Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update release branch #306

Open
wants to merge 5 commits into
base: celo-release-v2.0
Choose a base branch
from

Conversation

piersy
Copy link

@piersy piersy commented Feb 5, 2025

Updating the release branch with these fixes and the latest version of geth from the corresponding release branch (celo-release-v2.0) in op-geth.

piersy and others added 2 commits February 4, 2025 16:40
The script was not substituting the go.mod file and the Dockerfile since the
regexes were not matching.

The regex for the Dockerfile contained '@sha256:' which perl was
interpreting as a global symbol, in order to interpret it literally we
needed to escape the '@'.

The regex for the go.mod file contained an extra space before the arrow
'go-ethereum .* => ', in a tidied go.mod file there is one space between
the package name and the arrow '=>'.

Also adds failure output so that it's easier to debug where this is
going wrong.

---------

Co-authored-by: Karl Bartel <[email protected]>
Co-authored-by: Paul Lange <[email protected]>
@piersy piersy requested a review from karlb February 5, 2025 08:58
@piersy piersy marked this pull request as draft February 5, 2025 10:25
The substitution \1 and the beginning of the image hash together created
\150 which perl interprets as the octal character code for h.

To prevent this we need to use the \${1} notation to reference captured
groups.
@piersy piersy force-pushed the piersy/update-release-branch branch from 4444de3 to de5edc2 Compare February 5, 2025 16:12
@piersy piersy requested a review from palango February 5, 2025 16:13
@piersy piersy marked this pull request as ready for review February 5, 2025 16:13
@palango
Copy link
Collaborator

palango commented Feb 5, 2025

Still some errors:

=== Errors
cmd/celo-migrate/state.go:93:33: undefined: addresses.AlfajoresAddresses
cmd/celo-migrate/state.go:94:33: undefined: addresses.BaklavaAddresses
cmd/celo-migrate/state.go:95:33: undefined: addresses.MainnetAddresses

@piersy piersy force-pushed the piersy/update-release-branch branch from de5edc2 to ffba5ac Compare February 5, 2025 16:48
Copy link

Updated dependencies detected. Learn more about Socket for GitHub ↗︎

Package New capabilities Transitives Size Publisher
pypi/[email protected] 🔁 pypi/[email protected] environment, eval, filesystem, network, shell, unsafe 0 2.14 MB Armin.Rigo, alexgaynor, fijal, ...5 more

View full report↗︎

Copy link

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSourceCI
AI-detected potential code anomaly pypi/[email protected]
  • Notes: The code contains multiple potential security risks, including unauthorized file writes, command injection, information leakage, and code injection. It should be reviewed and modified to ensure proper input validation, sanitization, and secure handling of user input. The presence of 'eval' raises concerns about the safety and security of the code.
  • Confidence: 0.80
  • Severity: 0.70
🚫

View full report↗︎

Next steps

What is an AI-detected potential code anomaly?

AI has identified unusual behaviors that may pose a security risk.

An AI system found a low-risk anomaly in this package. It may still be fine to use, but you should check that it is safe before proceeding.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@@ -138,7 +138,7 @@ func testFees(t *testing.T, cfg e2esys.SystemConfig) {

baseFeeRecipient := predeploys.BaseFeeVaultAddr
if sys.RollupConfig.IsCel2(sys.L2GenesisCfg.Timestamp) {
baseFeeRecipient = addresses.GetAddresses(cfg.L2ChainIDBig()).FeeHandler
baseFeeRecipient = addresses.FeeHandlerAddress
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this coming in? This looks like we're stepping back.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants