Skip to content

Latest commit

 

History

History
445 lines (436 loc) · 19.2 KB

File metadata and controls

445 lines (436 loc) · 19.2 KB

Security and Compatibility Boundaries

This package builds and verifies Sui Move packages through browser-compatible WASM artifacts. The supported public APIs compile source snapshots, run the full-artifact Move unit-test path, prepare publish or upgrade bytecode payload data, update caller-provided publication files from successful external execution results, and compare rebuilt bytecode with caller-provided reference artifacts.

The WASM artifacts are not transaction executors, wallets, RPC clients, TLS clients, filesystem scanners, signing tools, certificate validators, or general cryptographic verification engines. Caller applications provide source files, dependency snapshots, reference bytecode, and any transaction/RPC results.

Runtime Boundaries

  • Build and provenance APIs do not fetch RPC, execute transactions, sign data, choose gas, read host filesystem package roots, or validate remote TLS certificates.
  • The full artifact can run Move unit tests for the supported package snapshot path. Unit-test execution is not a substitute for production cryptographic, certificate, networking, or randomness validation.
  • Compatibility replacements are declared in scripts/compat/manifest.json. The prepared WASM build must use those declared replacements; missing overlays are build failures.
  • move-package-alt and move-package-alt-compilation are compatibility-hollow placeholders in the prepared WASM build. The supported package-manager behavior is implemented in local Rust/WASM helpers and covered by parity fixtures for selected stages.

Compat Manifest Inventory

The following JSON block is checked against scripts/compat/manifest.json by node test/integration/run.mjs security-doc.

{
  "stubTemplates": {
    "anemo": {
      "compatSource": "anemo",
      "category": "networking",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "antithesis_sdk": {
      "compatSource": "antithesis-sdk",
      "category": "test-instrumentation",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "antithesis-sdk": {
      "compatSource": "antithesis-sdk",
      "category": "test-instrumentation",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "blst": {
      "compatSource": "blst_lib",
      "category": "cryptography",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "consensus-config": {
      "compatSource": "consensus-config",
      "category": "consensus",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "consensus-types": {
      "compatSource": "consensus-types",
      "category": "consensus",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "errno": {
      "compatSource": "errno",
      "category": "host-os",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "fastcrypto-tbls": {
      "compatSource": "fastcrypto-tbls",
      "category": "cryptography",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "fastcrypto-vdf": {
      "compatSource": "fastcrypto-vdf",
      "category": "cryptography",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "fastcrypto-zkp": {
      "compatSource": "fastcrypto-zkp",
      "category": "cryptography",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "fs4": {
      "compatSource": "fs4",
      "category": "filesystem-locking",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "getrandom": {
      "compatSource": "getrandom",
      "category": "randomness",
      "reachability": "linked by dependencies; supported public APIs must not rely on cryptographic randomness",
      "behavior": "returns zero-filled randomness values if called"
    },
    "move-package-alt": {
      "compatSource": "move-package-alt",
      "category": "package-manager-placeholder",
      "reachability": "not called by sui-move-wasm runtime package-manager path",
      "behavior": "placeholder exposes only the minimal Vanilla flavor shape used for compilation"
    },
    "move-package-alt-compilation": {
      "compatSource": "move-package-alt-compilation",
      "category": "build-plan-placeholder",
      "reachability": "not called by sui-move-wasm runtime package-manager path",
      "behavior": "placeholder BuildConfig method returns an error if called"
    },
    "mysten-metrics": {
      "compatSource": "mysten-metrics",
      "category": "metrics",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "mysten-network": {
      "compatSource": "mysten-network",
      "category": "networking",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "neptune": {
      "compatSource": "neptune_lib",
      "category": "cryptography",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "neptune-cash": {
      "compatSource": "neptune_lib",
      "category": "cryptography",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "neptune-triton": {
      "compatSource": "neptune_lib",
      "category": "cryptography",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "rustix": {
      "compatSource": "rustix",
      "category": "host-os",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "secp256k1": {
      "compatSource": "secp256k1_lib",
      "category": "cryptography",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "stacker": {
      "compatSource": "stacker",
      "category": "host-stack",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "sui-rpc": {
      "compatSource": "sui-rpc",
      "category": "rpc-networking",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "tonic": {
      "compatSource": "tonic",
      "category": "networking",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "x509-parser": {
      "compatSource": "x509-parser",
      "category": "x509-tls",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    },
    "zstd": {
      "compatSource": "zstd",
      "category": "compression",
      "reachability": "not part of supported public build/provenance side effects",
      "behavior": "compatibility replacement declared by manifest; see scripts/compat source for exact symbols"
    }
  },
  "filePatches": {
    "fastcryptoRistretto255Mod": {
      "compatFile": "fastcrypto_ristretto255_mod.rs",
      "category": "cryptography",
      "reachability": "only when the linked upstream crate calls this patched module",
      "behavior": "WASM-compatible patched source replaces the upstream module"
    },
    "fastcryptoSecp256r1Mod": {
      "compatFile": "fastcrypto_secp256r1_mod.rs",
      "category": "cryptography",
      "reachability": "only when the linked upstream crate calls this patched module",
      "behavior": "WASM-compatible patched source replaces the upstream module"
    },
    "moveUnitTestRunner": {
      "compatFile": "move_unit_test_runner_patch.rs",
      "category": "unit-test-runner",
      "reachability": "full artifact test runner path",
      "behavior": "uses deterministic WASM-safe runner behavior"
    },
    "nitroAttestation": {
      "compatFile": "nitro_attestation.rs",
      "category": "native-attestation",
      "reachability": "only when the linked upstream crate calls this patched module",
      "behavior": "native returns a not-supported error code"
    },
    "rangeproofs": {
      "compatFile": "rangeproofs.rs",
      "category": "cryptography",
      "reachability": "only when the linked upstream crate calls this patched module",
      "behavior": "native returns a not-supported error code"
    }
  },
  "emptyStubCrates": {
    "anstream": {
      "category": "terminal-output",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "anstyle": {
      "category": "terminal-output",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "anstyle-parse": {
      "category": "terminal-output",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "anstyle-query": {
      "category": "terminal-output",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "axum": {
      "category": "networking-runtime",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "blstrs": {
      "category": "cryptography",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "colorchoice": {
      "category": "terminal-output",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "named-lock": {
      "category": "filesystem-locking",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "nitro-attestation": {
      "category": "native-attestation",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "nitro-attestation-sys": {
      "category": "native-attestation",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "psm": {
      "category": "host-process",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "rustls": {
      "category": "tls-x509",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "rusty-fork": {
      "category": "host-process",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-analytics-indexer": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-benchmark": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-faucet": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-graphql-e2e-tests": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-graphql-rpc": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-alt": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-alt-consistent-api": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-alt-consistent-store": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-alt-e2e-tests": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-alt-framework-store-traits": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-alt-graphql": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-alt-jsonrpc": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-alt-metrics": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-alt-object-store": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-alt-reader": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-alt-restorer": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-indexer-builder": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-surfer": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "sui-tls": {
      "category": "tls-x509",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "suins-indexer": {
      "category": "rpc-indexer-or-service",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "terminal_size": {
      "category": "terminal-output",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "tokio-postgres-rustls": {
      "category": "tls-x509",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "tokio-stream": {
      "category": "networking-runtime",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "tokio-tungstenite": {
      "category": "networking-runtime",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "webpki": {
      "category": "tls-x509",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "x509-certificate": {
      "category": "tls-x509",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "zstd-safe": {
      "category": "compression",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    },
    "zstd-sys": {
      "category": "compression",
      "reachability": "not part of supported public runtime path",
      "behavior": "generated empty crate declared by compat manifest"
    }
  }
}