B3Note v2

What v2 fixes

B3Note v1 had security and correctness problems serious enough that v2 is a rewrite:

• Notes were not private. v1 used DFINITY’s unsafe example vetKD system-API canister, whose master secret key is in its source. It also encrypted every note to the anonymous principal’s identity and gave that decryption key to any anonymous caller, while encrypted_texts() returned everyone’s ciphertext.
• Anyone could overwrite any note. edit_encrypted_text never checked ownership.
• Internet Identity users could not read their notes. They were encrypted to one identity and decrypted with another. Signing in also replaced the user’s record and lost their note list, and share links never worked for them.
• Writes were silently dropped. Updates to stable-map entries were made on copies and never written back, so the “3 tries” limit on links never applied. Writes inside query methods were discarded.
• Cleanup stopped after upgrades. Timers were not rescheduled. Expired anonymous users left their ciphertext behind forever, and add_simple_note let anyone grow an unbounded heap map.
• Other defects: fixed-size storable bounds that trapped on larger values, an off-by-one note limit, an un-awaited fetchRootKey, a hard-coded host, and an empty LICENSE file.

v2 uses the IC’s native vetKD, ic-cdk 0.20, ic-stable-structures 0.7, icp-cli, ic-reactor 4 (beta) and @icp-sdk/*.

Upgrading from v1

v2 has a new stable-memory layout, so install it as a new canister or reinstall; an in-place upgrade cannot read v1’s state. v1 notes cannot be migrated: they were encrypted with keys from an insecure demo vetKD canister (see above). scripts/migrate-mainnet.sh reinstalls v1’s mainnet canisters with v2, keeping their IDs and URL, without taking a snapshot (there is no way back to v1). Run it with an identity that controls them:

./scripts/migrate-mainnet.sh preflight          # read-only: identity, controllers, cycles (≥ 1 T)
./scripts/migrate-mainnet.sh migrate            # reinstalls backend + frontend with v2, then verifies
./scripts/migrate-mainnet.sh retire-system-api  # deletes v1's insecure vetKD canister, recovering its cycles