m/metamask-extension
1
0
Fork 0
mirror of https://github.com/kremalicious/metamask-extension.git synced 2024-11-22 09:57:02 +01:00
Code

Add applyLavaMoat build flag (#14583)

Browse Source 
Adds a new flag, `--apply-lavamoat`, to the main build script. The flag controls whether LavaMoat is actually applied to the output of the build process. The flag defaults to `true`, but we explicitly set it to `false` in the `start` package script. Meanwhile, the `start:lavamoat` script is modified such that it applies LavaMoat to the build output in development mode, but it no longer runs the build process itself under LavaMoat as there aren't very compelling reasons to do so.

This change is motivated by the fact that development builds do not have their own dedicated LavaMoat policies, which causes development builds to fail since #14537. The downside of this change is that LavaMoat-related failures will not be detected when running `yarn start`. @kumavis has plans for fixing this problem in a future major version of the `@lavamoat` suite.
This commit is contained in:
Erik Marks 2022-04-29 15:56:30 -07:00 committed by GitHub
parent 54a89f029e
commit 73a7ce9e39
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
7 changed files with 27 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/background.html
View File

@ -6,7 +6,7 @@
<body> <body>
<script src="./globalthis.js" type="text/javascript" charset="utf-8"></script> <script src="./globalthis.js" type="text/javascript" charset="utf-8"></script>
<script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script> <script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script>
{{@if(it.useLavamoat)}} {{@if(it.applyLavaMoat)}}
<script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script> <script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script>
<script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script> <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
<script src="./policy-load.js" type="text/javascript" charset="utf-8"></script> <script src="./policy-load.js" type="text/javascript" charset="utf-8"></script>

2
app/home.html
View File

@ -12,7 +12,7 @@
<div id="popover-content"></div> <div id="popover-content"></div>
<script src="./globalthis.js" type="text/javascript" charset="utf-8"></script> <script src="./globalthis.js" type="text/javascript" charset="utf-8"></script>
<script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script> <script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script>
{{@if(it.useLavamoat)}} {{@if(it.applyLavaMoat)}}
<script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script> <script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script>
<script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script> <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
<script src="./policy-load.js" type="text/javascript" charset="utf-8"></script> <script src="./policy-load.js" type="text/javascript" charset="utf-8"></script>

2
app/notification.html
View File

@ -35,7 +35,7 @@
<div id="popover-content"></div> <div id="popover-content"></div>
<script src="./globalthis.js" type="text/javascript" charset="utf-8"></script> <script src="./globalthis.js" type="text/javascript" charset="utf-8"></script>
<script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script> <script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script>
{{@if(it.useLavamoat)}} {{@if(it.applyLavaMoat)}}
<script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script> <script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script>
<script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script> <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
<script src="./policy-load.js" type="text/javascript" charset="utf-8"></script> <script src="./policy-load.js" type="text/javascript" charset="utf-8"></script>

2
app/popup.html
View File

@ -12,7 +12,7 @@
<div id="popover-content"></div> <div id="popover-content"></div>
<script src="./globalthis.js" type="text/javascript" charset="utf-8"></script> <script src="./globalthis.js" type="text/javascript" charset="utf-8"></script>
<script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script> <script src="./sentry-install.js" type="text/javascript" charset="utf-8"></script>
{{@if(it.useLavamoat)}} {{@if(it.applyLavaMoat)}}
<script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script> <script src="./runtime-lavamoat.js" type="text/javascript" charset="utf-8"></script>
<script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script> <script src="./lockdown-more.js" type="text/javascript" charset="utf-8"></script>
<script src="./policy-load.js" type="text/javascript" charset="utf-8"></script> <script src="./policy-load.js" type="text/javascript" charset="utf-8"></script>

8
development/build/index.js
View File

@ -57,6 +57,7 @@ defineAndRunBuildTasks();
function defineAndRunBuildTasks() { function defineAndRunBuildTasks() {
const { const {
applyLavaMoat,
buildType, buildType,
entryTask, entryTask,
isLavaMoat, isLavaMoat,
@ -89,6 +90,7 @@ function defineAndRunBuildTasks() {
const styleTasks = createStyleTasks({ livereload }); const styleTasks = createStyleTasks({ livereload });
const scriptTasks = createScriptTasks({ const scriptTasks = createScriptTasks({
applyLavaMoat,
browserPlatforms, browserPlatforms,
buildType, buildType,
ignoredFiles, ignoredFiles,
@ -170,6 +172,7 @@ function defineAndRunBuildTasks() {
function parseArgv() { function parseArgv() {
const NamedArgs = { const NamedArgs = {
ApplyLavaMoat: 'apply-lavamoat',
BuildType: 'build-type', BuildType: 'build-type',
BuildVersion: 'build-version', BuildVersion: 'build-version',
LintFenceFiles: 'lint-fence-files', LintFenceFiles: 'lint-fence-files',
@ -180,6 +183,7 @@ function parseArgv() {
const argv = minimist(process.argv.slice(2), { const argv = minimist(process.argv.slice(2), {
boolean: [ boolean: [
NamedArgs.ApplyLavaMoat,
NamedArgs.LintFenceFiles, NamedArgs.LintFenceFiles,
NamedArgs.Lockdown, NamedArgs.Lockdown,
NamedArgs.PolicyOnly, NamedArgs.PolicyOnly,
@ -187,6 +191,7 @@ function parseArgv() {
], ],
string: [NamedArgs.BuildType, NamedArgs.BuildVersion], string: [NamedArgs.BuildType, NamedArgs.BuildVersion],
default: { default: {
[NamedArgs.ApplyLavaMoat]: true,
[NamedArgs.BuildType]: BuildType.main, [NamedArgs.BuildType]: BuildType.main,
[NamedArgs.BuildVersion]: '0', [NamedArgs.BuildVersion]: '0',
[NamedArgs.LintFenceFiles]: true, [NamedArgs.LintFenceFiles]: true,
@ -232,8 +237,11 @@ function parseArgv() {
const version = getVersion(buildType, buildVersion); const version = getVersion(buildType, buildVersion);
return { return {
// Should we apply LavaMoat to the build output?
applyLavaMoat: argv[NamedArgs.ApplyLavaMoat],
buildType, buildType,
entryTask, entryTask,
// Is this process running in lavamoat-node?
isLavaMoat: process.argv[0].includes('lavamoat'), isLavaMoat: process.argv[0].includes('lavamoat'),
policyOnly, policyOnly,
shouldIncludeLockdown: argv[NamedArgs.Lockdown], shouldIncludeLockdown: argv[NamedArgs.Lockdown],

21
development/build/scripts.js
View File

@ -140,6 +140,7 @@ const noopWriteStream = through.obj((_file, _fileEncoding, callback) =>
module.exports = createScriptTasks; module.exports = createScriptTasks;
function createScriptTasks({ function createScriptTasks({
applyLavaMoat,
browserPlatforms, browserPlatforms,
buildType, buildType,
ignoredFiles, ignoredFiles,
@ -180,6 +181,7 @@ function createScriptTasks({
const standardSubtask = createTask( const standardSubtask = createTask(
`${taskPrefix}:standardEntryPoints`, `${taskPrefix}:standardEntryPoints`,
createFactoredBuild({ createFactoredBuild({
applyLavaMoat,
browserPlatforms, browserPlatforms,
buildType, buildType,
devMode, devMode,
@ -343,6 +345,7 @@ function createScriptTasks({
} }
function createFactoredBuild({ function createFactoredBuild({
applyLavaMoat,
browserPlatforms, browserPlatforms,
buildType, buildType,
devMode, devMode,
@ -473,21 +476,21 @@ function createFactoredBuild({
groupSet, groupSet,
commonSet, commonSet,
browserPlatforms, browserPlatforms,
useLavamoat: true, applyLavaMoat,
}); });
renderHtmlFile({ renderHtmlFile({
htmlName: 'notification', htmlName: 'notification',
groupSet, groupSet,
commonSet, commonSet,
browserPlatforms, browserPlatforms,
useLavamoat: true, applyLavaMoat,
}); });
renderHtmlFile({ renderHtmlFile({
htmlName: 'home', htmlName: 'home',
groupSet, groupSet,
commonSet, commonSet,
browserPlatforms, browserPlatforms,
useLavamoat: true, applyLavaMoat,
}); });
break; break;
} }
@ -497,7 +500,7 @@ function createFactoredBuild({
groupSet, groupSet,
commonSet, commonSet,
browserPlatforms, browserPlatforms,
useLavamoat: true, applyLavaMoat,
}); });
break; break;
} }
@ -507,7 +510,7 @@ function createFactoredBuild({
groupSet, groupSet,
commonSet, commonSet,
browserPlatforms, browserPlatforms,
useLavamoat: false, applyLavaMoat: false,
}); });
break; break;
} }
@ -858,11 +861,11 @@ function renderHtmlFile({
groupSet, groupSet,
commonSet, commonSet,
browserPlatforms, browserPlatforms,
useLavamoat, applyLavaMoat,
}) { }) {
if (useLavamoat === undefined) { if (applyLavaMoat === undefined) {
throw new Error( throw new Error(
'build/scripts/renderHtmlFile - must specify "useLavamoat" option', 'build/scripts/renderHtmlFile - must specify "applyLavaMoat" option',
); );
} }
const htmlFilePath = `./app/${htmlName}.html`; const htmlFilePath = `./app/${htmlName}.html`;
@ -870,7 +873,7 @@ function renderHtmlFile({
const jsBundles = [...commonSet.values(), ...groupSet.values()].map( const jsBundles = [...commonSet.values(), ...groupSet.values()].map(
(label) => `./${label}.js`, (label) => `./${label}.js`,
); );
const htmlOutput = Sqrl.render(htmlTemplate, { jsBundles, useLavamoat }); const htmlOutput = Sqrl.render(htmlTemplate, { jsBundles, applyLavaMoat });
browserPlatforms.forEach((platform) => { browserPlatforms.forEach((platform) => {
const dest = `./dist/${platform}/${htmlName}.html`; const dest = `./dist/${platform}/${htmlName}.html`;
// we dont have a way of creating async events atm // we dont have a way of creating async events atm

6
package.json
View File

@ -9,11 +9,11 @@
"scripts": { "scripts": {
"setup": "yarn install && yarn setup:postinstall", "setup": "yarn install && yarn setup:postinstall",
"setup:postinstall": "yarn patch-package && yarn allow-scripts", "setup:postinstall": "yarn patch-package && yarn allow-scripts",
"start": "yarn build:dev dev", "start": "yarn build:dev --apply-lavamoat=false",
"start:lavamoat": "yarn build dev", "start:lavamoat": "yarn build:dev --apply-lavamoat=true",
"dist": "yarn build prod", "dist": "yarn build prod",
"build": "yarn lavamoat:build", "build": "yarn lavamoat:build",
"build:dev": "node development/build/index.js", "build:dev": "node development/build/index.js dev",
"start:test": "SEGMENT_HOST='https://api.segment.io' SEGMENT_WRITE_KEY='FAKE' yarn build testDev", "start:test": "SEGMENT_HOST='https://api.segment.io' SEGMENT_WRITE_KEY='FAKE' yarn build testDev",
"benchmark:chrome": "SELENIUM_BROWSER=chrome node test/e2e/benchmark.js", "benchmark:chrome": "SELENIUM_BROWSER=chrome node test/e2e/benchmark.js",
"benchmark:firefox": "SELENIUM_BROWSER=firefox node test/e2e/benchmark.js", "benchmark:firefox": "SELENIUM_BROWSER=firefox node test/e2e/benchmark.js",