Ignite cli isn't appropriate for use with sdk & ibc go

[faddat]

Summary of Bug

Despite multiple reports from myself, the ignite CLI has continued to use critically outdated versions of important software in the cosmos ecosystem. The most recent example is that it is shipping with IBC-go v2.0.3

Users should have an expectation at any templating tool that ships with the SDK and is mentioned in the read me file uses and creates templates that are ready to use and safe to use. This is not my first public or private report of this problem conservatively speaking I would say that it is my third report of this problem.

Here's an ongoing example of the trouble:

CosmosContracts/juno#207

I have written code to remove the ignite CLI from several block chains. This is mainly due to the fact that the cosmos CMD library moxie appropriate usage of the CMD folder most importantly at upgrade time.

Users of the SDK are very well aware that it is more difficult to upgrade a chain than it is to start a chain. New users tend not to be aware of this. Because they lack this awareness, they create chains using the ignite CLA without re-factoring the CMD folder and later in the Blockchain lifecycle the teams maintaining those chains experience significant pain because:

• critical libraries cannot be properly upgraded
• they're suddenly importing multiple versions of, eg: ibc-go
• they're not able to rapidly upgrade to new cosmos-sdk releases (best recent example being the tendermint 34.19 upgrade and the most recent upgrades to 44 and 45)
• they're not able to work with beta and release candidate versions of the cosmos sdk
• the only option to proceed with their work is to fork the ignite cli repository

These problems have occurred over time. I have attempted to assist with solutions. So far, any efforts that I have made in this direction have failed entirely. I am an early contributor to starport is now called the ignite CLI and I love that concept including its use of dart. But I'm faced with repeatedly removing this software from different chains. It takes me about 24 hours per chain to write and verify the code, and sometimes there are complications, meaning that it takes longer.

Version

the bug is our readme file

Steps to Reproduce

Use the templating software that we endorse, then try to upgrade to more secure versions of critical cosmos libraries.

Solution

Do not endorse templating software that locks users into a non-modular, and provably less secure way of operating.

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[aaronc]

I feel like after app wiring it should be much easier to keep things up to date, either for apps with or without ignite

[fadeev]

Responded: #12212 (comment)

[tac0turtle]

Its hard for me to form an opinion about this as im not a user. It would be nice to have the ignite team working a bit closer to the sdk team instead of seeing ignite cli look like a black box.

I will close this issue and the PR. lets work together on a path forward, there has been work from the sdk team to make the UX around developing apps easier.

[faddat]

Ignite has requested that we have these conversations in public and I kind of agree. So then the next best place would end up being the Juno repository and we just bounce it around could we maybe I’ll:

how about I try opening an issue that outlines where I think it could be useful? Maybe that’s a good starting point.

I have legitimate concerns about this tool, and the intersection of security and maintainability

[tac0turtle]

lets open a GitHub discussion on template tooling. Templating is important, no need to clog issues and prs for the time being.