Skip to content

Commit da1ed1e

Browse files
nilslicenilslice
committed
chore: add tools directory and include modsurfer
Signed-off-by: Steve Manuel <[email protected]>
1 parent e2f4fac commit da1ed1e

File tree

3 files changed

+174
-0
lines changed

3 files changed

+174
-0
lines changed

‎tools/modsurfer/README.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Modsurfer Module Validation
2+
3+
Using the [Modsurfer](https://github.com/dylibso/modsurfer) tool to validate and scan your Spin
4+
modules is simple. Use the CLI or the [GitHub Action](https://github.com/modsurfer-validate-action)
5+
to ensure compatibility with the Fermyon Cloud or self-hosted Platform, and check for security or
6+
performance concerns before you deploy your code.
7+
8+
The easiest way to start is by using the GitHub Action. Add the following to your project repository:
9+
10+
#### `./github/workflows/modsurfer.yml`
11+
12+
```yaml
13+
name: Modsurfer Validate - Fermyon
14+
on: [push, pull_request]
15+
jobs:
16+
check-validate:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- uses: actions/checkout@v3
20+
- name: modsurfer validate
21+
uses: dylibso/modsurfer-validate-action@main
22+
with:
23+
path: path/to/your/module.wasm
24+
check: mod.yaml
25+
```
26+
27+
And include a "checkfile" in a file called `mod.yaml` (or whichever file you've referenced in the `check` field above):
28+
29+
```yaml
30+
validate:
31+
url: https://raw.githubusercontent.com/fermyon/spin/main/tools/modsurfer/http/mod.yaml
32+
```
33+
34+
The checkfile above uses a remote reference to ensure your Fermyon Spin project is compatible with
35+
the latest requirements of the Spin SDKs. This is based off the "http" templates. If you are using
36+
a different template, such as "redis", then find the related checkfile that matches the template
37+
you're using.

‎tools/modsurfer/http/mod.yaml

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# For more information about other checkfile options, see the documentation at https://dev.dylib.so/docs/modsurfer/cli#checkfile
2+
validate:
3+
allow_wasi: true
4+
imports:
5+
include:
6+
- namespace: wasi_snapshot_preview1
7+
name: fd_write
8+
params:
9+
- I32
10+
- I32
11+
- I32
12+
- I32
13+
results:
14+
- I32
15+
- namespace: wasi_snapshot_preview1
16+
name: random_get
17+
params:
18+
- I32
19+
- I32
20+
results:
21+
- I32
22+
- namespace: wasi_snapshot_preview1
23+
name: environ_get
24+
params:
25+
- I32
26+
- I32
27+
results:
28+
- I32
29+
- namespace: wasi_snapshot_preview1
30+
name: environ_sizes_get
31+
params:
32+
- I32
33+
- I32
34+
results:
35+
- I32
36+
- namespace: wasi_snapshot_preview1
37+
name: proc_exit
38+
params:
39+
- I32
40+
results: []
41+
namespace:
42+
include:
43+
- wasi_snapshot_preview1
44+
exports:
45+
include:
46+
- name: handle-http-request
47+
params:
48+
- I32
49+
- I32
50+
- I32
51+
- I32
52+
- I32
53+
- I32
54+
- I32
55+
- I32
56+
- I32
57+
- I32
58+
results:
59+
- I32
60+
- name: canonical_abi_realloc
61+
params:
62+
- I32
63+
- I32
64+
- I32
65+
- I32
66+
results:
67+
- I32
68+
- name: canonical_abi_free
69+
params:
70+
- I32
71+
- I32
72+
- I32
73+
results: []
74+
max: 3
75+
complexity:
76+
max_risk: medium

‎tools/modsurfer/redis/mod.yaml

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# For more information about other checkfile options, see the documentation at https://dev.dylib.so/docs/modsurfer/cli#checkfile
2+
validate:
3+
allow_wasi: true
4+
imports:
5+
include:
6+
- namespace: wasi_snapshot_preview1
7+
name: fd_write
8+
params:
9+
- I32
10+
- I32
11+
- I32
12+
- I32
13+
results:
14+
- I32
15+
- namespace: wasi_snapshot_preview1
16+
name: environ_get
17+
params:
18+
- I32
19+
- I32
20+
results:
21+
- I32
22+
- namespace: wasi_snapshot_preview1
23+
name: environ_sizes_get
24+
params:
25+
- I32
26+
- I32
27+
results:
28+
- I32
29+
- namespace: wasi_snapshot_preview1
30+
name: proc_exit
31+
params:
32+
- I32
33+
results: []
34+
namespace:
35+
include:
36+
- wasi_snapshot_preview1
37+
exports:
38+
include:
39+
- name: handle-redis-message
40+
params:
41+
- I32
42+
- I32
43+
results:
44+
- I32
45+
- name: canonical_abi_realloc
46+
params:
47+
- I32
48+
- I32
49+
- I32
50+
- I32
51+
results:
52+
- I32
53+
- name: canonical_abi_free
54+
params:
55+
- I32
56+
- I32
57+
- I32
58+
results: []
59+
max: 3
60+
complexity:
61+
max_risk: medium

0 commit comments

Comments
 (0)