Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add near-sdk version check for indirect dependencies #94

Open
BadConfig opened this issue Nov 14, 2022 · 0 comments
Open

add near-sdk version check for indirect dependencies #94

BadConfig opened this issue Nov 14, 2022 · 0 comments

Comments

@BadConfig
Copy link

Let's assume we have the following structure of dependency tree:

Workspace:
   Dependencies crate:
      near_sdk = 4.1
   Component crate:
      Dependencies crate
   Near bindgen: 
      Component crate,
      Dependencies crate

In this case we indirectly export near_sdk of a correct version, but running cargo near build will fail finding near_sdk.
The lookup code currently is looking only on the top-level (direct dependencies). This check itself allows us to prevent usage of incorrect version of near_sdk, and not to get sigfault if dependencies are non-consistent.

What I suggest to do is:

  • Check the resolve struct of crate generated by cargo_metadata
  • Find all near_sdk in dependency graph no matter them being direct or indirect
  • Check them all being suitable, if one of them isn't there is a change of indirect usage in the bindgen crate that may bring non-consistency.

The current near_sdk version check, is not flexible and vulnerable, if I will implement to the following scheme:

Workspace:
   Dependencies crate:
      near_sdk = 3
   Component crate:
      Dependencies crate
   Near bindgen: 
      Component crate,
      Dependencies crate
      near_sdk = 4.1

I will avoid check to panic at ABI generation and will get the non-consistent effect.

Another solution that may be combined with the previous one is to add a --no-sdk-check flag

cargo near build --no-sdk-check

This will allow for people that know what they are doing to avoid forking and patching this util if there will be any unmentioned cases for compilation.

@BadConfig BadConfig changed the title near-sdk version check for indirect dependencies add near-sdk version check for indirect dependencies Nov 14, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant