pharpend
b680336ba4
======================
NACL mental disability
======================
NACL is mentally disabled and can't be loaded as an ES6 module. That is, it can't be
"imported" using
```js
import * as nacl from './path/to/nacl.js';
```
Instead you have to include it in a page. So we have a page called
`background.html`.
I naively tried this
```html
<script src="dist/jex_include/local-nacl-1.0.3/nacl.js"></script>
```
That of course didn't work because we live in hell.
I initially thought the problem was an invalid hash. No. Notes as I figure it
out:
Trying to figure out why TweetNaCl isn't loading
ok so the problem is not an invalid hash, it's something specific
to nacl
to have an inline script, its hash must be specified in
manifest.json
example (integrity key is not necessary, it is there purely for
comment purposes)
beginning of line
V
| <script integrity="sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=">console.log('bg-test-inline.js line 1!');
|</script>
newline is there for hash purposes
this works if and only if
'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw=' is included
in the manifest.json
example (top level key):
"content_security_policy" : "script-src 'self' 'sha256-8T3dvQxHPNQvgxzCemw3KGUCM5RhknpCQF6pCcTdFTw='; object-src 'self'",
Absent that explicit allow, I get this error from Firefox:
Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”).
Refs:
1. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/content_security_policy
2. https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/Content_Security_Policy#inline_javascript
If I include the same script as a file,
<script src="bg-test-inline.js"></script>
this works irrespective of if I specify it as allowable in the manifest
nacl is just refusing to load
Loading failed for the <script> with source “moz-extension://eafd6a74-b75b-4312-9a34-8087b68395e7/dist/jex_include/local-nacl-1.0.3/nacl.js”.
I initially thought it was a hash problem, but it is not
TweetNaCL doesn't work as an ES6 module, it works by destructively
updating the window namespace. This I think was necessary before
ES6, and that behavior is retained either because of laziness or
because of backward compatibility reasons.
hmm
so this just plainly doesn't work and i cannot figure out why
<script src="dist/jex_include/local-nacl-1.0.3/nacl.js"></script>
I think it works if I do it in the popup window instead. Let's try
oh no
no
oh my god
i am so stupid
the problem was that i typed the url wrong
the package is "tweetnacl" not "nacl", and i also need /dist/ too
<script src="dist/jex_include/local-tweetnacl-1.0.3/dist/nacl.js"></script>
that works
all this time i thought that it was the browser that was mentally disabled
it turned out the mental disability was inside me all along
alright well I discovered a potential future pitfall at least
Vanillae
Vanillae is an Aeternity tool suite meant for small business use cases. Focus is placed on ease-of-use, simplicity, code quality, and good documentation.
You can read the grant proposal for more information about what this project is.
Vanillae is (intentionally) a very minimal toolset that only covers the most common Aeternity use cases. We also do not have any tooling for the Node/NPM ecosystem. If you have a more complicated use case or live in the Node/NPM ecosystem, you want the Aeternity JavaScript SDK. The SDK is a Swiss Army Knife. Vanillae is just a knife.
Vanillae grew out of Aegora.jp. We made a simple e-commerce store using Aeternity as the payment system. We encountered a lot of rough edges in Aeternity's tooling, and so developed our own, and open-sourced it. That became this project
Our tooling is grouped according to the project that spawned it
-
We needed the ability to talk to Superhero (the standard Aeternity browser wallet extension) from our page script. Sidekick is a simple library to do just that.
-
Sidekick Examples illustrate how to use sidekick
-
AWCP: the aepp/waellet communication protocol
This is the definition of the messaging protocol between the page script and the wallet. Sidekick implements one half of this protocol.
-
We encountered packaging as an obvious problem to solve, and NPM is simply a terrible way to solve it. Jex is a TypeScript/JavaScript package manager that avoids most of the NPM-related security issues.
-
-
Our server backend is written in Erlang. We needed to talk to the blockchain from our server backend. Vanillae.erl is an Erlang application that does that.
It is designed in such a way that you could write say a Vanillae Go library with an identical API but totally different internals. Ultimately the idea here is to create a language-agnostic API for talking to the Aeternity blockchain from the
-
Jaeck Russell: this is a (work-in-progress) simpler wallet than Superhero
-
Vanillae Files: any time where we encountered some weird thing that is like 1 hour of information but takes 15 hours to understand because it's poorly documented, we tried to document it here.