@ethernity-cloud/sdk-js 1.7.1 → 1.7.8

package/nodenithy/build/securelock/src/securelock.js.tmpl

@@ -325,6 +325,19 @@ class EtnySecureLock {
         const attributes = quote.slice(96, 112);
         const quoteMrenclave = quote.slice(112, 144).toString('hex');
         const reportData = quote.slice(368, 432);
+        // TWO report_data layouts, distinguished by which one names a
+        // REGISTERED validator (checked below):
+        //   fresh  (per-session): [0:32] freshness commitment, [32:52] address
+        //   legacy (boot quote):  [0:20] address,              [20:52] cert hash
+        // The fresh layout is what a current CAS injects; legacy remains only
+        // for a CAS that could not read this enclave's nonce. Reading the wrong
+        // one would parse commitment bytes as an address and fail every task,
+        // so both are resolved and the registry decides which is real.
+        const casCandidates = [
+            [ethers.utils.getAddress('0x' + reportData.slice(32, 52).toString('hex')), null],
+            [ethers.utils.getAddress('0x' + reportData.slice(0, 20).toString('hex')),
+             reportData.slice(20, 52).toString('hex')],
+        ];
 
         const vrAbi = [
             'function isValidator(address) view returns (bool)',
@@ -430,8 +443,11 @@ class EtnySecureLock {
             console.log('CAS environment binding OK: quote commits to ' +
                         `attestation session ${sessionId.slice(0, 16)}...`);
         }
-        // SGX ATTRIBUTES.FLAGS bit 1 = DEBUG. Tolerated only when the session
-        // explicitly says so (testnet debug CAS).
+        // SGX ATTRIBUTES.FLAGS bit 1 = DEBUG. A debug CAS protects nothing: its
+        // memory is readable from outside the enclave, so its keys and the
+        // session it serves are not secret. Both CAS modes (mainnet and
+        // testnet_cas) REFUSE one. Only plain 'testnet' tolerates it, and there
+        // the enclave never contacts a CAS at all so the check never runs.
         if ((attributes[0] & 0x02) && NETWORK_TYPE !== 'testnet') {
             return fault('CAS enclave runs in SGX DEBUG mode');
         }
@@ -451,26 +467,12 @@ class EtnySecureLock {
     }
 
     loadEnv() {
-        if (process.env.ETNY_CHAIN_ID) {
-            this.chain_id = parseInt(process.env.ETNY_CHAIN_ID);
-        }
-
-        if (process.env.ETNY_SMART_CONTRACT_ADDRESS) {
-            this.smart_contract_address = process.env.ETNY_SMART_CONTRACT_ADDRESS.trim();
-        }
-
-        if (process.env.ETNY_WEB3_PROVIDER) {
-            this.web3_provider = process.env.ETNY_WEB3_PROVIDER.trim();
-        }
-
-        if (process.env.IMAGE_REGISTRY_ADDRESS) {
-            this.image_registry_address = process.env.IMAGE_REGISTRY_ADDRESS.trim();
-        }
-
-        if (process.env.ETNY_BUCKET) {
-            this.etny_bucket = process.env.ETNY_BUCKET.trim();
-        }
-
+        // The chain id, PoX smart contract, Image Registry, Web3 provider and
+        // the SwiftStream bucket are build constants (setInitializers), never
+        // read from process.env: the node supplies the environment, and an
+        // override would let it choose the registry the trustedzone's
+        // certificate comes from. Only the per-task values below are taken
+        // from the environment.
         if (process.env.ETNY_CLIENT_CHALLENGE) {
             this.client_challenge = process.env.ETNY_CLIENT_CHALLENGE.trim();
         }
@@ -496,14 +498,35 @@ class EtnySecureLock {
         // this.iamge_registry_signer = new ethers.Contract(this.image_registry_address, image_registry_abi.abi, this.walletSigner);
     }
 
+    // The node-supplied bucket .env may only contribute these per-task values.
+    // Everything else the securelock trusts is a build constant (chain id, PoX
+    // contract, Image Registry, Web3 provider, ValidatorRegistry, bucket) or a
+    // variable the CAS injects into the enclave process environment (ECAS_*,
+    // SCONE_*). Any key outside this set, and any key already present in
+    // process.env, is ignored.
+    static NODE_ENV_ALLOWLIST = new Set([
+        'ETNY_MODE',
+        'ETNY_ORDER_ID',
+        'ETNY_CLIENT_CHALLENGE',
+    ]);
+
     async readEnv() {
         try {
             console.log('Getting .env if exists...');
             const envFile = await this.swiftStreamService.getFileContent(this.etny_bucket, ".env");
             console.log("Env:", envFile);
-            console.log("Saving .env file...");
-            await fs.promises.writeFile('.env', envFile);
-            require('dotenv').config();
+            // Parsed in memory: dotenv.parse does not touch process.env.
+            const parsed = require('dotenv').parse(Buffer.from(envFile));
+            for (const [key, value] of Object.entries(parsed)) {
+                if (!EtnySecureLock.NODE_ENV_ALLOWLIST.has(key)) {
+                    console.log(`Ignoring non-allowlisted .env key from the node bucket: ${key}`);
+                    continue;
+                }
+                if (Object.prototype.hasOwnProperty.call(process.env, key)) {
+                    continue;
+                }
+                process.env[key] = value;
+            }
 
             this.version = 'v3';
             this.etny_mode = process.env.ETNY_MODE;
@@ -516,30 +539,49 @@ class EtnySecureLock {
         }
     }
 
-    // v4 checksum validation: the DO-request is submitted on-chain by the owner,
-    // so the metadata checksum is already authenticated by the transaction sender;
-    // we only confirm the file content hashes to that recorded checksum. Empty
-    // input carries no checksum (has_checksum === false) and is skipped. Kept
-    // identical across securelock / trustedzone / validator so all three agree.
-    async validateClientPayload(payload_data, input_data) {
-        // The order metadata comes from the chain; a transient RPC failure
-        // must end in a signed failure result the trustedzone can hand over,
-        // not in a task that produces nothing until the trustedzone times out.
+    // The order metadata, from the chain, retried over transient RPC failures.
+    // It names the trustedzone whose certificate checks the handover and
+    // encrypts the result, so without it no result reaches the trustedzone.
+    // Returns whether it was loaded; a persistent failure sets SYSTEM_ERROR.
+    async loadOrderMetadata() {
         const maxRetries = 5;
         for (let attempt = 1; ; attempt++) {
             try {
                 await this.getDORequestMetadata();
-                break;
+                return true;
             } catch (e) {
                 if (attempt === maxRetries) {
                     this.task_code = TaskStatus.SYSTEM_ERROR;
                     this.task_result = `Failed to fetch metadata after ${maxRetries} attempts: ${e && e.message ? e.message : e}`;
                     this.is_valid_client_data = false;
-                    return;
+                    return false;
                 }
             }
         }
+    }
 
+    // v4 checksum validation: the DO-request is submitted on-chain by the owner,
+    // so the metadata checksum is already authenticated by the transaction sender;
+    // we only confirm the file content hashes to that recorded checksum. An
+    // empty input (no CID) is checked against its recorded checksum when there
+    // is one (the runners record the checksum of the empty string) and is the
+    // empty string when there is none; an input that names a CID must carry a
+    // checksum. Data that could not be read or decrypted (false) is reported,
+    // not hashed. Kept identical across securelock / trustedzone / validator so
+    // all three agree.
+    async validateClientPayload(payload_data, input_data) {
+        if (typeof payload_data !== 'string') {
+            this.task_code = TaskStatus.PAYLOAD_CHECKSUM_ERROR;
+            this.task_result = 'PAYLOAD NOT AVAILABLE';
+            this.is_valid_client_data = false;
+            return;
+        }
+        if (typeof input_data !== 'string') {
+            this.task_code = TaskStatus.INPUT_CHECKSUM_ERROR;
+            this.task_result = 'INPUT NOT AVAILABLE';
+            this.is_valid_client_data = false;
+            return;
+        }
         const pmeta = this._metadata.payload_metadata_obj;
         if (pmeta.has_checksum) {
             const expected = pmeta.checksum.toLowerCase().replace(/^0x/, '');
@@ -565,6 +607,14 @@ class EtnySecureLock {
                 this.task_result = 'INPUT CHECKSUM DOESN\'T MATCH';
                 this.is_valid_client_data = false;
             }
+        } else if (imeta.ipfs_hash) {
+            this.task_code = TaskStatus.INPUT_CHECKSUM_ERROR;
+            this.task_result = 'INPUT CHECKSUM DOESN\'T EXIST';
+            this.is_valid_client_data = false;
+        } else if (input_data !== '') {
+            this.task_code = TaskStatus.INPUT_CHECKSUM_ERROR;
+            this.task_result = 'INPUT CHECKSUM DOESN\'T MATCH';
+            this.is_valid_client_data = false;
         }
     }
 
@@ -606,7 +656,8 @@ class EtnySecureLock {
 
             const encryptedTuple = etny_crypto.encryptedDataFromBase64Json(encryptedBase64);
             const decryptedResult = etny_crypto.decrypt(this.privateKeyMaterial(), encryptedTuple);
-            return decryptedResult.toString();
+            // decrypt() returns false for an object that does not decrypt.
+            return decryptedResult === false ? false : decryptedResult.toString();
         } catch (e) {
             console.log(`Failed to get ${objectName} file`);
             return false;
@@ -615,13 +666,15 @@ class EtnySecureLock {
 
     async getTrustedZonePublicKey() {
         try {
+            // The certificate of the trustedzone the order runs with: the latest
+            // v3 image registered under the trustedzone name in metadata1 field 2,
+            // as the Python securelock reads it. Field 1 is this securelock's own
+            // hash, which is not a trustedzone entry.
             console.log('Getting the public key of the trusted zone enclave');
-            let imageHash = this._metadata.image_hash;
-            console.log('imageHash:', imageHash);
-            if (EtnySecureLock.debug) {
-                imageHash = 'v3-hash-1';
-            }
-            this.trustedZonePublicKey = await this.image_registry.getTrustedZoneImageCertPublicKey(imageHash);
+            const trustedZoneName = this._metadata.image_metadata.split(':')[2];
+            console.log('trustedZoneName:', trustedZoneName);
+            const latest = await this.image_registry.getLatestTrustedZoneImageCertPublicKey(trustedZoneName, 'v3');
+            this.trustedZonePublicKey = latest[1];
             console.log('Public key of the TrustedZone enclave from smart contract:', this.trustedZonePublicKey);
         } catch (e) {
             console.log('getTrustedZonePublicKey', e);
@@ -781,6 +834,12 @@ class EtnySecureLock {
 
     async saveResult() {
         try {
+            // A failure reported before execute() loaded the order metadata
+            // (one thrown in create(), see reportFailure) loads it here.
+            if (!this._metadata && !(await this.loadOrderMetadata())) {
+                console.log('Save result: no order metadata, so no trustedzone certificate to encrypt the result to');
+                return;
+            }
             await this.getTrustedZonePublicKey();
             // THE HANDOVER IS ALWAYS SIGNED: the trustedzone refuses an
             // unverifiable result/result-code, so the operator's storage
@@ -843,6 +902,40 @@ class EtnySecureLock {
     }
 
     async execute() {
+        // The order metadata names the trustedzone whose certificate checks
+        // the handover and encrypts the result, and the task binding is signed
+        // into the result; both are read before any check that can end the
+        // task, so every outcome below reaches the trustedzone as a result it
+        // can verify.
+        if (!(await this.loadOrderMetadata())) {
+            return false;
+        }
+        await this.getTrustedZonePublicKey();
+
+        // Task binding: the order id and enclave challenge the trustedzone
+        // generated for this task, forwarded as task.securelock + .sig. When
+        // present (and only with a valid trustedzone signature) the result and
+        // the code are signed over "<challenge>:<order_id>:" and the envelope
+        // carries both, so the trustedzone can refuse a result captured from
+        // any other run. Absent with an older trustedzone, which then verifies
+        // the bare result as before.
+        this.task_binding = null;
+        try {
+            const taskValue = await this.getFileContentAndDecrypt(this.etny_bucket, 'task.securelock');
+            const taskSig = await this.getFileContentAndDecrypt(this.etny_bucket, 'task.securelock.sig');
+            if (etny_crypto.verifySignature(this.trustedZonePublicKey, taskValue, taskSig)) {
+                const task = JSON.parse(String(taskValue));
+                if (Number.isInteger(Number(task.order_id)) && typeof task.challenge === 'string' && task.challenge) {
+                    this.task_binding = { order_id: Number(task.order_id), challenge: task.challenge };
+                    console.log(`Task binding attested by trustedzone: order ${this.task_binding.order_id}`);
+                }
+            } else {
+                console.error('task.securelock signature validation FAILED; result will not be bound');
+            }
+        } catch (e) {
+            console.log('No task binding supplied; result will not be bound');
+        }
+
         // ADJUDICATE the CAS attestation verdict recorded at startup. An
         // INVALID CAS quote terminates the task before the payload is
         // handled; the failure result (CAS_ATTESTATION_FAULT, 40) reaches
@@ -862,7 +955,6 @@ class EtnySecureLock {
         // handover -- the operator's storage layer between the enclaves must
         // not be able to substitute either. Mirrors the pynithy
         // validate_trustedzone_data behavior.
-        await this.getTrustedZonePublicKey();
         const payloadSig = await this.getFileContentAndDecrypt(this.etny_bucket, this.payload + '.sig');
         const inputSig = await this.getFileContentAndDecrypt(this.etny_bucket, this.input + '.sig');
         if (payloadSig === false ||
@@ -901,7 +993,6 @@ class EtnySecureLock {
             const callerValue = await this.getFileContentAndDecrypt(this.etny_bucket, 'caller.securelock');
             const callerSig = await this.getFileContentAndDecrypt(this.etny_bucket, 'caller.securelock.sig');
             if (typeof etny_crypto.verifySignature === 'function') {
-                await this.getTrustedZonePublicKey();
                 if (etny_crypto.verifySignature(this.trustedZonePublicKey, callerValue, callerSig)) {
                     this.task_caller = String(callerValue).trim();
                     console.log(`Task caller attested by trustedzone: ${this.task_caller}`);
@@ -915,31 +1006,6 @@ class EtnySecureLock {
             console.log('No attested task caller supplied; treating task as anonymous');
         }
 
-        // Task binding: the order id and enclave challenge the trustedzone
-        // generated for this task, forwarded as task.securelock + .sig. When
-        // present (and only with a valid trustedzone signature) the result and
-        // the code are signed over "<challenge>:<order_id>:" and the envelope
-        // carries both, so the trustedzone can refuse a result captured from
-        // any other run. Absent with an older trustedzone, which then verifies
-        // the bare result as before.
-        this.task_binding = null;
-        try {
-            const taskValue = await this.getFileContentAndDecrypt(this.etny_bucket, 'task.securelock');
-            const taskSig = await this.getFileContentAndDecrypt(this.etny_bucket, 'task.securelock.sig');
-            await this.getTrustedZonePublicKey();
-            if (etny_crypto.verifySignature(this.trustedZonePublicKey, taskValue, taskSig)) {
-                const task = JSON.parse(String(taskValue));
-                if (Number.isInteger(Number(task.order_id)) && typeof task.challenge === 'string' && task.challenge) {
-                    this.task_binding = { order_id: Number(task.order_id), challenge: task.challenge };
-                    console.log(`Task binding attested by trustedzone: order ${this.task_binding.order_id}`);
-                }
-            } else {
-                console.error('task.securelock signature validation FAILED; result will not be bound');
-            }
-        } catch (e) {
-            console.log('No task binding supplied; result will not be bound');
-        }
-
         this.configureStateRegistry();
 
         // Interactive session: the trustedzone stages session.config when the

package/nodenithy/build.mjs

@@ -31,9 +31,9 @@ const writeEnv = (key, value) => {
 // Kept in sync with etny-{pynithy,nodenithy}/v3/networks.yaml (the authoritative
 // on-chain constants). Covers all supported networks for both dApp types.
 export const ECRunner = {
-  // --- bloxberg (the testnet reads ECImageRegistryV2, mainnet the original) ---
-  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
-  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
+  // --- bloxberg (the testnet reads ECImageRegistryV3, mainnet the original) ---
+  'etny-pynithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy-testnet': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
   'etny-pynithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
   'etny-nodenithy': ['0x549A6E06BB2084100148D50F51CF77a3436C3Ae7', '0x15D73a742529C3fb11f3FA32EF7f0CC3870ACA31', 'https://bloxberg.ethernity.cloud', 8995],
   // --- polygon mainnet ---
@@ -52,8 +52,8 @@ export const ECRunner = {
   'ecld-pynithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   // --- the -unsafe networks: the contracts of the network each is named after ---
-  'etny-pynithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
-  'etny-nodenithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0x99A84C624C028bdf0a855A1E9E3f2fcf7275B3D8', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-pynithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
+  'etny-nodenithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
   'ecld-pynithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   'ecld-nodenithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
 };
@@ -90,11 +90,12 @@ const runCommand = (command, canPass = false) => {
 
 // Removes the containers this build and publish create, matched by exact name:
 // `--filter name=` matches a substring, so name=las would also match the LAS of
-// a CAS validator set on the same host.
+// a CAS validator set on the same host. `-v` removes their anonymous volumes
+// too: registry:2 keeps its pushed images in one, about 1.3 GB per build.
 const removeContainer = (name) => {
   const ids = shell.exec(`docker ps -a -q --filter "name=^/${name}$"`, { silent: true }).stdout.trim();
   if (ids) {
-    runCommand(`docker rm -f ${ids.split('\n').join(' ')}`);
+    runCommand(`docker rm -f -v ${ids.split('\n').join(' ')}`);
   }
 };
 

package/nodenithy/ipfs.mjs

@@ -223,12 +223,13 @@ const retryOnFailure = async (fn, label) => {
   return null;
 };
 
-// Upload a single file: POST it to /api/v0/add and return its hash.
-const uploadFileToIPFSOnce = async (filePath) => {
+// Upload a single file: POST it to /api/v0/add and return its hash. With
+// onlyHash the node computes the same hash and stores nothing.
+const uploadFileToIPFSOnce = async (filePath, onlyHash = false) => {
   const files = [filePath];
   const dir = path.dirname(filePath);
   const { body, boundary, length } = buildMultipartBody(files, dir);
-  const { statusCode, text } = await postAdd('', body, boundary, length, null);
+  const { statusCode, text } = await postAdd(onlyHash ? '?only-hash=true' : '', body, boundary, length, null);
   if (statusCode !== 200) {
     console.log(`Failed to upload to IPFS. Status code: ${statusCode}`);
     return null;
@@ -260,13 +261,15 @@ const uploadFileToIPFS = async (filePath) => {
 };
 
 // Upload a whole directory with wrap-with-directory=true and return the root
-// directory hash -- the exact behaviour of Python's upload_dir.
-const uploadDirOnce = async (dirPath) => {
+// directory hash -- the exact behaviour of Python's upload_dir. With onlyHash
+// the node computes the same root hash and stores nothing.
+const uploadDirOnce = async (dirPath, onlyHash = false) => {
   const abs = path.resolve(dirPath);
   const files = gatherFiles(abs);
   const totalSize = files.reduce((acc, f) => acc + fs.statSync(f).size, 0);
   const totalMb = Math.floor(totalSize / (1024 * 1024));
   const { body, boundary, length } = buildMultipartBody(files, abs);
+  const step = onlyHash ? 'Hashing enclave for IPFS' : 'Uploading and pinning enclave to IPFS';
 
   let lastShownMb = -1;
   let frame = 0;
@@ -276,27 +279,28 @@ const uploadDirOnce = async (dirPath) => {
       frame = (frame + 1) % SPINNER_FRAMES.length;
       lastShownMb = mb;
       process.stdout.write(
-        `\r\t${SPINNER_FRAMES[frame]}  Uploading and pinning enclave to IPFS... ${mb}MB/${totalMb}MB`
+        `\r\t${SPINNER_FRAMES[frame]}  ${step}... ${mb}MB/${totalMb}MB`
       );
     }
   };
 
   const query =
-    '?quieter=true&stream-channels=true&wrap-with-directory=true&progress=false&timeout=5m';
+    '?quieter=true&stream-channels=true&wrap-with-directory=true&progress=false&timeout=5m' +
+    (onlyHash ? '&only-hash=true' : '');
   const { statusCode, text } = await postAdd(query, body, boundary, length, onProgress);
 
   if (statusCode !== 200) {
-    process.stdout.write(`\r\t${FAIL}Uploading and pinning enclave to IPFS\n`);
+    process.stdout.write(`\r\t${FAIL}${step}\n`);
     console.log(`Failed to upload to IPFS. Status code: ${statusCode}`);
     return false;
   }
   const rootHash = parseRootHash(text);
   if (!rootHash) {
-    process.stdout.write(`\r\t${FAIL}Uploading and pinning enclave to IPFS\n`);
+    process.stdout.write(`\r\t${FAIL}${step}\n`);
     console.log('Failed to upload to IPFS. Could not determine root hash.');
     return false;
   }
-  process.stdout.write(`\r\t${CHECK}Uploading and pinning enclave to IPFS\n`);
+  process.stdout.write(`\r\t${CHECK}${step}\n`);
   return rootHash;
 };
 
@@ -322,6 +326,16 @@ const upload = async (p) => {
   return null;
 };
 
+// The hash `upload(p)` gives, from the same add call with only-hash: the IPFS
+// node neither stores nor announces anything.
+const hashForIPFS = async (p) => {
+  const stat = fs.statSync(p);
+  if (stat.isFile()) return retryOnFailure(() => uploadFileToIPFSOnce(p, true), 'hash_file');
+  if (stat.isDirectory()) return retryOnFailure(() => uploadDirOnce(p, true), 'hash_dir');
+  console.log(`Path ${p} is neither a file nor a directory.`);
+  return null;
+};
+
 // ---------------------------------------------------------------------------
 // Download helpers (kubo-rpc-client based; unchanged behaviour)
 // ---------------------------------------------------------------------------
@@ -397,6 +411,7 @@ const getContentFromIPFS = async (hash, maxRetries = process.env.REACT_APP_IPFS_
 export {
   initialize,
   upload,
+  hashForIPFS,
   uploadFileToIPFS,
   uploadFolderToIPFS,
   getFromIPFS,
@@ -405,7 +420,7 @@ export {
 };
 
 // ---------------------------------------------------------------------------
-// CLI (unchanged interface: --host --action upload/download --filePath/--folderPath)
+// CLI: --host --action upload/hash/download --filePath/--folderPath
 // ---------------------------------------------------------------------------
 
 program
@@ -413,7 +428,7 @@ program
   .option('--hhash <hhash>', 'IPFS hash')
   .option('--filePath <path>', 'Path to the file')
   .option('--folderPath <path>', 'Path to the folder')
-  .option('--action <action>', 'Action to perform (upload, download)')
+  .option('--action <action>', 'Action to perform (upload, hash, download)')
   .option('--token <token>', 'IPFS authorization token')
   .option('--output <path>', 'Output path for download');
 
@@ -445,6 +460,15 @@ if (isMain) {
         console.error('Please provide a filePath or folderPath for upload.');
         process.exit(1);
       }
+    } else if (options.action === 'hash') {
+      const target = options.filePath || options.folderPath;
+      if (!target) {
+        console.error('Please provide a filePath or folderPath to hash.');
+        process.exit(1);
+      }
+      const hhash = await hashForIPFS(target);
+      console.log(`${hhash}`);
+      process.exit(hhash ? 0 : 1);
     } else if (options.action === 'download') {
       if (options.filePath) {
         await getFromIPFS(options.hhash, options.filePath);
@@ -456,7 +480,7 @@ if (isMain) {
         console.error('Please provide a filePath or folderPath for download.');
       }
     } else {
-      console.error('Please provide a valid action (upload, download).');
+      console.error('Please provide a valid action (upload, hash, download).');
       process.exit(1);
     }
   };

package/nodenithy/run/image_registry.abi

@@ -1 +1 @@
-[{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"wallet","type":"address"}],"name":"AllowedWalletAdded","type":"event"},{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"wallet","type":"address"}],"name":"AllowedWalletRemoved","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"},{"indexed":false,"internalType":"string","name":"publicKey","type":"string"},{"indexed":false,"internalType":"string","name":"version","type":"string"}],"name":"ImageAdded","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"}],"name":"ImagePublished","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"}],"name":"ImageRemoved","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"}],"name":"ImageValidated","type":"event"},{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"previousOwner","type":"address"},{"indexed":true,"internalType":"address","name":"newOwner","type":"address"}],"name":"OwnerChanged","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"}],"name":"TrustedZoneImageAdded","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"}],"name":"TrustedZoneImageRemoved","type":"event"},{"inputs":[{"internalType":"address","name":"wallet","type":"address"}],"name":"addAllowedWallet","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"string","name":"certPublicKey","type":"string"},{"internalType":"string","name":"version","type":"string"},{"internalType":"string","name":"imageName","type":"string"},{"internalType":"string","name":"dockerComposeHash","type":"string"},{"internalType":"string","name":"session","type":"string"},{"internalType":"uint8","name":"fee","type":"uint8"}],"name":"addImage","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"string","name":"certPublicKey","type":"string"},{"internalType":"string","name":"version","type":"string"},{"internalType":"string","name":"imageName","type":"string"},{"internalType":"string","name":"dockerComposeHash","type":"string"},{"internalType":"string","name":"session","type":"string"},{"internalType":"uint8","name":"fee","type":"uint8"}],"name":"addTrustedZoneImage","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"address","name":"newRewardAddress","type":"address"}],"name":"changeImageRewardAddress","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"newOwner","type":"address"}],"name":"changeOwner","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"address","name":"newRewardAddress","type":"address"}],"name":"changeTrustedZoneImageRewardAddress","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"publishImage","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"wallet","type":"address"}],"name":"removeAllowedWallet","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"validateImage","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[],"stateMutability":"nonpayable","type":"constructor"},{"inputs":[{"internalType":"address","name":"","type":"address"}],"name":"allowedWallets","outputs":[{"internalType":"bool","name":"","type":"bool"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getImageCertPublicKey","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getImageSession","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"imageName","type":"string"},{"internalType":"string","name":"version","type":"string"}],"name":"getLatestImageVersionPublicKey","outputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"imageName","type":"string"},{"internalType":"string","name":"version","type":"string"}],"name":"getLatestTrustedZoneImageCertPublicKey","outputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getRewardAddress","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getTrustedZoneImageCertPublicKey","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getTrustedZoneImageSession","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getTrustedZoneRewardAddress","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"}],"name":"imageDetails","outputs":[{"internalType":"address","name":"owner","type":"address"},{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"string","name":"version","type":"string"},{"internalType":"string","name":"session","type":"string"},{"internalType":"uint8","name":"fee","type":"uint8"},{"internalType":"address","name":"rewardAddress","type":"address"},{"internalType":"bool","name":"validated","type":"bool"},{"internalType":"bool","name":"published","type":"bool"},{"internalType":"string","name":"certPublicKey","type":"string"},{"internalType":"string","name":"dockerComposeHash","type":"string"},{"internalType":"string","name":"name","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"uint256","name":"","type":"uint256"}],"name":"images","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"uint256","name":"","type":"uint256"}],"name":"imageVersions","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"},{"internalType":"uint256","name":"","type":"uint256"}],"name":"imageVersionsHash","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"owner","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"}],"name":"trustedZoneImageDetails","outputs":[{"internalType":"address","name":"owner","type":"address"},{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"string","name":"version","type":"string"},{"internalType":"string","name":"session","type":"string"},{"internalType":"uint8","name":"fee","type":"uint8"},{"internalType":"address","name":"rewardAddress","type":"address"},{"internalType":"bool","name":"validated","type":"bool"},{"internalType":"bool","name":"published","type":"bool"},{"internalType":"string","name":"certPublicKey","type":"string"},{"internalType":"string","name":"dockerComposeHash","type":"string"},{"internalType":"string","name":"name","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"uint256","name":"","type":"uint256"}],"name":"trustedZoneImageVersions","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"},{"internalType":"uint256","name":"","type":"uint256"}],"name":"trustedZoneVersionsHash","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"}]
+[{"inputs":[{"internalType":"string","name":"imageName","type":"string"}],"name":"imageNameOwner","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"wallet","type":"address"}],"name":"AllowedWalletAdded","type":"event"},{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"wallet","type":"address"}],"name":"AllowedWalletRemoved","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"},{"indexed":false,"internalType":"string","name":"publicKey","type":"string"},{"indexed":false,"internalType":"string","name":"version","type":"string"}],"name":"ImageAdded","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"}],"name":"ImagePublished","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"}],"name":"ImageRemoved","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"}],"name":"ImageValidated","type":"event"},{"anonymous":false,"inputs":[{"indexed":true,"internalType":"address","name":"previousOwner","type":"address"},{"indexed":true,"internalType":"address","name":"newOwner","type":"address"}],"name":"OwnerChanged","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"}],"name":"TrustedZoneImageAdded","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"}],"name":"TrustedZoneImageRemoved","type":"event"},{"inputs":[{"internalType":"address","name":"wallet","type":"address"}],"name":"addAllowedWallet","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"string","name":"certPublicKey","type":"string"},{"internalType":"string","name":"version","type":"string"},{"internalType":"string","name":"imageName","type":"string"},{"internalType":"string","name":"dockerComposeHash","type":"string"},{"internalType":"string","name":"session","type":"string"},{"internalType":"uint8","name":"fee","type":"uint8"}],"name":"addImage","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"string","name":"certPublicKey","type":"string"},{"internalType":"string","name":"version","type":"string"},{"internalType":"string","name":"imageName","type":"string"},{"internalType":"string","name":"dockerComposeHash","type":"string"},{"internalType":"string","name":"session","type":"string"},{"internalType":"uint8","name":"fee","type":"uint8"}],"name":"addTrustedZoneImage","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"address","name":"newRewardAddress","type":"address"}],"name":"changeImageRewardAddress","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"newOwner","type":"address"}],"name":"changeOwner","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"address","name":"newRewardAddress","type":"address"}],"name":"changeTrustedZoneImageRewardAddress","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"publishImage","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"address","name":"wallet","type":"address"}],"name":"removeAllowedWallet","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"validateImage","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[],"stateMutability":"nonpayable","type":"constructor"},{"inputs":[{"internalType":"address","name":"","type":"address"}],"name":"allowedWallets","outputs":[{"internalType":"bool","name":"","type":"bool"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getImageCertPublicKey","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getImageSession","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"imageName","type":"string"},{"internalType":"string","name":"version","type":"string"}],"name":"getLatestImageVersionPublicKey","outputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"imageName","type":"string"},{"internalType":"string","name":"version","type":"string"}],"name":"getLatestTrustedZoneImageCertPublicKey","outputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getRewardAddress","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getTrustedZoneImageCertPublicKey","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getTrustedZoneImageSession","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"getTrustedZoneRewardAddress","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"}],"name":"imageDetails","outputs":[{"internalType":"address","name":"owner","type":"address"},{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"string","name":"version","type":"string"},{"internalType":"string","name":"session","type":"string"},{"internalType":"uint8","name":"fee","type":"uint8"},{"internalType":"address","name":"rewardAddress","type":"address"},{"internalType":"bool","name":"validated","type":"bool"},{"internalType":"bool","name":"published","type":"bool"},{"internalType":"string","name":"certPublicKey","type":"string"},{"internalType":"string","name":"dockerComposeHash","type":"string"},{"internalType":"string","name":"name","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"uint256","name":"","type":"uint256"}],"name":"images","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"uint256","name":"","type":"uint256"}],"name":"imageVersions","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"},{"internalType":"uint256","name":"","type":"uint256"}],"name":"imageVersionsHash","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[],"name":"owner","outputs":[{"internalType":"address","name":"","type":"address"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"}],"name":"trustedZoneImageDetails","outputs":[{"internalType":"address","name":"owner","type":"address"},{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"string","name":"version","type":"string"},{"internalType":"string","name":"session","type":"string"},{"internalType":"uint8","name":"fee","type":"uint8"},{"internalType":"address","name":"rewardAddress","type":"address"},{"internalType":"bool","name":"validated","type":"bool"},{"internalType":"bool","name":"published","type":"bool"},{"internalType":"string","name":"certPublicKey","type":"string"},{"internalType":"string","name":"dockerComposeHash","type":"string"},{"internalType":"string","name":"name","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"uint256","name":"","type":"uint256"}],"name":"trustedZoneImageVersions","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"","type":"string"},{"internalType":"string","name":"","type":"string"},{"internalType":"uint256","name":"","type":"uint256"}],"name":"trustedZoneVersionsHash","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"},{"indexed":false,"internalType":"string","name":"imageName","type":"string"},{"indexed":false,"internalType":"string","name":"version","type":"string"}],"name":"ImageCertSet","type":"event"},{"anonymous":false,"inputs":[{"indexed":false,"internalType":"string","name":"ipfsHash","type":"string"},{"indexed":false,"internalType":"string","name":"imageName","type":"string"},{"indexed":false,"internalType":"string","name":"version","type":"string"},{"indexed":true,"internalType":"address","name":"owner","type":"address"},{"indexed":false,"internalType":"string","name":"ipfsPeer","type":"string"}],"name":"ImageRegistered","type":"event"},{"inputs":[],"name":"pendingImages","outputs":[{"internalType":"string[]","name":"","type":"string[]"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"string","name":"version","type":"string"},{"internalType":"string","name":"imageName","type":"string"},{"internalType":"string","name":"dockerComposeHash","type":"string"},{"internalType":"string","name":"session","type":"string"},{"internalType":"uint8","name":"fee","type":"uint8"},{"internalType":"string","name":"ipfsPeer","type":"string"}],"name":"registerImage","outputs":[],"stateMutability":"nonpayable","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"}],"name":"registrationPeer","outputs":[{"internalType":"string","name":"","type":"string"}],"stateMutability":"view","type":"function"},{"inputs":[{"internalType":"string","name":"ipfsHash","type":"string"},{"internalType":"string","name":"certPublicKey","type":"string"}],"name":"setImageCert","outputs":[],"stateMutability":"nonpayable","type":"function"}]