forge create

[aathan]

I'm experimenting with forge create and I'm a bit concerned that the json metadata file in the build artifacts contains absolute paths, particularly in the ast section. I'm not sure if the entire file is used to generate the IPFS hash included w/ the contract deployment and I am not immediately finding how to cause the build process to generate relative paths.

[onbjerg]

The AST is not in the metadata file. You can get the metadata file by passing --extra-output-files metadata to forge build and checking the .metadata.json file in out, e.g. out/Contract.sol/Contract.metadata.json

[aathan]

Ok, so I can confirm that forge build --force --root . --extra-output-files metadata produces a metadata file that contains absolute paths despite the --root .

On the other hand solc --base-path . -o out --bin --metadata etc. does not.

If there are any concerns about this I can open an issue. I won't claim to be fully conversant with etherscan & clones verification minutiae; particularly when using json or multi-file inputs, and how that may play with absolute paths.

It would be unfortunate if someone ends up having to expose private information leaked on the path (e.g. username) accidentally.

[onbjerg]

Multi-file verification works with Forge as it is now, so it shouldn't be an issue. If you're concerned about username leakage you should open up an issue in https://github.com/gakonst/ethers-rs as this is where the metadata comes from (so it's not really a Foundry issue).

[aathan]

Gotcha. To be clear, you believe the multi-file verification does not leak absolute file path location? I'll mention this thread over there. Thank you for the pointer.

[onbjerg]

I'm pretty sure -- I've been able to successfully verify with both flattened and multi-file on Linux, but I've heard there might be issues on Windows (although they might have been fixed as well)

[aathan]

I just want to make sure we're communicating. My concern is not whether verification happens, but whether verification leaks absolute path information. Not whether it works, but whether it works while leaking info. Anyway, I've mentioned it to gakonst.