coderabbitai[bot]
commented
2 weeks ago 📝 Walkthrough
## Walkthrough The `go.mod` file has been updated to reflect several dependency changes, including version upgrades and the addition of new dependencies. The Go toolchain version was updated from `go1.22.7` to `go1.22.8`. Key dependencies such as `github.com/gagliardetto/binary` and `gitlab.com/thorchain/tss/go-tss` have been modified, with the latter being updated to a new version. Several new dependencies have been introduced, and indirect comments have been removed from some existing dependencies. ## Changes | File | Change Summary | |---------------|----------------------------------------------------------------------------------------------------| | go.mod | - Updated Go toolchain version from `go1.22.7` to `go1.22.8` | | | - Updated dependency: `gitlab.com/thorchain/tss/go-tss` from `v0.0.0-20241031223543-...` to `v0.0.0-20241115165301-...` | | | - Added dependencies: `github.com/bnb-chain/tss-lib v1.5.0`, `github.com/montanaflynn/stats v0.7.1`, `github.com/showa-93/go-mask v0.6.2`, `github.com/tonkeeper/tongo v1.9.3` | | | - Updated `golang.org/x/mod v0.17.0` (removed indirect comment) | | | - Updated `github.com/gagliardetto/binary v0.8.0` (removed indirect comment) | ## Possibly related PRs - **#2847**: This PR updates the `go-tss` dependency in the `go.mod` file, which is directly related to the changes in the main PR that also involve updating the `go-tss` dependency to a new version. - **#3041**: This PR modifies the `go.mod` file to update the `go-tss` dependency version, which aligns with the dependency updates made in the main PR. - **#3139**: This PR involves changes to the orchestrator that may indirectly relate to the `go-tss` dependency updates, as it addresses issues in the signer resolution which could be affected by changes in the underlying dependencies. ## Suggested labels `UPGRADE_LIGHT_TESTS` ## Suggested reviewers - lumtis - swift1337 - kingpinXD - fbac - skosito - brewmaster012[!WARNING]
Rate limit exceeded
@gartnera has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 4 minutes and 58 seconds before requesting another review.
⌛ How to resolve this issue?
After the wait time has elapsed, a review can be triggered using the `@coderabbitai review` command as a PR comment. Alternatively, push new commits to this PR. We recommend that you space out your commits to avoid hitting the rate limit.🚦 How do rate limits work?
CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our [FAQ](https://docs.coderabbit.ai/faq) for further information.📥 Commits
Reviewing files that changed from the base of the PR and between 470ba7d8cbf373a998ecbf0d8d1212b59c872bff and 4e45902a37e86e48513eaa3a910f1824fee1f550.
📜 Recent review details
**Configuration used: .coderabbit.yaml** **Review profile: CHILL**📥 Commits
Reviewing files that changed from the base of the PR and between 470ba7d8cbf373a998ecbf0d8d1212b59c872bff and 4e45902a37e86e48513eaa3a910f1824fee1f550.⛔ Files ignored due to path filters (1)
* `go.sum` is excluded by `!**/*.sum`📒 Files selected for processing (1)
* `go.mod` (3 hunks)🔇 Additional comments (2)
go.mod (2)
`142-142`: **LGTM: Dependency comment updates** The removal of indirect comments from `github.com/gagliardetto/binary` and `golang.org/x/mod` indicates these are now direct dependencies, which aligns with their usage in the codebase. Also applies to: 298-298 --- `374-374`: **Verify the impact of TSS library replacement** The replacement of `gitlab.com/thorchain/tss/go-tss` with `github.com/zeta-chain/go-tss` is a critical change that addresses the infinite discovery address leak mentioned in the PR objectives. Let's verify the TSS library usage and potential impact:✅ Verification successful
Let me gather more information about the changes in the forked TSS library to understand the impact better. --- **TSS Library Update Addresses Critical Discovery Address Leak** The replacement of the TSS library with the forked version is verified to be a targeted security fix. The commit message from the forked repository explicitly confirms that it addresses the infinite discovery address leak issue. The change impacts multiple components across the codebase, but the modification is contained to the library replacement without requiring additional code changes. Key findings: - The TSS library is used across 10 different files in the codebase - The forked version (8535262eb16f) specifically fixes the infinite discovery address leak - All imports will automatically use the patched version due to the go.mod replacement directive🏁 Scripts executed
The following scripts were executed for the analysis: Script: ```shell #!/bin/bash # Search for TSS library imports and usage echo "Checking TSS library imports..." rg -l "gitlab.com/thorchain/tss/go-tss" echo "Checking TSS discovery-related function calls..." ast-grep --pattern 'discovery.$_($$$)' echo "Checking for any remaining thorchain TSS references..." rg "thorchain.*tss" ``` Length of output: 2110 --- Script: ```shell #!/bin/bash # Check the commit history of the forked TSS library echo "Checking the forked TSS library commit..." gh api repos/zeta-chain/go-tss/commits/8535262eb16f --jq '.commit.message' # Look for discovery-related code patterns echo "Checking discovery patterns in the codebase..." rg -A 3 "discovery" --type go # Check for any TSS configuration or setup code echo "Looking for TSS configuration..." ast-grep --pattern 'NewTssServer($$$)' ast-grep --pattern 'NewTssKeySign($$$)' ``` Length of output: 562Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?
https://github.com/zeta-chain/go-tss/pull/37
Will backport to release/v22 and release v22.1.1
No changelog since it will be released on v22
Summary by CodeRabbit