Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

clean up imports #4

Closed
liamsi opened this issue Jan 7, 2021 · 5 comments · Fixed by #7
Closed

clean up imports #4

liamsi opened this issue Jan 7, 2021 · 5 comments · Fixed by #7
Assignees
@evan-forbes

Comments

@liamsi
Copy link
Member

liamsi commented Jan 7, 2021

I quickly skimmed through the imports and it seems that the app imports a mixture of lazyledger-core and github.com/tendermint/tendermint.
@liamsi
Copy link
Member Author

liamsi commented Jan 7, 2021 •
edited
Loading

Actually, the replace directive should make this unnecessary.. But, we should make sure that this actually worked. One thing I've noticed with this regard is that versions of the dependency and the replace version diverge (0.34.0 vs 0.34.1):
https://github.com/lazyledger/lazyledger-app/blob/05e056d8e21e339c9460451ba9d5db560f96aaa1/go.mod#L16
https://github.com/lazyledger/lazyledger-app/blob/05e056d8e21e339c9460451ba9d5db560f96aaa1/go.mod#L26

@liamsi
Copy link
Member Author

liamsi commented Jan 7, 2021

I think that minor version glitch leads to not having the desired effect and the module used is still tendermint/tendermint instead of lazsledger/lazyledger-core.

Changing the replace to:
github.com/tendermint/tendermint v0.34.1 => github.com/lazyledger/lazyledger-core v0.0.0-20201215200419-0332760f7e24 yields:

go: github.com/lazyledger/lazyledger-app/app imports
        github.com/tendermint/tendermint/abci/types imports
        github.com/lazyledger/lazyledger-core/crypto/ed25519: github.com/lazyledger/lazyledger-core@v0.32.7: parsing go.mod:
        module declares its path as: github.com/tendermint/tendermint
                but was required as: github.com/lazyledger/lazyledger-core

I'm not sure we can use the replace directive like this.

@evan-forbes
Copy link
Member

evan-forbes commented Jan 7, 2021 •
edited
Loading

if a version or commit hash is added to the end of the lazyledger-core replace directive, it does replace, but it causes more errors (which could mean it's working!). I could swear I've used the replace directive before exactly like this, but if I can't get it to work, I'll replace directly as mentioned in #2. That's more explicit too.

@liamsi
Copy link
Member Author

liamsi commented Jan 7, 2021

Yeah, that definitely works and there I don't see any reason why not to use the "correct" imports in new code (unless we want to generate the boilerplate again; then we'd need to repeat the search&replace procedure but that that should be simple enough)

@liamsi
Copy link
Member Author

liamsi commented Jan 7, 2021 •
edited
Loading

This might mean that you have to replace the imports in the SDK fork first (#2) and update the dependency to the fork in here. Otherwise, not sure if go will be happy with two "different" types (as per the different import paths); probably not.

@evan-forbes evan-forbes self-assigned this Jan 8, 2021
@evan-forbes evan-forbes mentioned this issue Jan 9, 2021
Closed
@evan-forbes evan-forbes mentioned this issue Jan 25, 2021
Merged
rootulp added a commit that referenced this issue Mar 7, 2024
@rootulp
chore: upgrade to Go 1.22.1 (#3163)
fffabd1 
To resolve govulncheck issues like:

```
Vulnerability #2: GO-2024-2610
    Errors returned from JSON marshaling may break template escaping in
    html/template
  More info: https://pkg.go.dev/vuln/GO-2024-2610
  Standard library
    Found in: html/template@go1.22
    Fixed in: html/template@go1.22.1
    Example traces found:
Error:       #1: test/util/testnode/rpc_client.go:126:25: testnode.StartAPIServer calls api.Server.Start, which eventually calls template.Template.Execute
Error:       #2: test/util/testnode/rpc_client.go:126:25: testnode.StartAPIServer calls api.Server.Start, which eventually calls template.Template.ExecuteTemplate

Vulnerability #3: GO-2024-2600
    Incorrect forwarding of sensitive headers and cookies on HTTP redirect in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2600
  Standard library
    Found in: net/http@go1.22
    Fixed in: net/http@go1.22.1
    Example traces found:
Error:       #1: x/blobstream/client/verify.go:224:39: client.VerifyShares calls http.baseRPCClient.ProveShares, which eventually calls http.Client.Do
Error:       #2: cmd/celestia-appd/cmd/download_genesis.go:103:[23](https://github.com/celestiaorg/celestia-app/actions/runs/8169780335/job/22334531542?pr=3157#step:4:24): cmd.downloadFile calls http.Get

Vulnerability #4: GO-20[24](https://github.com/celestiaorg/celestia-app/actions/runs/8169780335/job/22334531542?pr=3157#step:4:25)-[25](https://github.com/celestiaorg/celestia-app/actions/runs/8169780335/job/22334531542?pr=3157#step:4:26)99
    Memory exhaustion in multipart form parsing in net/textproto and net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2599
  Standard library
    Found in: net/textproto@go1.22
    Fixed in: net/textproto@go1.22.1
    Example traces found:
Error:       #1: x/blobstream/client/verify.go:202:18: client.VerifyShares calls service.BaseService.Start, which eventually calls textproto.Reader.ReadLine
Error:       #2: test/e2e/util.go:25:23: e2e.keyGenerator.Generate calls io.ReadFull, which eventually calls textproto.Reader.ReadMIMEHeader

Vulnerability #5: GO-2024-2598
    Verify panics on certificates with an unknown public key algorithm in
    crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2024-2598
  Standard library
    Found in: crypto/x509@go1.22
    Fixed in: crypto/x509@go1.22.1
    Example traces found:
Error:       #1: test/e2e/util.go:25:23: e2e.keyGenerator.Generate calls io.ReadFull, which eventually calls x[50](https://github.com/celestiaorg/celestia-app/actions/runs/8169780335/job/22334531542?pr=3157#step:4:51)9.Certificate.Verify
```
ninabarbakadze pushed a commit to ninabarbakadze/celestia-app that referenced this issue Apr 2, 2024
@rootulp @ninabarbakadze
chore: upgrade to Go 1.22.1 (celestiaorg#3163)
38fd79e 
To resolve govulncheck issues like:

```
Vulnerability celestiaorg#2: GO-2024-2610
    Errors returned from JSON marshaling may break template escaping in
    html/template
  More info: https://pkg.go.dev/vuln/GO-2024-2610
  Standard library
    Found in: html/template@go1.22
    Fixed in: html/template@go1.22.1
    Example traces found:
Error:       celestiaorg#1: test/util/testnode/rpc_client.go:126:25: testnode.StartAPIServer calls api.Server.Start, which eventually calls template.Template.Execute
Error:       celestiaorg#2: test/util/testnode/rpc_client.go:126:25: testnode.StartAPIServer calls api.Server.Start, which eventually calls template.Template.ExecuteTemplate

Vulnerability celestiaorg#3: GO-2024-2600
    Incorrect forwarding of sensitive headers and cookies on HTTP redirect in
    net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2600
  Standard library
    Found in: net/http@go1.22
    Fixed in: net/http@go1.22.1
    Example traces found:
Error:       celestiaorg#1: x/blobstream/client/verify.go:224:39: client.VerifyShares calls http.baseRPCClient.ProveShares, which eventually calls http.Client.Do
Error:       celestiaorg#2: cmd/celestia-appd/cmd/download_genesis.go:103:[23](https://github.com/celestiaorg/celestia-app/actions/runs/8169780335/job/22334531542?pr=3157#step:4:24): cmd.downloadFile calls http.Get

Vulnerability celestiaorg#4: GO-20[24](https://github.com/celestiaorg/celestia-app/actions/runs/8169780335/job/22334531542?pr=3157#step:4:25)-[25](https://github.com/celestiaorg/celestia-app/actions/runs/8169780335/job/22334531542?pr=3157#step:4:26)99
    Memory exhaustion in multipart form parsing in net/textproto and net/http
  More info: https://pkg.go.dev/vuln/GO-2024-2599
  Standard library
    Found in: net/textproto@go1.22
    Fixed in: net/textproto@go1.22.1
    Example traces found:
Error:       celestiaorg#1: x/blobstream/client/verify.go:202:18: client.VerifyShares calls service.BaseService.Start, which eventually calls textproto.Reader.ReadLine
Error:       celestiaorg#2: test/e2e/util.go:25:23: e2e.keyGenerator.Generate calls io.ReadFull, which eventually calls textproto.Reader.ReadMIMEHeader

Vulnerability celestiaorg#5: GO-2024-2598
    Verify panics on certificates with an unknown public key algorithm in
    crypto/x509
  More info: https://pkg.go.dev/vuln/GO-2024-2598
  Standard library
    Found in: crypto/x509@go1.22
    Fixed in: crypto/x509@go1.22.1
    Example traces found:
Error:       celestiaorg#1: test/e2e/util.go:25:23: e2e.keyGenerator.Generate calls io.ReadFull, which eventually calls x[50](https://github.com/celestiaorg/celestia-app/actions/runs/8169780335/job/22334531542?pr=3157#step:4:51)9.Certificate.Verify
```
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@evan-forbes evan-forbes

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Update to the lazyledger packages instead of tendermint and the cosmos-sdk celestiaorg/celestia-app
2 participants
@liamsi @evan-forbes