Adding reference to Nuget package of LevelDB.Standard #935
Conversation
Codecov Report
@@ Coverage Diff @@
## master #935 +/- ##
==========================================
- Coverage 60.83% 58.46% -2.37%
==========================================
Files 195 186 -9
Lines 13333 13059 -274
==========================================
- Hits 8111 7635 -476
- Misses 5222 5424 +202
Continue to review full report at Codecov.
|
| @@ -23,6 +23,7 @@ | |||
| <ItemGroup> | |||
| <PackageReference Include="Akka" Version="1.3.11" /> | |||
| <PackageReference Include="K4os.Compression.LZ4" Version="1.1.3" /> | |||
| <PackageReference Include="LevelDB.Standard" Version="2.1.5" /> | |||
There was a problem hiding this comment.
I am scared about this, i love nugets, but this is a very humble nuget, so how could we are sure that the owner don't cheat us?
There was a problem hiding this comment.
@erikzhang , please please take a consideration about this.
There was a problem hiding this comment.
@shargon can't we "have our own"? Like "neo leveldb" in nuget?
There was a problem hiding this comment.
This is a problem.
We also have a leveldb package on nuget, but it does not currently support .NET Core.
https://www.nuget.org/packages/LevelDB.Net/
Maybe we should modify this package and use it?
There was a problem hiding this comment.
I prefer to fork it and modify it. Then will be owned by neo.
There was a problem hiding this comment.
I was able to compile leveldb from google's repo and deploy it to work with neo-cli locally. So wouldn't it make more sense to start with the google's source than any other fork of the leveldb code?
|
I have tons of issues with the current leveldb. It takes more than 1 hour for a new developer to compile and make it work properly. I think this PR is great, I wish we could add this to NEO 2, but I don't think we have the time for that. |
|
Reminder that C# can hide back doors too. Both Akka and K4os.Compression.LZ4 use unsafe code. Whatever process and policy used to monitor native dependencies like leveldb should also be used to monitor managed dependencies as well. |
|
I love the unit tests on this PR, and I'm neutral regarding leveldb. If it's system managed, or nuget managed, it doesn't add extra security in my opinion. If Neo servers are using ubuntu, with |
|
Package management is clearly NOT a security system: https://haacked.com/archive/2019/06/11/package-mwanager-security/ |
|
Hi everyone, could we fork it, check and modify it, then release a neo version finally. It's easy for us to practice by this way. And it's more simpler for users by using nuget , they don't need to install the leveldb by themselves. 😂 |
|
We are going to use RocksDB, I think. #966 😂 |
|
I will close this pr, since this change is replaced by RocksDB change. |
|
This should be migrated to a plugin when Istorage is ready |
Sure, I can reopen it or create a new PR then. |
|
I am waiting with RocksDB opened as remember, when IStorage is ready, we can move it to |
This reverts commit 7d0613f.
Here is the reference change of LevelDB and the unit test of Persistence module that related to the change.