@ethernity-cloud/sdk-js 1.7.7 → 1.7.8

package/README.md

@@ -50,7 +50,8 @@ The sdk has been tested on the following operating systems:
       for the compose and the certificate harvest, takes the trustedzone
       session name from the ImageRegistry, and links the session to the
       published image. `ecld-build` signs the securelock `--production`.
-      Harvesting the certificate needs SGX.
+      The certificate is harvested on an SGX host or, without one, extracted
+      by publickey.ethernity.cloud (see "How the image reaches the network").
     - Testnet Unsafe - the unsafe network beside the testnet (see below).
     - Mainnet - to be provided during the following updates
 - LitVM:

package/localKubo.js

@@ -46,6 +46,14 @@ function freePort() {
     });
 }
 
+// The host port in the first line of `docker port <container> 5001/tcp`
+// (`127.0.0.1:60823`), or null when there is none.
+function apiPortIn(dockerPortOutput) {
+    const first = String(dockerPortOutput || '').trim().split('\n')[0] || '';
+    const match = /:(\d+)$/.exec(first.trim());
+    return match ? Number(match[1]) : null;
+}
+
 // Whether the configured endpoint is one of the application's own; the public
 // API and an empty setting both mean "run a Kubo for this publish".
 function ownEndpoint(endpoint) {
@@ -62,6 +70,10 @@ class LocalKubo {
         this.container = `ecld-kubo-${String(name || 'publish').replace(/[^A-Za-z0-9_.-]/g, '-')}`;
         this.peers = (process.env.ECLD_IPFS_PEERS || BOOTNODE_MULTIADDR).split(',').map((p) => p.trim()).filter(Boolean);
         this.apiUrl = null;
+        // True while a registered image has this Kubo as its source: from the
+        // image's registration on chain until its certificate is on chain. A
+        // publish that ends in between leaves the Kubo running (release).
+        this.serving = false;
     }
 
     async api(command, params, timeout) {
@@ -69,21 +81,40 @@ class LocalKubo {
         return response.data;
     }
 
-    // Start the container and wait for its API; peer it with the bootnode.
-    // Throws when docker cannot run it or the API does not come up in time.
-    async start() {
-        const apiPort = await freePort();
-        this.apiUrl = `http://127.0.0.1:${apiPort}`;
-        try { execFileSync('docker', ['rm', '-f', this.container], { stdio: 'ignore' }); } catch (e) { /* not running */ }
-        const args = ['run', '-d', '--name', this.container, '-p', `127.0.0.1:${apiPort}:5001`];
-        if (await portFree(SWARM_PORT)) {
-            args.push('-p', `${SWARM_PORT}:4001`, '-p', `${SWARM_PORT}:4001/udp`);
-        }
-        args.push(KUBO_IMAGE, 'daemon', '--init', '--migrate=true');
+    // The API port of the container a previous publish of this project left
+    // running (release), or null when none runs.
+    keptApiPort() {
         try {
-            execFileSync('docker', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+            return apiPortIn(execFileSync('docker', ['port', this.container, '5001/tcp'], { stdio: ['ignore', 'pipe', 'ignore'] }));
         } catch (e) {
-            throw new Error(`docker could not start ${KUBO_IMAGE}: ${String(e.stderr || e.message).trim()}`);
+            return null;
+        }
+    }
+
+    // Start the container and wait for its API, or take over the one a
+    // previous publish of this project left serving its registered image,
+    // whose peer id that image's registry entry names; peer it with the
+    // bootnode. Throws when docker cannot run it or the API does not come up
+    // in time.
+    async start() {
+        const kept = this.keptApiPort();
+        if (kept !== null) {
+            this.apiUrl = `http://127.0.0.1:${kept}`;
+            console.log(`\t✔  IPFS node of the previous publish kept: ${this.container}`);
+        } else {
+            const apiPort = await freePort();
+            this.apiUrl = `http://127.0.0.1:${apiPort}`;
+            try { execFileSync('docker', ['rm', '-f', this.container], { stdio: 'ignore' }); } catch (e) { /* not running */ }
+            const args = ['run', '-d', '--name', this.container, '-p', `127.0.0.1:${apiPort}:5001`];
+            if (await portFree(SWARM_PORT)) {
+                args.push('-p', `${SWARM_PORT}:4001`, '-p', `${SWARM_PORT}:4001/udp`);
+            }
+            args.push(KUBO_IMAGE, 'daemon', '--init', '--migrate=true');
+            try {
+                execFileSync('docker', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+            } catch (e) {
+                throw new Error(`docker could not start ${KUBO_IMAGE}: ${String(e.stderr || e.message).trim()}`);
+            }
         }
         const deadline = Date.now() + API_READY_MS;
         for (;;) {
@@ -155,6 +186,20 @@ class LocalKubo {
     stop() {
         try { execFileSync('docker', ['rm', '-f', this.container], { stdio: 'ignore' }); } catch (e) { /* already gone */ }
     }
+
+    // End the publish's use of the Kubo: stop it, unless it is the source of
+    // a registered image whose certificate is not on chain yet, which it keeps
+    // serving to the extraction service and the bootnode's mirror; the next
+    // publish of the project takes it over, `docker rm -f` stops it.
+    release() {
+        if (!this.serving) {
+            this.stop();
+            return;
+        }
+        console.log(`\t⚠  The registered image stays available from this publish's IPFS node, the docker`);
+        console.log(`\t   container ${this.container}, for the extraction service and the bootnode.`);
+        console.log(`\t   Publish again to retry; \`docker rm -f ${this.container}\` stops it.`);
+    }
 }
 
-module.exports = { LocalKubo, ownEndpoint, PUBLIC_IPFS_HOST };
+module.exports = { LocalKubo, ownEndpoint, apiPortIn, PUBLIC_IPFS_HOST };

package/nodenithy/run.js

@@ -137,7 +137,7 @@ const main = async () => {
         }
         ipfsApi = localKubo.apiUrl;
         console.log(`\t✔  IPFS node for this publish: ${ipfsApi}`);
-        process.on('exit', () => localKubo.stop());
+        process.on('exit', () => localKubo.release());
     }
 
     // The CIDs uploadToIpfs gives, from the same add calls with only-hash: the
@@ -580,6 +580,9 @@ const main = async () => {
         hashForIpfs();
         if (localKubo) ipfsPeer = await localKubo.peerMultiaddr();
         execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "registerImage"`, { stdio: "inherit", env: { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer } });
+        // From here the registered image's source is this Kubo, until its
+        // certificate is on chain.
+        if (localKubo) localKubo.serving = true;
     }
     uploadToIpfs();
     const registryEnv = { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer };
@@ -711,6 +714,7 @@ const main = async () => {
         process.chdir(currentDir);
         console.log(`Registering the certificate of SECURELOCK ${securelock} in the IMAGE REGISTRY smart contract...`);
         execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "setImageCert"`, { stdio: "inherit", env: registryEnv });
+        if (localKubo) localKubo.serving = false;
     } else {
         // A V1 registry gets the tree that carries the certificate files,
         // uploaded again, with the certificate, in one addImage call.

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.7.7",
+  "version": "1.7.8",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
+    "test": "node --test \"test/**/*.test.js\"",
     "ecld-build": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/build.js",
     "ecld-publish": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/publish.js",
     "ecld-init": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/init.js",

package/pynithy/run.js

@@ -138,7 +138,7 @@ const main = async () => {
         }
         ipfsApi = localKubo.apiUrl;
         console.log(`\t✔  IPFS node for this publish: ${ipfsApi}`);
-        process.on('exit', () => localKubo.stop());
+        process.on('exit', () => localKubo.release());
     }
 
     // The CIDs uploadToIpfs gives, from the same add calls with only-hash: the
@@ -579,6 +579,9 @@ const main = async () => {
         hashForIpfs();
         if (localKubo) ipfsPeer = await localKubo.peerMultiaddr();
         execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "registerImage"`, { stdio: "inherit", env: { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer } });
+        // From here the registered image's source is this Kubo, until its
+        // certificate is on chain.
+        if (localKubo) localKubo.serving = true;
     }
     uploadToIpfs();
     const registryEnv = { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer };
@@ -688,6 +691,7 @@ const main = async () => {
         process.chdir(currentDir);
         console.log(`Registering the certificate of SECURELOCK ${securelock} in the IMAGE REGISTRY smart contract...`);
         execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "setImageCert"`, { stdio: "inherit", env: registryEnv });
+        if (localKubo) localKubo.serving = false;
     } else {
         // A V1 registry gets the tree that carries the certificate files,
         // uploaded again, with the certificate, in one addImage call.