Extend upgrade contract from 30 to 60 days

[sisuresh]

What

Leave enough time for validators to inspect upgrades. It's important to note that the initial MAXIMUM_ENTRY_LIFETIME in core is 31 days, so that should be increased if this PR is accepted.

[dmkozh]

What will happen if we don't update the core expiration limit? Maybe we should clamp the value with ledger max expiration?

[sisuresh]

What will happen if we don't update the core expiration limit? Maybe we should clamp the value with ledger max expiration?

It'll error here -

rs-soroban-env/soroban-env-host/src/storage.rs

Line 410 in 62da7a1

if new_live_until > host.max_live_until_ledger()? {

. Clamping silently doesn't sound safe or good UX to me. If the transaction was accepted, I'd expect the lifetime to be extended to what I requested.

[dmkozh]

Clamping silently doesn't sound safe or good UX to me. If the transaction was accepted, I'd expect the lifetime to be extended to what I requested

Yeah, I recall we've decided we won't do clamping in the host function itself. But I think clamping makes sense for the contract to do in order to not be bricked (after all, lifetime extension is not critical for the contract business logic and can be updated externally). So I would probably do that here just as a best practice (or maybe bump using the network setting?). I don't have too strong opinion here though.

[sisuresh]

Clamping silently doesn't sound safe or good UX to me. If the transaction was accepted, I'd expect the lifetime to be extended to what I requested

Yeah, I recall we've decided we won't do clamping in the host function itself. But I think clamping makes sense for the contract to do in order to not be bricked (after all, lifetime extension is not critical for the contract business logic and can be updated externally). So I would probably do that here just as a best practice (or maybe bump using the network setting?). I don't have too strong opinion here though.

Ah while that isn't a bad idea, I don't think it's necessary here because we invoke this contract in a core test case with the minimum settings, so we'd find out if the contract was bricked on the env bump.