Merge branch 'main' into pr/faddat/587

Author: chipshort

.circleci/config.yml

@@ -156,7 +156,7 @@ jobs:
             - v3-libwasmvm_audit-rust:1.81.0-
       - run:
           name: Install cargo-audit
-          command: cargo install --debug cargo-audit --version 0.17.6
+          command: cargo install --debug cargo-audit --version 0.21.0 --locked
       - run:
           name: Run cargo-audit
           working_directory: libwasmvm

.github/workflows/lint-go.yml

@@ -17,13 +17,13 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v4
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
         with:
-          go-version: "1.21.4"
+          go-version: "1.23.4"
           cache: false
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v3.6.0
+        uses: golangci/golangci-lint-action@v6
         with:
           # Require: The version of golangci-lint to use.
           # When `install-mode` is `binary` (default) the value can be v1.2 or v1.2.3 or `latest` to use the latest version.

README.md

@@ -28,7 +28,7 @@ library that can be used via FFI. It is compiled like this:
 # Run unit tests
 (cd libwasmvm && cargo test)
 
-# Create release build for your current system. Uses whatever default Rust
+# Create a release build for your current system. Uses whatever default Rust
 # version you have installed.
 make build-libwasmvm
 
@@ -107,11 +107,11 @@ go build -tags "nolink_libwasmvm"
 See [COMPILER_VERSIONS.md](docs/COMPILER_VERSIONS.md) for information on Go and
 Rust compiler support.
 
-The Rust implementation of the VM is compiled to a library called libwasmvm.
+The Rust implementation of the VM is compiled into a library called libwasmvm.
 This is then linked to the Go code when the final binary is built. For that
 reason not all systems supported by Go are supported by this project.
 
-Linux (tested on Ubuntu, Debian, Alpine) and macOS is supported. We are working
+Linux (tested on Ubuntu, Debian, Alpine) and macOS are supported. We are working
 on Windows support with very low priority (#288).
 
 [#288]: https://github.com/CosmWasm/wasmvm/pull/288

docs/COMPILER_VERSIONS.md

@@ -15,7 +15,7 @@ The Go version here has the following goals:
   versions reasonably wide to avoid unnecessary friction for users. I.e. just
   because Cosmos SDK now uses Go 1.19 does not mean we make 1.19 the minimal
   supported version here. However, the project should work with the latest
-  stable Go version. When the majority of our users is between 1.18 and 1.19, we
+  stable Go version. When the majority of our users are between 1.18 and 1.19, we
   can slowly remove 1.17 support by bumping the min version to 1.18.
 - Be stable enough to test Go code. We always pin the patch version to ensure CI
   runs are reproducible. Those versions will contain security issues from time
@@ -31,10 +31,10 @@ Go version locations:
 ## Rust
 
 In contrast to Go, the Rust compiler used here produces actual artifacts used
-directly by consumer projects. This are the shared .dylib, .so, .dll libraries
+directly by consumer projects. These are the shared .dylib, .so, .dll libraries
 as well as the static .a libraries. Those libwasmvm builds contain all the Rust
 code executing contracts, especially cosmwasm-vm. New Rust versions usually add
-features which are not necessarily used or needed. But we should move with the
+features that are not necessarily used or needed. But we should move with the
 ecosystem to keep the dependency tree compiling. Also new Rust versions tend to
 increase runtime speed through optimizer improvements, which never hurts.
 

docs/MIGRATING.md

@@ -27,7 +27,7 @@
 - `QueryRequest.Grpc` was added. It is similar to `QueryRequest.Stargate` but
   unlike that, it should always return protobuf encoded responses on all chains.
 - `VM.StoreCode` now returns a `uint64` containing the gas cost in CosmWasm gas
-  and takes a gas limit as argument. This was previously calculated in wasmd.
+  and takes a gas limit as an argument. This was previously calculated in wasmd.
   The change brings consistency with the other functions that cause gas usage.
 - `GoAPI` now requires an additional `ValidateAddress` function that validates
   whether the given string is a valid address. This was previously done

internal/api/lib.go

@@ -101,7 +101,7 @@ func StoreCodeUnchecked(cache Cache, wasm []byte) ([]byte, error) {
 	w := makeView(wasm)
 	defer runtime.KeepAlive(wasm)
 	errmsg := uninitializedUnmanagedVector()
-	checksum, err := C.store_code(cache.ptr, w, cbool(true), cbool(true), &errmsg)
+	checksum, err := C.store_code(cache.ptr, w, cbool(false), cbool(true), &errmsg)
 	if err != nil {
 		return nil, errorWithMessage(err, errmsg)
 	}

internal/api/lib_test.go

@@ -274,6 +274,28 @@ func TestStoreCodeUnchecked(t *testing.T) {
 	require.Equal(t, wasm, code)
 }
 
+func TestStoreCodeUncheckedWorksWithInvalidWasm(t *testing.T) {
+	cache, cleanup := withCache(t)
+	defer cleanup()
+
+	wasm, err := os.ReadFile("../../testdata/hackatom.wasm")
+	require.NoError(t, err)
+
+	// Look for "interface_version_8" in the wasm file and replace it with "interface_version_9".
+	// This makes the wasm file invalid.
+	wasm = bytes.Replace(wasm, []byte("interface_version_8"), []byte("interface_version_9"), 1)
+
+	// StoreCode should fail
+	_, err = StoreCode(cache, wasm, true)
+	require.ErrorContains(t, err, "Wasm contract has unknown interface_version_* marker export")
+
+	// StoreCodeUnchecked should not fail
+	checksum, err := StoreCodeUnchecked(cache, wasm)
+	require.NoError(t, err)
+	expectedChecksum := sha256.Sum256(wasm)
+	assert.Equal(t, expectedChecksum[:], checksum)
+}
+
 func TestPin(t *testing.T) {
 	cache, cleanup := withCache(t)
 	defer cleanup()