Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Provide build instructions to verify bytecode #423

Closed
jonathanpdunne opened this issue Aug 30, 2022 · 5 comments
Closed

Provide build instructions to verify bytecode #423

jonathanpdunne opened this issue Aug 30, 2022 · 5 comments
Labels

Comments

@jonathanpdunne
Copy link

Hey,

This code is compiled and built for use in a few browser extensions, and the Chrome store policies these extensions have to adhere to often restrict obfuscated code.

With this, it would be useful to include instructions in this repo, with some Dockerfile or similar, on how to generate the bytes that are uploaded to the npm package at npmjs.com, so the reviewers can verify the source.

A good example of this in practice is the uBlock Origin extension, which also contains compiled WASM: https://github.com/gorhill/uBlock/blob/master/src/js/wasm/README.md)

@jacogr
Copy link
Member

jacogr commented Aug 30, 2022

CI simply executes “yarn build” and publishes that tag to npm.

The specific steps are here - https://github.com/polkadot-js/wasm/blob/master/scripts/build-wasm.sh

@jonathanpdunne
Copy link
Author

Any details on the build environment? It seems that deterministic outputs aren't a guarantee with rust, and so I haven't been able to match the bytes in the npm package by running yarn build.

@jacogr
Copy link
Member

jacogr commented Aug 30, 2022

It is non-deterministic since it is also known to add paths. However these are part of stacks, which we try to strip completely - have no looked at the raw release output in ages so there may still be some. The Rust version and wasm-bindgen versions do matter, different versions will do different things.

Rust version is set at

RUST_VER=nightly-2021-12-02

Which is then used at

https://github.com/polkadot-js/wasm/blob/master/scripts/install-build-deps.sh

(Rust/bindgen version do change at points, but it costs a lot of verification before such a change is made in terms of tests and then actual output sizes as well)

@polkadot-js-bot
Copy link

This issue has been open for 21 days with no activity and is not labelled as an enhancement. It will be closed in 7 days.

@polkadot-js-bot
Copy link

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue if you think you have a related problem or query.

@polkadot-js polkadot-js locked as resolved and limited conversation to collaborators Oct 4, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
Projects
None yet
Development

No branches or pull requests

3 participants