fabric icon indicating copy to clipboard operation
fabric copied to clipboard

Timestamp string conversion is not deterministic

Open semil opened this issue 1 year ago • 2 comments

Description

Critical areas of the code like https://github.com/hyperledger/fabric/blob/c24c9b57439cfb1a9c2332d953286946ebfc3600/orderer/common/cluster/util.go#L812-L820 are using timestamp's String() method in order to calculate it's string representation.

The string method uses: https://github.com/hyperledger/fabric/blob/c24c9b57439cfb1a9c2332d953286946ebfc3600/vendor/google.golang.org/protobuf/types/known/timestamppb/timestamp.pb.go#L271-L273

https://github.com/hyperledger/fabric/blob/c24c9b57439cfb1a9c2332d953286946ebfc3600/vendor/google.golang.org/protobuf/internal/impl/api_export.go#L173-L177

https://github.com/hyperledger/fabric/blob/c24c9b57439cfb1a9c2332d953286946ebfc3600/vendor/google.golang.org/protobuf/encoding/prototext/encode.go#L85-L98

Which clearly states "Do not depend on the output being stable. It may change over time across different versions of the program.".

Evidence to that is the way the timestamp seconds:1693225332; nanos:471402000 is converted to string:

  • seconds:1693225332 nanos:471402000
  • seconds:1693225332 nanos:471402000 note the double vs single spacing.

This string is then converted to bytes array and it's hash is used to calculated different security components.

Steps to reproduce

No response

semil avatar Aug 28 '23 13:08 semil

@arkadiPiven and I are working on a fix.

semil avatar Aug 28 '23 13:08 semil

I think we just forgot to close this issue when the fix https://github.com/hyperledger/fabric/pull/4407 was merged. Should we just close this issue @semil or do you want to consider different approaches?

denyeart avatar Jun 12 '24 18:06 denyeart