handle replacing installations in writeCoreEval

[dckc]

What is the Problem Being Solved?

The myContractRef: publishRef(install(...)) idiom works fine for initial deployment of installations. You might think it would work to replace installations. But in recent experience, it does not, and lack of .reset() in the code below strongly suggests why the limitation.

agoric-sdk/packages/deploy-script-support/src/coreProposalBehavior.js

Lines 168 to 170 in 442f07c

	await Promise.all(
	installationEntries.map(([key, value]) => {
	produceInstallations[key].resolve(value);

Description of the Design

Add .reset().

Security Considerations

Should improve security by matching behavior better with developer expectations.

Could be a risk if any code is currently relying on the .resolve() being a no-op.

Scaling Considerations

N/A

Test Plan

A bootstrap test should suffice:

1. boot as usual
2. save the installation
3. run a core proposal to replace it
4. test that the new one is in place

cc @Chris-Hibbert

Upgrade Considerations

The coreProposalBehavior.js code is copied into each deployment, so there's no need to upgrade previous deployments.

Could be a risk if any code is currently relying on the .resolve() being a no-op.

[Chris-Hibbert]

Putting myContractRef: publishRef(install(...)) in the proposalBuilder script causes the proposal to be invoked with myContractRef bound to the installation in its options. A side-effect is that the installation is registered in the promise space in consume.installation.myContract. The bug above means that on upgrade, the installation will still be passed through in myContractRef, but the installation won't be updated in the promise space. That means that null-upgrades of these contracts would get an earlier installation.

The bug has been mitigated in several proposals by manually updating produce.installation.myContract. I see that code for auctions, vaults, and priceAggregator.

I don't see it for scaledPriceAuthority, zoe or walletFactory.

[Chris-Hibbert]

Provisioning was upgraded in U16, and did not include this fix.

[dckc]

provisioning is a plain vat, not a contract. There's no relevant installation.

And note that code has options: { provisioningRef } -- no use of the publishRef(install(...)) idiom.

walletFactory is a contract, but upgrade-wallet-factory2-proposal.js doesn't publish any new installation (handle).

[Chris-Hibbert]

For that matter, Zoe is also not a contract.