Skip to content

Conversation

@FUDCo
Copy link
Contributor

@FUDCo FUDCo commented Feb 12, 2025

This adds a new kernel-test package that has the machinery for running tests that involve message traffic being exchanged between vats.

Also included are a bunch of tests for various cases of liveslots <-> kernel promise handling.

Note that this probably needs some build script love. While it has a bunch of vat code for running the various tests, the build process does not generate the bundles that the tests themselves expect to see. Right now this needs to be done manually, but really should be automated.

Closes #336

@FUDCo FUDCo requested a review from a team as a code owner February 12, 2025 01:13
@socket-security

This comment was marked as resolved.

@socket-security
Copy link

socket-security bot commented Feb 12, 2025

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert Package NoteSourceCI
Manifest confusion npm/@agoric/store@0.9.3-upgrade-19-dev-c605745.0 ⚠︎
Manifest confusion npm/@agoric/base-zone@0.1.1-upgrade-19-dev-c605745.0 ⚠︎

Ignoring: npm/abbrev@3.0.0, npm/async-function@1.0.0

View full report↗︎

Next steps

What is manifest confusion?

This package has inconsistent metadata. This could be malicious or caused by an error when publishing the package.

Packages with inconsistent metadata may be corrupted or malicious.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/foo@1.0.0 or ignore all packages with @SocketSecurity ignore-all

  • @SocketSecurity ignore npm/@agoric/store@0.9.3-upgrade-19-dev-c605745.0
  • @SocketSecurity ignore npm/@agoric/base-zone@0.1.1-upgrade-19-dev-c605745.0

@FUDCo
Copy link
Contributor Author

FUDCo commented Feb 12, 2025

@SocketSecurity ignore npm/abbrev@3.0.0 npm/async-function@1.0.0 npm/@agoric/store@0.9.3-upgrade-18a-dev-eaeaf5a.0 npm/@agoric/base-zone@0.1.1-upgrade-18a-dev-eaeaf5a.0

@FUDCo FUDCo force-pushed the chip/liveslots-tests branch 6 times, most recently from cba9889 to 3905360 Compare February 26, 2025 07:28
@FUDCo FUDCo force-pushed the chip/liveslots-tests branch from 3905360 to 21611c7 Compare February 27, 2025 21:17
Includes test for various cases of liveslots <-> kernel promise handling.

Closes #336
@FUDCo FUDCo force-pushed the chip/liveslots-tests branch from 0627f53 to 7d6490c Compare February 28, 2025 00:50
Copy link
Member

@rekmarks rekmarks left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@FUDCo FUDCo enabled auto-merge (squash) February 28, 2025 08:20
@FUDCo FUDCo merged commit 8f2cc7c into main Feb 28, 2025
17 checks passed
@FUDCo FUDCo deleted the chip/liveslots-tests branch February 28, 2025 08:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add tests for liveslots integration

5 participants