No fake baggage #7636

mhofman · 2023-05-08T16:11:43Z

closes: #7578
closes: #7627
closes: #7651

Best reviewed commit-by-commit

Description

This is the result of a manual audit to track down and remove places where a fake baggage is created, or at least to explicitly contain it to tests, tools and demo contracts

In particular this PR does the following:

[refactor] Rename makeBoard to makeFakeBoard. I realized after the fact this was the same as reduce psuedo baggage #7627, but is slightly more complete and passes tests
[refactor] Introduce a makeDurableZoeKit which required a baggage, and deprecate makeZoeKit (with the removed options to specify a baggage). I also introduced a new makeZoeForTest tool and wrote a shared setupZoeForTest tool that creates a fake baggage, reducing the uses of makeDurableZoeKit to this test helper and the production vat-zoe
[refactor] Removed vat-zoe implementations used in tests and use the production one instead.
[fix] Make Zoe vat upgradable by stashing buildZoe params in the baggage. Fixes Zoe is not null-upgradable #7651
[fix] Remove the quoteMint from priceAuthority's privateArgs, and unconditionally create a durable issuer kit for it.
[chore] marked the remaining usages of makeIssueKit as not for production

Security Considerations

None

Scaling Considerations

None

Documentation Considerations

None

Testing Considerations

There is a new test tool for Zoe, which should be used instead of makeZoeKit, which is now deprecated.

Because of the makeFakeBoard rename, the following PR is required to land in documentation repo:

chore: use makeFakeBoard documentation#800

#documentation-branch: mhofman/7578-fix-make-zoe

turadg · 2023-05-08T16:20:39Z

packages/deploy-script-support/test/unitTests/test-install.js

@@ -9,10 +9,15 @@ import { resolve as importMetaResolve } from 'import-meta-resolve';

 import '../../exported.js';

+// eslint-disable-next-line import/no-extraneous-dependencies


if it's a dep please include it in package.json. but I don't think it needs to be a dep…

turadg · 2023-05-08T16:23:02Z

packages/deploy-script-support/test/unitTests/test-install.js

+  const { zoeService: zoe } = makeZoeKit(
+    makeScalarBigMapStore('zoe baggage', { durable: true }),
+    fakeVatAdmin,
+  );


this is common enough that there should be a single function to do it. perhaps makeZoeKitForTest in a tools export. Then most of these changes would be four chars at the call site (and an extra import, but on a package that's already a dependency).

Moreover, Zoe's baggage should always be durable, so the caller shouldn't be allowed to pass in any MapStore.

I introduced a makeZoeForTest, makeZoeKitForTest and common setupZoeForTest, and refactored all the tests to use these new tools. Its was a big refactor, but I think it paid out!

Looks it to me!

packages/zoe/src/zoeService/installationStorage.js

turadg · 2023-05-08T16:36:39Z

packages/zoe/src/contracts/priceAggregator.js

 */
-const start = async (zcf, privateArgs) => {
+const start = async (zcf, privateArgs, baggage) => {


please leave this contract alone because it's just an example, not part of production

agoric-sdk/packages/zoe/src/contracts/priceAggregator.js

Lines 47 to 52 in bb30947

* @deprecated use fluxAggregator

*

* This contract aggregates price values from a set of oracles and provides a

* PriceAuthority for their median. This naive method is game-able and so this module

* is a stub until we complete what is now in `fluxAggregatorKit.js`.

*

It is confusing that zoe/src/contracts has examples and production contracts. We have deferred cleaning up package factoring #4645

also:

Move the Zoe contract files out of packages/zoe #1656

Reverted, and annotated contract to be notForProductionUse

turadg · 2023-05-08T16:40:42Z

packages/zoe/src/contracts/scaledPriceAuthority.js

@@ -34,9 +33,11 @@ import { makePriceAuthorityTransform } from '../contractSupport/priceAuthorityTr
 */
 export const prepare = async (
  zcf,
-  { quoteMint = makeIssuerKit('quote', AssetKind.SET).mint } = {},
+  { quoteMint: providedQuoteMint } = {},


I don't see anywhere that this privateArg is provided. I think we're better off excising the privateArgs param. Please confirm @dckc .

yes, if it were important we would/should have had a test.

@michaelfig if you know something we haven't considered, please let us know.

turadg · 2023-05-08T16:45:56Z

packages/zoe/src/contractSupport/priceAuthorityQuoteMint.js

+ * @param {import('@agoric/vat-data').Baggage} baggage
+ * @param {ERef<Mint<'set'>>} [providedQuoteMint]
+ */
+export const prepareQuoteMint = (baggage, providedQuoteMint) => {


when we drop the privateArg (see below) I think this will be better factored as a provideQuoteMint.

turadg · 2023-05-08T16:48:37Z

packages/vats/src/core/chain-behaviors.js

@@ -460,6 +460,7 @@ export const publishAgoricNames = async (
  const marshaller = E(board).getPublishingMarshaller();

  // XXX will fail upon restart, but so would the makeStoredPublishKit this is replacing
+  // XXX is that ok?


yes, there's only one production use of makeStoredPublishKit which is vote outcomes and we've elected to defer durability of governance.

Updated with comment explaining why this is ok

turadg · 2023-05-08T16:50:21Z

packages/zoe/src/contracts/mintAndSellNFT.js

@@ -29,6 +29,7 @@ import { assert } from '@agoric/assert';
 const start = zcf => {
  const { tokenName = 'token' } = zcf.getTerms();
  // Create the internal token mint
+  // makeIssuerKit fails upgrade, safe because demo only?


in this case yes

marked contract as notForProductionUse

turadg · 2023-05-08T16:51:15Z

packages/vats/src/vat-mints.js

@@ -39,6 +39,7 @@ export function buildRootObject() {
     * @param  {[AssetKind?, DisplayInfo?]} issuerArgs
     */
    makeMintAndIssuer: (issuerNameSingular, ...issuerArgs) => {
+      // makeIssuerKit fails upgrade, safe because demo only?


I'm not sure. I see this in demo and devnet configs but also

agoric-sdk/packages/vats/decentral-core-config.json

Lines 35 to 38 in bb30947

"mints": {

"sourceSpec": "@agoric/vats/src/vat-mints.js"

},

"priceAuthority": {

@michaelfig ?

decentral-core-config.json is also non-production. See the $comment at the top.

vat-mints is very much demo-only. It has the poison pill that is enforced by static analysis in a test:

import { notForProductionUse } from '@agoric/internal/src/magic-cookie-test-only.js';

agoric-sdk/packages/vats/test/test-boot-config.js

Line 143 in 09b993a

test('no test-only code is in production configs', async t => {

This notForProductionUse is pretty cool. I added it to the other zoe contracts with makeIssuerKit that are supposed to not end up in production.

gibson042

These look like nice improvements!

packages/deploy-script-support/test/unitTests/test-install.js

gibson042 · 2023-05-08T16:55:44Z

packages/inter-protocol/test/psm/setupPsm.js

-    }),
+    makeZoeKit(
+      makeScalarBigMapStore('zoe baggage', { durable: true }),
+      makeFakeVatAdmin(() => {}).admin,


Nit: we could probably clarify the purpose of this empty function by naming it something like ignoreTestContext (and likewise in packages/smart-wallet/test/supports.js).

The empty function was not needed in the first place. Gone in the refactor

mhofman · 2023-05-09T19:58:17Z

Once this is green, I will rebase and fix up the commits, and mark as ready for review.

mhofman · 2023-05-09T21:55:29Z

@turadg it looks like since I removed the optional quoteMint of the scaled price authority, the type of privateArgs becomes empty and allows assignment of an arg of type string. This would not be a problem except that your Zoe type tests use that contract to as an example, and the type checking of privateArgs now fails an expected error. This is likely a case where if we were running in strict type mode / no implicit any, it would be fine, but alas we're not. I'm not sure of the best way forward to fix that one. Is there another contract that can be used here in place?

Error: test/types.test-d.ts(50,5): error TS2578: Unused '@ts-expect-error' directive.

turadg · 2023-05-09T22:25:38Z

I'm not sure of the best way forward to fix that one.

It's there to test that the types are defined so we can just give a different invalid argument.

  E(zoe).startInstance(
    scaledPriceInstallation,
    validIssuers,
    // @ts-expect-error includes an extra term
    { ...validTerms, extra: string },
  );

turadg

LGTM. Thanks for the clean commits.

I left a separate comment on how to get types passing.

turadg · 2023-05-09T22:30:05Z

packages/vats/src/core/chain-behaviors.js

@@ -460,6 +460,8 @@ export const publishAgoricNames = async (
  const marshaller = E(board).getPublishingMarshaller();

  // XXX will fail upon restart, but so would the makeStoredPublishKit this is replacing
+  // Since we expect the bootstrap vat to be replaced instead of upgraded this should be


turadg · 2023-05-09T22:31:09Z

packages/zoe/src/contractSupport/priceAuthorityQuoteMint.js

+export const provideQuoteMint = baggage => {
+  /** @type {ERef<Mint<'set'>>} */
+  let baggageQuoteMint;
+  if (baggage.has(`quoteMintIssuerBaggage`)) {


consider a const

mhofman · 2023-05-09T22:49:14Z

It's there to test that the types are defined so we can just give a different invalid argument.

That won't do because privateArgs: object now, which means it's equivalent to any in non strict TS mode....

Chris-Hibbert

LGTM

Reveals a non-upgradability issue of Zoe

mhofman requested a review from turadg May 8, 2023 16:11

turadg reviewed May 8, 2023

View reviewed changes

gibson042 reviewed May 8, 2023

View reviewed changes

mhofman mentioned this pull request May 9, 2023

Zoe is not null-upgradable #7651

Closed

mhofman force-pushed the mhofman/7578-no-fake-baggage branch 2 times, most recently from bdb380c to caa9e77 Compare May 9, 2023 21:43

mhofman marked this pull request as ready for review May 9, 2023 21:45

mhofman requested review from turadg and Chris-Hibbert May 9, 2023 21:57

This was referenced May 9, 2023

chore(contract): use makeZoeForTest Agoric/dapp-card-store#67

Closed

chore(contract): use makeZoeForTest Agoric/dapp-otc#52

Closed

chore: use makeFakeBoard Agoric/documentation#800

Merged

turadg approved these changes May 9, 2023

View reviewed changes

mhofman force-pushed the mhofman/7578-no-fake-baggage branch 2 times, most recently from 842dde2 to 4cd1c0e Compare May 10, 2023 00:09

Chris-Hibbert approved these changes May 10, 2023

View reviewed changes

mhofman added 9 commits May 10, 2023 01:17

refactor(vats): makeFakeBoard

700ed1d

refactor(zoe): new common setup-zoe tools for tests

ff9515b

refactor(zoe): use the production vat-zoe in tests

589d645

Reveals a non-upgradability issue of Zoe

refactor(zoe): makeZoeKit requires baggage

983615b

refactor(zoe): installation storage requires baggage

7a456e0

refactor(zoe): ZCF seat manager requires baggage

bf5f965

chore: mark makeIssuerKit as notForProductionUse

2f6eff4

fix(zoe): price authority durable quote mint

91ebc26

fix(zoe): Upgradable Zoe vat

83a5ab7

mhofman added 2 commits May 10, 2023 01:17

fix(zoe): Add explicit makeDurableZoeKit

a3f9dc0

chore(zoe): fix type checks

ff38968

mhofman force-pushed the mhofman/7578-no-fake-baggage branch from 4cd1c0e to ff38968 Compare May 10, 2023 01:21

mhofman enabled auto-merge May 10, 2023 01:21

mhofman added this pull request to the merge queue May 10, 2023

Merged via the queue into master with commit c78cb4c May 10, 2023

mhofman deleted the mhofman/7578-no-fake-baggage branch May 10, 2023 02:34

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

No fake baggage #7636

No fake baggage #7636

mhofman commented May 8, 2023 •

edited

Loading

turadg May 8, 2023

turadg May 8, 2023

mhofman May 9, 2023

turadg May 9, 2023

turadg May 8, 2023

dckc May 9, 2023

mhofman May 9, 2023

turadg May 8, 2023

dckc May 9, 2023

mhofman May 9, 2023

turadg May 8, 2023

turadg May 8, 2023

mhofman May 9, 2023

turadg May 8, 2023

mhofman May 9, 2023

turadg May 8, 2023

michaelfig May 9, 2023

dckc May 9, 2023 •

edited

Loading

mhofman May 9, 2023 •

edited

Loading

gibson042 left a comment

gibson042 May 8, 2023

mhofman May 9, 2023

mhofman commented May 9, 2023

mhofman commented May 9, 2023

turadg commented May 9, 2023

turadg left a comment

turadg May 9, 2023

turadg May 9, 2023

mhofman commented May 9, 2023

Chris-Hibbert left a comment

		@@ -9,10 +9,15 @@ import { resolve as importMetaResolve } from 'import-meta-resolve';

		import '../../exported.js';

		// eslint-disable-next-line import/no-extraneous-dependencies

	* @deprecated use fluxAggregator
	*
	* This contract aggregates price values from a set of oracles and provides a
	* PriceAuthority for their median. This naive method is game-able and so this module
	* is a stub until we complete what is now in `fluxAggregatorKit.js`.
	*

	"mints": {
	"sourceSpec": "@agoric/vats/src/vat-mints.js"
	},
	"priceAuthority": {

No fake baggage #7636

No fake baggage #7636

Conversation

mhofman commented May 8, 2023 • edited Loading

Description

Security Considerations

Scaling Considerations

Documentation Considerations

Testing Considerations

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

dckc May 9, 2023 • edited Loading

Choose a reason for hiding this comment

mhofman May 9, 2023 • edited Loading

Choose a reason for hiding this comment

gibson042 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mhofman commented May 9, 2023

mhofman commented May 9, 2023

turadg commented May 9, 2023

turadg left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mhofman commented May 9, 2023

Chris-Hibbert left a comment

Choose a reason for hiding this comment

mhofman commented May 8, 2023 •

edited

Loading

dckc May 9, 2023 •

edited

Loading

mhofman May 9, 2023 •

edited

Loading