Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions .github/workflows/lint.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ concurrency:
jobs:
golangci:
name: golangci-lint
runs-on: macos-latest
runs-on: ubuntu-latest
timeout-minutes: 120
steps:
- uses: actions/setup-go@v3
Expand Down Expand Up @@ -43,6 +43,14 @@ jobs:

BUILD_TAGS=rocksdb,grocksdb_clean_link
go build -tags $BUILD_TAGS ./cmd/chain-maind
golangci-lint run --out-format=github-actions --path-prefix=./ --timeout 30m --build-tags $BUILD_TAGS
golangci-lint run --fix --out-format=github-actions --path-prefix=./ --timeout 30m --build-tags $BUILD_TAGS
# Check only if there are differences in the source code
if: steps.changed-files.outputs.any_changed == 'true'
- name: check working directory is clean
id: changes
run: |
set +e
(git diff --no-ext-diff --exit-code)
echo "changed=$?" >> $GITHUB_OUTPUT
- if: steps.changes.outputs.changed == 1
run: echo "Working directory is dirty" && exit 1
46 changes: 46 additions & 0 deletions .github/workflows/test.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
name: Tests
on:
pull_request:
push:
branches:
- master
- release/**

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true

jobs:
test-versiondb:
runs-on: ubuntu-latest
steps:
- uses: actions/setup-go@v3
with:
go-version: 1.22
check-latest: true
- uses: actions/checkout@v4
- name: Install RocksDB Dependencies
run: |
sudo apt-get update
sudo apt-get -y install -y build-essential libsnappy-dev zlib1g-dev libbz2-dev libgflags-dev liblz4-dev libzstd-dev cmake
- name: Build and Install RocksDB
run: |
git clone https://github.com/facebook/rocksdb.git
cd rocksdb
git checkout v9.2.1
mkdir build && cd build
cmake .. -DCMAKE_BUILD_TYPE=Release -DWITH_SNAPPY=ON -DWITH_LZ4=ON -DWITH_ZLIB=ON -DWITH_ZSTD=ON
sudo make -j4
sudo make install
- uses: technote-space/get-diff-action@v6.1.2
with:
PATTERNS: |
**/**.sol
**/**.go
go.mod
go.sum
- name: Test and Create Coverage Report
run: |
export COSMOS_BUILD_OPTIONS=rocksdb
make test-versiondb
if: env.GIT_DIFF
4 changes: 4 additions & 0 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,10 @@ test-sim-after-import:
@echo "Running application simulation-after-import. This may take several minutes..."
@$(BINDIR)/runsim -Jobs=4 -SimAppPkg=$(SIMAPP) -ExitOnFail 50 5 TestAppSimulationAfterImport

test-versiondb:
@echo "Running test-versiondb..."
@go test -tags "rocksdb $(test_tags)" -mod=readonly $(SIMAPP) -run TestVersionDB

###############################################################################
### Localnet ###
###############################################################################
Expand Down
4 changes: 3 additions & 1 deletion app/app.go
Original file line number Diff line number Diff line change
Expand Up @@ -193,10 +193,12 @@ var (
_ servertypes.Application = (*ChainApp)(nil)
)

// RootMultiStore this is source from https://github.com/crypto-org-chain/cosmos-sdk/blob/release/v0.50.x/store/types/store.go
type RootMultiStore interface {
storetypes.MultiStore

LoadLatestVersion() error
// LatestVersion returns the latest version in the store
LatestVersion() int64
}

// ChainApp extends an ABCI application, but with most of its parameters exported.
Expand Down
29 changes: 29 additions & 0 deletions app/versiondb_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
//go:build rocksdb
// +build rocksdb

package app_test

import (
"testing"

dbm "github.com/cosmos/cosmos-db"
"github.com/crypto-org-chain/chain-main/v4/app"

"cosmossdk.io/log"

"github.com/cosmos/cosmos-sdk/client/flags"
"github.com/cosmos/cosmos-sdk/server"
simtestutil "github.com/cosmos/cosmos-sdk/testutil/sims"
simcli "github.com/cosmos/cosmos-sdk/x/simulation/client/cli"
)

func TestVersionDB(t *testing.T) {
db := dbm.NewMemDB()

appOptions := make(simtestutil.AppOptionsMap, 0)
appOptions[flags.FlagHome] = app.DefaultNodeHome
appOptions[server.FlagInvCheckPeriod] = simcli.FlagPeriodValue
appOptions["versiondb.enable"] = true
logger := log.NewNopLogger()
_ = app.New(logger, db, nil, false, appOptions, nil...)
}
6 changes: 6 additions & 0 deletions cmd/chain-maind/app/app.go
Original file line number Diff line number Diff line change
Expand Up @@ -258,6 +258,12 @@ func initRootCmd(rootCmd *cobra.Command, encodingConfig params.EncodingConfig, b
if changeSetCmd != nil {
rootCmd.AddCommand(changeSetCmd)
}

// versiondb changeset commands
versionDBChangeSet := VersionDBChangeSetCmd()
if versionDBChangeSet != nil {
rootCmd.AddCommand(versionDBChangeSet)
}
}

// genesisCommand builds genesis-related `simd genesis` command. Users may provide application specific commands as a parameter
Expand Down
98 changes: 98 additions & 0 deletions cmd/chain-maind/app/versiondb.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,23 @@
package app

import (
"bufio"
"os"
"path/filepath"
"sort"

"github.com/cosmos/iavl"
"github.com/crypto-org-chain/chain-main/v4/app"
"github.com/crypto-org-chain/chain-main/v4/cmd/chain-maind/opendb"
versiondbclient "github.com/crypto-org-chain/cronos/versiondb/client"
"github.com/crypto-org-chain/cronos/versiondb/tsrocksdb"
"github.com/spf13/cobra"
)

const (
flagVersion = "version"
)

func ChangeSetCmd() *cobra.Command {
keys, _, _ := app.StoreKeys()
storeNames := make([]string, 0, len(keys))
Expand All @@ -26,3 +35,92 @@ func ChangeSetCmd() *cobra.Command {
AppRocksDBOptions: opendb.NewRocksdbOptions,
})
}

func VersionDBChangeSetCmd() *cobra.Command {
keys, _, _ := app.StoreKeys()
storeNames := make([]string, 0, len(keys))
for name := range keys {
storeNames = append(storeNames, name)
}
sort.Strings(storeNames)

return DumpVersionDBChangeSet(versiondbclient.Options{
DefaultStores: storeNames,
OpenReadOnlyDB: opendb.OpenReadOnlyDB,
AppRocksDBOptions: opendb.NewRocksdbOptions,
})
}

func DumpVersionDBChangeSet(opts versiondbclient.Options) *cobra.Command {
cmd := &cobra.Command{
Use: "dumpversiondb-at-version",
Short: "dump versiondb changeset at version [dir] [outDir]",
Args: cobra.ExactArgs(2),
RunE: func(cmd *cobra.Command, args []string) error {

dir := args[0]
outDir := args[1]

version, err := cmd.Flags().GetInt64(flagVersion)
if err != nil {
return err
}
versionDB, err := tsrocksdb.NewStore(dir)
if err != nil {
return err
}
if err := os.MkdirAll(outDir, os.ModePerm); err != nil {
return err
}

for _, storeKey := range opts.DefaultStores {
it, err := versionDB.IteratorAtVersion(storeKey, nil, nil, &version)
if err != nil {
return err
}
defer it.Close()

kvsFile := filepath.Join(outDir, storeKey)
fpKvs, err := createFile(kvsFile)
if err != nil {
return err
}
kvsWriter := bufio.NewWriter(fpKvs)

var pairs []*iavl.KVPair
for ; it.Valid(); it.Next() {
key := make([]byte, len(it.Key()))
copy(key, it.Key())
value := make([]byte, len(it.Value()))
copy(value, it.Value())
pair := &iavl.KVPair{Key: key, Value: value}
if len(pair.Value) == 0 {
pair.Delete = true
}
pairs = append(pairs, pair)
}
changeset := &iavl.ChangeSet{Pairs: pairs}
// https://github.com/crypto-org-chain/cronos/blob/28bc916d0903050ac30ddd79805f451bc38923d3/versiondb/client/changeset.go#L43
err = versiondbclient.WriteChangeSet(kvsWriter, version, changeset)
if err != nil {
return err
}
err = kvsWriter.Flush()
if err != nil {
return err
}
err = fpKvs.Close()
if err != nil {
return err
}
}
return nil
},
}
cmd.Flags().Int64(flagVersion, 0, "the version to dump")
return cmd
}

func createFile(name string) (*os.File, error) {
return os.OpenFile(name, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
}
4 changes: 4 additions & 0 deletions cmd/chain-maind/app/versiondb_placeholder.go
Original file line number Diff line number Diff line change
Expand Up @@ -10,3 +10,7 @@ import (
func ChangeSetCmd() *cobra.Command {
return nil
}

func VersionDBChangeSetCmd() *cobra.Command {
return nil
}
5 changes: 4 additions & 1 deletion go.mod
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ require (
cosmossdk.io/x/upgrade v0.1.4
github.com/cometbft/cometbft v0.38.17
github.com/cosmos/cosmos-db v1.1.1
github.com/cosmos/cosmos-sdk v0.50.14
github.com/cosmos/cosmos-sdk v0.50.13
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

High severity vulnerability introduced by a package you're using:
Line 24 lists a dependency (github.com/cosmos/cosmos-sdk) with a known High severity vulnerability. Fixing requires upgrading or replacing the dependency.

ℹ️ Why this matters

Affected versions of github.com/cosmos/cosmos-sdk are vulnerable to Integer Overflow or Wraparound. A malicious validator can exploit improperly handled arithmetic in the distribution module by making a crafted deposit to the validator rewards pool. This integer overflow can trigger a chain halt, resulting in a denial-of-service.

References: GHSA

To resolve this comment:
Upgrade this dependency to at least version 0.50.14 at go.mod.

💬 Ignore this finding

To ignore this, reply with:

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

You can view more details on this finding in the Semgrep AppSec Platform here.

github.com/cosmos/gogoproto v1.7.0
github.com/cosmos/ibc-go/modules/capability v1.0.1
github.com/cosmos/ibc-go/v8 v8.7.0
Expand Down Expand Up @@ -229,6 +229,9 @@ replace (
replace (
// use cosmos fork of keyring
github.com/99designs/keyring => github.com/cosmos/keyring v1.2.0

// release/chain-main/v0.50.x
github.com/cosmos/cosmos-sdk => github.com/crypto-org-chain/cosmos-sdk v0.50.6-0.20250515092613-f67eec43305b
// dgrijalva/jwt-go is deprecated and doesn't receive security updates.
// TODO: remove it: https://github.com/cosmos/cosmos-sdk/issues/13134
github.com/dgrijalva/jwt-go => github.com/golang-jwt/jwt/v4 v4.4.2
Expand Down
4 changes: 2 additions & 2 deletions go.sum
Original file line number Diff line number Diff line change
Expand Up @@ -421,8 +421,6 @@ github.com/cosmos/cosmos-db v1.1.1 h1:FezFSU37AlBC8S98NlSagL76oqBRWq/prTPvFcEJNC
github.com/cosmos/cosmos-db v1.1.1/go.mod h1:AghjcIPqdhSLP/2Z0yha5xPH3nLnskz81pBx3tcVSAw=
github.com/cosmos/cosmos-proto v1.0.0-beta.5 h1:eNcayDLpip+zVLRLYafhzLvQlSmyab+RC5W7ZfmxJLA=
github.com/cosmos/cosmos-proto v1.0.0-beta.5/go.mod h1:hQGLpiIUloJBMdQMMWb/4wRApmI9hjHH05nefC0Ojec=
github.com/cosmos/cosmos-sdk v0.50.14 h1:G8CtGHFWbExa+ZpVOVAb4kFmko/R30igsYOwyzRMtgY=
github.com/cosmos/cosmos-sdk v0.50.14/go.mod h1:hrWEFMU1eoXqLJeE6VVESpJDQH67FS1nnMrQIjO2daw=
github.com/cosmos/go-bip39 v1.0.0 h1:pcomnQdrdH22njcAatO0yWojsUnCO3y2tNoV1cb6hHY=
github.com/cosmos/go-bip39 v1.0.0/go.mod h1:RNJv0H/pOIVgxw6KS7QeX2a0Uo0aKUlfhZ4xuwvCdJw=
github.com/cosmos/gogogateway v1.2.0 h1:Ae/OivNhp8DqBi/sh2A8a1D0y638GpL3tkmLQAiKxTE=
Expand Down Expand Up @@ -455,6 +453,8 @@ github.com/creachadair/tomledit v0.0.24 h1:5Xjr25R2esu1rKCbQEmjZYlrhFkDspoAbAKb6
github.com/creachadair/tomledit v0.0.24/go.mod h1:9qHbShRWQzSCcn617cMzg4eab1vbLCOjOshAWSzWr8U=
github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
github.com/crypto-org-chain/cosmos-sdk v0.50.6-0.20250515092613-f67eec43305b h1:gIBPJumFHfzuwmdReRANQTyWQKK/Vh2LHlpKdSrlqeA=
github.com/crypto-org-chain/cosmos-sdk v0.50.6-0.20250515092613-f67eec43305b/go.mod h1:hrWEFMU1eoXqLJeE6VVESpJDQH67FS1nnMrQIjO2daw=
github.com/crypto-org-chain/cronos/memiavl v0.0.5-0.20241028093154-0f94930c27ce h1:yRF9Zsk4fzVBhBQEjkA4oE+Q3Q/Kgaj/UX4gK+xwaAs=
github.com/crypto-org-chain/cronos/memiavl v0.0.5-0.20241028093154-0f94930c27ce/go.mod h1:IyRvgFKOQPC/Qdx543PGl6WgeDOU+hWdv+xLz3stotc=
github.com/crypto-org-chain/cronos/store v0.0.5-0.20241028093154-0f94930c27ce h1:g6ltW2J6W10pp8poYCfjUwVkzHy2izh7/71EvUXRgjM=
Expand Down
5 changes: 3 additions & 2 deletions gomod2nix.toml
Original file line number Diff line number Diff line change
Expand Up @@ -153,8 +153,9 @@ schema = 3
version = "v1.0.0-beta.5"
hash = "sha256-Fy/PbsOsd6iq0Njy3DVWK6HqWsogI+MkE8QslHGWyVg="
[mod."github.com/cosmos/cosmos-sdk"]
version = "v0.50.14"
hash = "sha256-IChk3/9KRGlUFPRJvA3fFBsGkKDKImE5FSv4jRlJyFg="
version = "v0.50.6-0.20250515092613-f67eec43305b"
hash = "sha256-l+hjQshLCgptTxAxZWXAN6lZ02mjMifEHkaDmElkukg="
replaced = "github.com/crypto-org-chain/cosmos-sdk"
[mod."github.com/cosmos/go-bip39"]
version = "v1.0.0"
hash = "sha256-Qm2aC2vaS8tjtMUbHmlBSagOSqbduEEDwc51qvQaBmA="
Expand Down
Loading