crossbario / crossbario/autobahn-python
Document AUTOBAHN_STRIP_XBR install-time option
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 2.5k
- Forks
- 768
- PR merge metrics
- No merged PRs in 30d
Description
The current behavior for autobahn is to install a bunch of xbr modules even when the user does not request them to be installed.
There are a number of reason this is a bad idea:
-
Packages should not install modules that are not relevant to the typical use case for the package without strong technical justification as this can significantly increase attack surface, especially for a package like
autobahnwhich already has significant network attack surface(in one of my projects it's effectively the only package doing any remote network communications over public networks other than the usual DNS/DHCP/VPN client daemons). -
Over time the demarcation point between the
xbrmodules andautobahnmay become less clear which increases the security audit complexity, already this seems to be starting to happen as there arexbrmodules in multiple different autobahn paths. By splitting the modules into a separate package it becomes very obvious that they are not relevant to the typical use case and thus can be ignored when auditing security. -
In regards to the security of
xbrspecifically, it is well known in the cryptocurrency community that the Ethereum project has a very poor track record in regards to security in general, in fact I have personally discovered security vulnerabilities in the design of some ETH network protocols in the past. Being able to fully remove potentially risky Ethereum project related code makes it easier to audit the security of autobahn. -
The maintenance of the conditional loading of imports is more complex than using conditional installation of the
xbrmodules.
The approach I took in #1369 to splitting out the xbr package from autobahn has a number of advantages:
-
It cleanly separates out the
xbrfeature from the rest of autobahn so that one doesn't need to audit the security of thexbrside to ensure it can't accidentally cause runtime side effects when using baseautobahnfunctionality. -
It still allows for
xbrandautobahnto be developed in a tightly coupled way, for example by always having both packages require exact versions of each other in the setup.py(you can just script the package version bump to always bump and uploadautobahnandxbrat the same time with matching versions). They will still share and install to the sameautobahnsite-packages namespace as before and can be installed in the same way by the end user, the main difference is that the development tree and distribution packages have cleanly separated functionality and thatautobahncan be installed withoutxbr. -
It allows for simplification of the
xbrparts of the codebase as one can entirely remove all the conditional dependency based import logic currently used throughout thexbrcomponents asxbrwould only ever be installed when all necessary dependencies are also installed.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the proposed split in #1369 and the setup.py package configuration to understand the AUTOBAHN_STRIP_XBR install-time option. Document how the option affects installation and the separate xbr package, then verify that the documentation matches the packaging behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100