Operator changes in Canton 3.7.0 and 3.7.1. Graphic: CantonNews.
Two tools that operators use to repair a Canton participant or export its keys are now switched off by default. With Canton 3.7.0, released October 29, operators must explicitly enable these capabilities. Repair commands can change stored ledger state during a repair; key export can take cryptographic keys out of the system that holds them.
A change for operators
Making these tools opt-in reduces the chance that a routine setup leaves a sensitive capability available by accident. An operator who needs to carry out a repair or export a key has to review the configuration first. For a wallet user, there is no corresponding instruction to move assets.
An October 30 follow-up, Canton 3.7.1, adds a setting for keys managed by Google Cloud. It lets operators configure the waiting period between scheduling a key version for destruction and its actual destruction. The default remains 30 days.
The two October releases change operator software; MainNet activation follows a separate decision. Source: Canton 3.7.0 release notes.
Why a software release and a network upgrade have different dates
Version 3.7.0 makes protocol version 37 available in the software. A protocol version defines rules that participating systems need to agree on. Publishing code gives operators access to those rules; changing the rules used by the shared Global Synchronizer requires a coordinated upgrade.
That difference is visible in the Splice release notes: Splice 0.9.4 bundles Canton 3.6.4. The separate vote for a November 7 MainNet upgrade concerns protocol version 36. Neither is an announcement that MainNet has adopted version 37.
Another feature that needs that distinction is Hybrid Party Replication, work to support hosting the same Canton identity across nodes. The 3.7.0 notes include groundwork for describing those arrangements. They say full support will follow in a later 3.7 release.
Source: Canton 3.7.0 release notes.
