Skip to content

fix(gnovm): pin the per-file Go version in the consensus type-check#5978

Open
davd-gzl wants to merge 3 commits into
gnolang:masterfrom
davd-gzl:fix/gnovm-typecheck-pin-and-dead-guard
Open

fix(gnovm): pin the per-file Go version in the consensus type-check#5978
davd-gzl wants to merge 3 commits into
gnolang:masterfrom
davd-gzl:fix/gnovm-typecheck-pin-and-dead-guard

Conversation

@davd-gzl

@davd-gzl davd-gzl commented Jul 18, 2026

Copy link
Copy Markdown
Member

Follow-up to #5893.

Whoever uploads a package decides which language rules it gets checked against. The chain should decide.

One comment line gets code accepted that should be rejected. for range 10 needs Go 1.22, which the VM cannot run:

//go:build go1.22

package z
func F() { for range 10 {} }   // rejected without the first line, accepted with it

The chain sets the language version to Go 1.18 before checking. That setting only applies to files which do not state a version themselves, and //go:build go1.N is how a file states one:

chain sets go1.18
   |
parse the file     the //go:build line sets the file's own version
   |
check the code     the file's version wins, so go1.22 is used

It also makes the answer depend on the machine. Go's type checker refuses a file asking for a version newer than the Go release used to build the node, so a package marked go1.26 is accepted by a node built with Go 1.26 and rejected by one built with Go 1.25:

file requires newer Go version go1.26 (application built with go1.25)

The fix erases the version a file states, right after parsing:

chain sets go1.18
   |
parse the file     the //go:build line sets the file's own version
   |
erase it           <- the fix
   |
check the code     nothing left to override, so go1.18 is used

A new test covers both cases and fails without the fix.

The second commit is unrelated cleanup: a nil check that can never run, left by the #5891 merge.

davd-gzl added 2 commits July 18, 2026 22:39
The consensus type-check pins types.Config.GoVersion to go1.18 so the
accept/reject verdict for a submitted package is a function of the package
alone. The pin only governs files carrying no per-file version: go/types
upgrades a file above the Config pin when it has a //go:build go1.N line,
and rejects a file whose version exceeds the version the binary was built
with.

Package bodies are attacker-supplied and reach go/types through go/parser,
which populates ast.File.GoVersion from those lines. So a submitter could
raise the gate on their own file, and a file tagged above one validator's
toolchain was accepted on a newer build and rejected on an older one. Both
are state forks across heterogeneous validator builds.

Blank ast.File.GoVersion on every parsed .gno file in GoParseMemPackage.
Build constraints have no meaning in Gno, so no per-file version can
legitimately be set from inside a submitted package, and Config.GoVersion
becomes the sole version authority for every file and every import.
…BlockNodes

IterMemPackage's only implementation skips prod-less packages before its
only channel send, and the Store interface documents that skip, so the
receiving nil check can never fire. The guard arrived as a merge artifact:
it comes from the un-squashed branch of gnolang#5891, whose squash on master put
the skip in store.go instead, and the merge kept both copies.
@Gno2D2

Gno2D2 commented Jul 18, 2026

Copy link
Copy Markdown
Collaborator

🛠 PR Checks Summary

🔴 Pending initial approval by a review team member, or review from tech-staff

Manual Checks (for Reviewers):
  • IGNORE the bot requirements for this PR (force green CI check)
Read More

🤖 This bot helps streamline PR reviews by verifying automated checks and providing guidance for contributors and reviewers.

✅ Automated Checks (for Contributors):

🟢 Maintainers must be able to edit this pull request (more info)
🔴 Pending initial approval by a review team member, or review from tech-staff

☑️ Contributor Actions:
  1. Fix any issues flagged by automated checks.
  2. Follow the Contributor Checklist to ensure your PR is ready for review.
    • Add new tests, or document why they are unnecessary.
    • Provide clear examples/screenshots, if necessary.
    • Update documentation, if required.
    • Ensure no breaking changes, or include BREAKING CHANGE notes.
    • Link related issues/PRs, where applicable.
☑️ Reviewer Actions:
  1. Complete manual checks for the PR, including the guidelines and additional checks if applicable.
📚 Resources:
Debug
Automated Checks
Maintainers must be able to edit this pull request (more info)

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 The pull request was created from a fork (head branch repo: davd-gzl/gno)

Then

🟢 Requirement satisfied
└── 🟢 Maintainer can modify this pull request

Pending initial approval by a review team member, or review from tech-staff

If

🟢 Condition met
└── 🟢 And
    ├── 🟢 The base branch matches this pattern: ^master$
    └── 🟢 Not (🔴 Pull request author is a member of the team: tech-staff)

Then

🔴 Requirement not satisfied
└── 🔴 If
    ├── 🔴 Condition
    │   └── 🔴 Or
    │       ├── 🔴 At least one of these user(s) reviewed the pull request: [aronpark1007 davd-gzl jefft0 notJoon omarsy MikaelVallenet] (with state "APPROVED")
    │       ├── 🔴 At least 1 user(s) of the team tech-staff reviewed pull request
    │       └── 🔴 This pull request is a draft
    └── 🔴 Else
        └── 🔴 And
            ├── 🟢 This label is applied to pull request: review/triage-pending
            └── 🔴 On no pull request

Manual Checks
**IGNORE** the bot requirements for this PR (force green CI check)

If

🟢 Condition met
└── 🟢 On every pull request

Can be checked by

  • Any user with comment edit permission

@davd-gzl
davd-gzl marked this pull request as ready for review July 18, 2026 22:09
@Gno2D2 Gno2D2 added the review/triage-pending PRs opened by external contributors that are waiting for the 1st review label Jul 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

📦 🤖 gnovm Issues or PRs gnovm related review/triage-pending PRs opened by external contributors that are waiting for the 1st review

Projects

Development

Successfully merging this pull request may close these issues.

2 participants