Keep feature branch for multiple contracts per account up-to-date

Makefile

@@ -284,7 +284,8 @@ docker-build-bootstrap:
 
 .PHONY: docker-build-bootstrap-transit
 docker-build-bootstrap-transit:
-	docker build -f cmd/Dockerfile --ssh default --build-arg TARGET=bootstrap/transit --target production-nocgo \
+	docker build -f cmd/Dockerfile --ssh default --build-arg TARGET=bootstrap/transit --build-arg COMMIT=$(COMMIT)  --build-arg VERSION=$(VERSION) --no-cache \
+	    --target production-transit-nocgo  \
 		-t "$(CONTAINER_REGISTRY)/bootstrap-transit:latest" -t "$(CONTAINER_REGISTRY)/bootstrap-transit:$(SHORT_COMMIT)" -t "$(CONTAINER_REGISTRY)/bootstrap-transit:$(IMAGE_TAG)" .
 
 .PHONY: docker-build-loader

access/errors.go

@@ -3,6 +3,8 @@ package access
 import (
 	"errors"
 	"fmt"
+
+	"github.com/onflow/flow-go/model/flow"
 )
 
 // ErrUnknownReferenceBlock indicates that a transaction references an unknown block.
@@ -48,3 +50,23 @@ type InvalidGasLimitError struct {
 func (e InvalidGasLimitError) Error() string {
 	return fmt.Sprintf("transaction gas limit (%d) exceeds the maximum gas limit (%d)", e.Actual, e.Maximum)
 }
+
+// InvalidAddressError indicates that a transaction references an invalid flow Address
+// in either the Authorizers or Payer field.
+type InvalidAddressError struct {
+	Address flow.Address
+}
+
+func (e InvalidAddressError) Error() string {
+	return fmt.Sprintf("invalid address: %s", e.Address)
+}
+
+// InvalidTxByteSizeError indicates that a transaction byte size exceeds the maximum.
+type InvalidTxByteSizeError struct {
+	Maximum uint64
+	Actual  uint64
+}
+
+func (e InvalidTxByteSizeError) Error() string {
+	return fmt.Sprintf("transaction byte size (%d) exceeds the maximum byte size allowed for a transaction (%d)", e.Actual, e.Maximum)
+}

access/validator.go

@@ -48,24 +48,37 @@ type TransactionValidationOptions struct {
 	AllowUnknownReferenceBlockID bool
 	MaxGasLimit                  uint64
 	CheckScriptsParse            bool
+	// MaxAddressIndex is a simple spam prevention measure. It rejects any
+	// transactions referencing an address with index newer than the specified
+	// maximum. A zero value indicates no address checking.
+	MaxAddressIndex uint64
+	MaxTxSizeLimit  uint64
 }
 
 type TransactionValidator struct {
-	blocks  Blocks
+	blocks  Blocks     // for looking up blocks to check transaction expiry
+	chain   flow.Chain // for checking validity of addresses
 	options TransactionValidationOptions
 }
 
 func NewTransactionValidator(
 	blocks Blocks,
+	chain flow.Chain,
 	options TransactionValidationOptions,
 ) *TransactionValidator {
 	return &TransactionValidator{
 		blocks:  blocks,
+		chain:   chain,
 		options: options,
 	}
 }
 
 func (v *TransactionValidator) Validate(tx *flow.TransactionBody) (err error) {
+	err = v.checkTxSizeLimit(tx)
+	if err != nil {
+		return err
+	}
+
 	err = v.checkMissingFields(tx)
 	if err != nil {
 		return err
@@ -88,6 +101,22 @@ func (v *TransactionValidator) Validate(tx *flow.TransactionBody) (err error) {
 
 	// TODO check account/payer signatures
 
+	err = v.checkAddresses(tx)
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (v *TransactionValidator) checkTxSizeLimit(tx *flow.TransactionBody) error {
+	txSize := uint64(tx.ByteSize())
+	if txSize > v.options.MaxTxSizeLimit {
+		return InvalidTxByteSizeError{
+			Actual:  txSize,
+			Maximum: v.options.MaxTxSizeLimit,
+		}
+	}
 	return nil
 }
 
@@ -175,6 +204,33 @@ func (v *TransactionValidator) checkCanBeParsed(tx *flow.TransactionBody) error
 	return nil
 }
 
+func (v *TransactionValidator) checkAddresses(tx *flow.TransactionBody) error {
+
+	for _, address := range append(tx.Authorizers, tx.Payer) {
+		// first we check objective validity, essentially whether or not this
+		// is a valid output of the address generator
+		if !v.chain.IsValid(address) {
+			return InvalidAddressError{Address: address}
+		}
+
+		// skip second check if not configured
+		if v.options.MaxAddressIndex == 0 {
+			continue
+		}
+
+		// next we check subjective validity based on the configured maximum index
+		index, err := v.chain.IndexFromAddress(address)
+		if err != nil {
+			return fmt.Errorf("could not get index for address (%s): %w", address, err)
+		}
+		if index > v.options.MaxAddressIndex {
+			return InvalidAddressError{Address: address}
+		}
+	}
+
+	return nil
+}
+
 func remove(s []string, r string) []string {
 	for i, v := range s {
 		if v == r {

cmd/Dockerfile

@@ -32,6 +32,8 @@ RUN mkdir /app
 WORKDIR /app
 
 ARG TARGET
+ARG COMMIT
+ARG VERSION
 
 COPY . .
 
@@ -76,19 +78,21 @@ COPY --from=build-debug /app/app /bin/app
 
 ENTRYPOINT ["dlv", "--listen=:2345", "--headless=true", "--api-version=2", "--accept-multiclient", "exec", "/bin/app"]
 
-FROM build-env as build-production-nocgo
+FROM build-env as build-transit-production-nocgo
 WORKDIR /app
 
 RUN --mount=type=cache,target=/go/pkg/mod \
     --mount=type=cache,target=/root/.cache/go-build \
     --mount=type=ssh \
-    GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-extldflags -static" -o ./app ./cmd/${TARGET}
+    GO111MODULE=on CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags "-extldflags -static \
+    -X 'github.com/onflow/flow-go/cmd/bootstrap/build.commit=${COMMIT}' -X  'github.com/onflow/flow-go/cmd/bootstrap/build.semver=${VERSION}'" \
+    -o ./app ./cmd/${TARGET}
 
 RUN chmod a+x /app/app
 
 ## (3) Add the statically linked binary to a distroless image
-FROM gcr.io/distroless/base as production-nocgo
+FROM gcr.io/distroless/base as production-transit-nocgo
 
-COPY --from=build-production-nocgo /app/app /bin/app
+COPY --from=build-transit-production-nocgo /app/app /bin/app
 
 ENTRYPOINT ["/bin/app"]

cmd/bootstrap/build/version.go

@@ -0,0 +1,43 @@
+// Package build contains information about the build that injected at build-time.
+//
+// To use this package, simply import it in your program, then add build
+// arguments like the following:
+//
+//   go build -ldflags "-X github.com/dapperlabs/flow-go/version.semver=v1.0.0"
+package build
+
+// Default value for build-time-injected version strings.
+const undefined = "undefined"
+
+// The following variables are injected at build-time using ldflags.
+var (
+	semver string
+	commit string
+)
+
+// Semver returns the semantic version of this build.
+func Semver() string {
+	return semver
+}
+
+// Commit returns the commit at which this build was created.
+func Commit() string {
+	return commit
+}
+
+// IsDefined determines whether a version string is defined. Inputs should
+// have been produced from this package.
+func IsDefined(v string) bool {
+	return v != undefined
+}
+
+// If any of the build-time-injected variables are empty at initialization,
+// mark them as undefined.
+func init() {
+	if len(semver) == 0 {
+		semver = undefined
+	}
+	if len(commit) == 0 {
+		commit = undefined
+	}
+}

cmd/bootstrap/cmd/keygen.go

@@ -0,0 +1,76 @@
+package cmd
+
+import (
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	model "github.com/onflow/flow-go/model/bootstrap"
+)
+
+// keygenCmd represents the key gen command
+var keygenCmd = &cobra.Command{
+	Use:   "keygen",
+	Short: "Generate Staking and Networking keys for a list of nodes",
+	Long:  `Generate Staking and Networking keys for a list of nodes provided by the flag '--config'`,
+	Run: func(cmd *cobra.Command, args []string) {
+		// check if out directory exists
+		exists, err := pathExists(flagOutdir)
+		if err != nil {
+			log.Error().Msg("could not check if directory exists")
+			return
+		}
+
+		// check if the out directory is empty or has contents
+		if exists {
+			empty, err := isEmptyDir(flagOutdir)
+			if err != nil {
+				log.Error().Msg("could not check if directory as empty")
+				return
+			}
+
+			if !empty {
+				log.Error().Msg("output directory already exists and has content. delete and try again.")
+				return
+			}
+		}
+
+		// create keys
+		log.Info().Msg("generating internal private networking and staking keys")
+		nodes := genNetworkAndStakingKeys([]model.NodeInfo{})
+		log.Info().Msg("")
+
+		// count roles
+		roleCounts := nodeCountByRole(nodes)
+		for role, count := range roleCounts {
+			log.Info().Msg(fmt.Sprintf("created keys for %d %s nodes", count, role.String()))
+		}
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(keygenCmd)
+
+	// required parameters
+	keygenCmd.Flags().
+		StringVar(&flagConfig, "config", "--node-config.json", "path to a JSON file containing multiple node configurations (Role, Address, Stake)")
+	_ = keygenCmd.MarkFlagRequired("config")
+
+}
+
+// isEmptyDir returns True if the directory contains children
+func isEmptyDir(path string) (bool, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return false, err
+	}
+	defer f.Close()
+
+	_, err = f.Readdirnames(1)
+	if err == io.EOF {
+		return true, nil
+	}
+	return false, err // Either not empty or error, suits both cases
+}

cmd/bootstrap/cmd/util.go

@@ -9,6 +9,8 @@ import (
 	"path/filepath"
 
 	"github.com/onflow/flow-go/crypto"
+	model "github.com/onflow/flow-go/model/bootstrap"
+	"github.com/onflow/flow-go/model/flow"
 	"github.com/onflow/flow-go/utils/io"
 )
 
@@ -78,3 +80,30 @@ func filesInDir(dir string) ([]string, error) {
 	})
 	return files, err
 }
+
+// pathExists
+func pathExists(path string) (bool, error) {
+	_, err := os.Stat(path)
+	if err == nil {
+		return true, nil
+	}
+	if os.IsNotExist(err) {
+		return false, nil
+	}
+	return false, err
+}
+
+func nodeCountByRole(nodes []model.NodeInfo) map[flow.Role]uint16 {
+	roleCounts := map[flow.Role]uint16{
+		flow.RoleCollection:   0,
+		flow.RoleConsensus:    0,
+		flow.RoleExecution:    0,
+		flow.RoleVerification: 0,
+		flow.RoleAccess:       0,
+	}
+	for _, node := range nodes {
+		roleCounts[node.Role] = roleCounts[node.Role] + 1
+	}
+
+	return roleCounts
+}

cmd/bootstrap/transit/main.go

@@ -19,6 +19,7 @@ import (
 	"google.golang.org/api/iterator"
 	"google.golang.org/api/option"
 
+	"github.com/onflow/flow-go/cmd/bootstrap/build"
 	"github.com/onflow/flow-go/model/bootstrap"
 	"github.com/onflow/flow-go/model/flow"
 	utilsio "github.com/onflow/flow-go/utils/io"
@@ -29,6 +30,8 @@ var (
 	FilenameTransitKeyPriv     = "transit-key.priv.%v"
 	FilenameRandomBeaconCipher = bootstrap.FilenameRandomBeaconPriv + ".%v.enc"
 	flowBucket                 string
+	commit                     = build.Commit()
+	semver                     = build.Semver()
 )
 
 const fileMode = os.FileMode(0644)
@@ -53,8 +56,9 @@ var (
 func main() {
 
 	var bootDir, keyDir, wrapID, role string
-	var pull, push, prepare bool
+	var version, pull, push, prepare bool
 
+	flag.BoolVar(&version, "v", false, "View version and commit information")
 	flag.StringVar(&bootDir, "d", "~/bootstrap", "The bootstrap directory containing your node-info files")
 	flag.StringVar(&keyDir, "t", "", "Token provided by the Flow team to access the transit server")
 	flag.BoolVar(&pull, "pull", false, "Fetch keys and metadata from the transit server")
@@ -65,6 +69,12 @@ func main() {
 	flag.StringVar(&flowBucket, "flow-bucket", "flow-genesis-bootstrap", "Storage for the transit server")
 	flag.Parse()
 
+	// always print version information
+	printVersion()
+	if version {
+		return
+	}
+
 	if role == "" {
 		flag.Usage()
 		log.Fatal("Node role must be specified")
@@ -132,6 +142,21 @@ func fetchNodeID(bootDir string) (string, error) {
 	return strings.TrimSpace(string(data)), nil
 }
 
+// Print the version and commit id
+func printVersion() {
+	// Print version/commit strings if they are known
+	if build.IsDefined(semver) {
+		fmt.Printf("Transit script Version: %s\n", semver)
+	}
+	if build.IsDefined(commit) {
+		fmt.Printf("Transit script Commit: %s\n", commit)
+	}
+	// If no version info is known print a message to indicate this.
+	if !build.IsDefined(semver) && !build.IsDefined(commit) {
+		fmt.Printf("Transit script version information unknown\n")
+	}
+}
+
 // Run the push process
 // - create transit keypair (if the role type is Consensus)
 // - upload files to GCS bucket