feat: Added a command to check the contract for compliance with the code from which it was derived #480

FroVolod · 2025-05-05T16:55:10Z

./near contract verify deployed-at ...

deployed-vs-docker.mov

./near contract verify wasm-file simple-package-verify-rs-ci_testnet.wasm

wasm-vs-docker.mov

dj8yfo · 2025-05-13T21:07:03Z

Imo it should also download sources and point user to them, if the verification was a MATCH.

As in not just saying contract is OK, which is meaningless,

but as in contract is a MATCH to these SOURCES, please kindly look at these sources, if you want to know, if contract does anything good at all.

It's the same function as nearblocks, which provides verification status AND the sources in case of a match, without the sources there's no useful info. But this time it's nearblocks in CLI.

dj8yfo · 2025-05-13T21:16:10Z

Cargo.toml

+near-workspaces = "0.19.0"
+near-verify-rs = "0.3.0"
+camino = "1.1.1"
+git2 = "0.19"
+tempfile = "3.10.1"


all of the new deps have to be feature-gated with e.g. verify_contract feature, so that cargo-near can pull in near-cli as a dependency without this new feature, in order to not have e.g. potentially 2 versions of near-verify-rs in its dependency tree.

strictly speaking, cargo-near depends only on deploy_contract + create_dev_account feature of near-cli (doesn't exist), but that's definetely not a top priority to try to structure dependencies so, that only things needed for deploy_contract & create_dev_account are imported by cargo-near

dj8yfo · 2025-05-13T23:31:11Z

src/commands/contract/verify/mod.rs

+    let target_dir = camino::Utf8PathBuf::from_path_buf(target_dir)
+        .map_err(|err| color_eyre::eyre::eyre!("convert path buf {:?}", err))?;
+
+    contract_source_metadata.validate(None)?;


This has to use trusted images whitelist. See examples in near_verify_rs repo (at least sourcescan/cargo-near). This is also important in context of server-side verification, where arbitrary images cannot be trusted by default.

Empty whitelist can be under a #[interactive_clap(long, skip_interactive_input)] no_image_whitelist: bool flag (imo)

…_into

…_code_into

FroVolod · 2025-05-22T13:58:40Z

Imo it should also download sources and point user to them, if the verification was a MATCH.

As in not just saying contract is OK, which is meaningless,

but as in contract is a MATCH to these SOURCES, please kindly look at these sources, if you want to know, if contract does anything good at all.

It's the same function as nearblocks, which provides verification status AND the sources in case of a match, without the sources there's no useful info. But this time it's nearblocks in CLI.

there is such an option:

frol

@race-of-sloths score 8

race-of-sloths · 2025-06-22T12:14:07Z

@FroVolod Thank you for your contribution! Your pull request is now a part of the Race of Sloths!
Do you want to apply for monthly streak? Get 8+ score for a single PR this month and receive boost for race-of-sloths!

Current status: executed

Reviewer	Score
@frol	8

Your contribution is much appreciated with a final score of 8!
You have received 95 (80 base + 10 monthly bonus + 5% lifetime bonus) Sloth points for this contribution

@frol received 25 Sloth Points for reviewing and scoring this pull request.

Congratulations @FroVolod! Your PR was highly scored and you completed another monthly streak! To keep your monthly streak make another pull request next month and get 8+ score for it

What is the Race of Sloths

Race of Sloths is a friendly competition where you can participate in challenges and compete with other open-source contributors within your normal workflow

For contributors:

Tag @race-of-sloths inside your pull requests
Wait for the maintainer to review and score your pull request
Check out your position in the Leaderboard
Keep weekly and monthly streaks to reach higher positions
Boast your contributions with a dynamic picture of your Profile

For maintainers:

Score pull requests that participate in the Race of Sloths and receive a reward
Engage contributors with fair scoring and fast responses so they keep their streaks
Promote the Race to the point where the Race starts promoting you
Grow the community of your contributors

Feel free to check our website for additional details!

Bot commands

For contributors
- Include a PR: @race-of-sloths include to enter the Race with your PR
For maintainers:
- Invite contributor @race-of-sloths invite to invite the contributor to participate in a race or include it, if it's already a runner.
- Assign points: @race-of-sloths score [1/2/3/5/8/13] to award points based on your assessment.
- Reject this PR: @race-of-sloths exclude to send this PR back to the drawing board.
- Exclude repo: @race-of-sloths pause to stop bot activity in this repo until @race-of-sloths unpause command is called

## 🤖 New release * `near-cli-rs`: 0.20.0 -> 0.21.0 (⚠ API breaking changes) ### ⚠ `near-cli-rs` breaking changes ```text --- failure enum_no_repr_variant_discriminant_changed: enum variant had its discriminant change value --- Description: The enum's variant had its discriminant value change. This breaks downstream code that used its value via a numeric cast like `as isize`. ref: https://doc.rust-lang.org/reference/items/enumerations.html#assigning-discriminant-values impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.41.0/src/lints/enum_no_repr_variant_discriminant_changed.ron Failed in: variant ContractActionsDiscriminants::DownloadAbi 4 -> 5 in /tmp/.tmpHq8aq0/near-cli-rs/src/commands/contract/mod.rs:61 variant ContractActionsDiscriminants::DownloadWasm 5 -> 6 in /tmp/.tmpHq8aq0/near-cli-rs/src/commands/contract/mod.rs:64 variant ContractActionsDiscriminants::ViewStorage 6 -> 7 in /tmp/.tmpHq8aq0/near-cli-rs/src/commands/contract/mod.rs:67 variant ContractActionsDiscriminants::DownloadAbi 4 -> 5 in /tmp/.tmpHq8aq0/near-cli-rs/src/commands/contract/mod.rs:61 variant ContractActionsDiscriminants::DownloadWasm 5 -> 6 in /tmp/.tmpHq8aq0/near-cli-rs/src/commands/contract/mod.rs:64 variant ContractActionsDiscriminants::ViewStorage 6 -> 7 in /tmp/.tmpHq8aq0/near-cli-rs/src/commands/contract/mod.rs:67 --- failure enum_variant_added: enum variant added on exhaustive enum --- Description: A publicly-visible enum without #[non_exhaustive] has a new variant. ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.41.0/src/lints/enum_variant_added.ron Failed in: variant SignWithDiscriminants:SubmitAsDaoProposal in /tmp/.tmpHq8aq0/near-cli-rs/src/transaction_signature_options/mod.rs:64 variant SignWithDiscriminants:SubmitAsDaoProposal in /tmp/.tmpHq8aq0/near-cli-rs/src/transaction_signature_options/mod.rs:64 variant CliContractActions:Verify in /tmp/.tmpHq8aq0/near-cli-rs/src/commands/contract/mod.rs:26 variant CliSignWith:SubmitAsDaoProposal in /tmp/.tmpHq8aq0/near-cli-rs/src/transaction_signature_options/mod.rs:19 variant SignWith:SubmitAsDaoProposal in /tmp/.tmpHq8aq0/near-cli-rs/src/transaction_signature_options/mod.rs:64 variant ContractActionsDiscriminants:Verify in /tmp/.tmpHq8aq0/near-cli-rs/src/commands/contract/mod.rs:58 variant ContractActionsDiscriminants:Verify in /tmp/.tmpHq8aq0/near-cli-rs/src/commands/contract/mod.rs:58 --- failure trait_newly_sealed: pub trait became sealed --- Description: A publicly-visible trait became sealed, so downstream crates are no longer able to implement it ref: https://rust-lang.github.io/api-guidelines/future-proofing.html#sealed-traits-protect-against-downstream-implementations-c-sealed impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.41.0/src/lints/trait_newly_sealed.ron Failed in: trait near_cli_rs::common::JsonRpcClientExt in file /tmp/.tmpHq8aq0/near-cli-rs/src/common.rs:2342 ``` <details><summary>Changelog</summary> <blockquote> ## [0.21.0](v0.20.0...v0.21.0) - 2025-07-08 ### Added - Improved support for importing implicit accounts ([#498](#498)) - Added a command to confirm locally that the deployed contract matches the source code it was built from ([#480](#480)) - Add support for submitting general DAO proposals ([#492](#492)) ### Fixed - Fixed typos in the default CLI config ([#501](#501)) - Fixed error RpcError: [missing field disable_9393_fix] ([#502](#502)) - use re-rexported version of `indicatif` module, needed for `tracing-indicatif` ([#503](#503)) - `clippy::result_large_err` warning ([#488](#488)) ### Other - Added `verify_contract`/`inspect_contract` feauture gates ([#504](#504)) - Pinned binary releases to use ubuntu-22.04 ([#506](#506)) - Fixed linting errors - non-inlined formatting syntax ([#499](#499)) - fix some typos ([#494](#494)) - simplified action struct ([#493](#493)) - added more RPCs (FAST NEAR and Lava) to the default config generation ([#491](#491)) - introduced `BoxedJsonRpcResult` type ([#490](#490)) - fixed shell configuration for command history ([#487](#487)) </blockquote> </details> --- This PR was generated with [release-plz](https://github.com/release-plz/release-plz/).

thisisjoshford added this to DevTools May 5, 2025

github-project-automation bot moved this to NEW❗ in DevTools May 5, 2025

FroVolod added 4 commits May 10, 2025 16:23

start

4e85efa

added verifying to WASM code

8cf0cbc

refactored

8694fc4

updated Cargo.lock

a6c73c7

FroVolod force-pushed the contract-verify branch from 7eaf490 to a6c73c7 Compare May 10, 2025 13:28

FroVolod added 3 commits May 12, 2025 18:11

Merge branch 'main' into contract-verify

36ce73e

Merge branch 'main' into contract-verify

370119d

Merge branch 'main' into contract-verify

30d1099

dj8yfo reviewed May 13, 2025

View reviewed changes

FroVolod and others added 7 commits May 15, 2025 10:42

Merge branch 'main' into contract-verify

18885f8

added flags: use_contract_source_code_path, save_contract_source_code…

83c1f8e

…_into

refactored flags: use_contract_source_code_path, save_contract_source…

a7e59af

…_code_into

refactored ContractFile

7840af0

added "verify_contract" to features

8a9e450

added trusted images whitelist

852b982

fixed contract verification message

2d5b6a8

FroVolod closed this May 22, 2025

github-project-automation bot moved this from NEW❗ to Shipped 🚀 in DevTools May 22, 2025

FroVolod reopened this May 22, 2025

github-project-automation bot moved this from Shipped 🚀 to NEW❗ in DevTools May 22, 2025

FroVolod and others added 4 commits May 31, 2025 15:58

Merge branch 'main' into contract-verify

9f6f4c4

added --teach-me flag

877c915

updated GUIDE

dbebddd

Merge branch 'main' into contract-verify

04b0fd3

frol mentioned this pull request Jun 16, 2025

🔷 [Epic] Contracts Verification tooling near/devtools#7

Open

FroVolod and others added 2 commits June 20, 2025 16:33

Merge branch 'main' into contract-verify

2b843b8

"Verify contract using WASM file" block removed

7a928b2

FroVolod marked this pull request as ready for review June 22, 2025 09:49

FroVolod requested review from akorchyn, PolyProgrammist and frol as code owners June 22, 2025 09:49

frol approved these changes Jun 22, 2025

View reviewed changes

frol merged commit a54e03e into main Jun 22, 2025
11 checks passed

frol deleted the contract-verify branch June 22, 2025 12:16

github-project-automation bot moved this from NEW❗ to Shipped 🚀 in DevTools Jun 22, 2025

frol mentioned this pull request Jun 19, 2025

chore: release v0.21.0 #489

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Added a command to check the contract for compliance with the code from which it was derived #480

feat: Added a command to check the contract for compliance with the code from which it was derived #480

Uh oh!

FroVolod commented May 5, 2025 •

edited

Loading

Uh oh!

dj8yfo commented May 13, 2025 •

edited

Loading

Uh oh!

dj8yfo May 13, 2025 •

edited

Loading

Uh oh!

FroVolod May 21, 2025

Uh oh!

dj8yfo May 13, 2025 •

edited

Loading

Uh oh!

dj8yfo May 14, 2025

Uh oh!

FroVolod May 21, 2025

Uh oh!

FroVolod commented May 22, 2025

Uh oh!

frol left a comment

Uh oh!

race-of-sloths commented Jun 22, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

feat: Added a command to check the contract for compliance with the code from which it was derived #480

feat: Added a command to check the contract for compliance with the code from which it was derived #480

Uh oh!

Conversation

FroVolod commented May 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dj8yfo commented May 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dj8yfo May 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

FroVolod May 21, 2025

Choose a reason for hiding this comment

Uh oh!

dj8yfo May 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dj8yfo May 14, 2025

Choose a reason for hiding this comment

Uh oh!

FroVolod May 21, 2025

Choose a reason for hiding this comment

Uh oh!

FroVolod commented May 22, 2025

Uh oh!

frol left a comment

Choose a reason for hiding this comment

Uh oh!

race-of-sloths commented Jun 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

FroVolod commented May 5, 2025 •

edited

Loading

dj8yfo commented May 13, 2025 •

edited

Loading

dj8yfo May 13, 2025 •

edited

Loading

dj8yfo May 13, 2025 •

edited

Loading

race-of-sloths commented Jun 22, 2025 •

edited

Loading