Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(gnomod): forbid require and find dependencies without it #3123

Open
wants to merge 42 commits into
base: master
Choose a base branch
from

Conversation

n0izn0iz
Copy link
Contributor

@n0izn0iz n0izn0iz commented Nov 14, 2024

A step towards the importer package (#2932) and future of gno.mod (#2904)

  • BREAKING CHANGE: remove require statement support from gno.mod
  • use .gno files import statements to find dependencies
  • extract package download routines in gnovm/pkg/gnopkgfetch
  • add and use a mocked rpc client that "fetch" packages from the examples dir
  • extract imports gathering utils in gnovm/pkg/gnoimports

I decided to do this first to avoid having multiple ways to resolve dependencies lying around in the codebase and causing confusion in subsequent steps

Contributors' checklist...
  • Added new tests, or not needed, or not feasible
  • Provided an example (e.g. screenshot) to aid review or the PR is self-explanatory
  • Updated the official documentation or not needed
  • No breaking changes were made, or a BREAKING CHANGE: xxx message was included in the description
  • Added references to related issues and PRs
  • Provided any useful hints for running manual tests

Signed-off-by: Norman Meier <norman@samourai.coop>
…ould be reverted)

Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
Signed-off-by: Norman Meier <norman@samourai.coop>
@github-actions github-actions bot added 🧾 package/realm Tag used for new Realms or Packages. 📦 🤖 gnovm Issues or PRs gnovm related 📦 ⛰️ gno.land Issues or PRs gno.land package related labels Nov 14, 2024

res := ctypes.ResultABCIQuery{}

finfo, err := os.Stat(target)

Check failure

Code scanning / CodeQL

Incorrect conversion between integer types High

Incorrect conversion of an integer with architecture-dependent bit size from
strconv.Atoi
to a lower bit size type uint16 without an upper bound check.
Incorrect conversion of an integer with architecture-dependent bit size from
strconv.Atoi
to a lower bit size type uint16 without an upper bound check.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wtf github

}

if finfo.IsDir() {
entries, err := os.ReadDir(target)

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression

This path depends on a [user-provided value](1). This path depends on a [user-provided value](2). This path depends on a [user-provided value](3). This path depends on a [user-provided value](4).
}
res.Response.Data = []byte(strings.Join(files, "\n"))
} else {
content, err := os.ReadFile(target)

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression

This path depends on a [user-provided value](1). This path depends on a [user-provided value](2). This path depends on a [user-provided value](3). This path depends on a [user-provided value](4).

res := ctypes.ResultABCIQuery{}

finfo, err := os.Stat(target)

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
.
This path depends on a
user-provided value
.
This path depends on a
user-provided value
.
This path depends on a
user-provided value
.
}

if finfo.IsDir() {
entries, err := os.ReadDir(target)

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
.
This path depends on a
user-provided value
.
This path depends on a
user-provided value
.
This path depends on a
user-provided value
.
}
res.Response.Data = []byte(strings.Join(files, "\n"))
} else {
content, err := os.ReadFile(target)

Check failure

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
.
This path depends on a
user-provided value
.
This path depends on a
user-provided value
.
This path depends on a
user-provided value
.
Signed-off-by: Norman Meier <norman@samourai.coop>
@n0izn0iz n0izn0iz changed the title feat(gnomod): forbid require and find imports without it feat(gnomod): forbid require and find dependencies without it Nov 14, 2024
@@ -35,6 +36,11 @@ func IsStdlib(s string) bool {
return !strings.HasPrefix(s, "gno.land/")
Copy link
Member

@moul moul Nov 14, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For your information, this will become dynamic in #2911, which will be finished soon.

I recommend waiting for #2911 to be completed and merged before making any further hardcoded changes to the domain.

Edit: I believe it's fine; the potential conflict should be easy to resolve from any direction. There's no need to wait for #2911.

@n0izn0iz n0izn0iz marked this pull request as ready for review November 14, 2024 10:13
@n0izn0iz
Copy link
Contributor Author

n0izn0iz commented Nov 14, 2024

@thehowl actually this is fully ready for review, the tests are failing due to codecov only it seems

@Kouteki Kouteki requested a review from thehowl November 14, 2024 13:34
Signed-off-by: Norman Meier <norman@samourai.coop>
Copy link

codecov bot commented Nov 14, 2024

Codecov Report

Attention: Patch coverage is 62.06897% with 99 lines in your changes missing coverage. Please review.

Project coverage is 63.68%. Comparing base (b3800b7) to head (89185f8).

Files with missing lines Patch % Lines
gnovm/pkg/gnopkgfetch/gnopkgfetch.go 51.21% 31 Missing and 9 partials ⚠️
gnovm/pkg/gnopkgfetch/gnopkgfetch_testing.go 65.62% 16 Missing and 6 partials ⚠️
gnovm/pkg/gnoimports/imports.go 65.90% 10 Missing and 5 partials ⚠️
gnovm/pkg/gnomod/file.go 14.28% 6 Missing ⚠️
gnovm/pkg/doc/dirs.go 81.48% 4 Missing and 1 partial ⚠️
gnovm/pkg/gnomod/pkg.go 73.68% 3 Missing and 2 partials ⚠️
gno.land/pkg/integration/testing_integration.go 70.00% 2 Missing and 1 partial ⚠️
gnovm/pkg/gnolang/helpers.go 0.00% 2 Missing ⚠️
gnovm/pkg/gnomod/gnomod.go 0.00% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #3123      +/-   ##
==========================================
- Coverage   63.80%   63.68%   -0.13%     
==========================================
  Files         549      552       +3     
  Lines       78833    78748      -85     
==========================================
- Hits        50301    50152     -149     
- Misses      25143    25202      +59     
- Partials     3389     3394       +5     
Flag Coverage Δ
contribs/gnodev 61.16% <ø> (ø)
contribs/gnofaucet 14.82% <ø> (ø)
gno.land 73.67% <70.00%> (-0.03%) ⬇️
gnovm 67.68% <61.75%> (-0.26%) ⬇️
misc/genstd 79.72% <ø> (ø)
tm2 62.35% <ø> (-0.04%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.


🚨 Try these New Features:

@n0izn0iz n0izn0iz marked this pull request as draft November 14, 2024 18:47
@n0izn0iz
Copy link
Contributor Author

seems some tests are failing after merging master, my bad, will fix asap

@n0izn0iz n0izn0iz marked this pull request as ready for review November 15, 2024 07:10
@n0izn0iz
Copy link
Contributor Author

fixed

@Kouteki Kouteki added the in focus Core team is prioritizing this work label Nov 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in focus Core team is prioritizing this work 📦 ⛰️ gno.land Issues or PRs gno.land package related 📦 🤖 gnovm Issues or PRs gnovm related 🧾 package/realm Tag used for new Realms or Packages.
Projects
Status: In Review
Development

Successfully merging this pull request may close these issues.

3 participants