Security News
Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
cargo-near
Advanced tools
Release notes and unreleased changes can be found in the CHANGELOG
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/cargo-near/releases/latest/download/cargo-near-installer.sh | sh
irm https://github.com/near/cargo-near/releases/latest/download/cargo-near-installer.ps1 | iex
npm install cargo-near
cargo install --locked cargo-near
or, install the most recent version from git repository:
$ git clone https://github.com/near/cargo-near
$ cargo install --locked --path cargo-near
See cargo near --help
for a complete list of available commands or run cargo near
to dive into interactive mode. Help is also available for each individual command with a --help
flag, e.g. cargo near build --help
.
cargo near
Starts interactive mode that will allow to explore all the available commands.
Use --teach-me
flag if you want to know "how it works".
cargo near --teach-me
Starts an interactive mode with an explanation of the execution of the selected command.
Additionally depends on Git binary being installed, besides cargo.
cargo near new
Initializes a new project skeleton to create a contract from a template.
Example of github workflows configuration, created by cargo near new
.
cargo near build
Builds a NEAR smart contract along with its ABI (while in the directory containing contract's Cargo.toml).
Running the above command opens a menu with following variants:
non-reproducible-wasm
Recommended variant for use during local development.
This is a regular build, which behaves much like and is a thin wrapper around a regular cargo build --target wasm32-unknown-unknown --release
.
Additional flags for build configuration can be looked up by
cargo near build non-reproducible-wasm --help
if needed.
reproducible-wasm
Recommended variant for the production releases.
This variant runs a reproducible build in a Docker container, which:
Cargo.lock
of project is created (e.g. via cargo update
) and added to git.
--locked
build by downstream cargo
command.[package.metadata.near.reproducible_build]
section of contract's Cargo.toml
and package.repository
field
Cargo.toml
of
template project, generated by cargo near new
What's a reproducible build in context of NEAR? Why is it needed? Explanation of these points and a step-by-step tutorial is present at SourceScan/verification-guide.
[package.metadata.near.reproducible_build]
configuration
image
and image_digest
are straightforward to configure:
container_build_command
field
container_build_command
for images starting with sourcescan/cargo-near:0.13.0-rust-1.83.0 and after it is ["cargo", "near", "build", "non-reproducible-wasm", "--locked"]
, where the --locked
flag is requiredcontainer_build_command
for images prior to sourcescan/cargo-near:0.13.0-rust-1.83.0 is ["cargo", "near", "build"]
cargo near build non-reproducible-wasm --help
for newer/latest imagescargo near build --help
for older onesdocker run -it sourcescan/cargo-near:0.11.0-rust-1.82.0
(or another specific image) and checking the --help
message of exact cargo-near
in container may be helpful when in doubtcargo near
allows parameterizing build with values of environment variables, present at the time of the build and not present in a contract's source code,
by specifying their names in passed_env
array
cargo near abi
Generates NEAR smart contract's ABI (while in the directory containing contract's Cargo.toml).
Once contract is deployed, this will allow you to call a view function __contract_abi
to retrieve a ZST-compressed ABI.
cargo near create-dev-account
Guides you through creation of a new NEAR account on testnet.
cargo near deploy
Builds the smart contract (equivalent to cargo near build
) and guides you to deploy it to the blockchain.
Similar to build
, running the above command opens a menu with following variants:
build-non-reproducible-wasm
This forwards to non-reproducible-wasm variant of build
command.
build-reproducible-wasm
This forwards to reproducible-wasm variant of build
command.
deploy
command from Docker build requires that contract's source code:
package.repository
.cargo
environment variablesBoth of the following are mentioned on https://doc.rust-lang.org/cargo/reference/config.html#buildrustflags
RUSTFLAGS
running e.g.
RUSTFLAGS="your_custom_value" cargo near build non-reproducible-wasm
won't result in "your_custom_value"
affecting the build.
RUSTFLAGS="-Awarnings"
is always used for abi build stage, and RUSTFLAGS="-C link-arg=-s"
for wasm build stage.
Logic for concatenating default values of this variable with values from env was removed in cargo-near-0.13.3
/cargo-near-build-0.4.3
, as it was seen as
an unnecessary complication.
There's still a way to override this parameter for wasm build stage, e.g.:
cargo near build non-reproducible-wasm --env 'RUSTFLAGS=--verbose'
RUST_LOG=info cargo near build non-reproducible-wasm --env 'RUSTFLAGS=--verbose -C link-arg=-s'
CARGO_ENCODED_RUSTFLAGS
This variable is always unset during build, so
CARGO_ENCODED_RUSTFLAGS="your_custom_value" cargo near build non-reproducible-wasm
won't result in "your_custom_value"
affecting the build.
This is so to avoid weird issues like #287 when composing multiple builds via build scripts.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as below, without any additional terms or conditions.
Licensed under either of
at your option.
FAQs
Cargo extension for building Rust smart contracts on NEAR
The npm package cargo-near receives a total of 40 weekly downloads. As such, cargo-near popularity was classified as not popular.
We found that cargo-near demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
Security News
Bun 1.2 enhances its JavaScript runtime with 90% Node.js compatibility, built-in S3 and Postgres support, HTML Imports, and faster, cloud-first performance.