@ethernity-cloud/sdk-js 1.7.1 → 1.7.7

package/pynithy/run/public_key_service.js

@@ -65,14 +65,21 @@ console.log("Docker Composer Hash:", dockerComposerHash);
     const submitResponse = await submitIpfsHash(hhash, enclaveName, protocolVersion, network, templateVersion, dockerComposerHash);
     console.log("Submit IPFS Hash Response:", submitResponse);
 
-    // Check IPFS Hash Status
+    // The service answers publicKey 0 while the image is queued or running
+    // (with status, percent and queuePosition), -1 when the extraction failed
+    // (with reason) and the certificate when done.
     while (true) {
         const checkResponse = await checkIpfsHashStatus(hhash);
         if ("publicKey" in checkResponse) {
             if (checkResponse.publicKey === 0) {
-                console.log(`Public key not available yet. Queue position: ${checkResponse.queuePosition || 'Unknown'}`);
+                if (checkResponse.status === "running") {
+                    console.log(`Public key extraction running, ${checkResponse.percent || 0}% done`);
+                } else {
+                    console.log(`Public key not available yet. Queue position: ${checkResponse.queuePosition ?? 'Unknown'}`);
+                }
             } else if (checkResponse.publicKey === -1) {
-                console.log("Hash is not derived from Eternity Cloud SDK.");
+                console.log(`Public key extraction failed: ${checkResponse.reason || "reason not reported by the service"}`);
+                console.log("Fix the cause (keep the image pinned, build with the current SDK) and publish again: a new submission of the same hash runs the extraction again.");
                 process.exit(1);
             } else {
                 console.log("Public Key:", checkResponse.publicKey);

package/pynithy/run.js

@@ -8,6 +8,7 @@ const https = require('https');
 const casConfig = require('../cas/config.js');
 const casResolver = require('../cas/resolver.js');
 const sessionRegistry = require('../cas/session_registry.js');
+const { LocalKubo, ownEndpoint } = require('../localKubo.js');
 
 if (!fs.existsSync('.env')) {
     console.error("Error: .env file not found");
@@ -82,7 +83,7 @@ process.env.REGISTRY_PATH = `${currentDir}/registry`;
 const registryPath = process.env.REGISTRY_PATH;
 
 const runDockerCommand = (service) => {
-    const command = `docker-compose run -e SCONE_LOG=INFO -e SCONE_HASH=1 ${service}`;
+    const command = `docker-compose run --rm -e SCONE_LOG=INFO -e SCONE_HASH=1 ${service}`;
     const output = execSync(command).toString().trim();
     console.log(`Output of ${command}: ${output}`);
     return output.split('\n').filter(line => !/Creating|Pulling|latest|Digest/.test(line)).join('');
@@ -102,7 +103,7 @@ const extractSconeHash = (service) => {
 // Returns '' if the file is absent (testnet builds).
 const extractSignedMrenclave = (service) => {
     try {
-        const command = `docker-compose -f docker-compose.yml run --no-deps --entrypoint cat ${service} /signed_mrenclave.txt`;
+        const command = `docker-compose -f docker-compose.yml run --rm --no-deps --entrypoint cat ${service} /signed_mrenclave.txt`;
         const output = execSync(command, { stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();
         const m = output.match(/\b[a-fA-F0-9]{64}\b/);
         return m ? m[0] : '';
@@ -119,6 +120,79 @@ const main = async () => {
         console.error("Error: MEMORY_TO_ALLOCATE is not set in .env; run ecld-build first.");
         process.exit(1);
     }
+
+    // Where the image goes. An IPFS API of the application's own
+    // (IPFS_ENDPOINT, when it is not the public one) takes precedence.
+    // Otherwise the publish runs its own Kubo: the public write API of
+    // ipfs.ethernity.cloud is closing, and the image is held by this Kubo,
+    // peered with the bootnode, until its certificate is on chain.
+    let localKubo = null;
+    let ipfsApi = process.env.IPFS_ENDPOINT || '';
+    if (!ownEndpoint(ipfsApi)) {
+        localKubo = new LocalKubo(process.env.PROJECT_NAME);
+        try {
+            await localKubo.start();
+        } catch (e) {
+            console.error(`Error: ${e.message}`);
+            process.exit(1);
+        }
+        ipfsApi = localKubo.apiUrl;
+        console.log(`\t✔  IPFS node for this publish: ${ipfsApi}`);
+        process.on('exit', () => localKubo.stop());
+    }
+
+    // The CIDs uploadToIpfs gives, from the same add calls with only-hash: the
+    // IPFS node stores and announces nothing. Set by hashForIpfs, after which
+    // uploadToIpfs refuses an upload that gives other CIDs.
+    let expectedCids = null;
+    const hashForIpfs = () => {
+        const hashOf = (target) => {
+            try {
+                const out = execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action hash ${target}`, { stdio: ['ignore', 'pipe', 'inherit'] });
+                return out.toString().trim().split('\n').pop().trim();
+            } catch (e) {
+                console.error(`Error: could not hash ${target} for IPFS: ${e.message}`);
+                process.exit(1);
+            }
+        };
+        process.env.IPFS_DOCKER_COMPOSE_HASH = hashOf('--filePath docker-compose-final.yml');
+        process.env.IPFS_HASH = hashOf(`--folderPath ${registryPath}`);
+        console.log("IPFS_DOCKER_COMPOSE_HASH (before upload): ", process.env.IPFS_DOCKER_COMPOSE_HASH);
+        console.log("IPFS_HASH (before upload): ", process.env.IPFS_HASH);
+        expectedCids = { image: process.env.IPFS_HASH, compose: process.env.IPFS_DOCKER_COMPOSE_HASH };
+    };
+
+    // The compose and the image tree, added through ipfsApi; their CIDs land
+    // in IPFS_DOCKER_COMPOSE_HASH / IPFS_HASH (files and environment).
+    const uploadToIpfs = () => {
+        for (const file of ['IPFS_HASH.ipfs', 'IPFS_DOCKER_COMPOSE_HASH.ipfs']) {
+            if (fs.existsSync(file)) fs.unlinkSync(file);
+        }
+        console.log('Upload docker-compose-final.yml to IPFS');
+        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --filePath docker-compose-final.yml`, { stdio: "inherit" });
+        if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
+            console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
+            process.exit(1);
+        }
+        process.env.IPFS_DOCKER_COMPOSE_HASH = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
+        console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
+        writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
+        console.log('Upload docker registry to IPFS');
+        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
+        if (!fs.existsSync('IPFS_HASH.ipfs')) {
+            console.error("Error: Could not upload registry to IPFS, please try again!");
+            process.exit(1);
+        }
+        process.env.IPFS_HASH = fs.readFileSync('IPFS_HASH.ipfs', 'utf8').trim();
+        console.log("IPFS_HASH: ", process.env.IPFS_HASH);
+        writeEnv('IPFS_HASH', process.env.IPFS_HASH);
+        if (expectedCids && (process.env.IPFS_HASH !== expectedCids.image
+            || process.env.IPFS_DOCKER_COMPOSE_HASH !== expectedCids.compose)) {
+            console.error(`Error: the upload gave ${process.env.IPFS_HASH} (compose ${process.env.IPFS_DOCKER_COMPOSE_HASH}), not the registered ${expectedCids.image} (compose ${expectedCids.compose}).`);
+            process.exit(1);
+        }
+    };
+
     ['docker-compose.yml', 'docker-compose-final.yml'].forEach(file => {
         const template = `${file}.tmpl`;
         if (!fs.existsSync(template)) {
@@ -238,17 +312,19 @@ const main = async () => {
     // Where the session goes depends on who provisions the securelock. On a
     // CAS-attested testnet it is registered ON-CHAIN in the ethernity-cas
     // SessionRegistry, which the validator set reads and which accepts no
-    // POST; the publish then waits until the validators serve it, because the
-    // public-key harvest below provisions the enclave from them. On mainnet it
-    // is registered with the Scontain CAS. A self-signing testnet has none: a
-    // CAS-issued certificate would not match the key the enclave derives.
-    if (!cas) {
-        console.log(`\t✔  ${process.env.BLOCKCHAIN_NETWORK}: no CAS session; the securelock self-signs from MR_ENCLAVE`);
-    } else if (casTestnet) {
+    // POST. That happens once the image is registered, below: the
+    // SessionRegistry takes a securelock session only from the wallet that
+    // owns the image name. The publish then waits until the validators serve
+    // it, because the public-key harvest provisions the enclave from them. On
+    // mainnet it is registered with the Scontain CAS. A self-signing testnet
+    // has none: a CAS-issued certificate would not match the key the enclave
+    // derives.
+    const registerSessionOnChain = async () => {
         const registered = await sessionRegistry.register(
             casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
             process.env.PRIVATE_KEY, fs.readFileSync('etny-securelock-test.yaml'),
-            process.env.IPFS_ENDPOINT, '');
+            ipfsApi, '');
+        if (localKubo) await localKubo.provide(registered.cid);
         if (registered.registered) {
             console.log(`\t✔  Session ${registered.name} registered on-chain (body ${registered.cid})`);
             await sessionRegistry.waitVisible(
@@ -256,7 +332,10 @@ const main = async () => {
         } else {
             console.log(`\t✔  Session ${registered.name} already registered on-chain with this body (${registered.hash})`);
         }
-    } else {
+    };
+    if (!cas) {
+        console.log(`\t✔  ${process.env.BLOCKCHAIN_NETWORK}: no CAS session; the securelock self-signs from MR_ENCLAVE`);
+    } else if (!casTestnet) {
     // don't generate new keys if PREDECESSOR_HASH_SECURELOCK is not empty and the key.pem and cert.pem files exist
     if (PREDECESSOR_HASH_SECURELOCK !== 'EMPTY' && fs.existsSync('key.pem') && fs.existsSync('cert.pem')) {
         console.log("Skipping key pair generation and certificate creation.");
@@ -406,15 +485,20 @@ const main = async () => {
     console.log("# Update docker-compose files");
 
     // On a CAS-attested testnet the compose names the CAS both enclaves are
-    // provisioned from (a validator resolved from the registry, or
-    // ECLD_CAS_ADDR; the node re-resolves it before each task) and the
-    // trustedzone session the ImageRegistry records for this template.
+    // provisioned from and the trustedzone session the ImageRegistry records
+    // for this template. docker-compose.yml, which harvests the certificate
+    // here, names a validator that answered (or ECLD_CAS_ADDR); the published
+    // docker-compose-final.yml names the first validator in registry order,
+    // so that a rerun of this publish renders the same compose. The node and
+    // the extraction service resolve a CAS again before they run it.
     let casAddr = null;
+    let publishedCasAddr = null;
     let trustedZoneSession = null;
     if (casTestnet) {
         casAddr = await casResolver.casAddressFor(casChain.rpcUrl, casConfig.VALIDATOR_REGISTRY[templateName]);
-        console.log(`\t✔  CAS for this network: ${casAddr}`);
-        trustedZoneSession = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "" "getTrustedZoneSession"`).toString().trim();
+        publishedCasAddr = await casResolver.publishedCasAddress(casChain.rpcUrl, casConfig.VALIDATOR_REGISTRY[templateName]);
+        console.log(`\t✔  CAS for this network: ${casAddr} (the published compose names ${publishedCasAddr})`);
+        trustedZoneSession = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "getTrustedZoneSession"`).toString().trim();
         if (!trustedZoneSession) {
             console.error(`ERROR! The ImageRegistry records no trustedzone session for ${templateName}.`);
             process.exit(1);
@@ -454,7 +538,8 @@ const main = async () => {
             .replace(/__ENCLAVE_NAME_SECURELOCK__/g, ENCLAVE_NAME_SECURELOCK)
             .replace(/__ENCLAVE_NAME_TRUSTEDZONE__/g, ENCLAVE_NAME_TRUSTEDZONE);
         if (casTestnet) {
-            updatedContent = updatedContent.replace(/SCONE_CAS_ADDR=scone-cas\.cf/g, `SCONE_CAS_ADDR=${casAddr}`);
+            const fileCasAddr = file === 'docker-compose-final.yml' ? publishedCasAddr : casAddr;
+            updatedContent = updatedContent.replace(/SCONE_CAS_ADDR=scone-cas\.cf/g, `SCONE_CAS_ADDR=${fileCasAddr}`);
         }
 
         fs.writeFileSync(file, updatedContent, 'utf8');
@@ -478,7 +563,30 @@ const main = async () => {
     // let PUBLIC_KEY_SECURELOCK_RES = execSync(`docker-compose run etny-securelock 2>/dev/null | grep -v Creating | grep -v Pulling | grep -v latest | grep -v Digest | sed 's/.*PUBLIC_KEY:\\s*//' | tr -d '\\r'`).toString().trim();
 
 
-    // TODO: calculate hash of the files localy, and query the public key service, if the hash is already there it means we dont have to do the below.
+    // The image and its compose go out before the certificate is extracted,
+    // whichever way it is: the extraction service fetches them by these CIDs.
+    // On a two-step registry (ECImageRegistryV2 and later) the wallet records
+    // the image first (registerImage, with the publish's node), under the
+    // CIDs the upload gives, hashed before anything is stored. On
+    // ECImageRegistryV3 that binds the image name to this wallet before the
+    // upload, the session registration or anything else discloses it. The
+    // bootnode's mirror then pins the image and the extraction service queues
+    // it from the chain; the certificate is written below by the same wallet
+    // (setImageCert). A V1 registry takes both in one addImage call.
+    const registryV2 = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "isV2"`, { env: { ...process.env, PROJECT_NAME: securelock } }).toString().trim() === 'true';
+    let ipfsPeer = '';
+    if (registryV2) {
+        hashForIpfs();
+        if (localKubo) ipfsPeer = await localKubo.peerMultiaddr();
+        execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "registerImage"`, { stdio: "inherit", env: { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer } });
+    }
+    uploadToIpfs();
+    const registryEnv = { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer };
+    if (registryV2 && localKubo) {
+        await localKubo.provide(process.env.IPFS_HASH);
+        await localKubo.provide(process.env.IPFS_DOCKER_COMPOSE_HASH);
+    }
+    if (casTestnet) await registerSessionOnChain();
 
     if (fs.existsSync('certificate.securelock.crt')) {
         // delete it
@@ -487,7 +595,7 @@ const main = async () => {
 
     let PUBLIC_KEY_SECURELOCK_RES = '';
     try {
-        const output = execSync(`docker-compose run etny-securelock`, { cwd: runDir }).toString();
+        const output = execSync(`docker-compose run --rm etny-securelock`, { cwd: runDir }).toString();
         console.log("Output of docker-compose run etny-securelock:");
         // Extract the WHOLE multi-line PEM certificate block from the enclave
         // output. A previous version grabbed only the single line containing
@@ -520,43 +628,6 @@ const main = async () => {
             process.exit(0);
         } else {
             console.log("\nGenerating certificates using the Ethernity Cloud signing service...\n");
-            console.log("**** Started ipfs initial pining ****");
-            if (fs.existsSync('IPFS_HASH.ipfs')) {
-                fs.unlinkSync('IPFS_HASH.ipfs');
-            }
-            if (fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
-                fs.unlinkSync('IPFS_DOCKER_COMPOSE_HASH.ipfs');
-            }
-
-
-            console.log('Upload docker-compose-final.yml to IPFS');
-            const dockerHash = execSync(`node ../ipfs.mjs --host "${process.env.IPFS_ENDPOINT}" --action upload --filePath docker-compose-final.yml`, { stdio: "inherit" });
-            if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
-                console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
-                process.exit(1);
-            }
-            process.env.IPFS_DOCKER_COMPOSE_HASH = fs.readFileSync('IPFS_DOCKER_COMPOSE_HASH.ipfs', 'utf8').trim();
-            console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
-            writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
-            console.log()
-            await new Promise(resolve => setTimeout(resolve, 3000));
-
-            console.log('Upload docker registry to IPFS');
-            const repositoryHash = execSync(`node ../ipfs.mjs --host "${process.env.IPFS_ENDPOINT}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
-            if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
-                console.error("Error: Could not upload registry to IPFS, please try again!");
-                process.exit(1);
-            }
-            process.env.IPFS_HASH = fs.readFileSync(`./IPFS_HASH.ipfs`, 'utf8').trim();
-            console.log("IPFS_HASH: ", process.env.IPFS_HASH);
-            writeEnv('IPFS_HASH', process.env.IPFS_HASH);
-
-            console.log()
-
-            console.log("**** Finished ipfs initial pining ****");
-            console.log()
-            console.log()
-
             console.log(`ENCLAVE_NAME_SECURELOCK: ${ENCLAVE_NAME_SECURELOCK}`);
             execSync(`node ./public_key_service.js --enclave_name "${securelock}" --protocol_version "v3" --network "${process.env.BLOCKCHAIN_NETWORK}" --template_version "${process.env.VERSION}"`, { stdio: 'inherit' });
             PUBLIC_KEY_SECURELOCK_RES = fs.readFileSync('PUBLIC_KEY.txt', 'utf8').trim();
@@ -591,7 +662,7 @@ const main = async () => {
     }
 
     // const scriptPath = path.resolve(__dirname, '/image_registry.js');
-    const trustedZoneCert = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "" "getTrustedZoneCert"`).toString().trim();
+    const trustedZoneCert = execSync(`node ./image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" ${templateName} "v3" "getTrustedZoneCert"`).toString().trim();
 
     console.log("trustedZoneCert: ", trustedZoneCert);
 
@@ -608,41 +679,42 @@ const main = async () => {
     console.log("Listing certificate PUBLIC_KEY_TRUSTEDZONE:");
     console.log(fs.readFileSync('certificate.trustedzone.crt', 'utf8'));
 
+    // image_registry.js reads the securelock certificate from registry/.
     fs.copyFileSync('certificate.securelock.crt', `${registryPath}/certificate.securelock.crt`);
     fs.copyFileSync('certificate.trustedzone.crt', `${registryPath}/certificate.trustedzone.crt`);
 
-    if (fs.existsSync('IPFS_HASH.ipfs')) {
-        fs.unlinkSync('IPFS_HASH.ipfs');
-    }
-
-    console.log('Upload docker registry to IPFS');
-    execSync(`node ../ipfs.mjs --host "${process.env.IPFS_ENDPOINT}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
-    if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
-        console.error("Error: Could not upload registry to IPFS, please try again!");
-        process.exit(1);
-    }
-    process.env.IPFS_HASH = fs.readFileSync(`./IPFS_HASH.ipfs`, 'utf8').trim();
-    console.log("IPFS_HASH: ", process.env.IPFS_HASH);
-    writeEnv('IPFS_HASH', process.env.IPFS_HASH);
-    process.chdir(currentDir);
-    console.log(`Adding certificates for SECURELOCK ${securelock} into IMAGE REGISTRY smart contract...`);
-    // image_registry.js registers the image under PROJECT_NAME.
-    const registryEnv = { ...process.env, PROJECT_NAME: securelock };
-    let existing = false;
-    try {
-        const existingImages = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "${process.env.VERSION}" "${process.env.PRIVATE_KEY}" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
-        if (existingImages.toString().trim().replace('Image hash: ', '') === process.env.IPFS_HASH) {
-            console.log("Certificates for SECURELOCK already added to IMAGE REGISTRY smart contract");
+    if (registryV2) {
+        // The registered hash is the tree uploaded before the extraction.
+        process.chdir(currentDir);
+        console.log(`Registering the certificate of SECURELOCK ${securelock} in the IMAGE REGISTRY smart contract...`);
+        execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "setImageCert"`, { stdio: "inherit", env: registryEnv });
+    } else {
+        // A V1 registry gets the tree that carries the certificate files,
+        // uploaded again, with the certificate, in one addImage call.
+        if (fs.existsSync('IPFS_HASH.ipfs')) {
+            fs.unlinkSync('IPFS_HASH.ipfs');
+        }
+        console.log('Upload docker registry to IPFS');
+        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
+        if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
+            console.error("Error: Could not upload registry to IPFS, please try again!");
+            process.exit(1);
+        }
+        process.env.IPFS_HASH = fs.readFileSync(`./IPFS_HASH.ipfs`, 'utf8').trim();
+        console.log("IPFS_HASH: ", process.env.IPFS_HASH);
+        writeEnv('IPFS_HASH', process.env.IPFS_HASH);
+        if (localKubo) await localKubo.provide(process.env.IPFS_HASH);
+        process.chdir(currentDir);
+        console.log(`Adding certificates for SECURELOCK ${securelock} into IMAGE REGISTRY smart contract...`);
+        // image_registry.js registers the image under PROJECT_NAME and prints
+        // why when it cannot.
+        registryEnv.IPFS_HASH = process.env.IPFS_HASH;
+        try {
+            execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "${process.env.VERSION}" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
+        } catch (error) {
+            console.error("Error: Could not add the certificates of the SECURELOCK to the IMAGE REGISTRY smart contract");
+            process.exit(1);
         }
-        existing = true;
-    } catch (error) {
-        // console.error("Error: Could not add certificates for SECURELOCK into IMAGE REGISTRY smart contract");
-        // console.error(error);
-        // process.exit(1);
-    }
-
-    if (!existing) {
-        const res = execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "" "" "" "registerSecureLockImage"`, { stdio: "inherit", env: registryEnv });
     }
     // The on-chain session points at the image it admits, so a validator can
     // pin the image beside the body it serves.

package/revert.js

@@ -0,0 +1,76 @@
+// What the node answered when a contract call failed.
+//
+// ethers 5 reads revert data only from a geth-style JSON-RPC error, which it
+// turns into the call's result and decodes into a CALL_EXCEPTION with no
+// node error nested. The bloxberg node (Parity 2.7) answers eth_call with
+// {"data": "Reverted 0x..."}, which ethers reports as a CALL_EXCEPTION with
+// "missing revert data" and the node's error nested, and its eth_estimateGas
+// error carries no data at all. ethers reports an eth_call that timed out as
+// the same CALL_EXCEPTION, with the timeout nested. A refusal is therefore
+// read from a simulated call (callStatic), out of the node's own error.
+const { ethers } = require('ethers');
+
+const ERROR_STRING = '0x08c379a0'; // Error(string)
+const PANIC = '0x4e487b71'; // Panic(uint256)
+
+function bodyError(body) {
+  try {
+    return JSON.parse(body).error;
+  } catch (e) {
+    return undefined;
+  }
+}
+
+// The JSON-RPC errors the node answered with: the errors nested in an ethers
+// error, and in the response bodies it carries, that hold the node's numeric
+// error code. A call the node never answered has none.
+function nodeErrors(e) {
+  const found = [];
+  for (let err = e, depth = 0; err && depth < 5; err = err.error, depth++) {
+    for (const candidate of [err, bodyError(err.body)]) {
+      if (candidate && typeof candidate.code === 'number') found.push(candidate);
+    }
+  }
+  return found;
+}
+
+// Whether the node answered the call with a revert, rather than failing to
+// answer it (a timeout, an unreachable node, a rate limit).
+function isRevert(e) {
+  if (e.code !== ethers.errors.CALL_EXCEPTION) return false;
+  if (!e.error) return true;
+  return nodeErrors(e).some((err) => (typeof err.data === 'string' && err.data.startsWith('Reverted'))
+    || /revert/i.test(err.message || ''));
+}
+
+// The revert data the node returned, as 0x-prefixed hex with at least a
+// selector, or null.
+function revertData(e) {
+  for (const err of nodeErrors(e)) {
+    if (typeof err.data !== 'string') continue;
+    const m = err.data.match(/^(?:Reverted )?(0x(?:[0-9a-fA-F]{2})*)$/);
+    if (m && m[1].length >= 10) return m[1];
+  }
+  return null;
+}
+
+// The refusal as the contract states it: a require message, or a custom
+// error of `iface` with its arguments. Falls back to the error's own message
+// when the node returned no revert data.
+function revertReason(e, iface) {
+  if (e.errorName === 'Error' && e.reason) return e.reason;
+  if (e.errorName) return `${e.errorName}(${(e.errorArgs || []).map(String).join(', ')})`;
+  const data = revertData(e);
+  if (!data) return e.reason || e.message;
+  const args = `0x${data.slice(10)}`;
+  try {
+    if (data.startsWith(ERROR_STRING)) return ethers.utils.defaultAbiCoder.decode(['string'], args)[0];
+    if (data.startsWith(PANIC)) return `Panic(${ethers.utils.defaultAbiCoder.decode(['uint256'], args)[0]})`;
+    const parsed = iface.parseError(data);
+    return `${parsed.name}(${parsed.args.map(String).join(', ')})`;
+  } catch (err) {
+    return `reverted with data ${data}`;
+  }
+}
+
+module.exports = { isRevert, revertData, revertReason };