ethPM is Code Legos – Nick Gheorghita

hello I'm Nick I work at the etherium foundation on the Python team a snake charmer if you will and I've been spending a lot of time working on each p.m. the theory and package manager and I'm here hopefully today to convince you why it should be a part of your development pipeline and your daily workflow cool so eath is money logos I think it's a pretty spiffy meme does a good job of extracting away all the confusing things and illustrating what you can do with composability you can build cool Lego masterpieces and also as a developer and I think most developers share this we all loved Legos at some point in our lifetime maybe still personally I was more of a connects guy so eat this money connect but you know the idea is the same so I'd like to present or to present that eath p.m. is code Legos so when we talk about Legos what is a Lego I think a Lego is an idea a smart contract idea but it also could be a community it can be a company it can be just a single developer but what these all these Lego abstractions share is that they require code to be an actual Lego the code is what goes on the blockchain and that is what we compose together to build new Legos or new Lego models so who here has used Oken Zeppelin hopefully some of you right it's a pretty phenomenal organization I think the whole ecosystem would struggling without them they provide like really great LEGO pieces they also are focused on the fundamental building blocks so think like 2x2 LEGO pieces or 4x2 LEGO pieces very important but limiting you can't build really intricate fancy things with just square bricks so I'd like to present that are present that an e PM uri is equivalent to a Lego brick and it doesn't have to be a 2x2 it can be any kind of Lego brick it can be a person Lego wheel a rocket Lego but the idea of the Lego is contained in this string and this is what we call an EP M URI and so it starts off with the scheme which is EPM it's followed by the registry address which should be ENS contract addresses are fine but honestly no one should be using them anymore everyone should be using e NS followed by the chain ID which is optional if it's left out it defaults to the main net and then you have the package name and the package version and within this string you can capture any EPM package on any registry pretty much any like Lego you want to pass around cool so now let's play with some Legos hopefully this works out we'll see alright so in the EPM there are many ways to use each VM but the easiest way is with the our CLI tool and so this is just it's pretty similar to other CLI package managers right now we have nothing available but so let's see let's pretend it's a year 2500 and some virus has mysteriously wiped out all humanity about 480 years before and you're scrolling the blockchain looking for some good has historic data on what happened so with this activate command you can activate any EPM package right in your command line so we have this URI which would be all right and so that's the p.

m. URI for the Lu Han here a doctor package and right now it's going to the registry looking up the IP FS hash and then it's going to ipfs and grabbing the package and then it's making all the package assets available and so you can see we have one contract instance that was available from this package and we can use it right here and I think it's inscription and so yeah this is the formatting is weird but this is the data on the blockchain and the doctor's name is in there somewhere so now you know a little bit more about how humanity was wiped out but okay so that was just activating a package we're not writing anything to disk we're just playing with LEGOs and so maybe something a little more present would be e 2 and e 2 we have this deposit contract which is responsible for managing the eath 1 deposits so this is I think it's pretty much done but if you just you're interested in what's going on or you want to keep up to date as new PRS are merged in you can use your CLI so here we'll install it and the URI will be from the e2 registry a deposit contract and so again this is going to the registry fetching the ipfs hash of the package and then you an IP FS and then since we installed it it's writing it to disk and now you can see with the list command we have it available and if you want to go look at it this EP n packages is pretty much like a node modules directory you shouldn't mess with it really but here's the original manifest and then you can see here is the registry contract and also with this command line you can uninstall update packages same thing you can do with other command line tools cool and we also have support like ether scan contracts verified contracts only just because they're useful people this is like a very popular way to verify your contract for the world to see so let's see VA we copy this and the ether scan EPM will just activate this but you can also install these two discs and it'll take the source file and all the assets and write them to disk there's main chain so right now we also have the ether scan API key loaded as an environment variable but it's going and hitting the ether scan API it's packaging up all the assets it can and then it's activating the package and so right now we have this main net v-day instance contract instance functions so there's a message yeah Oh Valentine's Day so yeah happy Valentine's Day people and if your name is tats txx loves you so you can do that with any verified contract on either scan and you can interact with the instance right from your command line so maybe something a little more fun would be the compound protocol was pretty cool so let's install that so this is again installing the compound package to disk and you can see we have it here there it is one point one point oh and then we can activate it and now I'm going to pass in with the CLI you can set an encrypted key file so I'm gonna pass in the key file password just just temporary so don't try to hack me please this is activating the package again and so you can see with this package there's a lot more useful for assets in this package we have all these contract factories you can from you right here in this ipython instance you can deploy a contract factory on any test net and you also have these these deployments here which are all maintenance so yeah we can and again these web three instances are seated with your key file password so it's automatic transaction signing which can be useful because I hate setting up web three instances and then just past cool so there you go we just queried our bounce and you can redeem you can do whatever you want right here from your command line so yeah this is the CLI it's a pretty easy way to get started with the playing with EPM packages but it's also not the only way so if we take let's say the compound manifest URI we can go to the remix IDE which is another great tool and in remix yeah we have this EPM plugin for remix so you just pop this in here and now it's importing you have to do some permissions and here you go now we have all those same sources and we can we also have the deployments so if you want to use the remix interface to talk to the blockchain that's fine but yet you can just import any of these and then you have them do some permissions and then you have them here so yeah so that's just like hopefully entices you a little bit it's a easy way to interact with an EE PM package so let's talk a little bit more about what is an EDM package and it's just Jason it's a structure Jason we have a specification in our Docs and versioned also so each release has a package name and eversion and those make the unique identifier for a specific package and what's inside this jason well there's these are some of the main fields but the most important ones are contract types and deployments the contract type can be thought of just as a class definition of a contract idea and a deployment would be an instance of a contract idea on one of the chains and again like some of the packages we played with some are big some are small some had a lot of information some had none so it's a really flexible spec you only need to include what you want to include you can just put a contract address and that can be your package it can be just be a single ABI or it can be like an entire protocol across multiple chains and what's the registry so these were the ENS names in the EPM URI and this is where you go to fetch your content addressed URI that identifies the manifest or the Jason it's basically just an on chain data store there are three data points stored for each package release a name a version and then the content addressed URI so that can be anything like ipfs swarm or github blobs and you know once it's on the blockchain the only rule of a registry is you can't rerelease the same packaged version twice so you know that once a package has been released you're always interacting with the assets that the author published and yes so we have a federated model to EPM v1 we had one central registry which is not the best security model you don't want someone in charge of managing all these packages so if you want to release a package you publish a registry or you deploy a registry and then you publish your packages to that registry and so this brings up the question of trust in software if you're a developer if you're only using code that you write like you will never get far we have to use code other people write so that with that assumption I never go audit thoroughly the packages I use I use them pretty blindly like it's not it doesn't take much for me to use the package so they're not just in the blockchain world in the normal programming paradigms like there's a large element of trust when it comes to using other people's code and we kind of have followed that model too in the blockchain world and a lot of this trust is stored in the social layer so you know if I see a package with 20 million downloads or uses then I'm like eh it's probably good to use if I and the malicious packages when they're found to be malicious usually tend to bubble up pretty quickly through various social networking platforms so yeah like it's not great but like no one can just you can't trust any code all the code you find right like in EPM you should only use packages that belong that you find on registries where you trust the owner so the owner the ENS name or whoever manages a registry should be a party that you trust whether it's an individual developer or a company but the good news is once you do identify these registries then you're good to go you have tons of cool logos to play with and so yeah so playing with LEGOs is cool but making Legos maybe is a little bit harder requires a little more effort why would someone go to these extra steps when we already have so many extra steps I'd argue one it's good for yourself you don't end up with a million different ABI files and you don't know which one was from which version and you're looking at the contract address you deployed to on Rob's 10 last month versioning your smart contract development is very good practice for yourself if you're a security auditor and you work hard to to validate these Legos EPM is a elegant protocol or solution to publicize your hard work and your audited byte code and your audited smart contract files and not only are you displaying that these are safe to use in the same motion you're making these available for developers everywhere to import with one line into their framework or to use your Legos same with companies and protocols like you're trying to decrease the friction for developers to build on top of you publishing your contracts as EPM packages makes it just one step easier for any developer to import your package and to start building on top of it and also for the ecosystem the more Legos we have as an ecosystem the more cool things we can build yes so an EPM package plus good documentation because just because you have a package you need to know how to use your so as always good documentation is a must and then it's easy for people to start building on top of or start building with your Legos so EPM support it's a really simple specification to support it's just Jason again you're just parsing the jason are you doing a couple calls to the blockchain and then parsing the jason brownie remix truffle truffle supports version 1 of the spec version to support will come in the next major bump we have libraries in Python JavaScript Russ and go the CLI web 3pi integration but yeah like super easy to implement I'd highly suggest that if you if you maintain a framework then just go ahead and implement it and it opens up this whole world of legos to play with we also have this Ian s name if you want to register your registry under a subdomain just to make it easy for people to find like just let me know hit me up on git er or Twitter and I'm happy to add you if you don't want to use this ENS name and you just want to list your registry in our directory then just let me know I'm happy to do that yeah so this is kind of like what I'd really hope to see one day if you go all the way to the right we have our EPM widget and so I just like to see that in any github repo that has smart contracts no more you don't have to like copy and paste a smart contract going to remix compile it to get the ABI right now it's just like a one click you have the URI and you're ready to go and so I think this is as a developer this would just be like really useful and so what's next this on the left is probably the worst thing ever I remember when I first started doing ball chains everyone you're dealing with real money and everyone says don't up because you'll lose your money and then you come to confirm this hex string you like I don't know what I'm doing anymore so we really need to fix this and on the right is kind of the solution we're moving towards so we're working with the solidity team and if p.m. will be the specification they use for their metadata output in the compiler and there's another project that's kind of running alongside EPM called source verify and together we'll be able to provide a much better UX for users where you can have human readable transaction confirmation which is really the way it should be yeah if you're hacking or if you're not hacking or if you just want to play around this is how easy it is to get started all the CLI needs is a in Fira key and then you you're ready to go our website we have Doc's there's a lot about we have an explorer for registries but you can find everything of use from the just eath p.m.

comm or the docs there's guides on how to use each VM creating your packages really easy with the CLI - we have a Twitter I'll be on Twitter this weekend maybe but git er is a much better place to find me but if you're hacking and want to create a package or you just have any questions like I'll be around all weekend and like I'd love to help out and [Music] yeah that's it so let's build some cool Lego masterpieces any questions if you like you had time for questions questions I mean not right now but it's pretty easy to implement sure yeah yeah definitely don't be shy guys it's good to ask questions compliments all right that's fine all right we can talk to you all day no I'm we're waiting for our next presenter unless you snuck oh there he is awesome okay great thank you thank you next everybody [Music] you