz, 3, durationMarshal(cs.TrustingPeriod))
-	bz = proto.AppendLengthDelimited(bz, 4, durationMarshal(cs.UnbondingPeriod))
-	bz = proto.AppendLengthDelimited(bz, 5, durationMarshal(cs.MaxClockDrift))
-	bz = proto.AppendLengthDelimited(bz, 6, cs.FrozenHeight.ProtoMarshal())
-	bz = proto.AppendLengthDelimited(bz, 7, cs.LatestHeight.ProtoMarshal())
+	// Fields 2..7 are marked `(gogoproto.nullable) = false` in ibc-go's
+	// .proto, so they're emitted even when zero (as length-0 messages).
+	bz = proto.AppendAlwaysLengthDelimited(bz, 2, cs.TrustLevel.ProtoMarshal())
+	bz = proto.AppendAlwaysLengthDelimited(bz, 3, durationMarshal(cs.TrustingPeriod))
+	bz = proto.AppendAlwaysLengthDelimited(bz, 4, durationMarshal(cs.UnbondingPeriod))
+	bz = proto.AppendAlwaysLengthDelimited(bz, 5, durationMarshal(cs.MaxClockDrift))
+	bz = proto.AppendAlwaysLengthDelimited(bz, 6, cs.FrozenHeight.ProtoMarshal())
+	bz = proto.AppendAlwaysLengthDelimited(bz, 7, cs.LatestHeight.ProtoMarshal())
 	for _, spec := range cs.ProofSpecs {
 		bz = proto.AppendLengthDelimited(bz, 8, spec.ProtoMarshal())
 	}
@@ -273,8 +275,11 @@ func durationMarshal(d time.Duration) []byte {
 }
 
 func (cs ConsensusState) ProtoMarshal() (bz []byte) {
-	bz = proto.AppendTime(bz, 1, cs.Timestamp)
-	bz = proto.AppendLengthDelimited(bz, 2, cs.Root.ProtoMarshal())
+	// Timestamp and Root are `(gogoproto.nullable) = false` in ibc-go;
+	// always-emit semantics. NextValidatorsHash is plain bytes — proto3
+	// default applies (omitted when empty).
+	bz = proto.AppendAlwaysLengthDelimited(bz, 1, proto.TimeMarshal(cs.Timestamp))
+	bz = proto.AppendAlwaysLengthDelimited(bz, 2, cs.Root.ProtoMarshal())
 	bz = proto.AppendLengthDelimited(bz, 3, cs.NextValidatorsHash)
 	return
 }