Repository navigation
fix: drop the dependency on github.com/hyperledger/fabric - #59
Open
mbrandenburger wants to merge 2 commits into
Open
mbrandenburger wants to merge 2 commits into
mbrandenburger wants to merge 2 commits into
Conversation
stubwrapper used only util.ComputeSHA256 from Fabric, which requires github.com/hyperledger/fabric v2.1.1+incompatible. That is the newest +incompatible Fabric release, as later ones need the /v2 module path, so users of cc-tools cannot move past its known vulnerabilities. Use crypto/sha256 instead. Fabric's ComputeSHA256 is SHA-256 through its software BCCSP, which uses crypto/sha256, so GetPrivateDataHash returns the same hash. Add a test for the write-set path of GetPrivateDataHash. Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
Since the module was renamed to github.com/hyperledger-labs/cc-tools/v2, the test step looked for github.com/hyperledger-labs/cc-tools/test, which no longer exists in the module, and failed with "no required module provides package". Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cc-tools imports
github.com/hyperledger/fabricfor a single function:util.ComputeSHA256instubwrapper/stubWrapper.go. This PR replaces it withcrypto/sha256from the standard library and removes the Fabric dependency. It also fixes the CI test step, which has been failing since the module was renamed tocc-tools/v2.Why
github.com/hyperledger/fabricis the code base of the Fabric peer and orderer, not a Go library meant to be imported by chaincode. Pulling it into cc-tools adds Fabric's whole dependency tree to every chaincode that uses cc-tools.ComputeSHA256computes SHA-256 through its default software BCCSP, which usescrypto/sha256, sosha256.Sum256returns the same bytes.github.com/hyperledger/fabric v2.1.1+incompatible. That is the last+incompatibleFabric release; newer releases use the/v2and/v3module paths, so the dependency can't be raised to a patched version. Fabric v2.1.1 is affected by 6 published advisories, 5 of them high; 5 are fixed in Fabric 2.2.4 to 2.4.6.github.com/hyperledger/fabricv2.1.1 (GHSA-j96p-r523-8r3w, GHSA-vjj6-5m9f-wqjw, GHSA-9w7j-q3xw-p9vh, GHSA-72x4-cq6r-jp4p, GHSA-v9w2-543f-h69m, GHSA-48gg-32q2-4r6m), all coming in through cc-tools.Changes
stubwrapper/stubWrapper.go:GetPrivateDataHashhashes a value from the write set withsha256.Sum256instead ofutil.ComputeSHA256.go.mod/go.sum:github.com/hyperledger/fabricand the 11 modules it pulled in are gone.test/stubwrapper_test.go: a test for the write-set path ofGetPrivateDataHash, checked against the known SHA-256 of"abc". It passes both before and after this change, so the old and new code return the same hash.CI fix
The test step in
.github/workflows/go.ymlrango test github.com/hyperledger-labs/cc-tools/test. Since #57 renamed the module togithub.com/hyperledger-labs/cc-tools/v2, that package path no longer exists in the module, and the step fails with "no required module provides package github.com/hyperledger-labs/cc-tools/test". This happens onmainas well, independent of the change above; this PR is the first run of the workflow since the rename. The second commit adds/v2to the path.Testing
go build,go vetandgo test ./...pass with Go 1.27.3 and with Go 1.22.0, the version ingo.mod. The corrected CI test command passes as well, with 60.8% coverage. With this branch,github.com/hyperledger/fabricis no longer in the module graph of FPC's confidential-escrow sample.