fix: ensure no invalid opcodes in wasm light client binary (#92)

also added a check to ensure that sign-ext opcodes don't find their way
back into the binary.

this also provides a significant improvement to the size of the binary,
from 2.8M to 1.1M (758K to 322K gzipped).

closes #91

Author: benluelo

dictionary.txt

@@ -493,4 +493,7 @@ Boneh
 Shacham
 zkps
 Verkle
-Polkadot
+Polkadot
+passthru
+wasi
+rustlib

flake.nix

@@ -57,17 +57,24 @@
       ];
       perSystem = { config, self', inputs', pkgs, system, lib, ... }:
         let
-          rust-nightly = pkgs.rust-bin.fromRustupToolchain {
+          nightlyConfig = {
             channel = "nightly-2023-05-16";
             components = [ "rust-src" "rust-analyzer" ];
             profile = "default";
           };
 
-          withBuildTarget = target: crane.lib.${system}.overrideToolchain (pkgs.rust-bin.fromRustupToolchain {
-            channel = "nightly-2023-05-16";
-            components = [ "cargo" "rustc" "rust-src" ];
-            targets = [ target ];
-          });
+          rust-nightly = pkgs.rust-bin.fromRustupToolchain nightlyConfig;
+
+          withBuildTarget = target:
+            let
+              toolchain = pkgs.rust-bin.fromRustupToolchain {
+                inherit (nightlyConfig) channel profile;
+                components = nightlyConfig.components ++ [ "cargo" "rustc" "rust-src" ];
+                # hopefully if we ever use wasi this issue will be resolved: pkgs.rust.toRustTarget pkgs.hostPlatform
+                targets = [ target (pkgs.rust.toRustTarget pkgs.hostPlatform) ];
+              };
+            in
+            crane.lib.${system}.overrideToolchain (toolchain) // { inherit toolchain; };
           craneLib = crane.lib.${system}.overrideToolchain rust-nightly;
 
           mkChecks = pkgName: checks: pkgs.lib.mapAttrs' (name: value: { name = "${pkgName}-${name}"; value = value; }) checks;
@@ -128,7 +135,8 @@
 
               crane = {
                 lib = craneLib;
-                inherit withBuildTarget cargoArtifacts commonAttrs mkChecks;
+                hostTarget = pkgs.rust.toRustTarget pkgs.hostPlatform;
+                inherit withBuildTarget cargoArtifacts commonAttrs mkChecks rustSrc;
               };
 
               proto = {

light-clients/ethereum-light-client.nix

@@ -1,22 +1,43 @@
 { ... }: {
   perSystem = { self', pkgs, system, config, inputs', crane, ... }:
     let
-      attrs = crane.commonAttrs
-        // (crane.lib.crateNameFromCargoToml { cargoToml = ./ethereum-light-client/Cargo.toml; })
+      rustToolchain = crane.withBuildTarget CARGO_BUILD_TARGET;
+
+      attrs = (crane.lib.crateNameFromCargoToml { cargoToml = ./ethereum-light-client/Cargo.toml; })
         // {
         cargoExtraArgs = "-p union-ethereum-lc --features eth-minimal";
+        src = crane.rustSrc;
+        cargoVendorDir = crane.lib.vendorMultipleCargoDeps {
+          inherit (crane.lib.findCargoFiles crane.rustSrc) cargoConfigs;
+          cargoLockList = [
+            ../Cargo.lock
+            "${rustToolchain.toolchain.passthru.availableComponents.rust-src}/lib/rustlib/src/rust/Cargo.lock"
+          ];
+        };
       };
 
-      # cargoArtifacts = crane.lib.buildDepsOnly attrs;
-
       CARGO_BUILD_TARGET = "wasm32-unknown-unknown";
     in
     {
       packages = {
-        wasm-ethereum-lc = (crane.withBuildTarget CARGO_BUILD_TARGET).buildPackage (attrs // {
+        wasm-ethereum-lc = rustToolchain.buildPackage (attrs // {
           inherit CARGO_BUILD_TARGET;
 
-          # RUSTFLAGS are used to optimize the binary size
+          cargoBuildCommand = "RUSTFLAGS='-C target-feature=-sign-ext -C link-arg=-s -C target-cpu=mvp' cargo -Z build-std=std,panic_abort -Z build-std-features=panic_immediate_abort build --release --lib --target ${CARGO_BUILD_TARGET}";
+
+          checkPhase = ''
+            cargo test ${attrs.cargoExtraArgs} --target ${crane.hostTarget}
+
+            # grep exits 0 if a match is found
+            if ${pkgs.binaryen}/bin/wasm-dis target/wasm32-unknown-unknown/release/union_ethereum_lc.wasm | grep -P '\.extend\d{1,2}_s'
+            then
+              echo "wasm binary contains invalid opcodes!"
+              exit 1
+            else
+              echo "wasm binary doesn't contain any sign-extension opcodes!"
+            fi
+          '';
+
           installPhase = ''
             mkdir -p $out/lib
             # Optimize the binary size a little bit more
@@ -28,9 +49,10 @@
         });
       };
 
-      checks = crane.mkChecks "wasm-ethereum-lc" {
-        clippy = crane.lib.cargoClippy (attrs // { inherit (crane) cargoArtifacts; });
-        test = crane.lib.cargoTest (attrs // { inherit (crane) cargoArtifacts; });
-      };
+      checks = crane.mkChecks "wasm-ethereum-lc"
+        {
+          clippy = crane.lib.cargoClippy (attrs // { inherit (crane) cargoArtifacts; });
+          test = crane.lib.cargoTest (attrs // { inherit (crane) cargoArtifacts; });
+        };
     };
 }

light-clients/ethereum-light-client/.cargo/config.toml

@@ -5,4 +5,5 @@ unit-test = "test --lib"
 integration-test = "test --test integration"
 schema = "run --bin schema"
 
-rustflags = ["-C link-arg=-s"]
+rustflags = ["-C target-feature=-sign-ext", "-C link-arg=-s", "-C target-cpu=mvp"]
+