Upgrade Internet Identity Backend Canister to 3cd91d621

Backend Canister Upgrade

This release introduces major changes in Internet Identity's authentication scheme, enabling users to keep track of devices they've used to authenticate with apps and sign those out remotely. An @icp-sdk/auth library update and documentation around this will follow shortly. Internet Identity remains backwards compatible with older library versions, this release will continue to work with existing apps that are still on older library versions.

What's Changed

_Since proposal-backend-143847_

• feat(be,fe): answer a silent re-auth without rendering anything (#4248)
• feat(be): sign a browser out from the user's own settings (#4246)
• feat(be): let an app sign its own session out (#4245)
• feat(be): record that a session is still in use (#4244)
• feat(be): mint short-lived app delegations from a session (#4265)
• feat(be): sign a session to the II frontend at sign-in (#4268)
• feat(be): cap sessions per identity (#4267)
• feat(be): store a revocable session on the account reference (#4266)
• feat(be): verify a browser's key and its announced successor (#4264)
• feat(be): register the browser a session was created from (#4242)
• feat(be): add a session record to the account reference schema (#4241)
• chore(be): retire the account counter discrepancy counter (#4318)
• chore(be): retire the account principal index backfill (#4312)

Full release notes

Wasm Verification

To build the wasm modules yourself and verify their hashes, run the following commands from the root of the Internet Identity repository:

git pull  # to ensure you have the latest changes.
git checkout 3cd91d621bb060308d04ff41155f378f1bc857cb
./scripts/verify-hash \
    --ii-hash 8a43eb4c95e7ffc5fd80435bc31aba2fd71c0a7ed7bde4ff4e8cc04876caeae7 \
    --archive-hash c3a3499c1a9b3636ebc4485a98df7ad57a130aa44959c402bc9f57f0888d53cf

Backend Argument Verification

Run the following command to verify the backend upgrade argument hash:

didc encode -d ./src/internet_identity/internet_identity.did -t '(opt InternetIdentityInit)' '(null)' | xxd -r -p | sha256sum

The output should match the argument hash.