Nicholas Gheorghita, Jason Carver ~ Don't Go Postal

[Music] uh so i'm jason uh you may have noticed that this slide title is not the slides that uh you guys showed up for that's not a mistake um our our uh projects got our talks got kind of merged today so what's going to happen is for people who are just getting started with with python and using using python on evm i'm going to show you a qr code for these slides and you'll be able to come back later or you know on your time now to uh to get started up because nick's gonna start his talk in just a few moments and uh they'll assume that you know the basics of how to get connected with python so these are from my slides at devcon last year and they are just to get you started so here's a qr code for people who are interested in in this sort of intro level slides for the for the python um just random shout out for constantinople coming up in a couple weeks uh if you're not aware yet uh some intricacies of create two means that you can't assume dead contracts stay dead if they've been deployed after constantinople so check it out if that was news to you uh that's all i have for today and it's on to nick for the rest i'll be walking around if people have questions just raise your hand i'll come help you out what's the name of your blog post oh defend against wild magic defend against wild magic on medium google it and you'll find it all right we're gonna do some package management um this isn't really like a code long session because time is short but uh the code i'll be going through is here and so you can go steal it and play with it locally all right cool icebreaker hands up if you've ever used a package manager before in any operating system or any like language all right cool uh all right how about this hands up if you're a developer and you've never used a package manager all right cool so yeah this talk isn't to like um convince you we need a package manager in ethereum because those hands or lack of hands should be enough if you need convincing in the repo i just linked there's a good blog by uh nick from truffle okay so the first rule of epm is only install packages from trusted registries this is because in ethpm anybody can deploy their own package registry which means they can publish malicious packages to their package registry so if you don't trust whoever's in control of the package registry you're interacting with you could be dealing with malicious code so it's just something to be mindful of and just because you find a package that's available on reddit doesn't mean you should interact with it unless you uh trust the registry's owner um so yeah recently we have this um this uh vm explorer explorer for epm which basically like helps you interact with on-chain registries and we have a directory here and this just came out last week so it's pretty scarce but um here are some registries you can go explore and play with and like use their packages if you if you create your own registry and want to be listed here just send me a link in the getter channel and i'll include you okay so today's like storyline more or less is grandma has gone surfing and uh shark bit off her arm but luckily grandma's part of a financial savings co-op that provides funding for prosthetic arms but only if your arm's been bent off by a shark so she needs approval from a doctor to confirm that it was indeed a shark that bit off her arm basically we're going to deploy multi-sig the co-op will fund it and approve a transaction to give grandma funds and then the doctor will approve that it was a shark that bit off her arm and then grandma will be able to purchase a nice new arm so these are some words i'll be some words i'll be using um today registry it's basically a smart contract that lives on chain and it hosts all the data for your packages a package is basically a collection of package releases but what ties them all together is their package names so you'd have a wallet package or a multi-sig package or any kind of package you want a release or version is you know 1.0.0 1.0.1 and it's composed of a package name a version in epm we don't really care what versioning you use but some semantic versioning is suggested and the third component is a content address uri so this is your ipfs or swarm uri we also support github blobs and then a manifest is the json file that represents a release so it's basically just a big json object that has all the contract assets and the package name version in new york not the url but the uri like what is resolved at the uri is a json manifest all right so uh let's start with a little setup um so we're using some libraries today uh web3.

pi uh the this local library which is just some constants we'll also be using pythpm and eth utils and these are all open source libraries you can go check them out and contribute so we're just importing some good things to use in this next slide uh we're setting up some middleware so web3 provides this nice middleware to automatically sign and send your transactions instead of doing that uh manually more or less so on this line we use our private key to construct the middleware then we add it to our middleware onion we set the default account and then this last line is like a temporary flag since the package management api is still unstable it might change just for security you have to enable the package management api cool uh so yeah web3 more or less is the layer or what sits between uh you as a dev or your dap and the chain in the same way web3.pm is what sits between you the dev or adap and an on-chain registry and just provide some good functions to make it uh convenient to interact with your on-chain registry and as you can see it's just a python class and so web3d.pm like let's check out what the registry is and it says pm object has no registry and that's because again there is no like central package registry that should be used in ethpm um so we don't ship with a default registry you should be like cognizant of shout out uh of uh which registry you're attached to and make sure these are always trusted registries so here on this next line we're setting our registry to snakecharmers.eth this is a package registry that like i deployed and i control so if you trust me you can trust my packages if you don't trust me you shouldn't use it here this is all right so this is a coven registry it has a fair amount of packages all the datpub and other shout out packages some of the spec packages ens die registries some other things here is the snake charmers registry it's on the mainnet and these are the packages we have this multi-sig package is what we're going to be using today this is the gnosis multi-stick contracts that i packaged up you can see we have the version and the uri here the package name is multi-sig let's go check it out and this is basically like just a pretty view of the json file um like here is the this is the raw manifest the ipfs that's stored on ipfs just all the different fields for a manifest we have uh the contracts are available there the contract types are here which is basically like abi by codes compiler data et cetera so that's the package we're going to be playing with today and okay so yeah so we've set our registry to snake charmers and like use ens again like always use enos but you can see now we have set our registry and this is the snake charmers address okay so now we're deploying our save grandma multi-sig um the package is uh the one we'll be using is a today is a python class you need a manifest and a web 3 instance to instantiate your package it provides some nice helper functions and it's also chain agnostic so it doesn't matter what chain your registry lives on the package can interact with any chain so you can have your packages live on robston and store mainnet deployments on it so okay so on this line we're going to get our multisig package from the snake charmers registry and you can see it's returned this package class which is a python class again multisig 1.0.

1 which is that manifest i just showed you in the explorer and here this is just to confirm that we have what we want this is line 8 is just getting the release data from the registry and you can see these are like the unique identifiers for the package we're working with and then for our package instance here the the uri attribute is the same ipfs hash as is stored on chain okay so to deploy a new instance we need a factory and we have our multi-stick package instance and to get your multi-sig factory you just call get contract factory and pass in the contract type cool and so i'm everything's kind of on the main net here and i don't want to deploy contracts right now because it's iffy so i've deployed this contract earlier today but basically like it's a one-line deploy once you have your contract factory but again i'm not going to deploy it just use this hash to look up the transaction receipt cool so for all intents and purposes we have just deployed a new multi-sig instance that we're going to use to save grandma cool so now we've deployed this new instance using the gnosis multi-stick package but now we're going to create a new package which will contain this deployment and here we'll be using a builder tool that's from pi ethpm and basically it can either start from scratch and compose a new manifest or can extend an existing manifest also handles like pinning to ipfs and disk writing or writing to disk um again like this builder tool is a dev tool it's really meant for other tools to be built on top of it so it's not really like sexy and streamlined for like the dev experience um if you need a hackathon project build something to make it uh much nicer um so on this first line we're piping in the old manifest that we started with second line we're updating the version to 1.0.2 um this chunk we're adding the deployment so these are the different fields that go into a deployment to identify the on-chain deployment and here we're using the validate function to make sure that the resultant manifest conforms to the json schema the epm specification and then this last line we're pinning it to ipfs and we're using the inferior back end here but you can use the local ipfs or any other gateway if you want cool so our new package that we've just created has been pinned to ipfs and this is its hash and now we're creating this is the content address uri that will be sent to the on-chain registry to identify our package and really quick i'm going to grab the ens package from the registry while we're still connected to the trusted snake charmers registry because we're going to use the ens package in a second cool so this doctor has just deployed a new multi-sig and he wants to publish his package but he can't publish it to the snake charmers registry because he doesn't own it so he's going to deploy a new registry and then publish the package to his newly deployed registry but again like before a main net is iffy and i'm not going to deploy a new registry but i did one earlier today and this is its address and like we can so we can look up this uh package uh registry that was deployed earlier today and you can see it's just an empty registry um cool so um right right now this web 3 instance is connected to the snake charmers registry but we want to update that and um this is a one-liner to deploy a viper instance of the registry contract and set it to the active registry on your pm object um so it's a very easy to create your own on-chain registry but we're just going to set it to the one here just cool this is like the active registry um for our web3pm instance all right and so like just to harp a little bit more on it everyone should be using ens like passing it around contract addresses is just like not good at all and we have enough problems in this ecosystem with ux we shouldn't make it hard on ourselves so if you remember i grabbed the ens package just a couple steps ago and what we're going to do is we're going to tie this newly deployed registry to an ens name um i already own this e s name so we're not going to stay here for three days and wait for the contract to expire or the auction to expire but within this ens package everything you need to bid reveal finalize etc on an es name is available so we're going to get our resolver instance this is the instance on the main net uh our domain for our doctor is dr mantis toboggan and this is just to set the name hash and so right now dr mantis toboggan is set to this address which is ox8f but we're going to update it to our newly deployed registry address so all right some things okay so let's see um yeah so again we're using the resolver instance on the mainnet we just grabbed this from the ens package if you didn't notice i didn't copy any contract address i didn't copy any source code or bytecode or abi it was just very simple to grab and now i'm interacting with the ens on the mainnet hopefully this transaction processes quickly but we'll see yeah i guess cool all right there we go so the transaction is processed and just to like verify that everything worked um let's look up dr mantis toboggan.ethon our explorer and it should resolve to the same there you go that's the same registry that we just deployed so now we have a newly deployed registry tied to an ens name and only a couple lines all right so now we have this new registry let's publish our save grammar package to our registry so it's available if you remember i created the content address uri uh four or five slides ago and this is a web3pm method to easily release your package to your actively set registry which again is the doctor registry um this is a transaction so it will take a second uh the only in ethpm we don't care what versioning you use but the only rule is that once a package version has been released to a registry you can't release the same version twice um this is you know like if you release 1.0.

0 and then change it with a malicious version that's poor experience for whoever loses their money so um yeah once you release a package version it's the only version that's allowed on the registry forever you can delete it but then you won't be able to re-release a same or a different version of the same package this is taking a little um but it should go soon hopefully and if everything works so we're back to explore and this is the registry and hopefully very soon this will show this newly created package um yeah again like it's a very it's very simple to deploy your own registry on chain we have uh two reference implementations one's in viper and one's in solidity they're both erc compliant so the solidity one is a little more full-featured but it's also much larger and um more expensive to deploy the viper one's toned down and simple and just very very easy the viper default registry doesn't support deleting packages but there's another version you can that's available if you want to release it this is taking longer than expected but uh sooner or later it'll go through hey no i think it timed out all right yeah it timed out but i mean it'll come through soon i hope but let's just move on and then we'll catch up with it in a second okay come on now well yeah i mean this is what happens when you use main net in a live code demo and i don't have anything to fill this time so we're just going to skip this step but uh it's just another helper function to interact with your on-chain registry all right cool so now we've completed all these steps we've deployed a new multi-sig we've packaged up our deployment we've deployed a new package registry tied it to ens and we've published our new package to our registry all without like any copy and pasting all in like a couple lines or not that many lines of code so now let's start interacting with this new package which contains our new deployment and so now it's up to the co-op to fund and improve this save gram uh deployment so this is a new web3 instance it's connected to the mainnet and but it's already been gone through the automatic sign and send transaction middleware setup we started with but with a different private key so it's essentially just like different parties web3 instance and again the pm module doesn't ship with a default registry so we have to set the registry and here we're setting it to the doctors registry just to confirm that it has the correct registry or has a set registry address all right let's see if it's come all right cool there's the package we just published to our registry and it looks very similar to the package we explored earlier except for now at the bottom it has a deployment and this is our save grandma deployment that lives on the main net and you can see like this is the contract i deployed earlier today and you know let's go save grandma all right so again we're on the co-ops web 3 instance now they're connected to the doctors registry and they're right now they're grabbing the package that contains the save grandma deployment um this next line we just grabbed the contract instance of save grandma cool and uh so like just to get some bearings uh grandma has no ether the multi-sig contract has no ether but the co-op has some ether so we're going to send some money to the multisig to fund the multi-sig again another mainnet transaction so who knows how long this will take but basically what we're doing here is the co-op has grabbed the save grandma instance from the package and they're just uh sending some money to the contract deployment uh or to the deployed multi-sig and yes so it's again this is the gnosis multi-sig there are two parties on the multi-sig uh the doctor and the co-op and both of them need to approve a transaction for the transaction to be executed but of course if we're sending money um we have to fund the multisig first so cool looks like that happened all right so now the multisig has 0.01 ether which is plenty of money to buy a new prosthetic arm okay this next hat uh this next transaction now the co-op is submitting the transaction to send money to grandma um we're basically passing in the grandma's address and then uh how big we or how much money we want to send her and then empty bytes um so this will automatically confirm the transaction from the co-op's point of view so that's one out of two confirmations we need to send money to grandma to execute the transaction in the multi-sig it will only take a couple more seconds hopefully um yeah so we're we're approving here uh sending .005 ether to grandma so if everything works out well sooner or later this grandma will show .005 ether cool it looks like it went through all right so now the co-op has approved the transaction to save grandma now the doctor has to confirm that yes it was a shark that bit off her arm and she deserves this money um so now we're back to our initial web 3 instance which was the um with a doctor's private key and again we're setting the registry i think it's already set but just doing it again just in case and then we're grabbing the multi-sig package which now has a different version than the one we used earlier and 1.02 is the one that contains the deployment doctor's instance of the save grandma contract and now the doctor is confirming the transaction that will send money to grandma and we just wait for that to mine and then if this is the second of two required approvals so if this one goes through it will automatically send money to grandma because it tries to or the gnosis multi-stake tries to execute every time a transaction is confirmed still going um cool so how many people here are hacking this weekend how many people don't have ideas in our hacking this weekend all right well it's fine um all this all these libraries are open source you can play with them i it went through so i'll all right cool so if everything worked then grandma should have some money here and we can see grandma has money the multi-sigs been devalued by the transaction amount um and now she can she has a sweet new arm cool so i just kind of like talked for a long time and threw a lot of code there but i hope you recognize that like we didn't copy and paste any apis we didn't copy and paste any contract code we interacted only with verified trusted contract assets and we accomplished all these goals in like not very many lines of code um especially if i was on the test net that would have taken half the amount of time um and we saved grandma so that was a good accomplishment for everyone here today if you don't get anything else done like good job um all right so ethpm like if you're a developer like i hope you kind of like see where this is going and how this can be helpful to you we were using like the gnosis multisig is like a fairly simple one or single contract but like epm is capable of supporting infinite or much more complex smart contract systems so you can put as many contracts into a package as you want and if you package it up well then you can make any smart contract system available for developers to build on without having to copy contracts without having to like do all the finicky setup that you usually mess up and you spend two hours trying to fix it's a very easy one-line code to grab any package that you want yeah uh you know it makes prototyping very quick for or quick and easy for developers if you need an owned contract for some uh authentication authorization you just grab it with one line of code from a trusted registry install it and then you're good to go if you're developing a protocol and you want people to build on your protocol like package up your smart contracts and make them available to developers uh a good a a well-created package and good documentation is all a developer needs to start building on top of your protocol with like minimal code um if you're a consultant or an auditor or just looking for a job want to make a name in the space maintaining a registry with trusted packages is a great way to like get recognition in the space and if you're just a cool person who's into interesting things this is something you're or good for you um yeah i'm here all week we have a getter channel that's my name just ping me if you have any questions or if you want help i'd love to hear like any ideas for contracts you'd like to use um i'll help you like package them up and yeah i'm gonna oh that's it um okay cool the music has started uh thank you very much uh no just kidding uh here's a really good quote that i like a lot it helps i work in distributed team working on this like amorphous idea that nobody really knows what it is that is ethereum um and so yeah just like focus on building good things and we'll end up building something good together thanks [Applause]