Skip to content

Commit

Permalink
Copy binaries from builtins repo (#162)
Browse files Browse the repository at this point in the history
* Build the machine with a custom SDK
* Add built-in binaries instead of bounty bundles
* Add `libatomic1` as dependency
* Move `solidity` to `solc`
* Use custom SDK in tests
* Run assertion scripts with bash
* Let bash expand aliases (off by default when non-interactive)
* Update paths to bounties and exploits in tests
* Add `clean` and `distclean` targets to root Makefile
* Update populate script
* Update README
* Update `info.json` files
* Remove unused files
* Idempotent Makefile
* Quote absolute paths as they might contain spaces
* Make targets `.PHONY`
* Use `curl` instead of `wget`
* Remove slides
* Translate table of dependencies into graph
* Bump Ubuntu base image
* Bump Node.js to 20
* Remove `make bounties` from CI
* Remove `make bounties` from README
* Move test image build to its own repo
* Flatten Makefile rules for bundles
* Make `test` depend on `bounties` target
* Copy binaries from `builtins` image
* Remove explicit platforms from Dockerfile
* Create `BUILTINS_VERSION` argument

---------

Co-authored-by: Enderson Maia <[email protected]>
  • Loading branch information
guidanoli and endersonmaia authored Oct 2, 2024
1 parent a0f62f3 commit e935a07
Show file tree
Hide file tree
Showing 38 changed files with 232 additions and 2,013 deletions.
11 changes: 2 additions & 9 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ jobs:
contents: read
env:
PNPM_VERSION: 9
NODE_VERSION: 18
NODE_VERSION: 20
CARTESI_MACHINE_IMAGE_NAME: bug-buster-machine
CARTESI_NODE_IMAGE_NAME: bug-buster-node
REGISTRY: ghcr.io/${{ github.repository_owner }}
Expand All @@ -39,14 +39,6 @@ jobs:
id: setup_buildx
uses: docker/setup-buildx-action@v3

- name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v3

- name: Build bounty examples
run: make bounties
env:
BUILDX_BUILDER: ${{ steps.setup_buildx.outputs.name }}

- name: Extract metadata from Git refs and GitHub events
id: extract_metadata
uses: docker/metadata-action@v5
Expand All @@ -71,6 +63,7 @@ jobs:
with:
context: .
load: true
platforms: linux/riscv64
builder: ${{ steps.setup_buildx.outputs.name }}
tags: ${{ steps.extract_metadata.outputs.tags }}
labels: ${{ steps.extract_metadata.outputs.labels }}
Expand Down
1 change: 0 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -9,4 +9,3 @@ frontend/src/model/__generated__
frontend/tsconfig.tsbuildinfo
frontend/yarn.lock
*.bin
slides.pdf
42 changes: 29 additions & 13 deletions Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,15 @@

# This enforces that the packages downloaded from the repositories are the same
# for the defined date, no matter when the image is built.
ARG NOBLE_DATE=20240801
ARG APT_UPDATE_SNAPSHOT=${NOBLE_DATE}T030400Z
ARG UBUNTU_TAG=noble-20240827.1
ARG APT_UPDATE_SNAPSHOT=20240827T030400Z

# Built-in binaries version
ARG BUILTINS_VERSION=0.6.0

################################################################################
# cross base stage
FROM ubuntu:noble-${NOBLE_DATE} AS base-build-stage
FROM --platform=$BUILDPLATFORM ubuntu:${UBUNTU_TAG} AS base-build-stage

ARG APT_UPDATE_SNAPSHOT
ARG DEBIAN_FRONTEND=noninteractive
Expand All @@ -20,7 +23,7 @@ EOF

################################################################################
# riscv64 base stage
FROM --platform=linux/riscv64 ubuntu:noble-${NOBLE_DATE} AS base-target-stage
FROM ubuntu:${UBUNTU_TAG} AS base-target-stage

ARG APT_UPDATE_SNAPSHOT
ARG DEBIAN_FRONTEND=noninteractive
Expand All @@ -41,15 +44,15 @@ set -e
apt install -y --no-install-recommends \
build-essential \
ca-certificates \
g++-riscv64-linux-gnu \
wget
curl \
g++-riscv64-linux-gnu
EOF

ARG GOVERSION=1.23.1

WORKDIR /opt/build

RUN wget https://go.dev/dl/go${GOVERSION}.linux-$(dpkg --print-architecture).tar.gz && \
RUN curl -L -R -O https://go.dev/dl/go${GOVERSION}.linux-$(dpkg --print-architecture).tar.gz && \
tar -C /usr/local -xzf go${GOVERSION}.linux-$(dpkg --print-architecture).tar.gz

ENV GOOS=linux
Expand Down Expand Up @@ -77,7 +80,7 @@ apt install -y --no-install-recommends \
lua5.4 \
build-essential \
ca-certificates \
wget
curl
EOF

WORKDIR /opt/build
Expand All @@ -87,7 +90,7 @@ ARG BUBBLEWRAP_VER=0.8.0
RUN <<EOF
set -eu
apt-get install -y libseccomp-dev libcap-dev
wget -O bubblewrap-${BUBBLEWRAP_VER}.tar.xz https://github.com/containers/bubblewrap/releases/download/v${BUBBLEWRAP_VER}/bubblewrap-${BUBBLEWRAP_VER}.tar.xz
curl -L -R -O https://github.com/containers/bubblewrap/releases/download/v${BUBBLEWRAP_VER}/bubblewrap-${BUBBLEWRAP_VER}.tar.xz
tar xf bubblewrap-${BUBBLEWRAP_VER}.tar.xz
mv bubblewrap-${BUBBLEWRAP_VER} bubblewrap
cd bubblewrap
Expand All @@ -100,7 +103,7 @@ ARG BWRAPBOX_VER=0.2.2
COPY --chmod=466 bwrapbox/generate-rules.lua /tmp
RUN <<EOF
set -eu
wget -O bwrapbox-${BWRAPBOX_VER}.tar.gz https://github.com/edubart/bwrapbox/archive/refs/tags/v${BWRAPBOX_VER}.tar.gz
curl -L -R -o bwrapbox-${BWRAPBOX_VER}.tar.gz https://github.com/edubart/bwrapbox/archive/refs/tags/v${BWRAPBOX_VER}.tar.gz
tar xf bwrapbox-${BWRAPBOX_VER}.tar.gz
mv bwrapbox-${BWRAPBOX_VER} bwrapbox
cd bwrapbox
Expand All @@ -109,11 +112,16 @@ make generate-seccomp-rules seccomp-filter.bpf
make LDFLAGS=-static
EOF

################################################################################
# built-in binaries
FROM ghcr.io/crypto-bug-hunters/builtins:${BUILTINS_VERSION} AS builtins

################################################################################
# runtime stage: produces final image that will be executed
FROM base-target-stage

LABEL io.cartesi.sdk_version=0.9.0
LABEL io.cartesi.sdk_name=cryptobughunters/sdk
LABEL io.cartesi.sdk_version=0.11.1
LABEL io.cartesi.rollups.ram_size=128Mi
LABEL io.cartesi.rollups.data_size=128Mb

Expand All @@ -124,6 +132,7 @@ apt-get install -y --no-install-recommends \
busybox-static \
libasan6 \
libasan8 \
libatomic1 \
xz-utils
rm -rf /var/lib/apt/lists/*
EOF
Expand All @@ -134,12 +143,20 @@ ADD https://github.com/cartesi/machine-emulator-tools/releases/download/v${MACHI
RUN dpkg -i /tmp/machine-emulator-tools-v${MACHINE_EMULATOR_TOOLS_VERSION}.deb \
&& rm /tmp/machine-emulator-tools-v${MACHINE_EMULATOR_TOOLS_VERSION}.deb

COPY --from=builtins --chmod=755 /opt/bundle/busybox-1.36.1-linux-riscv64 /usr/bin/busybox-1.36.1
COPY --from=builtins --chmod=755 /opt/bundle/forge-2cdbfac-linux-riscv64 /usr/bin/forge-2cdbfac
COPY --from=builtins --chmod=755 /opt/bundle/lua-5.4.3-linux-riscv64 /usr/bin/lua-5.4.3
COPY --from=builtins --chmod=755 /opt/bundle/lua-5.4.7-linux-riscv64 /usr/bin/lua-5.4.7
COPY --from=builtins --chmod=755 /opt/bundle/reth-1.0.5-linux-riscv64 /usr/bin/reth-1.0.5
COPY --from=builtins --chmod=755 /opt/bundle/solc-0.8.27-linux-riscv64 /usr/bin/solc-0.8.27
COPY --from=builtins --chmod=755 /opt/bundle/sqlite-3.32.2-linux-riscv64 /usr/bin/sqlite-3.32.2
COPY --from=builtins --chmod=755 /opt/bundle/sqlite-3.43.2-linux-riscv64 /usr/bin/sqlite-3.43.2
COPY --from=riscv64-build-stage /opt/build/bubblewrap/bwrap /usr/bin/bwrap
COPY --from=riscv64-build-stage /opt/build/bwrapbox/bwrapbox /usr/bin/bwrapbox
COPY --from=riscv64-build-stage /opt/build/bwrapbox/seccomp-filter.bpf /usr/lib/bwrapbox/seccomp-filter.bpf

RUN useradd --home-dir /bounty bounty
RUN mkdir -p /bounties /bounties/examples /bounty
RUN mkdir -p /bounties /bounty
RUN chown bounty:bounty /bounty

ENV PATH="/opt/cartesi/bin:${PATH}"
Expand All @@ -148,7 +165,6 @@ WORKDIR /opt/cartesi/dapp
COPY --from=build-stage /opt/build/dapp .
COPY --chmod=755 skel/cartesi-init /usr/sbin/cartesi-init
COPY --chmod=755 skel/bounty-run /usr/bin/bounty-run
COPY --chmod=644 tests/bounties/**/*-bounty_riscv64.tar.xz /bounties/examples

ENTRYPOINT ["rollup-init"]
CMD ["/opt/cartesi/dapp/dapp"]
26 changes: 19 additions & 7 deletions Makefile
Original file line number Diff line number Diff line change
@@ -1,22 +1,34 @@
.PHONY: all
all: bounties test-image

.PHONY: bounties
bounties:
$(MAKE) -C tests/bounties

test-image:
docker build --tag bug-buster-test-image --file tests/Dockerfile --progress plain .
.PHONY: clean
clean:
$(MAKE) -C tests/bounties clean

test:
docker run -v $(shell pwd):/mnt --rm -it bug-buster-test-image lua5.4 tests/tests.lua
.PHONY: distclean
distclean:
$(MAKE) -C tests/bounties distclean

.PHONY: test
test: bounties
docker run -v "$(shell pwd):/mnt" --rm -it cryptobughunters/test-image:0.0.0 lua5.4 tests/tests.lua

.PHONY: shell
shell:
docker run -it -v "$(shell pwd)/.cartesi:/mnt:ro" cryptobughunters/sdk:0.11.1 cartesi-machine --ram-length=128Mi --flash-drive=label:root,filename:/mnt/image.ext2 -it /bin/bash

.PHONY: run-frontend-dev
run-frontend-dev:
cd frontend && pnpm dev

.PHONY: run-frontend-prod
run-frontend-prod:
cd frontend && pnpm build && pnpm start

.PHONY: populate
populate:
./populate.sh

slides:
docker run --rm --init -v $$PWD:/home/marp/app/ -e MARP_USER="$(id -u):$(id -g)" marpteam/marp-cli slides.md --allow-local-files --pdf
121 changes: 67 additions & 54 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -19,49 +19,59 @@ If, however, no one is able to submit a valid exploit until a certain deadline,
## Dependencies

For your purposes, not all dependencies may be required.
To help you figure out which dependencies you actually need, here is a table of dependencies for each part of the code base.

| Dependency | Version | Presentation | Back-end | Examples | Tests | Populate | CLI | Front-end |
| :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: | :-: |
| `docker` | 26.1 | :o: | :o: | :o: | :o: | | | |
| `go` | 1.21.1 | | | | | :o: | :o: | |
| `foundry` | nightly | | | | | :o: | :o: | |
| `jq` | 1.6 | | | | | :o: | | |
| `pnpm` | 9.x | | :o: | | :o: | :o: | | :o: |

## Presentation

For more info about the project, check out the slides.
To build the slides, run the following command:

```
make slides
```

## Building example bounties

Before building the machine image and testing, you need to compile the bounties binaries.

```sh
make bounties
```

The following bounties will be compiled and can be used for testing:

```
./tests/bounties/busybox-bounty/busybox-1.36.1-bounty_riscv64.tar.xz
./tests/bounties/lua-bounty/lua-5.4.3-bounty_riscv64.tar.xz
./tests/bounties/lua-bounty/lua-5.4.6-bounty_riscv64.tar.xz
./tests/bounties/sqlite-bounty/sqlite-3.32.2-bounty_riscv64.tar.xz
./tests/bounties/sqlite-bounty/sqlite-3.43.2-bounty_riscv64.tar.xz
```

Along with following exploits:

```
./tests/bounties/busybox-bounty/exploit-busybox-1.36.1.sh
./tests/bounties/lua-bounty/exploit-lua-5.4.3.lua
./tests/bounties/sqlite-bounty/exploit-sqlite-3.32.2.sql
To help you figure out which dependencies you actually need, here is a tree of dependencies for each part of the code base.

```mermaid
flowchart LR
%% External Dependencies
classDef dependency fill:#008DA5,color:#fff
bash:::dependency
docker:::dependency
cast:::dependency
go:::dependency
jq:::dependency
make:::dependency
pnpm:::dependency
tar:::dependency
xz:::dependency
%% Bug Buster Components
classDef component fill:#00F6FF,color:#000
BackEnd:::component
Shell:::component
BountyExamples:::component
Tests:::component
PopulateScript:::component
CLI:::component
FrontEnd:::component
%% Components -> Dependencies
BackEnd --> docker
BackEnd --> pnpm
Shell --> BackEnd
Shell --> docker
Shell --> make
BountyExamples --> make
BountyExamples --> tar
BountyExamples --> xz
Tests ---> docker
Tests ---> make
Tests --> BountyExamples
PopulateScript ---> bash
PopulateScript ---> cast
PopulateScript ---> jq
PopulateScript ---> pnpm
PopulateScript --> BountyExamples
PopulateScript --> CLI
CLI --> cast
CLI --> go
FrontEnd ---> pnpm
```

## Back-end
Expand Down Expand Up @@ -105,14 +115,8 @@ pnpm start

## Tests

Make sure you first built the machine image and bounties.
Then, build the test image.

```sh
make test-image
```

Now, you may run the tests.
Make sure you first built the machine image.
Then, you may run the tests.

```sh
make test
Expand Down Expand Up @@ -145,7 +149,7 @@ go run ./cli send dapp-address
go run ./cli send bounty \
-n "Lua Bounty" \
-d "Description of Lua bounty" \
-c ./tests/bounties/lua-bounty/lua-5.4.3-bounty_riscv64.tar.xz \
-c ./tests/bounties/dist/lua-5.4.3-bounty.tar.xz \
-t 0x92C6bcA388E99d6B304f1Af3c3Cd749Ff0b591e2
```

Expand All @@ -165,7 +169,7 @@ go run ./cli send sponsor \
go run ./cli send exploit \
-b 0 \
-n "Hacker Name" \
-e ./tests/bounties/lua-bounty/exploit-lua-5.4.3.lua
-e ./tests/bounties/src/lua/exploit-lua-5.4.3.lua
```

### Withdraw bounty
Expand All @@ -179,7 +183,7 @@ go run ./cli send withdraw -b 0
```sh
go run ./cli test \
-b 0 \
-e ./tests/bounties/lua-bounty/exploit-lua-5.4.3.lua
-e ./tests/bounties/src/lua/exploit-lua-5.4.3.lua
```

## Populating DApp
Expand Down Expand Up @@ -221,6 +225,15 @@ Below are some of those features.
When running Bug Buster locally, you might want to perform some operations that would otherwise be impossible in a production environment.
To this end, we advise you to install the [Foundry](https://book.getfoundry.sh/getting-started/installation) toolkit.

### Shell

If you want to run the machine locally through a shell interface, you can do so through the following command.
Please make sure you have built the machine beforehand.

```sh
make shell
```

### Time travel

When testing sponsor withdrawals, it's handy to be able to instantly advance time past the expiry date of some bounty.
Expand Down
Loading

0 comments on commit e935a07

Please sign in to comment.