Find a good solution to tree_hash's getrandom dependency

[gjermundgaraba]

One of the libraries we use in the 08-wasm ethereum light client, tree_hash, has a downstream dependency on the library getrandom. The dependency graph we are talking about is tree_hash -> ethereum_hashing -> ring -> getrandom.

The reason getrandom is problematic is because it doesn't compile to CosmWasm (error at the bottom of the issue). Enabling "js" somehow would not solve the problem since CosmWasm doesn't have support for that either.

The current solution solved the problem at the ´tree_hash` level by forking and removing the ethereum_hashing dependency, which just does Sha256 with either sha2 or ring, depending on the platform.

Some potential solutions include:

• Forks (and maintain ourselves)
  • Keep a fork of tree_hash like we do today - potentially finding a less invasive solution than the current one that makes changes from upstream easier to integrate.
  • Forking the etheruem_hash library and remove the ring dependency (or add a feature flag that disables it entirely)
• Upstream a solution (i.e. avoiding having a fork - at least long-term)
  • Find a way to add a feature flag in either tree_hash or etheruem_hashing that we can upstream and therefore avoid having a fork to maintain
  • Go really deep and try to find a solution to add a feature flag in ´ring` that enables it to compile to CosmWasm (and get it upstreamed)

Error from running: cargo build --release --lib --target wasm32-unknown-unknown -p cw-08-wasm-etheruem-light-client

   Compiling getrandom v0.2.15
error: the wasm*-unknown-unknown targets are not supported by default, you may need to enable the "js" feature. For more information see: https://docs.rs/getrandom/#webassembly-support
   --> /Users/gg/.cargo/registry/src/index.crates.io-6f17d22bba15001f/getrandom-0.2.15/src/lib.rs:342:9
    |
342 | /         compile_error!("the wasm*-unknown-unknown targets are not supported by \
343 | |                         default, you may need to enable the \"js\" feature. \
344 | |                         For more information see: \
345 | |                         https://docs.rs/getrandom/#webassembly-support");
    | |________________________________________________________________________^

error[E0433]: failed to resolve: use of undeclared crate or module `imp`
   --> /Users/gg/.cargo/registry/src/index.crates.io-6f17d22bba15001f/getrandom-0.2.15/src/lib.rs:398:9
    |
398 |         imp::getrandom_inner(dest)?;
    |         ^^^ use of undeclared crate or module `imp`

For more information about this error, try `rustc --explain E0433`.
error: could not compile `getrandom` (lib) due to 2 previous errors
warning: build failed, waiting for other jobs to finish...
The following warnings were emitted during compilation:

warning: ring@0.17.8: error: unable to create target: 'No available targets are compatible with triple "wasm32-unknown-unknown"'
warning: ring@0.17.8: 1 error generated.

error: failed to run custom build command for `ring v0.17.8`

[gjermundgaraba]

Potentially related issues: CosmWasm/cosmwasm#1143

In this ring issue, the maintainer is mentioning being open to accepting PRs for enabling more wasm32-unknown-unknown environments: briansmith/ring#1921

[larry0x]

Here's where in ring it uses getrandom:

https://github.com/briansmith/ring/blob/8eee46910095cee0f9f6e07d7da6115f749bf52c/src/rand.rs#L121-L166

You see it's only included on certain OS's. Specifically for wasm32, only wasi applies, not wasm32-unknown-unnown unless a wasm32_unknown_unknown_js feature is activated.

However in Cargo.toml, getrandom is imported regardless of OS or feautre:

[dependencies]
getrandom = { version = "0.2.10" }

You should make an issue in ring to fix this... tell them to make a condition on importing getrandom:

[target.'cfg(...........)'.dependencies]
getrandom = { version = "0.2.10" }

[webmaster128]

Not much to add to Larry's answer.

Maybe some context: this is not CosmWasm specific. By default no Wasm supports randomness since it is a sandbox that cannot access any randomness API. The hint regarding the "js" feature is misleading unfortunately as it only helps for Wasm in JS environments like browsers. Usually in such cases it can be tricky to find the exact user of getrandom. But getting that out of the dependency tree is important and the way to go.