vendor: document local patches, fix xxhash major-version path - #73
Open
DHEBP wants to merge 4 commits into
Open
Conversation
vendor/ has no modules.txt and the repo has no go.sum, so Go does not verify
vendored contents against any declared version. Three dependencies carry local
modifications that match no upstream commit, and `go mod vendor` reverts them
silently with no warning:
golang.org/x/net proxy/direct.go 5s dial timeout
github.com/deroproject/graviton extra.go KeyCountEstimate bound + return
github.com/chzyer/readline operation.go, std.go KickReader, ReadCloser
vendor/PATCHES.md records each one with its base revision so it can be
re-applied or dropped deliberately. Note graviton's KeyCountEstimate feeds
response.KeyCount/SCKeyCount in p2p/rpc_changeset.go and p2p/rpc_treesection.go,
so despite its "only used for use display" comment the value reaches peers.
Separately, astrobwt/astrobwtv3/pow.go imported github.com/cespare/xxhash while
the directory vendored at that path declares module github.com/cespare/xxhash/v2.
Legacy vendoring never checks this; it becomes a hard error once a modules.txt
exists. The vendored source is moved to its declared path and the import
corrected.
This does not change PoW digests. The vendored source is byte-identical to
xxhash/v2@v2.1.3-0.20220110224501-aa1a74e0bbdf, so the binary already hashed
with v2 -- the move is 22 renames at 100% similarity with no content change,
and the only edit is the import line. Independently, v1.1.0 and that v2 revision
were differential-tested and produce identical Sum64 digests across 21934 inputs
(all lengths 0-2048 over 8 seeds, degenerate patterns, block boundaries, and
4KiB/64KiB/1MiB), with the known vector XXH64("")==ef46db3751d8e999 reproduced
by both and a negative control confirming the comparison detects a difference.
vendor/github.com/lesismal/llib/concurrent also imports the v1 path but is not
in the build graph.
Same defect as the xxhash change in the previous commit. The directory vendored at github.com/ybbus/jsonrpc declares module github.com/ybbus/jsonrpc/v2, while both consumers import the bare path: cmd/rpc_examples/pong_server/pong_server.go walletapi/xswd/xswd_test.go Legacy vendoring never checks this; it becomes a hard build error once a vendor/modules.txt exists, since a v1 import cannot resolve to a v2 module. The vendored source is moved to its declared path and both imports corrected. Content is unchanged -- 7 renames at 100% similarity, the only edits being the two import lines. The vendored source matches github.com/ybbus/jsonrpc/v2@v2.1.7-0.20201223232054-8cad9379f023 exactly. Lower stakes than the xxhash case: this is reachable only from an example binary and a test, not from derod, the wallet, or any consensus path. go build ./... is clean and go vet ./walletapi/xswd/ passes (which compiles the test file), matching the pre-change baseline.
The graviton patch note said only that the value is sent to peers. The receiving node also computes with it: chunk count, section bit-depth and the <4096 whole-tree branch in chain_bootstrap.go all derive from it.
My earlier description of the graviton local patch was wrong and overstated it.
Upstream at v0.0.0-20220130070622-2c248a53b2e1 ALREADY contains the `>= 20`
early break; it does not walk the whole tree. Verified by diffing the pristine
module against the vendored copy: the delta is a single hunk, two lines.
The real local change is only the small-tree return:
upstream: if len(depth_array) <= 4 { return int64(count) }
vendored: if len(depth_array) <= 19 { return int64(len(depth_array)) }
`count` is a named return that is never assigned, so upstream yields 0 for trees
with <=4 keys; the local version reports the sampled count for trees up to 19.
Consequence of reverting is correspondingly smaller than previously stated: no
fastsync consumer branches differently at those magnitudes.
DHEBP
force-pushed
the
fix/vendor-patches-and-xxhash-path
branch
from
August 13, 2026 20:27
4c7d9ed to
b28955d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements steps 1 and 2 from #72. Not a bug fix -- the tree builds and runs
correctly today. This stops a routine cleanup from silently changing behaviour.
Three vendored deps carry local modifications matching no released version and no
upstream commit. "go mod vendor" reverts all three silently, no error, no warning:
golang.org/x/net proxy/direct.go 5s dial timeout
github.com/deroproject/graviton extra.go KeyCountEstimate bound
github.com/chzyer/readline operation.go, std.go KickReader, ReadCloser
PATCHES.md records each with its base revision, the change, its consumers, and
what breaks if reverted.
One for a maintainer: graviton's KeyCountEstimate is commented "only used for use
display", but the value reaches peers via p2p/rpc_changeset.go:93,:104 and
p2p/rpc_treesection.go:42. Flagged, not changed.
astrobwt/astrobwtv3/pow.go imported github.com/cespare/xxhash, but the directory
vendored at that path declares module github.com/cespare/xxhash/v2. Legacy
vendoring never checks this; it is a hard build error once a modules.txt exists.
github.com/ybbus/jsonrpc has the same defect, imported bare from
cmd/rpc_examples/pong_server and walletapi/xswd/xswd_test.go. Lower stakes -- not
reachable from derod, the wallet, or any consensus path -- fixed in its own
commit, 7 renames plus two import lines.
PoW digests are unchanged. The vendored source is byte-identical to
xxhash/v2@v2.1.3-0.20220110224501-aa1a74e0bbdf, so the binary already hashed with
v2; the diff is 22 renames at 100% similarity with the import line as the only
content edit. Separately, v1.1.0 and that revision differential-test identical on
21,934 inputs with controls -- detail in #72.
go build ./... clean, go test ./astrobwt/... and go vet ./walletapi/xswd/ pass,
matching the pre-change baseline.
Not included: go.sum, modules.txt, dependency upgrades -- step 4 in #72, and a
maintainer call.
Refs #72