gate-evm-tools 1.0.28 → 1.0.31

package/runtime/delivery/compiler-files.ts

@@ -0,0 +1,179 @@
+/** Confined immutable compiler/toolchain files. This is separate from the custom-code purity policy. */
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+import { pathToFileURL, fileURLToPath } from 'node:url';
+import { compilerPackagePins } from './compiler-pins';
+import { compilerDependencyPins } from './compiler-dependency-pins';
+import { semanticHash } from '../workflow/lib/canonicalData';
+export const sha256 = (bytes: string | Buffer): string => crypto.createHash('sha256').update(bytes).digest('hex');
+export function relative(root: string, file: string): string {
+  const value = path.relative(root, file).split(path.sep).join('/');
+  if (!value || value.startsWith('../') || path.isAbsolute(value)) throw new Error('Compiler file escapes project');
+  return value;
+}
+export function regular(root: string, file: string): Buffer {
+  const rel = relative(root, path.resolve(file));
+  let current = root;
+  for (const part of rel.split('/')) {
+    current = path.join(current, part);
+    const s = fs.lstatSync(current);
+    if (s.isSymbolicLink() || (current === file ? (!s.isFile() || s.nlink !== 1) : !s.isDirectory())) throw new Error('Compiler file must be confined regular data without links');
+  }
+  return fs.readFileSync(file);
+}
+export interface CompilerPackage {
+  lockLocation: string; name: string; version: string; integrity: string;
+  source: { kind: 'registry' | 'tarball'; identity: string };
+  payload: Array<{ path: string; digest: string }>; payloadDigest: string;
+}
+export interface CompilerResolution { issuer: string; specifier: string; path: string; mode: 'cjs' | 'esm-node'; }
+export class CompilerFiles {
+  readonly files = new Map<string, string>();
+  readonly packages = new Map<string, CompilerPackage>();
+  readonly resolutions: CompilerResolution[] = [];
+  readonly modules = new Map<string, string>();
+  readonly #reviewedPackages = new Set<string>();
+  readonly #compilerChildPackages = new Set<string>();
+  #ownedPackageLocation?: string;
+  readonly #lock: Record<string, any>;
+  readonly #lockDigest: string;
+  constructor(readonly root: string) {
+    const bytes = regular(root, path.join(root, 'package-lock.json'));
+    this.#lock = JSON.parse(bytes.toString('utf8'));
+    this.#lockDigest = sha256(bytes);
+    if (![2, 3].includes(this.#lock.lockfileVersion)) throw new Error('Compiler qualification requires npm package lock v2/v3');
+  }
+  read(file: string): Buffer {
+    const bytes = regular(this.root, file), name = relative(this.root, file), digest = sha256(bytes);
+    if (this.files.has(name) && this.files.get(name) !== digest) throw new Error(`Compiler input drift: ${name}`);
+    this.files.set(name, digest);
+    return bytes;
+  }
+  package(file: string, approved = false, compilerChild = false): CompilerPackage {
+    const parts = relative(this.root, file).split('/'), npm = parts.lastIndexOf('node_modules');
+    if (npm < 0 || !parts[npm + 1]) throw new Error('Unsupported compiler package location');
+    const dir = path.join(this.root, ...parts.slice(0, npm + (parts[npm + 1].startsWith('@') ? 3 : 2)));
+    const lockLocation = relative(this.root, dir);
+    const enforceChildTopology = compilerChild || this.#compilerChildPackages.has(lockLocation);
+    const enforceReviewed = approved || enforceChildTopology || this.#reviewedPackages.has(lockLocation);
+    if (!lockLocation.startsWith('node_modules/') || !/(^|\/)node_modules\/(?:@[^/]+\/)?[^/]+$/.test(lockLocation)) throw new Error('Unsupported compiler package location');
+    const metadata = JSON.parse(this.read(path.join(dir, 'package.json')).toString('utf8'));
+    const entry = this.#lock.packages?.[lockLocation];
+    if (!entry || entry.link || entry.version !== metadata.version || !/^sha512-[A-Za-z0-9+/]+={0,2}$/.test(entry.integrity)) throw new Error('Compiler package has no matching npm lock provenance');
+    const payload: CompilerPackage['payload'] = [];
+    const visit = (directory: string): void => {
+      for (const name of fs.readdirSync(directory).sort()) {
+        if (name === 'node_modules') {
+          if (enforceChildTopology && directory !== dir) throw new Error(`Unsupported compiler package internal node_modules: ${relative(this.root, path.join(directory, name))}`);
+          continue;
+        }
+        const p = path.join(directory, name), s = fs.lstatSync(p);
+        if (s.isSymbolicLink()) throw new Error('Compiler package links are unsupported');
+        if (s.isDirectory()) visit(p);
+        else payload.push({ path: relative(dir, p), digest: sha256(this.read(p)) });
+      }
+    };
+    visit(dir);
+    payload.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+    const payloadDigest = sha256(payload.map(f => `${f.path}\0${f.digest}\n`).join(''));
+    const pin = compilerPackagePins[metadata.name];
+    const dependency = compilerDependencyPins[`${metadata.name}@${metadata.version}`];
+    if ((enforceReviewed && !pin && !dependency) || (pin && (pin.version !== metadata.version || pin.integrity !== entry.integrity || pin.payloadDigest !== payloadDigest)) || (dependency && (dependency.integrity !== entry.integrity || dependency.payloadDigest !== payloadDigest))) throw new Error(`Unapproved compiler adapter package payload: ${metadata.name}`);
+    const tarball = typeof entry.resolved === 'string' && entry.resolved.startsWith('file:') && entry.resolved.endsWith('.tgz');
+    if (!tarball && (typeof entry.resolved !== 'string' || !entry.resolved.startsWith('https://registry.npmjs.org/'))) throw new Error('Unsupported compiler package source');
+    const value: CompilerPackage = { lockLocation, name: metadata.name, version: metadata.version, integrity: entry.integrity, source: { kind: tarball ? 'tarball' : 'registry', identity: entry.integrity }, payload, payloadDigest };
+    if (this.packages.has(lockLocation) && semanticHash(this.packages.get(lockLocation)) !== semanticHash(value)) throw new Error('Compiler package payload drift');
+    this.packages.set(lockLocation, value);
+    if (enforceReviewed) this.#reviewedPackages.add(lockLocation);
+    if (enforceChildTopology) this.#compilerChildPackages.add(lockLocation);
+    return value;
+  }
+  resolve(issuer: string, specifier: string, mode: CompilerResolution['mode'] = 'cjs'): string {
+    let file: string;
+    if (mode === 'cjs') file = createRequire(issuer).resolve(specifier);
+    else {
+      const result = spawnSync(process.execPath, ['--experimental-import-meta-resolve', '--input-type=module', '-e', 'process.stdout.write(import.meta.resolve(process.argv[1], process.argv[2]))', specifier, pathToFileURL(issuer).href], { encoding: 'utf8', timeout: 10000 });
+      if (result.status !== 0) throw new Error('Compiler ESM issuer resolution failed');
+      file = fileURLToPath(result.stdout);
+    }
+    this.read(file);
+    const edge = { issuer: relative(this.root, issuer), specifier, path: relative(this.root, file), mode };
+    const old = this.resolutions.find(e => e.issuer === edge.issuer && e.specifier === specifier && e.mode === mode);
+    if (old && old.path !== edge.path) throw new Error('Compiler package resolution drift');
+    if (!old) this.resolutions.push(edge);
+    return file;
+  }
+  toolchain(): void {
+    if (process.env.NODE_PATH || /--(?:conditions|loader|import|require)/.test(process.env.NODE_OPTIONS ?? '')) throw new Error('Unsupported compiler Node resolution hooks');
+    const issuer = path.join(this.root, 'package.json');
+    const hh = this.resolve(issuer, 'hardhat/builtin-tasks/compile');
+    this.package(hh, true);
+    const analyzer = this.resolve(hh, '@nomicfoundation/solidity-analyzer');
+    this.package(analyzer, true);
+    if (process.platform !== 'darwin' || !['x64', 'arm64'].includes(process.arch)) throw new Error('Compiler qualification v1 supports the reviewed macOS Solidity parser backend');
+    this.package(this.resolve(analyzer, `@nomicfoundation/solidity-analyzer-darwin-${process.arch}`), true);
+    const plugin = this.resolve(issuer, '@openzeppelin/hardhat-upgrades');
+    this.package(plugin, true);
+    const owned = this.resolve(issuer, 'gate-evm-tools/workflow');
+    const ownedPackage = this.package(owned);
+    if (ownedPackage.name !== 'gate-evm-tools' || path.join(this.root, ownedPackage.lockLocation) !== fs.realpathSync(path.resolve(__dirname, '../..'))) throw new Error('Compiler project resolves a different GateTool package');
+    this.#ownedPackageLocation = ownedPackage.lockLocation;
+    const prep = path.join(path.dirname(owned), '../core/preparation/evm.js');
+    this.read(prep);
+    const pluginCore = this.resolve(plugin, '@openzeppelin/upgrades-core');
+    const ownedCore = this.resolve(prep, '@openzeppelin/upgrades-core');
+    if (pluginCore !== ownedCore) throw new Error('Plugin and preparation resolve different OZ core');
+    this.package(pluginCore, true);
+    const namespaced = path.join(path.dirname(pluginCore), 'utils/make-namespaced.js');
+    const parser = this.resolve(namespaced, '@nomicfoundation/slang/parser', 'esm-node');
+    this.package(parser, true);
+    this.resolve(namespaced, '@nomicfoundation/slang/cst', 'esm-node');
+    const slangPackage = [...this.packages.values()].find(p => p.name === '@nomicfoundation/slang')!;
+    const component = path.join(this.root, slangPackage.lockLocation, 'wasm/generated/solidity_cargo_wasm.component.js');
+    this.read(component);
+    for (const name of ['cli', 'filesystem', 'io']) {
+      const shim = this.resolve(component, `@bytecodealliance/preview2-shim/${name}`, 'esm-node');
+      if (!shim.endsWith(`/lib/nodejs/${name}.js`)) throw new Error('Unsupported Slang shim backend');
+      this.package(shim, true);
+    }
+    const ethers = this.resolve(prep, 'ethers');
+    if (this.package(ethers).version !== '6.15.0') throw new Error('Unsupported compiler ethers adapter');
+    this.runtime();
+  }
+  runtime(): void {
+    const locations = new Set<string>();
+    for (const file of Object.keys(require.cache).sort()) {
+      if (!file.startsWith(path.join(this.root, 'node_modules') + path.sep)) continue;
+      const parts = relative(this.root, file).split('/'), npm = parts.lastIndexOf('node_modules');
+      const location = parts.slice(0, npm + (parts[npm + 1].startsWith('@') ? 3 : 2)).join('/');
+      this.modules.set(relative(this.root, file), sha256(this.read(file)));
+      if (locations.has(location)) continue;
+      locations.add(location);
+      this.package(file, location !== this.#ownedPackageLocation);
+    }
+  }
+  wrapper(): void {
+    const runner = this.resolve(path.join(this.root, 'package.json'), 'hardhat/internal/solidity/compiler/solcjs-runner.js');
+    const wrapper = this.resolve(runner, 'solc/wrapper');
+    this.package(wrapper, true, true);
+    const seen = new Set<string>();
+    const dependencies = (entry: string): void => {
+      const p = this.package(entry, true, true);
+      if (seen.has(p.lockLocation)) return;
+      seen.add(p.lockLocation);
+      const metadataFile = path.join(this.root, p.lockLocation, 'package.json');
+      const metadata = JSON.parse(this.read(metadataFile).toString('utf8'));
+      for (const name of Object.keys(metadata.dependencies ?? {}).sort()) dependencies(this.resolve(metadataFile, name));
+    };
+    dependencies(wrapper);
+  }
+  verify(): void {
+    if (sha256(regular(this.root, path.join(this.root, 'package-lock.json'))) !== this.#lockDigest) throw new Error('Compiler npm lock drift');
+    for (const name of this.files.keys()) this.read(path.join(this.root, name));
+    for (const p of [...this.packages.values()]) this.package(path.join(this.root, p.lockLocation, 'package.json'));
+    for (const e of [...this.resolutions]) this.resolve(path.join(this.root, e.issuer), e.specifier, e.mode);
+  }
+}

package/runtime/delivery/compiler-io.ts

@@ -0,0 +1,10 @@
+import { setImmediate } from 'node:timers/promises';
+
+/** Give queued socket events an event-loop turn after synchronous qualification. */
+export async function yieldCompilerIo(): Promise<void> {
+  // The first check phase can still belong to the turn that ran the blocking
+  // work. A second check phase allows an intervening poll/close phase before
+  // the caller starts its next RPC, including after validation rejects.
+  await setImmediate();
+  await setImmediate();
+}

package/runtime/delivery/compiler-pins.ts

@@ -0,0 +1,143 @@
+/** Reviewed adapter v1: npm tarball SRI + full regular-file payload, Hardhat 2.26.3/OZ 3.9.1.
+ * Provenance and compiler release identities: docs/compiler-qualification.md. */
+/** Hardhat 2.26.3 Environment instance's stock arrow-function dispatcher. */
+export const compilerDispatcherPin = '853357bcbbadb86b2d8c2c557d2c0c403c2194210f710dcd4951a6f7ce1b7a00';
+export const compilerPackagePins: Record<string, { version: string; integrity: string; payloadDigest: string }> = {
+  "hardhat": {
+    "version": "2.26.3",
+    "integrity": "sha512-gBfjbxCCEaRgMCRgTpjo1CEoJwqNPhyGMMVHYZJxoQ3LLftp2erSVf8ZF6hTQC0r2wst4NcqNmLWqMnHg1quTw==",
+    "payloadDigest": "7b066e7110c42f364ed63f9f5ef8ff60090c5c99f826e559e323836590ecc8c5"
+  },
+  "@openzeppelin/hardhat-upgrades": {
+    "version": "3.9.1",
+    "integrity": "sha512-pSDjlOnIpP+PqaJVe144dK6VVKZw2v6YQusyt0OOLiCsl+WUzfo4D0kylax7zjrOxqy41EK2ipQeIF4T+cCn2A==",
+    "payloadDigest": "6efaa5c775481b84dd02cb2638edd20dba37248830d75afac609dccee398f5d7"
+  },
+  "@openzeppelin/upgrades-core": {
+    "version": "1.44.2",
+    "integrity": "sha512-m6iorjyhPK9ow5/trNs7qsBC/SOzJCO51pvvAF2W9nOiZ1t0RtCd+rlRmRmlWTv4M33V0wzIUeamJ2BPbzgUXA==",
+    "payloadDigest": "118cb904ef9a40924cdc5910bbc1842d1e1c5f7ab7627f7ef21445751f5041ad"
+  },
+  "@nomicfoundation/slang": {
+    "version": "0.18.3",
+    "integrity": "sha512-YqAWgckqbHM0/CZxi9Nlf4hjk9wUNLC9ngWCWBiqMxPIZmzsVKYuChdlrfeBPQyvQQBoOhbx+7C1005kLVQDZQ==",
+    "payloadDigest": "792350e3ea4dd2b4030efcc9ef5703797f95265bb81a0c8f562e3a77bf691ba4"
+  },
+  "@bytecodealliance/preview2-shim": {
+    "version": "0.17.0",
+    "integrity": "sha512-JorcEwe4ud0x5BS/Ar2aQWOQoFzjq/7jcnxYXCvSMh0oRm0dQXzOA+hqLDBnOMks1LLBA7dmiLLsEBl09Yd6iQ==",
+    "payloadDigest": "3d4431e8fe7849aa66804bf7e1389242a567f18cb80a4a087781a8354b72b4ce"
+  },
+  "solc": {
+    "version": "0.8.26",
+    "integrity": "sha512-yiPQNVf5rBFHwN6SIf3TUUvVAFKcQqmSUFeq+fb6pNRCo0ZCgpYOZDi3BVoezCPIAcKrVYd/qXlBLUP9wVrZ9g==",
+    "payloadDigest": "d93df7ad9373d68db3ea80f3151006b1018de785c9868f4a9c1632953175483b"
+  }
+};
+export const compilerTaskPins: Record<string, string[]> = {
+  "compile:solidity:get-source-paths": [
+    "086f478dc6172a8ad8053f21b47637cde5ed55e76fd68f4d19b957ca2ba89356"
+  ],
+  "compile:solidity:get-source-names": [
+    "a1b8fb51de8eafdf94e28fac8ba9402e0e6e01268a07118bb1b9c30f029abce9",
+    "9583d07a487241a306f8f3664134538b3090a176a3f21deffac38351f3b67221"
+  ],
+  "compile:solidity:read-file": [
+    "06c497e650e2ea9756c97b7bcdf07af4e6afdab79dfa5c8ef4cfde223b28cb62"
+  ],
+  "compile:solidity:transform-import-name": [
+    "eeb46e33346a903a5295142468b9b918c8748b9f964368627cd50158a950d3ac"
+  ],
+  "compile:solidity:get-remappings": [
+    "5ab29645d0ebc5524704c79710e351e6614f3c24b11295103a56e294f0119573"
+  ],
+  "compile:solidity:get-dependency-graph": [
+    "142b8b2c4b9dd1c34e6ea1d24dcb9726265af6894aa2cfdcbc5edb4bb1349f13"
+  ],
+  "compile:solidity:get-compilation-job-for-file": [
+    "af067baff070447e095958318b661b346714e57484bb17ffcfb81a4591c7595a"
+  ],
+  "compile:solidity:get-compilation-jobs": [
+    "6e37478620ee2d0d89c2c0228382e1787999edab0139a9cab52c720791e11bec"
+  ],
+  "compile:solidity:filter-compilation-jobs": [
+    "57aec1d24fd364cb627a8670e011b86fdc20e1d1f845e9585cf29cc3c5cd31f2"
+  ],
+  "compile:solidity:merge-compilation-jobs": [
+    "73a12bc4c50a44b46e718c73b971535a6c24b248a7b011b56178f233bd074179"
+  ],
+  "compile:solidity:log:nothing-to-compile": [
+    "cd923538222b92fa2211362f0e3dfd0c20b5832178829977a6a7b72a789e6013"
+  ],
+  "compile:solidity:compile-jobs": [
+    "1ee8f22b61649f9811fcf9af8ce9132a104356dee9f879fd2aa281aaea528c01"
+  ],
+  "compile:solidity:get-compiler-input": [
+    "420f39d71ea452ae396841d4d7f93d70a203c3e2e2d9b2a91afcc2387fa7818a"
+  ],
+  "compile:solidity:log:download-compiler-start": [
+    "41ade995b47233c3e434a03d0f1e5b4339908666e7dcd77e9f328648163e8676"
+  ],
+  "compile:solidity:log:download-compiler-end": [
+    "fec3f324d5d069c81c63a46a9d6a9c994aad6ebd442459b87e5eb35109a9a8e2"
+  ],
+  "compile:solidity:solc:get-build": [
+    "a7a556307db18606d47b4c82a8b3bc13ada65c8a0e26fce230617174fb6c22f4"
+  ],
+  "compile:solidity:solcjs:run": [
+    "f7d76b90af9bc86193f36cd11e0c6e6b320d0cd94c8ddc40ef716a22d1f9029e"
+  ],
+  "compile:solidity:solc:run": [
+    "2edba9ced2d5f142a1e379db77d08022896b399ac928e74eccaad363102bc24d"
+  ],
+  "compile:solidity:solc:compile": [
+    "46791a0856177dd42e1d85682d62105eae1c15c6f358373eb15d98068ac75890"
+  ],
+  "compile:solidity:compile": [
+    "c463efc2c16df2d0ab5614e3ad1cf29b53c30a232d29dcc1877944ded362a65a",
+    "aac183ca411256f0a1a578f008f460defbe927e19f4862c6e872b551c933f9b9"
+  ],
+  "compile:solidity:log:compilation-errors": [
+    "e49b352308cae76605f7281db154d755fd039303eadcc8fe09ae3fe038cad9a6"
+  ],
+  "compile:solidity:check-errors": [
+    "4a38486ed8200c5a8980cf5977ab5807e3dba751c3f2f07489fd1e2a198b9bd4"
+  ],
+  "compile:solidity:emit-artifacts": [
+    "cea16b5c8b5d83acf6ba4cb12a61ba02ae18f993c91d30bd1955b78c45bec74c"
+  ],
+  "compile:solidity:get-artifact-from-compilation-output": [
+    "adbd85a710196841f3c47df3308d9830f7bc5082d2d8da4db69095b71f476033"
+  ],
+  "compile:solidity:log:run-compiler-start": [
+    "fec3f324d5d069c81c63a46a9d6a9c994aad6ebd442459b87e5eb35109a9a8e2"
+  ],
+  "compile:solidity:log:run-compiler-end": [
+    "fec3f324d5d069c81c63a46a9d6a9c994aad6ebd442459b87e5eb35109a9a8e2"
+  ],
+  "compile:solidity:compile-job": [
+    "78f2f4f12fcaa3de0f9515ba6ac65fb84bec4acaf10bbafa2968e7d019879b5a"
+  ],
+  "compile:solidity:handle-compilation-jobs-failures": [
+    "b6cd7ff81b87cf684283ca09fab9640c97c79068d02cd9083791bcede7ad7e36"
+  ],
+  "compile:solidity:get-compilation-jobs-failure-reasons": [
+    "6577690e2180fb3227783110d0e92ae29c73ee4285a4058e42c5ddcd2df392f1"
+  ],
+  "compile:solidity:log:compilation-result": [
+    "523931a59747131b3fe33ffbfc4392806105fa8771421b080e2b3e1bf9881840"
+  ],
+  "compile:solidity": [
+    "128b2e5f335c43fdd6f159f0d7d1776299dc77e861033c60343d1f4e199f4360",
+    "72e5ec9900aaff7bcfe418806af4435ab898d89cfe410ff9ad286104552595b1"
+  ],
+  "compile:remove-obsolete-artifacts": [
+    "667d90b9f9c979e59e032469cc0085051f7b17d64b5d6515e772418505fe5f6d"
+  ],
+  "compile:get-compilation-tasks": [
+    "b57661a0fbc447f92b52b4efbc01f662d3997efaf05a98428904ce292480986e"
+  ],
+  "compile": [
+    "15f0e15729272889bc69c38f59bb093c5a6b7cb4f6b1837c02a377e976f18d96"
+  ]
+};