From 15d42486c61809856cee35ae871ae8a1325b1cf3 Mon Sep 17 00:00:00 2001 From: marcello33 Date: Sun, 30 Mar 2025 09:07:03 +0200 Subject: [PATCH 1/6] bump x/net --- go.mod | 10 +++++----- go.sum | 16 ++++++++++------ 2 files changed, 15 insertions(+), 11 deletions(-) diff --git a/go.mod b/go.mod index 8b7fa0b577..b9b7cbf00e 100644 --- a/go.mod +++ b/go.mod @@ -89,11 +89,11 @@ require ( go.opentelemetry.io/otel/sdk v1.27.0 go.uber.org/automaxprocs v1.5.3 go.uber.org/goleak v1.3.0 - golang.org/x/crypto v0.31.0 + golang.org/x/crypto v0.35.0 golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 - golang.org/x/sync v0.10.0 - golang.org/x/sys v0.28.0 - golang.org/x/text v0.21.0 + golang.org/x/sync v0.11.0 + golang.org/x/sys v0.30.0 + golang.org/x/text v0.22.0 golang.org/x/time v0.5.0 golang.org/x/tools v0.22.0 google.golang.org/grpc v1.64.1 @@ -170,7 +170,7 @@ require ( github.com/tklauser/numcpus v0.6.0 // indirect github.com/xrash/smetrics v0.0.0-20240312152122-5f08fbb34913 // indirect golang.org/x/mod v0.18.0 // indirect - golang.org/x/net v0.33.0 // indirect + golang.org/x/net v0.36.0 // indirect google.golang.org/protobuf v1.34.1 gopkg.in/yaml.v2 v2.4.0 // indirect gotest.tools v2.2.0+incompatible diff --git a/go.sum b/go.sum index 5646114d2b..110a5cbe73 100644 --- a/go.sum +++ b/go.sum @@ -2984,8 +2984,9 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs= golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8= golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM= -golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U= golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= +golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs= +golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ= golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= @@ -3160,8 +3161,8 @@ golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= golang.org/x/net v0.26.0/go.mod h1:5YKkiSynbBIh3p6iOc/vibscux0x38BZDkn8sCUPxHE= -golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I= -golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4= +golang.org/x/net v0.36.0 h1:vWF2fRbw4qslQsQzgFqZff+BItCvGFQqKzKIzx1rmoA= +golang.org/x/net v0.36.0/go.mod h1:bFmbeoIPfrw4sMHNhb4J9f6+tPziuGjq7Jk/38fxi1I= golang.org/x/oauth2 v0.0.0-20170207211851-4464e7848382/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -3232,8 +3233,9 @@ golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y= golang.org/x/sync v0.5.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= -golang.org/x/sync v0.10.0 h1:3NQrjDixjgGwUOCaF8w2+VYHv0Ve/vGYSbdkTa98gmQ= golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= +golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w= +golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -3374,8 +3376,9 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA= golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc= +golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808/go.mod h1:KG1lNk5ZFNssSZLrpVb4sMXKMpGwGXOxSG3rnu2gZQQ= golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE= golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0= @@ -3426,8 +3429,9 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI= -golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo= golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ= +golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM= +golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= From 750a07e5d4390fdce7f9ce2d2d2643a69c5bc1d1 Mon Sep 17 00:00:00 2001 From: marcello33 Date: Sun, 30 Mar 2025 09:29:55 +0200 Subject: [PATCH 2/6] fixes --- accounts/usbwallet/ledger.go | 6 ++++++ trie/encoding.go | 5 +++++ 2 files changed, 11 insertions(+) diff --git a/accounts/usbwallet/ledger.go b/accounts/usbwallet/ledger.go index b54cde016a..caaed99e4a 100644 --- a/accounts/usbwallet/ledger.go +++ b/accounts/usbwallet/ledger.go @@ -512,6 +512,12 @@ func (w *ledgerDriver) ledgerSignTypedMessage(derivationPath []uint32, domainHas // APDU length | 1 byte // Optional APDU data | arbitrary func (w *ledgerDriver) ledgerExchange(opcode ledgerOpcode, p1 ledgerParam1, p2 ledgerParam2, data []byte) ([]byte, error) { + // max safe length check + const maxDataLength = 128 * 1024 * 1024 // 128 MB + if len(data) > maxDataLength { + return nil, errors.New("data too large") + } + // Construct the message payload, possibly split into multiple chunks apdu := make([]byte, 2, 7+len(data)) diff --git a/trie/encoding.go b/trie/encoding.go index 8d98f67464..cb54ad2a29 100644 --- a/trie/encoding.go +++ b/trie/encoding.go @@ -16,6 +16,8 @@ package trie +import "math" + // Trie keys are dealt with in three distinct encodings: // // KEYBYTES encoding contains the actual key and nothing else. This encoding is the @@ -104,6 +106,9 @@ func compactToHex(compact []byte) []byte { } func keybytesToHex(str []byte) []byte { + if len(str) > math.MaxInt/2 { + panic("input too large") + } l := len(str)*2 + 1 var nibbles = make([]byte, l) From bb7e6fa40bd843252400cd5d506d06686cf494fc Mon Sep 17 00:00:00 2001 From: marcello33 Date: Thu, 10 Apr 2025 10:40:33 -0700 Subject: [PATCH 3/6] ci update --- .github/workflows/ci.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 292212e609..55b1b44ee9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -110,7 +110,7 @@ jobs: - name: Test run: make test - - uses: actions/upload-artifact@v4.4.0 + - uses: PaloAltoNetworks/upload-secure-artifact@main with: name: unitTest-coverage path: cover.out @@ -161,7 +161,7 @@ jobs: - name: test-integration run: make test-integration - - uses: actions/upload-artifact@v4.4.0 + - uses: PaloAltoNetworks/upload-secure-artifact@main with: name: integrationTest-coverage path: cover.out @@ -277,7 +277,7 @@ jobs: - name: Upload logs if: always() - uses: actions/upload-artifact@v4.4.0 + - uses: PaloAltoNetworks/upload-secure-artifact@main with: name: logs_${{ github.run_id }} path: | @@ -292,11 +292,11 @@ jobs: mkdir -p ${{ github.run_id }}/matic-cli sudo mv bor ${{ github.run_id }} sudo mv matic-cli/devnet ${{ github.run_id }}/matic-cli - sudo tar czf code.tar.gz ${{ github.run_id }} + sudo tar czf code.tar.gz --exclude='.git' . ${{ github.run_id }} - name: Upload code and chain data if: always() - uses: actions/upload-artifact@v4.4.0 + - uses: PaloAltoNetworks/upload-secure-artifact@main with: name: code_${{ github.run_id }} path: code.tar.gz From 09499853a52cb6536600789802ba27604e8f0a8d Mon Sep 17 00:00:00 2001 From: marcello33 Date: Thu, 10 Apr 2025 12:48:58 -0700 Subject: [PATCH 4/6] fix path for logs --- .github/workflows/ci.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 55b1b44ee9..589734f3f4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -275,13 +275,17 @@ jobs: echo "Starting RPC Tests..." timeout 5m bash bor/integration-tests/rpc_test.sh + - name: Resolve absolute path for logs + id: pathfix + run: | + echo "ABS_LOG_PATH=$(realpath matic-cli/devnet/logs)" >> $GITHUB_ENV + - name: Upload logs if: always() - - uses: PaloAltoNetworks/upload-secure-artifact@main + uses: PaloAltoNetworks/upload-secure-artifact@main with: name: logs_${{ github.run_id }} - path: | - matic-cli/devnet/logs + path: ${{ env.ABS_LOG_PATH }} - name: Package code and chain data if: always() From 40aecb500070c3024b5a8c0d5ff46dc81afab9dc Mon Sep 17 00:00:00 2001 From: marcello33 Date: Mon, 14 Apr 2025 17:13:57 +0200 Subject: [PATCH 5/6] no warning on package code --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 589734f3f4..eb3aba1c0a 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -296,7 +296,7 @@ jobs: mkdir -p ${{ github.run_id }}/matic-cli sudo mv bor ${{ github.run_id }} sudo mv matic-cli/devnet ${{ github.run_id }}/matic-cli - sudo tar czf code.tar.gz --exclude='.git' . ${{ github.run_id }} + sudo tar --warning=no-file-changed --exclude='.git' -czf code.tar.gz ${{ github.run_id }} - name: Upload code and chain data if: always() From 7a5c8643403080e570c93f72e38cab9ccaf5dbc6 Mon Sep 17 00:00:00 2001 From: Daniel Jones <105369507+djpolygon@users.noreply.github.com> Date: Sun, 27 Apr 2025 02:22:52 -0500 Subject: [PATCH 6/6] Updating packager (#1527) --- .github/workflows/amoy_deb_profiles.yml | 2 +- .github/workflows/mainnet_deb_profiles.yml | 2 +- .github/workflows/packager_deb.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/amoy_deb_profiles.yml b/.github/workflows/amoy_deb_profiles.yml index 80b73335cf..0031a1d5c4 100644 --- a/.github/workflows/amoy_deb_profiles.yml +++ b/.github/workflows/amoy_deb_profiles.yml @@ -384,7 +384,7 @@ jobs: uses: softprops/action-gh-release@v2 with: tag_name: ${{ env.GIT_TAG }} - prerelease: true + make_latest: false files: | packaging/deb/bor-amoy-**.deb packaging/deb/bor-pbss-amoy-**.deb diff --git a/.github/workflows/mainnet_deb_profiles.yml b/.github/workflows/mainnet_deb_profiles.yml index 893e5dce80..1edf37ee78 100644 --- a/.github/workflows/mainnet_deb_profiles.yml +++ b/.github/workflows/mainnet_deb_profiles.yml @@ -394,7 +394,7 @@ jobs: uses: softprops/action-gh-release@v2 with: tag_name: ${{ env.GIT_TAG }} - prerelease: true + make_latest: false files: | packaging/deb/bor-mainnet-**.deb packaging/deb/bor-pbss-mainnet-**.deb diff --git a/.github/workflows/packager_deb.yml b/.github/workflows/packager_deb.yml index 6d178e7293..fb733cd43b 100644 --- a/.github/workflows/packager_deb.yml +++ b/.github/workflows/packager_deb.yml @@ -122,7 +122,7 @@ jobs: uses: softprops/action-gh-release@v2 with: tag_name: ${{ env.GIT_TAG }} - prerelease: true + make_latest: false files: | packaging/deb/bor**.deb packaging/deb/bor**.deb.checksum