electric-coin-company / kotlin-bip39 Goto Github PK
View Code? Open in Web Editor NEWA concise implementation of BIP-0039 in Kotlin for Android. In order, it prioritizes being secure, concise and idiomatic.
License: MIT License
A concise implementation of BIP-0039 in Kotlin for Android. In order, it prioritizes being secure, concise and idiomatic.
License: MIT License
For a Gradle dependency:
gradle.properties
./gradlew dependencies --write-locks
./gradlew resolveAll --write-locks
See https://github.com/zcash/zcash-android-wallet-sdk and https://github.com/zcash/secant-android-wallet for examples of what build conventions would look like.
Specific conventions would be:
As a followup to #23, configure tests to also run on GitHub Actions.
Our default branch names are not consistent for our Android projects.
Align branch names for consistency, changing the default branch to main
.
required changes include:
main
We need to prepare for a future release by:
In order to be able to release updates to the library, we should have automated deployments.
Create an automated deployment with GitHub Actions, similar to the deployment configured in the Zcash Android SDK.
Steps that need to be completed:
We need to explicitly add the path to the setup action.
Verify that 6 and 9 words work as expected, add tests to confirm the behavior and then merge the change made here:
This should come after #18.
It is annoying to keep GitHub Actions dependencies updated.
Although dependabot does not support Gradle yet, it does support GitHub Actions. So we can configure dependabot to help with this.
To reduce the risk of software supply chain issues, we should enable dependency locking.
Although the published library itself doesn't depend on third party libraries, the Gradle build does rely on some plug-ins and the tests rely on some third party libraries.
Enable dependency locking for the build scripts, build-conventions, as well as add a new dependency locking convention similar to https://github.com/zcash/secant-android-wallet/blob/main/build-convention/src/main/kotlin/zcash.dependency-conventions.gradle.kts
This depends on #20 to be implemented first.
For a Gradle dependency:
gradle.properties
This is a followup for after 1.0.3 is released, basically this is just a version bump for now.
The artifact is published in Maven Central, so the readme can be updated to reflect this. There are two changes:
Running detekt points out:
kotlin-bip39/lib/src/jvmMain/kotlin/cash/z/ecc/android/bip39/Mnemonics.kt:85:53: This implementation of Iterator does not correctly implement the next() method as it doesn't throw a NoSuchElementException when no elements remain in the Iterator. [IteratorNotThrowingNoSuchElementException]
Note that the detekt baseline will suppress this warning. When implementing this change, be sure to update the detekt baseline file to remove this suppression.
Update Contributing Guidelines "Commit Messages" section to reflect the changes on iOS SDK
We have a number of ECC team members who are not familiar with IntelliJ and Kotlin. To help them be able to build this project from source, we should have easy to follow setup instructions.
Something similar to https://github.com/zcash/secant-android-wallet/blob/main/docs/Setup.md
gradle.properties
./gradlew dependencies --write-locks
@Suppress
statements.Create a basic GitHub action script to validate the gradle wrapper, compile the library, run ktlint, and detekt.
#24 is a followup issue to run the tests. Note that tests aren't being configured in this issue, because running the Android tests on CI can be complex. If we migrate to Multiplatform, then running those tests would be easier.
Gradle toolchains only support Adoptium JDKs, however we have been recommending Zulu. This means different developers may have inconsistent JVMs. Although they should be compatible, it would be great to eliminate this variability in builds.
Now that Adoptium publishes a Mac ARM JDK 11, we can remove using Zulu.
jcenter is deprecated, so migrate our build scripts to get dependencies from MavenCentral.
Migrate to using a toml-based version catalog for dependencies.
For a Gradle dependency:
gradle.properties
./gradlew resolveAll --write-locks
Developers have a hard time understanding how well the tests cover the library.
Introduce code coverage, most likely with the JetBrains Kover Gradle plugin.
We can manually apply Jacoco to generate coverage, although Kover will be more robust.
Add contributing Guidelines present on the other projects like ZcashLightClientKit or secant-ios-wallet
Since there's no demo app, this line should be deleted from the review checklist:
Run the app: Did you run the demo app and try the changes?
Although we don't really include dependencies in the library, having a dependencyUpdates
task to identify Gradle, Kotlin, and plugin updates would be helpful.
The binaries generated from the GitHub Actions are empty when attached to the build.
The output should have the JAR files.
The attached binaries are 22 bytes, e.g. they are empty.
When Mnemonics is first touched, it performs an initialization of SecureRandom
which is known to be slow.
While documenting this could be helpful, it doesn't give clients using this library a lot of options to work around it. That's because Mnemonics
is an object, so initialization is effectively a JVM static initializer when means it runs as soon as something touches the object.
Possible alternative implementations:
Some Kotlin idols idioms can make it more likely to introduce accidental API changes or leakage of internals via the public API.
https://kotlinlang.org/docs/whatsnew14.html#explicit-api-mode-for-library-authors
Adding this to the ktlintFormat
Gradle task should solve it:
jvmArgs("--add-opens", "java.base/java.lang=ALL-UNNAMED")
When doing multiple included builds with build-conventions, things can break when modules or conventions have the same name.
This will be a problem if trying to use an included build for both bip-39 and the Android SDK.
Rename the build-conventions folder to have a namespace.
To prevent compiler warnings from being introduced, they should be configured to be considered build errors. To implement this, add a property to gradle.properties
so that this option can be turned off during local development if desired.
This should be implemented after #20
See https://github.com/zcash/secant-android-wallet for an example of how this was implemented.
Migrate to the Kotlin Multiplatform Gradle plugin, but without any actual multiplatform implementation.
When Gradle plugins are applied, they can define their own Maven repositories. This could allow dependencies to come from sources that we don't trust.
In settings.gradle.kts, configure
repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
This is likely blocked until this is resolved: https://youtrack.jetbrains.com/issue/KT-52383/Kotlin-Multiplatform-Gradle-Plugin-Unable-to-disable-project-rep
Hello,
jcenter repo is shutting down. Do you have any plans to migrate?
As a library user, I'd like to clearly understand how uppercase and lowercase letters are handled. This should be included in the readme, confirmed with a unit test, and future-proof for other languages. In other words, whatever approach that is taken should also work for every common language used for bip39 word lists.
From a clean checkout:
./gradlew clean
./gradlew test
Results in the stack trace identified here
kotest/kotest#1600
See the https://github.com/zcash/zcash-android-wallet-sdk or https://github.com/zcash/secant-android-wallet for examples of the templates we'd use for bugs, features, and dependency updates.
There's a duplicate copy of the Gradle wrapper under lib/
. We just need the copies of these in the repo root. To resolve this, delete the following paths:
Our deployment jobs in GitHub actions are missing environment: deployment
so they aren't able to read the secrets necessary for deployment.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.