move: versioned toolchain compilation to verify source (MystenLabs#15731

)

## Description 

Implements versioned toolchain builds to verify bytecode when publishing
packages. That is, on `publish`, verifies package dependencies and
compiles modules with prior compiler versions if needed.

Guarded by `SUI_RUN_TOOLCHAIN_BUILD`.
discussion.

## Test Plan 

Added a test that requires a dep to compile with the current compiler by
reading from Move.lock. Supporting a prior compiler is TBD. All new
functionality gated for now by `SUI_RUN_TOOLCHAIN_BUILD`.

---
If your changes are not user-facing and do not break anything, you can
skip the following section. Otherwise, please briefly describe what has
changed under the Release Notes section.

### Type of Change (Check all that apply)

- [ ] protocol change
- [ ] user-visible impact
- [ ] breaking change for a client SDKs
- [ ] breaking change for FNs (FN binary must upgrade)
- [ ] breaking change for validators or node operators (must upgrade
binaries)
- [ ] breaking change for on-chain data layout
- [ ] necessitate either a data wipe or data migration

### Release notes

Cargo.toml

@@ -324,6 +324,7 @@ enum_dispatch = "^0.3"
 expect-test = "1.4.0"
 eyre = "0.6.8"
 fdlimit = "0.2.1"
+flate2 = "1.0.28"
 fs_extra = "1.3.0"
 futures = "0.3.28"
 futures-core = "0.3.21"
@@ -462,6 +463,7 @@ synstructure = "0.12"
 sysinfo = "0.27.5"
 tabled = { version = "0.12" }
 tap = "1.0.1"
+tar = "0.4.40"
 tempfile = "3.3.0"
 test-fuzz = "3.0.4"
 thiserror = "1.0.40"
@@ -507,6 +509,7 @@ tracing-subscriber = { version = "0.3.15", default-features = false, features =
 ttl_cache = "0.5.1"
 uint = "0.9.4"
 unescape = "0.1.0"
+ureq = "2.9.1"
 url = "2.3.1"
 uuid = { version = "1.1.2", features = ["v4", "fast-rng"] }
 webpki = { version = "0.101.0", package = "rustls-webpki", features = [
@@ -521,6 +524,7 @@ versions = "4.1.0"
 # Move dependencies
 move-binary-format = { path = "external-crates/move/crates/move-binary-format" }
 move-bytecode-utils = { path = "external-crates/move/crates/move-bytecode-utils" }
+move-bytecode-source-map = { path = "external-crates/move/crates/move-bytecode-source-map" }
 move-cli = { path = "external-crates/move/crates/move-cli" }
 move-compiler = { path = "external-crates/move/crates/move-compiler" }
 move-core-types = { path = "external-crates/move/crates/move-core-types" }

crates/sui-source-validation/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sui-source-validation"
-version = "0.1.0"
+version.workspace = true
 authors = ["Mysten Labs <[email protected]>"]
 license = "Apache-2.0"
 publish = false
@@ -11,7 +11,9 @@ path = "src/lib.rs"
 
 [dependencies]
 anyhow.workspace = true
+colored.workspace = true
 thiserror.workspace = true
+tracing.workspace = true
 futures.workspace = true
 
 sui-json-rpc-types.workspace = true
@@ -20,12 +22,20 @@ sui-sdk.workspace = true
 sui-move-build.workspace = true
 
 move-binary-format.workspace = true
+move-bytecode-source-map.workspace = true
+move-command-line-common.workspace = true
 move-compiler.workspace = true
 move-core-types.workspace = true
 move-package.workspace = true
 move-symbol-pool.workspace = true
+
+tar.workspace = true
+tempfile.workspace = true
+flate2.workspace = true
+ureq.workspace = true
 workspace-hack.workspace = true
 
+
 [dev-dependencies]
 
 expect-test.workspace = true

crates/sui-source-validation/fixture/versioned-a-depends-on-b/Move.toml

@@ -0,0 +1,10 @@
+[package]
+name = "a"
+version = "0.0.1"
+published-at = "$STORAGE_ID"
+
+[dependencies]
+b = { local = "../versioned-b" }
+
+[addresses]
+a = "$RUNTIME_ID"

crates/sui-source-validation/fixture/versioned-a-depends-on-b/sources/a.move

@@ -0,0 +1,11 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+module a::a {
+    use b::b::b;
+    use b::b::c;
+
+    public fun a() : u64 {
+        b() + c()
+    }
+}

crates/sui-source-validation/fixture/versioned-b/Move.lock

@@ -0,0 +1,11 @@
+# @generated by Move, please check-in and do not edit manually.
+
+[move]
+version = 0
+manifest_digest = "C70E0438875A0C3B10FA5995F317F701134E629D1B2E5F3DCA3621E50034F809"
+deps_digest = "E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855"
+
+[move.toolchain-version]
+compiler-version = "$COMPILER_VERSION"
+edition = "legacy"
+flavor = "sui"

crates/sui-source-validation/fixture/versioned-b/Move.toml

@@ -0,0 +1,7 @@
+[package]
+name = "b"
+version = "0.0.2"
+published-at = "$STORAGE_ID"
+
+[addresses]
+b = "$RUNTIME_ID"

crates/sui-source-validation/fixture/versioned-b/sources/b.move

@@ -0,0 +1,12 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+module b::b {
+    public fun b(): u64 {
+        42
+    }
+
+    public fun c(): u64 {
+        b() + 1
+    }
+}

crates/sui-source-validation/fixture/versioned-b/sources/c.move

@@ -0,0 +1,8 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+module b::c {
+    public fun c(): u64 {
+        43
+    }
+}

crates/sui-source-validation/fixture/versioned-b/sources/d.move

@@ -0,0 +1,8 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+module b::d {
+    public fun d(): u64 {
+        44
+    }
+}