Skip to content
This repository has been archived by the owner on Jan 24, 2025. It is now read-only.

Update local-setup.md and security-intro.md #412

Closed
wants to merge 3 commits into from
Closed

Update local-setup.md and security-intro.md #412

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0faf1df
Update security-intro.md
donnie-near Sep 2, 2024
c20f73c
Update local-setup.md
donnie-near Sep 3, 2024
05a06a1
Update local-setup.md
donnie-near Sep 3, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 27 additions & 50 deletions content/courses/onchain-development/local-setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,61 +1,47 @@
---
title: Local Program Development
objectives:
- Set up a local environment for Solana program development, with Solana CLI
tools, Rust and Anchor.
- Ensure Anchor works out of the box with no errors or warnings
- Set up a local environment for Solana program development, including Solana CLI tools, Rust, and Anchor.
- Ensure Anchor works out of the box with no errors or warnings.
description:
"Setup a local development environment for building onchain programs."
"Set up a local development environment for building onchain programs."
---

## Summary

- To develop onchain programs on your machine, you need **Solana CLI**, **Rust**
and (optional, but recommended) **Anchor**.
- You can use `anchor init` to create a new blank Anchor project
- `anchor test` runs your tests, and also builds your code.
- To develop onchain programs on your machine, you need **Solana CLI**, **Rust**, and (optional, but recommended) **Anchor**.
- You can use `anchor init` to create a new blank Anchor project.
- `anchor test` runs your tests and also builds your code.

## Lesson

There's no lesson here! Let's install Solana CLI tools, the Rust SDK, and
Anchor, and create a test program to ensure that our setup works.
There’s no formal lesson here! Let’s install Solana CLI tools, the Rust SDK, and Anchor, and create a test program to ensure that everything is set up correctly.

## Lab

#### Extra steps for Windows users
### Extra Steps for Windows Users

Firstly install
[Windows Terminal](https://apps.microsoft.com/detail/9N0DX20HK701) from the
Microsoft store.
1. First, install [Windows Terminal](https://apps.microsoft.com/detail/9N0DX20HK701) from the Microsoft Store.

Then
[install Windows Subsystem for Linux (WSL)](https://learn.microsoft.com/en-us/windows/wsl/install).
WSL provides a Linux environment that launches instantly whenever you need it
and doesn't slow your computer down.
2. Next, [install Windows Subsystem for Linux (WSL)](https://learn.microsoft.com/en-us/windows/wsl/install). WSL provides a lightweight Linux environment that you can launch instantly whenever needed without slowing down your computer.

Start Windows Terminal, launch an 'Ubuntu' session inside the terminal, and
proceed with the rest of these steps.
3. Start Windows Terminal, launch an 'Ubuntu' session inside the terminal, and proceed with the steps below.

#### Download Rust

First, download Rust by
[following the instructions](https://www.rust-lang.org/tools/install):
### Download Rust

Begin by [downloading Rust](https://www.rust-lang.org/tools/install) with the following command:
```
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
```

#### Download the Solana CLI tools

Next
[download the Solana CLI tools](https://docs.solana.com/cli/install-solana-cli-tools).
Next [download the Solana CLI tools](https://docs.solana.com/cli/install-solana-cli-tools) using this command:

```
sh -c "$(curl -sSfL https://release.anza.xyz/stable/install)"
```

Afterwards, `solana -V` should show `solana-cli 1.18.x` (any number for `x` is
fine).
After installation, running `solana -V` should show `solana-cli 1.18.x` (the x can be any number).

#### Download Anchor

Expand All @@ -67,12 +53,11 @@ avm install latest
avm use latest
```

Afterwards, `anchor -V` should show `anchor-cli 0.30.0`.
After installation, running `anchor -V` should show `anchor-cli 0.30.0`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This isn't the current version of Anchor.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, I'm currently prioritizing updates with lower complexity. Thank you for the feedback—I have already implemented the necessary changes


#### Check your Anchor installation

Create a temporary project, with the default contents, using Anchor and make
sure it compiles and runs our tests:
Create a temporary project with the default contents using Anchor, and verify that it compiles and runs your tests:

```bash
anchor init temp-project
Expand All @@ -81,37 +66,29 @@ anchor test
```

**The `anchor test` command should complete with no errors or warnings**.
However you may encounter issues, and we'll fix them below:
However, if you encounter issues, here’s how to resolve some common problems:

##### `package `solana-program v1.18.12` cannot be built because it requires rustc 1.75.0 or newer` error
##### Error: `package `solana-program v1.18.12` cannot be built because it requires rustc 1.75.0 or newer`

Run `cargo add solana-program@"=1.18.x"`, where `x` matches your version of
`solana-cli`. Then re-run `anchor test`.
Run `cargo add solana-program@"=1.18.x"`, where `x` matches your version of `solana-cli`. Then re-run `anchor test`.

##### `Error: Unable to read keypair file`
##### Error: `Unable to read keypair file`

Add a keypair to `.config/solana/id.json`. You can either copy a keypair from an
`.env` file (just the array of numbers) into a file or use the command
`solana-keygen new --no-bip39-passphrase` to create a new keypair file. Then
re-run `anchor test`.
Add a keypair to `.config/solana/id.json`. You can either copy a keypair from an `.env` file (just the array of numbers) into a file or use the command `solana-keygen new --no-bip39-passphrase` to create a new keypair file. Then re-run `anchor test`.

##### `unused variable: 'ctx'` warning
##### Warning: `unused variable: 'ctx'`

This simply means the `initialize` instruction handler isn't doing anything yet.
You can open `programs/favorites/src/lib.rs` and change `ctx` to `_ctx` or just
This simply means the `initialize` instruction handler isn't doing anything yet. You can open `programs/favorites/src/lib.rs` and change `ctx` to `_ctx` or just
go onto the next step.

##### `No license field in package.json` warning
##### Warning: `No license field in package.json`

Open package.json, add `"license": "MIT"` or `"license": "UNLICENSED"` depending
on preferences
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can remove these, they're fixed in Anchor 0.30.1.


#### All done?

Ensure `anchor test` completes successfully - with no warnings and no errors -
before continuing.
Ensure `anchor test` completes successfully, with no warnings or errors, before moving on.

<Callout type="success" title="Completed the lab?">
Push your code to GitHub and
[tell us what you thought of this lesson](https://form.typeform.com/to/IPH0UGz7#answers-lesson=aa0b56d6-02a9-4b36-95c0-a817e2c5b19d)!
<Callout type="success" title="Completed the lab?"> Push your code to GitHub and [let us know what you thought of this lesson](https://form.typeform.com/to/IPH0UGz7#answers-lesson=aa0b56d6-02a9-4b36-95c0-a817e2c5b19d)!
</Callout>
75 changes: 35 additions & 40 deletions content/courses/program-security/security-intro.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,48 +1,43 @@
---
title: How to approach the Program Security module
title: How to Approach the Program Security Module
objectives:
- understand how to approach the Program Security Module
description:
"Learn how to think intelligently about security for your onchain programs,
whether developing in Anchor or in Native Rust."
- Understand how to approach the Program Security Module
description: >
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What does the > do?

Learn how to think intelligently about security for your onchain programs,
whether developing in Anchor or in Native Rust.
---

## Overview

The goal of this course is to expose you to a wide variety of common security
exploits that are unique to Solana development. We’ve heavily modeled this
course off Coral's
The goal of this course is to expose you to a wide variety of common security exploits
that are unique to Solana development. This course is heavily based on Coral's
[Sealevel Attacks](https://github.com/coral-xyz/sealevel-attacks) repo.

We've covered program security in our
[Anchor](/content/courses/onchain-development.md) and
[native Rust](/content/courses/native-onchain-development.md) development
courses because we wanted to make sure that anyone deploying programs to Mainnet
right out of the gates had at least a basic understanding of security. And if
that’s you then hopefully the fundamental principles you learned in that lesson
have led to you avoiding some common Solana exploits on your own.

This unit is meant to build on top of that lesson with two goals in mind:

1. To expand your awareness of the Solana programming model and the areas where
you need to focus to close up security loopholes in your programs
2. To show you the array of tools provided by Anchor to help you keep your
programs secure

If you went through the Basic Security lesson, the first few lessons should seem
familiar. They largely cover topics we discussed in that lesson. After that,
some of the attacks may seem new. We encourage you to go through all of them.

The last thing to call out is that there are a lot more lessons in this course
than in prior course. And the lessons aren't dependent on each other in the same
ways, so you can bounce around a bit more if you'd like.

Originally, we were going to have more, shorter lessons in this course. And
while they might be shorter than average, they aren't much shorter. It turns out
that even though each of the security vulnerabilities is "simple," there's a lot
to discuss. So each lesson may have a little bit less prose and more code
snippets, making it easy for readers to choose how in depth to go. But,
ultimately, each lesson is still as fully-fledged as they have been before so
that you can really get a solid grasp on each of the discussed security risks.

As always, we appreciate feedback. Good luck digging in!
We've already covered program security in our
[Anchor](https://github.com/solana-foundation/developer-content/tree/main/content/courses/onchain-development) and
[Rust native](https://github.com/solana-foundation/developer-content/tree/main/content/courses/native-onchain-development) development
courses because we want to ensure that anyone deploying programs to Mainnet has at least a
basic understanding of security. If that's you, we hope the fundamental principles you learned
in those lessons have helped you avoid some common Solana exploits.

This unit is meant to build on top of that lesson with two main goals:

1. To expand your understanding of the Solana programming model and the areas where you need to
focus to close security loopholes in your programs.
2. To show you the set of tools provided by Anchor to help you keep your programs secure.

If you went through the Basic Security lesson, the first few lessons should feel familiar as they
largely cover topics we've discussed before. After that, some of the attacks may seem new to you.
We encourage you to go through all of them.

One last thing to note is that there are more lessons in this course than in prior ones.
Since the lessons aren't as dependent on each other, you can explore them in any order you prefer.

Originally, we intended to have shorter lessons in this course. While they might be slightly
shorter than average, they are still comprehensive. Even though each security vulnerability
is "simple," there is a lot to discuss. As a result, each lesson might have less prose and more
code snippets, making it easier for readers to choose how deeply they want to dive in.
However, each lesson is still fully developed so that you can thoroughly grasp each of the
discussed security risks.

As always, we appreciate your feedback. Good luck diving in!
Loading