Remove pureCopy, ALLOW_IMPLICIT_REMOTABLES #1061
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
erights
changed the title
|
Agoric/agoric-sdk#4458 is merged, so this one should no longer be blocked on that one. |
michaelfig
approved these changes
Feb 4, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
We are now allowing ourselves to assume a protection we have not yet implemented --- that Passable pass-by-copy composites (CopyArray, CopyRecord, Tagged) cannot be proxies. Enforcing this would mirror the security properties of the proposed Records and Tuples, ensuring that these are only passive pure data that cannot cause side effects or interleave with user code, for example, to mount reentrancy attacks. (Need issue number where this assumption is documented.)
Given that assumption, we no longer need
pureCopynor the contrast betweenOnlyDataandPureData. The namePureDatabetter suggests the strong property that we're allowing ourselves to assume. So we delete all uses ofpureCopyand occurrences ofOnlyDataor replace them withPureData.This PR also removes the long deprecated
ALLOW_IMPLICIT_REMOTABLESflag / environment variable. We have long ago switched it off by default and have gone for a long time without any need to turn it back on. At this point, we won't break anything by removing it.Agoric/agoric-sdk#4458 should go first, deleting uses of
pureCopywhich endo will no longer export.The only use of
sameValueZerowas in agoric-sdk, so between the two PRs, we're moving it there. The other PR should go first for this reason as well. This PR stops exporting it. Agoric/agoric-sdk#4458 stops importing, instead defining its own.