feat(endomoat): policy generation implementation

[boneskull]

This branch is for @naugtur and I to collaborate on policy-gen changes.

Setup

1. Checkout PR feat(compartment-mapper): expose extraParsers option endojs/endo#2190 in a working copy of endojs/endo
2. Run yarn to update deps, etc.
3. Run this:

   npx lerna build:types && \ 
   npm link -w @endo/compartment-mapper -w ses -w @endo/env-options -w @endo/cjs-module-analyzer \
     -w @endo/static-module-record -w @endo/zip

4. Navigate to your LavaMoat/LavaMoat working copy.
5. Run this:

   npm ci && \
   npm link @endo/compartment-mapper ses @endo/env-options @endo/cjs-module-analyzer \
     @endo/static-module-record @endo/zip -w packages/endomoat && \
   npm run rebuild:types # verify linking

The above will only work properly if all versions of @endo/compartment-mapper are the same; run npm ls @endo/compartment-mapper to verify this. If this isn't the case, deduping won't occur upon linking, and the type generation will fail.

Note

If you find linking fails because ses' prepare script doesn't work, delete the prepare script from its package.json.

[boneskull]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat(endomoat): support native modules in policy gen #1076
• feat(endomoat): policy generation implementation #969 👈
• feat: lavamoat + @endo/compartment-mapper PoC #772
• chore: update lockfile post-release (yet again) #1062
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

Join @boneskull and the rest of your teammates on Graphite

[naugtur]

Could we have the core/tofu changes here and rebase our work on those? Otherwise, the endomoat and webpack work will be super hard to review.

[boneskull]

CLI now looks like:

endomoat <entrypoint>

Run an application

Commands:
  endomoat run <entrypoint>  Run an application                        [default]
  endomoat gen <entrypoint>  Generate policy files; overwrites existing policies
                                                             [aliases: generate]

Positionals:
  entrypoint  Path to the application entry point            [string] [required]

Options:
      --help                         Show help                         [boolean]
      --version                      Show version number               [boolean]
  -p, --policy                       Filepath to a policy file
                                 [string] [default: "lavamoat/node/policy.json"]
  -o, --policy-override, --override  Filepath to a policy override file
                        [string] [default: "lavamoat/node/policy-override.json"]
      --policy-debug, --pd           Filepath to a policy debug file
                           [string] [default: "lavamoat/node/policy-debug.json"]
      --cwd                          Path to application root directory
                                         [string] [default: (current directory)]

Note that run is the default command. And so if we do endomoat gen --help:

endomoat gen <entrypoint>

Generate policy files; overwrites existing policies

Behavior Options:
      --run    Run the application after policy generated              [boolean]
      --debug  Additionally write a debug policy                       [boolean]

Positionals:
  entrypoint  Path to the application entry point            [string] [required]

Options:
      --help                         Show help                         [boolean]
      --version                      Show version number               [boolean]
  -p, --policy                       Filepath to a policy file
                                 [string] [default: "lavamoat/node/policy.json"]
  -o, --policy-override, --override  Filepath to a policy override file
                        [string] [default: "lavamoat/node/policy-override.json"]
      --policy-debug, --pd           Filepath to a policy debug file
                           [string] [default: "lavamoat/node/policy-debug.json"]
      --cwd                          Path to application root directory
                                         [string] [default: (current directory)]

Anyway. Subcommands make more sense to me than just a big bucket of options.

[socket-security]

Removed dependencies detected. Learn more about Socket for GitHub ↗︎

🚮 Removed packages: npm/@endo/compartment-mapper@1.1.3

View full report↗︎