Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CLI] Deprecation warnings for dependency verification (DVX-698) #20977

Merged
merged 13 commits into from
Feb 6, 2025

Conversation

mdgeorge4153
Copy link
Contributor

@mdgeorge4153 mdgeorge4153 commented Jan 24, 2025

Description

This adds a warning that source verification will become opt-in instead of opt-out in a future release, along with the --verify-deps flag that currently disables the warning.

Test plan

Several shell tests that cover the behavior with no flags, with both flags, and with each flag independently, on a package with source that has changed since publication. See the snapshot files for the tests and expected output.


Release notes

Check each box that your changes affect. If none of the boxes relate to your changes, release notes aren't required.

For each box you select, include information after the relevant heading that describes the impact of your changes that a user might notice and any actions they must take to implement updates.

  • Protocol:
  • Nodes (Validators and Full nodes):
  • gRPC:
  • JSON-RPC:
  • GraphQL:
  • CLI: publication and upgrade will now warn that source verification will become opt-in in a future release; the warning can be disabled with either --skip-dependency-verification or the new --verify-deps flags
  • Rust SDK:

Copy link

vercel bot commented Jan 24, 2025

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
sui-docs ✅ Ready (Inspect) Visit Preview 💬 Add feedback Feb 6, 2025 8:55pm
2 Skipped Deployments
Name Status Preview Comments Updated (UTC)
multisig-toolkit ⬜️ Ignored (Inspect) Visit Preview Feb 6, 2025 8:55pm
sui-kiosk ⬜️ Ignored (Inspect) Visit Preview Feb 6, 2025 8:55pm

@mdgeorge4153 mdgeorge4153 temporarily deployed to sui-typescript-aws-kms-test-env January 24, 2025 21:04 — with GitHub Actions Inactive
@mdgeorge4153 mdgeorge4153 changed the title Mdgeorge/source verification deprecation [DVX-698] Deprecation warnings for dependency verification Jan 24, 2025
@mdgeorge4153 mdgeorge4153 temporarily deployed to sui-typescript-aws-kms-test-env February 3, 2025 21:13 — with GitHub Actions Inactive
@mdgeorge4153 mdgeorge4153 changed the title [DVX-698] Deprecation warnings for dependency verification [CLI] Deprecation warnings for dependency verification (DVX-698) Feb 3, 2025
Copy link
Contributor

@stefan-mysten stefan-mysten left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Love the comprehensive tests. Thanks @mdgeorge4153!

In a follow up PR we should probably address these flags also for sui client ptb. Unfortunately, if one creates a PTB for publish/upgrade, we cannot pass there the skip-deps-verification.
We might want to add those, not 100% sure though.
cc @tzakian

@stefan-mysten
Copy link
Contributor

A small nit: I would say we should aim at having a concrete target release when this gets deprecated and put it both in the message and in the release notes.

@mdgeorge4153 mdgeorge4153 temporarily deployed to sui-typescript-aws-kms-test-env February 6, 2025 20:54 — with GitHub Actions Inactive
@mdgeorge4153 mdgeorge4153 merged commit e9fd794 into main Feb 6, 2025
47 checks passed
@mdgeorge4153 mdgeorge4153 deleted the mdgeorge/source-verification-deprecation branch February 6, 2025 21:33
mdgeorge4153 added a commit that referenced this pull request Feb 6, 2025
)

## Description 

This adds a warning that source verification will become opt-in instead
of opt-out in a future release, along with the `--verify-deps` flag that
currently disables the warning.

## Test plan 

Several shell tests that cover the behavior with no flags, with both
flags, and with each flag independently, on a package with source that
has changed since publication. See the snapshot files for the tests and
expected output.

---

## Release notes

Check each box that your changes affect. If none of the boxes relate to
your changes, release notes aren't required.

For each box you select, include information after the relevant heading
that describes the impact of your changes that a user might notice and
any actions they must take to implement updates.

- [ ] Protocol: 
- [ ] Nodes (Validators and Full nodes): 
- [ ] gRPC:
- [ ] JSON-RPC: 
- [ ] GraphQL: 
- [X] CLI: publication and upgrade will now warn that source
verification will become opt-in in a future release; the warning can be
disabled with either `--skip-dependency-verification` or the new
`--verify-deps` flags
- [ ] Rust SDK:
stefan-mysten pushed a commit that referenced this pull request Feb 7, 2025
)

## Description 

This adds a warning that source verification will become opt-in instead
of opt-out in a future release, along with the `--verify-deps` flag that
currently disables the warning.

## Test plan 

Several shell tests that cover the behavior with no flags, with both
flags, and with each flag independently, on a package with source that
has changed since publication. See the snapshot files for the tests and
expected output.

---

## Release notes

Check each box that your changes affect. If none of the boxes relate to
your changes, release notes aren't required.

For each box you select, include information after the relevant heading
that describes the impact of your changes that a user might notice and
any actions they must take to implement updates.

- [ ] Protocol: 
- [ ] Nodes (Validators and Full nodes): 
- [ ] gRPC:
- [ ] JSON-RPC: 
- [ ] GraphQL: 
- [X] CLI: publication and upgrade will now warn that source
verification will become opt-in in a future release; the warning can be
disabled with either `--skip-dependency-verification` or the new
`--verify-deps` flags
- [ ] Rust SDK:
mdgeorge4153 added a commit that referenced this pull request Feb 7, 2025
…cation (#21127)

## Description 

This adds a warning that source verification will become opt-in instead
of opt-out in a future release, along with the `--verify-deps` flag that
currently disables the warning.

## Test plan 

Several shell tests that cover the behavior with no flags, with both
flags, and with each flag independently, on a package with source that
has changed since publication. See the snapshot files for the tests and
expected output.

## Release notes

Check each box that your changes affect. If none of the boxes relate to
your changes, release notes aren't required.

For each box you select, include information after the relevant heading
that describes the impact of your changes that a user might notice and
any actions they must take to implement updates.

- [ ] Protocol: 
- [ ] Nodes (Validators and Full nodes): 
- [ ] gRPC:
- [ ] JSON-RPC: 
- [ ] GraphQL: 
- [X] CLI: publication and upgrade will now warn that source
verification will become opt-in in a future release; the warning can be
disabled with either `--skip-dependency-verification` or the new
`--verify-deps` flags
- [ ] Rust SDK:
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants