chore: Merge remote-tracking branch 'origin/master' into gno-resolver

Signed-off-by: Norman <norman@samourai.coop>

Author: n0izn0iz

.github/codecov.yml

@@ -10,19 +10,10 @@ coverage:
   round: down
   precision: 2
   status:
-    project:
+    patch: # new lines
       default:
-        target: auto
-        threshold: 5 # Let's decrease this later.
-        base: parent
-        if_no_uploads: error
-        if_not_found: success
-        if_ci_failed: error
-        only_pulls: false
-    patch:
-      default:
-        target: auto
-        threshold: 5 # Let's decrease this later.
+        target: 80
+        threshold: 10
         base: auto
         if_no_uploads: error
         if_not_found: success

.github/workflows/genesis-verify.yml

@@ -14,7 +14,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        testnet: [ "test5.gno.land" ]
+        testnet: [ ] # Currently, all active testnet deployment genesis.json are legacy
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code

.github/workflows/gh-pages.yml

@@ -1,11 +1,14 @@
 # generate Go docs and publish on gh-pages branch
 # Live at: https://gnolang.github.io/gno
-name: Go Reference Docs Deployment
+name: GitHub pages (godoc & stdlib_diff) build and deploy
 
 on:
   push:
     branches:
       - master
+  pull_request:
+    branches:
+      - master
   workflow_dispatch:
 
 permissions:
@@ -19,29 +22,39 @@ concurrency:
 
 jobs:
   build:
-    if: ${{ github.repository == 'gnolang/gno' }} # Alternatively, validate based on provided tokens and permissions.
+    if: github.repository == 'gnolang/gno' # Alternatively, validate based on provided tokens and permissions.
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v5
         with:
           go-version-file: go.mod
-      - run: echo "GOROOT=$(go env GOROOT)" >> $GITHUB_ENV
-      - run: echo $GOROOT
+      # Use the goroot at the top of the project to compare with the GnoVM
+      # stdlib, rather than the one in stdlib_diff (which may have a go.mod with
+      # a different toolchain version).
+      - run: echo "GOROOT_SAVE=$(go env GOROOT)" >> $GITHUB_ENV
       - run: "cd misc/stdlib_diff && make gen"
       - run: "cd misc/gendocs && make install gen"
       - run: "mkdir -p pages_output/stdlib_diff"
       - run: |
           cp -r misc/gendocs/godoc/* pages_output/
           cp -r misc/stdlib_diff/stdlib_diff/* pages_output/stdlib_diff/
+
+      # These two last steps will be skipped on pull requests
       - uses: actions/configure-pages@v5
         id: pages
+        if: github.event_name != 'pull_request'
+
       - uses: actions/upload-pages-artifact@v3
+        if: github.event_name != 'pull_request'
         with:
           path: ./pages_output
 
   deploy:
-    if: ${{ github.repository == 'gnolang/gno' }} # Alternatively, validate based on provided tokens and permissions.
+    if: >
+      github.repository == 'gnolang/gno' &&
+      github.ref == 'refs/heads/master' &&
+      github.event_name == 'push'
     runs-on: ubuntu-latest
     environment:
       name: github-pages

contribs/github-bot/internal/config/config.go

@@ -33,12 +33,18 @@ func Config(gh *client.GitHub) ([]AutomaticCheck, []ManualCheck) {
 	auto := []AutomaticCheck{
 		{
 			Description: "Maintainers must be able to edit this pull request ([more info](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/working-with-forks/allowing-changes-to-a-pull-request-branch-created-from-a-fork))",
-			If:          c.CreatedFromFork(),
-			Then:        r.MaintainerCanModify(),
+			If: c.And(
+				c.BaseBranch("^master$"),
+				c.CreatedFromFork(),
+			),
+			Then: r.MaintainerCanModify(),
 		},
 		{
 			Description: "Changes to 'docs' folder must be reviewed/authored by at least one devrel and one tech-staff",
-			If:          c.FileChanged(gh, "^docs/"),
+			If: c.And(
+				c.BaseBranch("^master$"),
+				c.FileChanged(gh, "^docs/"),
+			),
 			Then: r.And(
 				r.Or(
 					r.AuthorInTeam(gh, "tech-staff"),
@@ -57,7 +63,10 @@ func Config(gh *client.GitHub) ([]AutomaticCheck, []ManualCheck) {
 		},
 		{
 			Description: "Pending initial approval by a review team member, or review from tech-staff",
-			If:          c.Not(c.AuthorInTeam(gh, "tech-staff")),
+			If: c.And(
+				c.BaseBranch("^master$"),
+				c.Not(c.AuthorInTeam(gh, "tech-staff")),
+			),
 			Then: r.
 				If(r.Or(
 					r.ReviewByOrgMembers(gh).WithDesiredState(utils.ReviewStateApproved),
@@ -91,7 +100,7 @@ func Config(gh *client.GitHub) ([]AutomaticCheck, []ManualCheck) {
 		{
 			Description: "Determine if infra needs to be updated before merging",
 			If: c.And(
-				c.BaseBranch("master"),
+				c.BaseBranch("^master$"),
 				c.Or(
 					c.FileChanged(gh, `Dockerfile`),
 					c.FileChanged(gh, `^misc/deployments`),

contribs/gnodev/go.mod

@@ -79,6 +79,7 @@ require (
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/sig-0/insertion-queue v0.0.0-20241004125609-6b3ca841346b // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
+	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
 	github.com/yuin/goldmark v1.7.8 // indirect
 	github.com/yuin/goldmark-emoji v1.0.2 // indirect

contribs/gnodev/go.sum

@@ -32,6 +32,7 @@ require (
 	github.com/rs/cors v1.11.1 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/sig-0/insertion-queue v0.0.0-20241004125609-6b3ca841346b // indirect
+	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/otel v1.34.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.34.0 // indirect

contribs/gnofaucet/go.mod

@@ -36,6 +36,7 @@ require (
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/sig-0/insertion-queue v0.0.0-20241004125609-6b3ca841346b // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
+	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/zondax/hid v0.9.2 // indirect
 	github.com/zondax/ledger-go v0.14.3 // indirect
 	go.etcd.io/bbolt v1.3.11 // indirect

contribs/gnofaucet/go.sum

@@ -12,7 +12,10 @@ import (
 	"github.com/gnolang/gno/tm2/pkg/commands"
 )
 
-var errInvalidGenesisState = errors.New("invalid genesis state type")
+var (
+	errInvalidGenesisState = errors.New("invalid genesis state type")
+	errInvalidTxSignature  = errors.New("invalid tx signature")
+)
 
 type verifyCfg struct {
 	common.Cfg
@@ -60,10 +63,32 @@ func execVerify(cfg *verifyCfg, io commands.IO) error {
 		}
 
 		// Validate the initial transactions
-		for _, tx := range state.Txs {
+		for index, tx := range state.Txs {
 			if validateErr := tx.Tx.ValidateBasic(); validateErr != nil {
 				return fmt.Errorf("invalid transacton, %w", validateErr)
 			}
+
+			// Genesis txs can only be signed by 1 account.
+			// Basic tx validation ensures there is at least 1 signer
+			signer := tx.Tx.GetSignatures()[0]
+
+			// Grab the signature bytes of the tx.
+			// Genesis transactions are signed with
+			// account number and sequence set to 0
+			signBytes, err := tx.Tx.GetSignBytes(genesis.ChainID, 0, 0)
+			if err != nil {
+				return fmt.Errorf("unable to get tx signature payload, %w", err)
+			}
+
+			// Verify the signature using the public key
+			if !signer.PubKey.VerifyBytes(signBytes, signer.Signature) {
+				return fmt.Errorf(
+					"%w #%d, by signer %s",
+					errInvalidTxSignature,
+					index,
+					signer.PubKey.Address(),
+				)
+			}
 		}
 
 		// Validate the initial balances

contribs/gnogenesis/go.mod

@@ -8,8 +8,12 @@ import (
 	"github.com/gnolang/gno/gno.land/pkg/gnoland"
 	"github.com/gnolang/gno/tm2/pkg/bft/types"
 	"github.com/gnolang/gno/tm2/pkg/commands"
+	"github.com/gnolang/gno/tm2/pkg/crypto/ed25519"
 	"github.com/gnolang/gno/tm2/pkg/crypto/mock"
+	"github.com/gnolang/gno/tm2/pkg/sdk/bank"
+	"github.com/gnolang/gno/tm2/pkg/std"
 	"github.com/gnolang/gno/tm2/pkg/testutils"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
@@ -63,6 +67,99 @@ func TestGenesis_Verify(t *testing.T) {
 		require.Error(t, cmdErr)
 	})
 
+	t.Run("invalid tx signature", func(t *testing.T) {
+		t.Parallel()
+
+		g := getValidTestGenesis()
+
+		testTable := []struct {
+			name        string
+			signBytesFn func(tx *std.Tx) []byte
+		}{
+			{
+				name: "invalid chain ID",
+				signBytesFn: func(tx *std.Tx) []byte {
+					// Sign the transaction, but with a chain ID
+					// that differs from the genesis chain ID
+					signBytes, err := tx.GetSignBytes(g.ChainID+"wrong", 0, 0)
+					require.NoError(t, err)
+
+					return signBytes
+				},
+			},
+			{
+				name: "invalid account params",
+				signBytesFn: func(tx *std.Tx) []byte {
+					// Sign the transaction, but with an
+					// account number that is not 0
+					signBytes, err := tx.GetSignBytes(g.ChainID, 10, 0)
+					require.NoError(t, err)
+
+					return signBytes
+				},
+			},
+		}
+
+		for _, testCase := range testTable {
+			t.Run(testCase.name, func(t *testing.T) {
+				t.Parallel()
+
+				tempFile, cleanup := testutils.NewTestFile(t)
+				t.Cleanup(cleanup)
+
+				// Generate the transaction
+				signer := ed25519.GenPrivKey()
+
+				sendMsg := bank.MsgSend{
+					FromAddress: signer.PubKey().Address(),
+					ToAddress:   signer.PubKey().Address(),
+					Amount:      std.NewCoins(std.NewCoin("ugnot", 10)),
+				}
+
+				tx := std.Tx{
+					Msgs: []std.Msg{sendMsg},
+					Fee: std.Fee{
+						GasWanted: 1000000,
+						GasFee:    std.NewCoin("ugnot", 20),
+					},
+				}
+
+				// Sign the transaction
+				signBytes := testCase.signBytesFn(&tx)
+
+				signature, err := signer.Sign(signBytes)
+				require.NoError(t, err)
+
+				tx.Signatures = append(tx.Signatures, std.Signature{
+					PubKey:    signer.PubKey(),
+					Signature: signature,
+				})
+
+				g.AppState = gnoland.GnoGenesisState{
+					Balances: []gnoland.Balance{},
+					Txs: []gnoland.TxWithMetadata{
+						{
+							Tx: tx,
+						},
+					},
+				}
+
+				require.NoError(t, g.SaveAs(tempFile.Name()))
+
+				// Create the command
+				cmd := NewVerifyCmd(commands.NewTestIO())
+				args := []string{
+					"--genesis-path",
+					tempFile.Name(),
+				}
+
+				// Run the command
+				cmdErr := cmd.ParseAndRun(context.Background(), args)
+				assert.ErrorIs(t, cmdErr, errInvalidTxSignature)
+			})
+		}
+	})
+
 	t.Run("invalid balances", func(t *testing.T) {
 		t.Parallel()
 

contribs/gnogenesis/go.sum

@@ -23,6 +23,7 @@ require (
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/sig-0/insertion-queue v0.0.0-20241004125609-6b3ca841346b // indirect
 	github.com/stretchr/testify v1.10.0 // indirect
+	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/otel v1.34.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.34.0 // indirect

contribs/gnogenesis/internal/verify/verify.go

@@ -38,6 +38,7 @@ require (
 	github.com/sig-0/insertion-queue v0.0.0-20241004125609-6b3ca841346b // indirect
 	github.com/stretchr/testify v1.10.0 // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
+	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/zondax/hid v0.9.2 // indirect
 	github.com/zondax/ledger-go v0.14.3 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect

contribs/gnogenesis/internal/verify/verify_test.go

@@ -33,6 +33,7 @@ require (
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/sig-0/insertion-queue v0.0.0-20241004125609-6b3ca841346b // indirect
 	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
+	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	go.etcd.io/bbolt v1.3.11 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 	go.opentelemetry.io/otel v1.34.0 // indirect