@ethernity-cloud/sdk-js 1.7.7 → 1.7.9

package/README.md

@@ -50,7 +50,8 @@ The sdk has been tested on the following operating systems:
       for the compose and the certificate harvest, takes the trustedzone
       session name from the ImageRegistry, and links the session to the
       published image. `ecld-build` signs the securelock `--production`.
-      Harvesting the certificate needs SGX.
+      The certificate is harvested on an SGX host or, without one, extracted
+      by publickey.ethernity.cloud (see "How the image reaches the network").
     - Testnet Unsafe - the unsafe network beside the testnet (see below).
     - Mainnet - to be provided during the following updates
 - LitVM:

package/localKubo.js

@@ -46,6 +46,14 @@ function freePort() {
     });
 }
 
+// The host port in the first line of `docker port <container> 5001/tcp`
+// (`127.0.0.1:60823`), or null when there is none.
+function apiPortIn(dockerPortOutput) {
+    const first = String(dockerPortOutput || '').trim().split('\n')[0] || '';
+    const match = /:(\d+)$/.exec(first.trim());
+    return match ? Number(match[1]) : null;
+}
+
 // Whether the configured endpoint is one of the application's own; the public
 // API and an empty setting both mean "run a Kubo for this publish".
 function ownEndpoint(endpoint) {
@@ -62,6 +70,10 @@ class LocalKubo {
         this.container = `ecld-kubo-${String(name || 'publish').replace(/[^A-Za-z0-9_.-]/g, '-')}`;
         this.peers = (process.env.ECLD_IPFS_PEERS || BOOTNODE_MULTIADDR).split(',').map((p) => p.trim()).filter(Boolean);
         this.apiUrl = null;
+        // True while a registered image has this Kubo as its source: from the
+        // image's registration on chain until its certificate is on chain. A
+        // publish that ends in between leaves the Kubo running (release).
+        this.serving = false;
     }
 
     async api(command, params, timeout) {
@@ -69,21 +81,40 @@ class LocalKubo {
         return response.data;
     }
 
-    // Start the container and wait for its API; peer it with the bootnode.
-    // Throws when docker cannot run it or the API does not come up in time.
-    async start() {
-        const apiPort = await freePort();
-        this.apiUrl = `http://127.0.0.1:${apiPort}`;
-        try { execFileSync('docker', ['rm', '-f', this.container], { stdio: 'ignore' }); } catch (e) { /* not running */ }
-        const args = ['run', '-d', '--name', this.container, '-p', `127.0.0.1:${apiPort}:5001`];
-        if (await portFree(SWARM_PORT)) {
-            args.push('-p', `${SWARM_PORT}:4001`, '-p', `${SWARM_PORT}:4001/udp`);
-        }
-        args.push(KUBO_IMAGE, 'daemon', '--init', '--migrate=true');
+    // The API port of the container a previous publish of this project left
+    // running (release), or null when none runs.
+    keptApiPort() {
         try {
-            execFileSync('docker', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+            return apiPortIn(execFileSync('docker', ['port', this.container, '5001/tcp'], { stdio: ['ignore', 'pipe', 'ignore'] }));
         } catch (e) {
-            throw new Error(`docker could not start ${KUBO_IMAGE}: ${String(e.stderr || e.message).trim()}`);
+            return null;
+        }
+    }
+
+    // Start the container and wait for its API, or take over the one a
+    // previous publish of this project left serving its registered image,
+    // whose peer id that image's registry entry names; peer it with the
+    // bootnode. Throws when docker cannot run it or the API does not come up
+    // in time.
+    async start() {
+        const kept = this.keptApiPort();
+        if (kept !== null) {
+            this.apiUrl = `http://127.0.0.1:${kept}`;
+            console.log(`\t✔  IPFS node of the previous publish kept: ${this.container}`);
+        } else {
+            const apiPort = await freePort();
+            this.apiUrl = `http://127.0.0.1:${apiPort}`;
+            try { execFileSync('docker', ['rm', '-f', this.container], { stdio: 'ignore' }); } catch (e) { /* not running */ }
+            const args = ['run', '-d', '--name', this.container, '-p', `127.0.0.1:${apiPort}:5001`];
+            if (await portFree(SWARM_PORT)) {
+                args.push('-p', `${SWARM_PORT}:4001`, '-p', `${SWARM_PORT}:4001/udp`);
+            }
+            args.push(KUBO_IMAGE, 'daemon', '--init', '--migrate=true');
+            try {
+                execFileSync('docker', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+            } catch (e) {
+                throw new Error(`docker could not start ${KUBO_IMAGE}: ${String(e.stderr || e.message).trim()}`);
+            }
         }
         const deadline = Date.now() + API_READY_MS;
         for (;;) {
@@ -155,6 +186,20 @@ class LocalKubo {
     stop() {
         try { execFileSync('docker', ['rm', '-f', this.container], { stdio: 'ignore' }); } catch (e) { /* already gone */ }
     }
+
+    // End the publish's use of the Kubo: stop it, unless it is the source of
+    // a registered image whose certificate is not on chain yet, which it keeps
+    // serving to the extraction service and the bootnode's mirror; the next
+    // publish of the project takes it over, `docker rm -f` stops it.
+    release() {
+        if (!this.serving) {
+            this.stop();
+            return;
+        }
+        console.log(`\t⚠  The registered image stays available from this publish's IPFS node, the docker`);
+        console.log(`\t   container ${this.container}, for the extraction service and the bootnode.`);
+        console.log(`\t   Publish again to retry; \`docker rm -f ${this.container}\` stops it.`);
+    }
 }
 
-module.exports = { LocalKubo, ownEndpoint, PUBLIC_IPFS_HOST };
+module.exports = { LocalKubo, ownEndpoint, apiPortIn, PUBLIC_IPFS_HOST };

package/nodenithy/run.js

@@ -137,7 +137,7 @@ const main = async () => {
         }
         ipfsApi = localKubo.apiUrl;
         console.log(`\t✔  IPFS node for this publish: ${ipfsApi}`);
-        process.on('exit', () => localKubo.stop());
+        process.on('exit', () => localKubo.release());
     }
 
     // The CIDs uploadToIpfs gives, from the same add calls with only-hash: the
@@ -580,6 +580,9 @@ const main = async () => {
         hashForIpfs();
         if (localKubo) ipfsPeer = await localKubo.peerMultiaddr();
         execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "registerImage"`, { stdio: "inherit", env: { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer } });
+        // From here the registered image's source is this Kubo, until its
+        // certificate is on chain.
+        if (localKubo) localKubo.serving = true;
     }
     uploadToIpfs();
     const registryEnv = { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer };
@@ -711,6 +714,7 @@ const main = async () => {
         process.chdir(currentDir);
         console.log(`Registering the certificate of SECURELOCK ${securelock} in the IMAGE REGISTRY smart contract...`);
         execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "setImageCert"`, { stdio: "inherit", env: registryEnv });
+        if (localKubo) localKubo.serving = false;
     } else {
         // A V1 registry gets the tree that carries the certificate files,
         // uploaded again, with the certificate, in one addImage call.

package/nodenithy/src/ec_helloworld_example.js

@@ -23,7 +23,11 @@ function App() {
         if (UNSAFE_NETWORK) {
             await runner.setNetwork(...UNSAFE_NETWORK);
         }
-        runner.initializeStorage(IPFS_ENDPOINT);
+        // An IPFS API of the dApp's own carries the task's artefacts; without
+        // one they go through the bootnode's payload intake (the public API's
+        // add is closed to callers without a token).
+        if (IPFS_ENDPOINT && !IPFS_ENDPOINT.includes("ipfs.ethernity.cloud")) runner.initializeStorage(IPFS_ENDPOINT);
+        else runner.initializePublicIntake();
 
         // Events are named by task status; detail is { message, status, progress }.
         runner.addEventListener(ECStatus.DEFAULT, (e) => {

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.7.7",
+  "version": "1.7.9",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
+    "test": "node --test \"test/**/*.test.js\"",
     "ecld-build": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/build.js",
     "ecld-publish": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/publish.js",
     "ecld-init": "cross-env node ./node_modules/@ethernity-cloud/sdk-js/init.js",
@@ -38,7 +39,7 @@
     "!**/*.pyc"
   ],
   "dependencies": {
-    "@ethernity-cloud/runner": "^0.6.3",
+    "@ethernity-cloud/runner": "^0.6.4",
     "acorn": "^8.11.0",
     "adm-zip": "^0.5.14",
     "axios": "^1.7.2",

package/pynithy/run.js

@@ -138,7 +138,7 @@ const main = async () => {
         }
         ipfsApi = localKubo.apiUrl;
         console.log(`\t✔  IPFS node for this publish: ${ipfsApi}`);
-        process.on('exit', () => localKubo.stop());
+        process.on('exit', () => localKubo.release());
     }
 
     // The CIDs uploadToIpfs gives, from the same add calls with only-hash: the
@@ -579,6 +579,9 @@ const main = async () => {
         hashForIpfs();
         if (localKubo) ipfsPeer = await localKubo.peerMultiaddr();
         execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "registerImage"`, { stdio: "inherit", env: { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer } });
+        // From here the registered image's source is this Kubo, until its
+        // certificate is on chain.
+        if (localKubo) localKubo.serving = true;
     }
     uploadToIpfs();
     const registryEnv = { ...process.env, PROJECT_NAME: securelock, IPFS_PEER: ipfsPeer };
@@ -688,6 +691,7 @@ const main = async () => {
         process.chdir(currentDir);
         console.log(`Registering the certificate of SECURELOCK ${securelock} in the IMAGE REGISTRY smart contract...`);
         execSync(`node ${runDir}/image_registry.js "${process.env.BLOCKCHAIN_NETWORK}" "${securelock}" "v3" "setImageCert"`, { stdio: "inherit", env: registryEnv });
+        if (localKubo) localKubo.serving = false;
     } else {
         // A V1 registry gets the tree that carries the certificate files,
         // uploaded again, with the certificate, in one addImage call.

package/pynithy/src/ec_helloworld_example.js

@@ -23,7 +23,11 @@ function App() {
         if (UNSAFE_NETWORK) {
             await runner.setNetwork(...UNSAFE_NETWORK);
         }
-        runner.initializeStorage(IPFS_ENDPOINT);
+        // An IPFS API of the dApp's own carries the task's artefacts; without
+        // one they go through the bootnode's payload intake (the public API's
+        // add is closed to callers without a token).
+        if (IPFS_ENDPOINT && !IPFS_ENDPOINT.includes("ipfs.ethernity.cloud")) runner.initializeStorage(IPFS_ENDPOINT);
+        else runner.initializePublicIntake();
 
         // Events are named by task status; detail is { message, status, progress }.
         runner.addEventListener(ECStatus.DEFAULT, (e) => {

package/run.js

@@ -42,7 +42,12 @@ try { require('dotenv').config(); } catch (e) { /* dotenv optional */ }
 const casConfig = require('./cas/config.js');
 const { networkFor, unsafeVariant } = require('./network.js');
 
-const DEFAULT_IPFS = 'https://ipfs.ethernity.cloud/api/v0';
+// `--ipfs intake` (the default): the artefacts' CIDs are computed locally and
+// the bytes delivered to the bootnode's payload intake once the DO request is
+// on chain (runner initializePublicIntake); `--ipfs <url>` uploads and reads
+// through that Kubo RPC API instead. The public API's add is closed to callers
+// without a token.
+const DEFAULT_IPFS = 'intake';
 
 function parseArgs(argv) {
   const opts = { ipfs: DEFAULT_IPFS, timeout: 600, taskPrice: 3, cpu: 1, memory: 1, storage: 10, bandwidth: 1, duration: 1, validators: 1, node: '' };
@@ -86,7 +91,8 @@ enclaves:  --securelock <name> (default PROJECT_NAME), --trustedzone <name> (def
            on an -unsafe network the default is each one's -unsafe variant
 key:       PRIVATE_KEY (a funded 0x key) from .env / env, or ECLD_PRIVATE_KEY
 resources: --task-price 3 --cpu 1 --memory 1 --storage 10 --bandwidth 1 --duration 1 --validators 1
-other:     --node <addr>  --ipfs <url>  --timeout <sec>  --json`;
+other:     --node <addr>  --ipfs intake|<kubo api url> (default intake: the bootnode's payload intake)
+           --timeout <sec>  --json`;
 
 async function main() {
   const { opts, positional } = parseArgs(process.argv.slice(2));
@@ -173,7 +179,8 @@ async function main() {
     console.error('ecld-run: could not initialise the runner: ' + e.message);
     process.exit(1);
   }
-  runner.initializeStorage(opts.ipfs);
+  if (opts.ipfs === 'intake') runner.initializePublicIntake();
+  else runner.initializeStorage(opts.ipfs);
 
   let lastPhase = null;
   const onProgress = (e) => {