From c6f08f2e7af3128706ae596a2b4cc88db0d341d7 Mon Sep 17 00:00:00 2001 From: Martin Raszyk Date: Thu, 12 Nov 2026 11:42:36 +0000 Subject: [PATCH 1/3] docs: record the install argument hash in canister history Document the new args_hash field of code_deployment canister history entries introduced by dfinity/ic#12077. --- docs/references/ic-interface-spec/abstract-behavior.md | 3 +++ docs/references/ic-interface-spec/changelog.md | 7 +++++++ docs/references/ic-interface-spec/management-canister.md | 2 +- docs/references/management-canister.md | 1 + public/references/ic.did | 1 + 5 files changed, 13 insertions(+), 1 deletion(-) diff --git a/docs/references/ic-interface-spec/abstract-behavior.md b/docs/references/ic-interface-spec/abstract-behavior.md index 13a4220c..dd5643f2 100644 --- a/docs/references/ic-interface-spec/abstract-behavior.md +++ b/docs/references/ic-interface-spec/abstract-behavior.md @@ -424,6 +424,7 @@ ChangeDetails | CodeDeployment { mode : CodeDeploymentMode; module_hash : Blob; + args_hash : opt Blob; } | LoadSnapshot { from_canister_id : PrincipalId; @@ -2504,6 +2505,7 @@ New_canister_history = { details = CodeDeployment { mode = A.mode; module_hash = SHA-256(A.wasm_module); + args_hash = opt SHA-256(A.arg); }; }; } @@ -2670,6 +2672,7 @@ New_canister_history = { details = CodeDeployment { mode = Upgrade; module_hash = SHA-256(A.wasm_module); + args_hash = opt SHA-256(A.arg); }; }; } diff --git a/docs/references/ic-interface-spec/changelog.md b/docs/references/ic-interface-spec/changelog.md index daf70e7e..c6585bb9 100644 --- a/docs/references/ic-interface-spec/changelog.md +++ b/docs/references/ic-interface-spec/changelog.md @@ -8,6 +8,13 @@ sidebar: ## Changelog {#changelog} +### 0.71.0 (2026-11-XX) {$0_71_0} + +* New field `args_hash` of a code deployment in the canister history, holding the SHA-256 hash of the + argument `arg` of `install_code` (and `install_chunked_code`) that was passed to the canister's + `canister_init` or `canister_post_upgrade` method. The field is `null` for code deployments recorded + before the system started recording it. + ### 0.70.0 (2026-10-05) {$0_70_0} * New variant `secp256r1` of `ecdsa_curve`, selecting threshold ECDSA on the NIST P-256 curve in `ecdsa_public_key` and `sign_with_ecdsa`. Key derivation follows SLIP-10 and signatures are encoded as diff --git a/docs/references/ic-interface-spec/management-canister.md b/docs/references/ic-interface-spec/management-canister.md index 2587f747..0ed47146 100644 --- a/docs/references/ic-interface-spec/management-canister.md +++ b/docs/references/ic-interface-spec/management-canister.md @@ -371,7 +371,7 @@ Provides the history of the canister, its current module SHA-256 hash, and its c The canister history consists of a list of canister changes (canister creation, code uninstallation, code deployment, loading a snapshot, controllers change, canister renaming). Every canister change consists of the system timestamp at which the change was performed, the canister version after performing the change, the change's origin (a user or a canister), and its details. The change origin includes the principal (called *originator* in the following) that initiated the change and, if the originator is a canister, the originator's canister version when the originator initiated the change (if available). - Canister creation is described by the full set of controllers along with a [hash of the environment variables](./https-interface.md#hash-of-map), if environment variables were specified. The order of controllers stored in the canister history may vary depending on the implementation. -- Code deployment is described by its mode (code install, code reinstall, code upgrade) and the SHA-256 hash of the newly deployed canister module. +- Code deployment is described by its mode (code install, code reinstall, code upgrade), the SHA-256 hash of the newly deployed canister module, and the SHA-256 hash of the argument passed to the canister's `canister_init` or `canister_post_upgrade` method (the field `arg` of `install_code`). The hash of the argument is `null` for code deployments recorded before the system started recording it. - Loading a snapshot is described by the canister ID of the canister from which the snapshot was loaded (if that canister ID is different than the canister ID onto which the snapshot is loaded), the snapshot ID, the canister version and timestamp at which the snapshot was taken (the canister version and timestamp refer to the canister from which the snapshot was loaded), and the source of the snapshot (canister state or metadata upload). - Controllers change is described by the full new set of controllers after the change. The order of controllers stored in the canister history may vary depending on the implementation. - Canister renaming is described by the canister ID and the total number of canister changes before renaming as well as the canister ID, the canister version, and the total number of canister changes of the new canister ID. Because only a dedicated NNS canister can perform canister renaming, the actual principal who requested canister renaming is recorded in a separate field `requested_by`. The total number of canister changes reported by the IC method `canister_info` is overriden to the total number of canister changes of the new canister ID. Canister changes referring to the canister ID before renaming are preserved. diff --git a/docs/references/management-canister.md b/docs/references/management-canister.md index 9db08607..88035565 100644 --- a/docs/references/management-canister.md +++ b/docs/references/management-canister.md @@ -159,6 +159,7 @@ Returns the history, current module hash, and controllers of any canister. Unlik - **Returns:** - `total_num_changes` (`nat64`) - `recent_changes`: list of canister changes (creation, deployment, controller changes, etc.) + - A code deployment entry records the mode (`install`, `reinstall`, or `upgrade`), the SHA-256 hash of the installed module (`module_hash`), and the SHA-256 hash of the install argument `arg` (`args_hash`; `null` for deployments recorded before the hash was introduced) - `module_hash` (`opt blob`) - `controllers` (`vec principal`) diff --git a/public/references/ic.did b/public/references/ic.did index 6cdd0ccc..4ec52e9e 100644 --- a/public/references/ic.did +++ b/public/references/ic.did @@ -76,6 +76,7 @@ type change_details = variant { code_deployment : record { mode : variant { install; reinstall; upgrade }; module_hash : blob; + args_hash : opt blob; }; load_snapshot : record { from_canister_id : opt principal; From b0351442772fa46366070d32b1f6ec4ed31e367b Mon Sep 17 00:00:00 2001 From: Martin Raszyk Date: Thu, 12 Nov 2026 11:44:28 +0000 Subject: [PATCH 2/3] docs: drop the code deployment entry line from the canister_info reference --- .sources/internetidentity | 2 +- docs/references/management-canister.md | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/.sources/internetidentity b/.sources/internetidentity index 6eda54fa..64ba1637 160000 --- a/.sources/internetidentity +++ b/.sources/internetidentity @@ -1 +1 @@ -Subproject commit 6eda54fadafa1d4c2e05522f84fed03705459e76 +Subproject commit 64ba163788085b0606fcaa0e106d8a15ab73338b diff --git a/docs/references/management-canister.md b/docs/references/management-canister.md index 88035565..9db08607 100644 --- a/docs/references/management-canister.md +++ b/docs/references/management-canister.md @@ -159,7 +159,6 @@ Returns the history, current module hash, and controllers of any canister. Unlik - **Returns:** - `total_num_changes` (`nat64`) - `recent_changes`: list of canister changes (creation, deployment, controller changes, etc.) - - A code deployment entry records the mode (`install`, `reinstall`, or `upgrade`), the SHA-256 hash of the installed module (`module_hash`), and the SHA-256 hash of the install argument `arg` (`args_hash`; `null` for deployments recorded before the hash was introduced) - `module_hash` (`opt blob`) - `controllers` (`vec principal`) From 9777b1b072f1452cde359d65e736738f0ea0a6a3 Mon Sep 17 00:00:00 2001 From: Martin Raszyk Date: Thu, 12 Nov 2026 11:44:39 +0000 Subject: [PATCH 3/3] chore: restore the internetidentity submodule pin --- .sources/internetidentity | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.sources/internetidentity b/.sources/internetidentity index 64ba1637..6eda54fa 160000 --- a/.sources/internetidentity +++ b/.sources/internetidentity @@ -1 +1 @@ -Subproject commit 64ba163788085b0606fcaa0e106d8a15ab73338b +Subproject commit 6eda54fadafa1d4c2e05522f84fed03705459e76