@ethernity-cloud/sdk-js 1.7.8 → 1.7.10

package/nodenithy/run.js

@@ -1,5 +1,5 @@
 const fs = require('fs');
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 require('dotenv').config();
 const readline = require('readline');
 const forge = require('node-forge');
@@ -8,7 +8,7 @@ const https = require('https');
 const casConfig = require('../cas/config.js');
 const casResolver = require('../cas/resolver.js');
 const sessionRegistry = require('../cas/session_registry.js');
-const { LocalKubo, ownEndpoint } = require('../localKubo.js');
+const { LocalKubo, ownEndpoint, PUBLIC_IPFS_HOST } = require('../localKubo.js');
 
 if (!fs.existsSync('.env')) {
     console.error("Error: .env file not found");
@@ -121,13 +121,17 @@ const main = async () => {
     const trustedZoneHeap = isMainnet ? '256M' : '1024M';
 
     // Where the image goes. An IPFS API of the application's own
-    // (IPFS_ENDPOINT, when it is not the public one) takes precedence.
-    // Otherwise the publish runs its own Kubo: the public write API of
-    // ipfs.ethernity.cloud is closing, and the image is held by this Kubo,
-    // peered with the bootnode, until its certificate is on chain.
+    // (IPFS_ENDPOINT, with IPFS_TOKEN as its Authorization header when set)
+    // takes precedence. Otherwise the publish runs its own Kubo: the public
+    // API of ipfs.ethernity.cloud takes no adds or pins without a writer
+    // token, and the image is held by this Kubo, peered with the bootnode,
+    // until its certificate is on chain.
     let localKubo = null;
     let ipfsApi = process.env.IPFS_ENDPOINT || '';
-    if (!ownEndpoint(ipfsApi)) {
+    let ipfsToken = '';
+    if (ownEndpoint(ipfsApi)) {
+        ipfsToken = process.env.IPFS_TOKEN || '';
+    } else {
         localKubo = new LocalKubo(process.env.PROJECT_NAME);
         try {
             await localKubo.start();
@@ -139,23 +143,28 @@ const main = async () => {
         console.log(`\t✔  IPFS node for this publish: ${ipfsApi}`);
         process.on('exit', () => localKubo.release());
     }
+    // node ../ipfs.mjs against ipfsApi, with the token as IPFS_TOKEN in its
+    // environment: the command line is in a failure's message and in the
+    // process list. A non-zero exit ends the publish.
+    const ipfsEnv = { ...process.env, IPFS_TOKEN: ipfsToken };
+    const ipfsCli = (args, stdio) => {
+        try {
+            return execFileSync(process.execPath, ['../ipfs.mjs', '--host', ipfsApi, ...args], { stdio, env: ipfsEnv });
+        } catch (e) {
+            console.error(`Error: node ../ipfs.mjs ${args.join(' ')} failed (${e.status != null ? `exit ${e.status}` : (e.signal || e.code)}).`);
+            process.exit(1);
+        }
+    };
 
     // The CIDs uploadToIpfs gives, from the same add calls with only-hash: the
     // IPFS node stores and announces nothing. Set by hashForIpfs, after which
     // uploadToIpfs refuses an upload that gives other CIDs.
     let expectedCids = null;
     const hashForIpfs = () => {
-        const hashOf = (target) => {
-            try {
-                const out = execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action hash ${target}`, { stdio: ['ignore', 'pipe', 'inherit'] });
-                return out.toString().trim().split('\n').pop().trim();
-            } catch (e) {
-                console.error(`Error: could not hash ${target} for IPFS: ${e.message}`);
-                process.exit(1);
-            }
-        };
-        process.env.IPFS_DOCKER_COMPOSE_HASH = hashOf('--filePath docker-compose-final.yml');
-        process.env.IPFS_HASH = hashOf(`--folderPath ${registryPath}`);
+        const hashOf = (target) => ipfsCli(['--action', 'hash', ...target], ['ignore', 'pipe', 'inherit'])
+            .toString().trim().split('\n').pop().trim();
+        process.env.IPFS_DOCKER_COMPOSE_HASH = hashOf(['--filePath', 'docker-compose-final.yml']);
+        process.env.IPFS_HASH = hashOf(['--folderPath', registryPath]);
         console.log("IPFS_DOCKER_COMPOSE_HASH (before upload): ", process.env.IPFS_DOCKER_COMPOSE_HASH);
         console.log("IPFS_HASH (before upload): ", process.env.IPFS_HASH);
         expectedCids = { image: process.env.IPFS_HASH, compose: process.env.IPFS_DOCKER_COMPOSE_HASH };
@@ -168,7 +177,7 @@ const main = async () => {
             if (fs.existsSync(file)) fs.unlinkSync(file);
         }
         console.log('Upload docker-compose-final.yml to IPFS');
-        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --filePath docker-compose-final.yml`, { stdio: "inherit" });
+        ipfsCli(['--action', 'upload', '--filePath', 'docker-compose-final.yml'], 'inherit');
         if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
             console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
             process.exit(1);
@@ -177,7 +186,7 @@ const main = async () => {
         console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
         writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
         console.log('Upload docker registry to IPFS');
-        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
         if (!fs.existsSync('IPFS_HASH.ipfs')) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);
@@ -324,7 +333,7 @@ const main = async () => {
         const registered = await sessionRegistry.register(
             casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
             process.env.PRIVATE_KEY, fs.readFileSync('etny-securelock-test.yaml'),
-            ipfsApi, '');
+            ipfsApi, '', ipfsToken);
         if (localKubo) await localKubo.provide(registered.cid);
         if (registered.registered) {
             console.log(`\t✔  Session ${registered.name} registered on-chain (body ${registered.cid})`);
@@ -589,6 +598,29 @@ const main = async () => {
     if (registryV2 && localKubo) {
         await localKubo.provide(process.env.IPFS_HASH);
         await localKubo.provide(process.env.IPFS_DOCKER_COMPOSE_HASH);
+    } else if (!registryV2 && localKubo) {
+        // On a V1 registry nothing is recorded before the certificate, so the
+        // bootnode's mirror pins nothing from this Kubo, and the certificate
+        // extraction service and the nodes, which fetch from the bootnode,
+        // would wait on an image it never receives: the compose and the image
+        // are pinned on the public API, which fetches them from this Kubo over
+        // the connection it holds. The pin takes a token (IPFS_TOKEN); without
+        // one the publish stops here, before anything is on chain.
+        const publicToken = process.env.IPFS_TOKEN || '';
+        if (!publicToken) {
+            console.error("Error: this network's image registry records an image only with its certificate, so the image must be pinned on the public IPFS API before the certificate is extracted, and the public API takes a pin only with a token.");
+            console.error(`       Set IPFS_TOKEN to a writer token of ${PUBLIC_IPFS_HOST} and publish again.`);
+            process.exit(1);
+        }
+        for (const cid of [process.env.IPFS_DOCKER_COMPOSE_HASH, process.env.IPFS_HASH]) {
+            console.log(`Pinning ${cid} on the public IPFS API`);
+            try {
+                execFileSync(process.execPath, ['../ipfs.mjs', '--host', `https://${PUBLIC_IPFS_HOST}`, '--action', 'pin', '--hhash', cid], { stdio: 'inherit', env: { ...process.env, IPFS_TOKEN: publicToken } });
+            } catch (e) {
+                console.error(`Error: the public IPFS API did not pin ${cid} (${e.status != null ? `exit ${e.status}` : (e.signal || e.code)}).`);
+                process.exit(1);
+            }
+        }
     }
     if (casTestnet) await registerSessionOnChain();
 
@@ -722,7 +754,7 @@ const main = async () => {
             fs.unlinkSync('IPFS_HASH.ipfs');
         }
         console.log('Upload docker registry to IPFS');
-        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
         if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);

package/nodenithy/src/ec_helloworld_example.js

@@ -5,7 +5,8 @@ import { ECStatus } from "@ethernity-cloud/runner/enums";
 // Filled in from the project's .env by src/preStart.mjs on `npm start`: the
 // securelock this dApp is published as, the trustedzone it was built against,
 // the network's token address and chain id, the -unsafe network when the dApp
-// runs without a CAS (null otherwise), and the IPFS endpoint.
+// runs without a CAS (null otherwise), and the IPFS API of the dApp's own ('' when
+// the task's artefacts go through the bootnode's payload intake).
 const PROJECT_NAME = "";
 const TRUSTED_ZONE_IMAGE = "";
 const NETWORK_ADDRESS = "";
@@ -23,7 +24,10 @@ function App() {
         if (UNSAFE_NETWORK) {
             await runner.setNetwork(...UNSAFE_NETWORK);
         }
-        runner.initializeStorage(IPFS_ENDPOINT);
+        // An IPFS API of the dApp's own (IPFS_ENDPOINT) carries the task's
+        // artefacts; without one they go through the bootnode's payload intake.
+        if (IPFS_ENDPOINT) runner.initializeStorage(IPFS_ENDPOINT);
+        else runner.initializePublicIntake();
 
         // Events are named by task status; detail is { message, status, progress }.
         runner.addEventListener(ECStatus.DEFAULT, (e) => {

package/nodenithy/src/preStart.mjs

@@ -3,7 +3,10 @@
 // .env, the way ecld-run reads the same values. PROJECT_NAME and
 // TRUSTED_ZONE_IMAGE take their -unsafe form on an -unsafe network; the
 // network's token address, chain id and -unsafe (network, type) come from the
-// runner's own enums through the SDK's network table.
+// runner's own enums through the SDK's network table; IPFS_ENDPOINT is the
+// IPFS API of the dApp's own, or '' (no setting, or the public API, which
+// takes no writes without a token), on which the dApp delivers its task
+// artefacts through the bootnode's payload intake.
 import fs from 'fs';
 import { createRequire } from 'module';
 import dotenv from 'dotenv';
@@ -13,6 +16,7 @@ dotenv.config();
 const require = createRequire(import.meta.url);
 const casConfig = require('@ethernity-cloud/sdk-js/cas/config.js');
 const { networkFor } = require('@ethernity-cloud/sdk-js/network.js');
+const { dappEndpoint } = require('@ethernity-cloud/sdk-js/localKubo.js');
 
 const { PROJECT_NAME, TRUSTED_ZONE_IMAGE, BLOCKCHAIN_NETWORK, IPFS_ENDPOINT } = process.env;
 if (!PROJECT_NAME || !BLOCKCHAIN_NETWORK) {
@@ -31,7 +35,7 @@ const constants = {
   NETWORK_ADDRESS: network.address,
   CHAIN_ID: network.chainId || null,
   UNSAFE_NETWORK: network.unsafe || null,
-  IPFS_ENDPOINT: IPFS_ENDPOINT || 'https://ipfs.ethernity.cloud',
+  IPFS_ENDPOINT: dappEndpoint(IPFS_ENDPOINT),
 };
 
 const filePath = 'src/ec_helloworld_example.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ethernity-cloud/sdk-js",
-  "version": "1.7.8",
+  "version": "1.7.10",
   "description": "A package to run ethernity cloud build scripts",
   "scripts": {
     "test": "node --test \"test/**/*.test.js\"",
@@ -39,7 +39,7 @@
     "!**/*.pyc"
   ],
   "dependencies": {
-    "@ethernity-cloud/runner": "^0.6.3",
+    "@ethernity-cloud/runner": "^0.6.5",
     "acorn": "^8.11.0",
     "adm-zip": "^0.5.14",
     "axios": "^1.7.2",

package/pynithy/build.mjs

@@ -48,14 +48,14 @@ export const ECRunner = {
   // --- ethereum sepolia ---
   'ecld-pynithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
   'ecld-nodenithy-ethereum-sepolia': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://ethereum-sepolia-rpc.publicnode.com', 11155111],
-  // --- litvm liteforge testnet (shares sepolia contracts; distinct chain/RPC) ---
-  'ecld-pynithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
-  'ecld-nodenithy-litvm-testnet': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  // --- litvm liteforge testnet: the PoX is the EthernityImplementationV2 1.1 of 2026-10-11; the image registry is the ECImageRegistryV3 of 2026-10-12 ---
+  'ecld-pynithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  'ecld-nodenithy-litvm-testnet': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
   // --- the -unsafe networks: the contracts of the network each is named after ---
   'etny-pynithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
   'etny-nodenithy-testnet-unsafe': ['0x02882F03097fE8cD31afbdFbB5D72a498B41112c', '0xa372a6e1Eb7Fcf343AF6b91E809b900C55001CD1', 'https://bloxberg.ethernity.cloud', 8995],
-  'ecld-pynithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
-  'ecld-nodenithy-litvm-testnet-unsafe': ['0x29D3eC870565B6A1510232bd950A8Bc8336f0EB2', '0x55e0ad455Be85162b71a790f00Fc305680E3CE53', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
+  'ecld-pynithy-litvm-testnet-unsafe': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441],
+  'ecld-nodenithy-litvm-testnet-unsafe': ['0xE35991de1f2A435e29E70406FA2781b1AffCb168', '0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D', 'https://liteforge.rpc.caldera.xyz/infra-partner-http', 4441]
 };
 
 // ethernity-cas ValidatorRegistry per template, baked into the enclave so it

package/pynithy/ipfs.mjs

@@ -1,6 +1,10 @@
 // ipfs.mjs
 //
-// IPFS client for the Ethernity Cloud JS SDK.
+// IPFS client of the publish (nodenithy/run.js, pynithy/run.js): adds, hashes
+// and reads through the IPFS API named with --host, the publish's own Kubo
+// (http://127.0.0.1:<port>) or an IPFS API of the dApp's own; --token, or
+// IPFS_TOKEN in the environment when the flag is absent, is the Authorization
+// header value that API takes, when it takes one.
 //
 // The UPLOAD path is a faithful port of the Python SDK's IPFSClient
 // (ethernity_cloud_sdk_py/commands/pynithy/ipfs_client.py): it posts directly
@@ -12,7 +16,7 @@
 // the Python pipeline step-for-step so both SDKs upload identically (e.g. for
 // the certex / public-key extraction flow).
 //
-// The DOWNLOAD path keeps the existing kubo-rpc-client based helpers.
+// The DOWNLOAD path uses kubo-rpc-client, with the same Authorization header.
 import http from 'http';
 import https from 'https';
 import { URL } from 'url';
@@ -31,29 +35,33 @@ const getRetryDelay = (retryCount, baseDelay = 1) => baseDelay * 2 ** retryCount
 const RETRY_COUNT = 10; // mirrors Python ipfs_client.RETRY_COUNT
 
 // Endpoint + auth, mirroring the Python IPFSClient constructor.
-//   apiUrl : e.g. "https://ipfs.ethernity.cloud"
-//   addUrl : `${apiUrl}/api/v0/add`
+//   apiUrl     : the API's base URL, e.g. "http://127.0.0.1:5001"; adds go to
+//                `${apiUrl}/api/v0/add`
+//   authHeader : the Authorization header value (--token), or null
 let apiUrl = null;
-let authHeader = null; // Authorization header value, or null
+let authHeader = null;
 
 // kubo-rpc-client instance, used only for the download helpers below.
 let ipfs = null;
 
 const initialize = (host, protocol, port, token) => {
+  authHeader = token && token !== '' ? token : null;
   // Normalise the endpoint to a base URL string, matching how the Python client
   // treats `ipfs_endpoint` (it just prepends it to `/api/v0/add`).
+  let opts;
   if (host && host.search('http') !== -1) {
-    apiUrl = host.replace(/\/+$/, '');
-    ipfs = create(host);
+    // The API's base URL: a trailing /api/v0 is dropped, since addUrl appends it.
+    apiUrl = host.replace(/\/+$/, '').replace(/\/api\/v0$/, '');
+    opts = { url: apiUrl };
   } else {
     const proto = protocol || 'http';
     const p = port ? `:${port}` : '';
     apiUrl = `${proto}://${host}${p}`.replace(/\/+$/, '');
-    const opts = { host, protocol: proto, port };
-    if (token) opts.headers = { authorization: token };
-    ipfs = create(opts);
+    opts = { host, protocol: proto, port };
   }
-  authHeader = token && token !== '' ? token : null;
+  // The reads send the same Authorization header as the adds.
+  if (authHeader) opts.headers = { authorization: authHeader };
+  ipfs = create(opts);
 };
 
 // ---------------------------------------------------------------------------
@@ -336,8 +344,48 @@ const hashForIPFS = async (p) => {
   return null;
 };
 
+// Pin `cid` on the API (`pin/add`), which fetches the blocks it does not hold
+// from the peers that provide them and answers once the pin is complete.
+// Resolves true when the API names the CID among its pins.
+const pinOnIPFS = (cid, timeoutMs = 3600000) =>
+  new Promise((resolve, reject) => {
+    const url = new URL(`${apiUrl}/api/v0/pin/add?arg=${encodeURIComponent(cid)}&recursive=true`);
+    const mod = url.protocol === 'https:' ? https : http;
+    const headers = { 'Content-Length': '0' };
+    if (authHeader) headers.Authorization = authHeader;
+    const req = mod.request(
+      {
+        method: 'POST',
+        hostname: url.hostname,
+        port: url.port || (url.protocol === 'https:' ? 443 : 80),
+        path: `${url.pathname}${url.search}`,
+        headers,
+        timeout: timeoutMs
+      },
+      (res) => {
+        let text = '';
+        res.setEncoding('utf8');
+        res.on('data', (chunk) => {
+          text += chunk;
+        });
+        res.on('end', () => {
+          if (res.statusCode !== 200) {
+            console.log(`Failed to pin ${cid} on ${apiUrl}: status ${res.statusCode}`);
+            console.log(text.slice(0, 300));
+            resolve(false);
+            return;
+          }
+          resolve(text.includes(cid));
+        });
+      }
+    );
+    req.on('timeout', () => req.destroy(new Error(`pin/add of ${cid} took longer than ${timeoutMs} ms`)));
+    req.on('error', reject);
+    req.end();
+  });
+
 // ---------------------------------------------------------------------------
-// Download helpers (kubo-rpc-client based; unchanged behaviour)
+// Download helpers (kubo-rpc-client, with the Authorization header of initialize())
 // ---------------------------------------------------------------------------
 
 const getFromIPFS = async (hhash, filePath, maxRetries = process.env.REACT_APP_IPFS_RETRIES || 5) => {
@@ -412,6 +460,7 @@ export {
   initialize,
   upload,
   hashForIPFS,
+  pinOnIPFS,
   uploadFileToIPFS,
   uploadFolderToIPFS,
   getFromIPFS,
@@ -424,12 +473,12 @@ export {
 // ---------------------------------------------------------------------------
 
 program
-  .option('--host <host>', 'IPFS host')
+  .requiredOption('--host <host>', "IPFS API URL: the publish's own Kubo (http://127.0.0.1:<port>) or an IPFS API of the dApp's own")
   .option('--hhash <hhash>', 'IPFS hash')
   .option('--filePath <path>', 'Path to the file')
   .option('--folderPath <path>', 'Path to the folder')
-  .option('--action <action>', 'Action to perform (upload, hash, download)')
-  .option('--token <token>', 'IPFS authorization token')
+  .option('--action <action>', 'Action to perform (upload, hash, pin, download)')
+  .option('--token <token>', 'Authorization header value for the API (IPFS_TOKEN in the environment when absent)')
   .option('--output <path>', 'Output path for download');
 
 const isMain = process.argv[1] && process.argv[1].endsWith('ipfs.mjs');
@@ -439,8 +488,7 @@ if (isMain) {
   const options = program.opts();
 
   const main = async () => {
-    const host = options.host || 'localhost';
-    initialize(host, undefined, undefined, options.token || '');
+    initialize(options.host, undefined, undefined, options.token || process.env.IPFS_TOKEN || '');
 
     if (options.action === 'upload') {
       if (options.filePath) {
@@ -469,6 +517,14 @@ if (isMain) {
       const hhash = await hashForIPFS(target);
       console.log(`${hhash}`);
       process.exit(hhash ? 0 : 1);
+    } else if (options.action === 'pin') {
+      if (!options.hhash) {
+        console.error('Please provide --hhash, the CID to pin.');
+        process.exit(1);
+      }
+      const pinned = await pinOnIPFS(options.hhash);
+      if (pinned) console.log(`${options.hhash}`);
+      process.exit(pinned ? 0 : 1);
     } else if (options.action === 'download') {
       if (options.filePath) {
         await getFromIPFS(options.hhash, options.filePath);
@@ -480,7 +536,7 @@ if (isMain) {
         console.error('Please provide a filePath or folderPath for download.');
       }
     } else {
-      console.error('Please provide a valid action (upload, hash, download).');
+      console.error('Please provide a valid action (upload, hash, pin, download).');
       process.exit(1);
     }
   };

package/pynithy/run/docker-compose-swift-stream.yml

@@ -3,7 +3,10 @@ version: '3.2'
 services:
   minio:
     container_name: etny-swift-stream
-    image: quay.io/minio/minio:RELEASE.2023-03-13T19-46-17Z
+    # quay.io/minio/minio:RELEASE.2023-03-13T19-46-17Z, mirrored on 2026-10-13
+    # (image id c69ff79d5831): quay.io answers 401 to an anonymous pull of
+    # that tag, and the mirror is pulled without credentials.
+    image: registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/minio/minio:RELEASE.2023-03-13T19-46-17Z
     command: server /data/
     expose:
       - "9000"

package/pynithy/run/docker-compose-swift-stream.yml.tmpl

@@ -3,7 +3,10 @@ version: '3.2'
 services:
   minio:
     container_name: etny-swift-stream
-    image: quay.io/minio/minio:RELEASE.2023-03-13T19-46-17Z
+    # quay.io/minio/minio:RELEASE.2023-03-13T19-46-17Z, mirrored on 2026-10-13
+    # (image id c69ff79d5831): quay.io answers 401 to an anonymous pull of
+    # that tag, and the mirror is pulled without credentials.
+    image: registry.ethernity.cloud:443/debuggingdelight/ethernity-cloud-sdk-registry/minio/minio:RELEASE.2023-03-13T19-46-17Z
     command: server /data/
     expose:
       - "9000"

package/pynithy/run/image_registry.js

@@ -39,7 +39,7 @@ function setVars(network = "") {
         }
     } else if (BLOCKCHAIN_NETWORK.includes("LitVM")) {
         NETWORK_RPC = "https://liteforge.rpc.caldera.xyz/infra-partner-http";
-        IMAGE_REGISTRY_ADDRESS = "0x55e0ad455Be85162b71a790f00Fc305680E3CE53";
+        IMAGE_REGISTRY_ADDRESS = "0xAf8Ce29103E1f59feDD49688ff070Ffc2346AF1D";
         CHAIN_ID = 4441;
     }
 }

package/pynithy/run.js

@@ -1,5 +1,5 @@
 const fs = require('fs');
-const { execSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 require('dotenv').config();
 const readline = require('readline');
 const forge = require('node-forge');
@@ -8,7 +8,7 @@ const https = require('https');
 const casConfig = require('../cas/config.js');
 const casResolver = require('../cas/resolver.js');
 const sessionRegistry = require('../cas/session_registry.js');
-const { LocalKubo, ownEndpoint } = require('../localKubo.js');
+const { LocalKubo, ownEndpoint, PUBLIC_IPFS_HOST } = require('../localKubo.js');
 
 if (!fs.existsSync('.env')) {
     console.error("Error: .env file not found");
@@ -122,13 +122,17 @@ const main = async () => {
     }
 
     // Where the image goes. An IPFS API of the application's own
-    // (IPFS_ENDPOINT, when it is not the public one) takes precedence.
-    // Otherwise the publish runs its own Kubo: the public write API of
-    // ipfs.ethernity.cloud is closing, and the image is held by this Kubo,
-    // peered with the bootnode, until its certificate is on chain.
+    // (IPFS_ENDPOINT, with IPFS_TOKEN as its Authorization header when set)
+    // takes precedence. Otherwise the publish runs its own Kubo: the public
+    // API of ipfs.ethernity.cloud takes no adds or pins without a writer
+    // token, and the image is held by this Kubo, peered with the bootnode,
+    // until its certificate is on chain.
     let localKubo = null;
     let ipfsApi = process.env.IPFS_ENDPOINT || '';
-    if (!ownEndpoint(ipfsApi)) {
+    let ipfsToken = '';
+    if (ownEndpoint(ipfsApi)) {
+        ipfsToken = process.env.IPFS_TOKEN || '';
+    } else {
         localKubo = new LocalKubo(process.env.PROJECT_NAME);
         try {
             await localKubo.start();
@@ -140,23 +144,28 @@ const main = async () => {
         console.log(`\t✔  IPFS node for this publish: ${ipfsApi}`);
         process.on('exit', () => localKubo.release());
     }
+    // node ../ipfs.mjs against ipfsApi, with the token as IPFS_TOKEN in its
+    // environment: the command line is in a failure's message and in the
+    // process list. A non-zero exit ends the publish.
+    const ipfsEnv = { ...process.env, IPFS_TOKEN: ipfsToken };
+    const ipfsCli = (args, stdio) => {
+        try {
+            return execFileSync(process.execPath, ['../ipfs.mjs', '--host', ipfsApi, ...args], { stdio, env: ipfsEnv });
+        } catch (e) {
+            console.error(`Error: node ../ipfs.mjs ${args.join(' ')} failed (${e.status != null ? `exit ${e.status}` : (e.signal || e.code)}).`);
+            process.exit(1);
+        }
+    };
 
     // The CIDs uploadToIpfs gives, from the same add calls with only-hash: the
     // IPFS node stores and announces nothing. Set by hashForIpfs, after which
     // uploadToIpfs refuses an upload that gives other CIDs.
     let expectedCids = null;
     const hashForIpfs = () => {
-        const hashOf = (target) => {
-            try {
-                const out = execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action hash ${target}`, { stdio: ['ignore', 'pipe', 'inherit'] });
-                return out.toString().trim().split('\n').pop().trim();
-            } catch (e) {
-                console.error(`Error: could not hash ${target} for IPFS: ${e.message}`);
-                process.exit(1);
-            }
-        };
-        process.env.IPFS_DOCKER_COMPOSE_HASH = hashOf('--filePath docker-compose-final.yml');
-        process.env.IPFS_HASH = hashOf(`--folderPath ${registryPath}`);
+        const hashOf = (target) => ipfsCli(['--action', 'hash', ...target], ['ignore', 'pipe', 'inherit'])
+            .toString().trim().split('\n').pop().trim();
+        process.env.IPFS_DOCKER_COMPOSE_HASH = hashOf(['--filePath', 'docker-compose-final.yml']);
+        process.env.IPFS_HASH = hashOf(['--folderPath', registryPath]);
         console.log("IPFS_DOCKER_COMPOSE_HASH (before upload): ", process.env.IPFS_DOCKER_COMPOSE_HASH);
         console.log("IPFS_HASH (before upload): ", process.env.IPFS_HASH);
         expectedCids = { image: process.env.IPFS_HASH, compose: process.env.IPFS_DOCKER_COMPOSE_HASH };
@@ -169,7 +178,7 @@ const main = async () => {
             if (fs.existsSync(file)) fs.unlinkSync(file);
         }
         console.log('Upload docker-compose-final.yml to IPFS');
-        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --filePath docker-compose-final.yml`, { stdio: "inherit" });
+        ipfsCli(['--action', 'upload', '--filePath', 'docker-compose-final.yml'], 'inherit');
         if (!fs.existsSync('IPFS_DOCKER_COMPOSE_HASH.ipfs')) {
             console.error("Error: Could not upload docker-compose-final.yml to IPFS, please try again!");
             process.exit(1);
@@ -178,7 +187,7 @@ const main = async () => {
         console.log("IPFS_DOCKER_COMPOSE_HASH: ", process.env.IPFS_DOCKER_COMPOSE_HASH);
         writeEnv('IPFS_DOCKER_COMPOSE_HASH', process.env.IPFS_DOCKER_COMPOSE_HASH);
         console.log('Upload docker registry to IPFS');
-        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
         if (!fs.existsSync('IPFS_HASH.ipfs')) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);
@@ -323,7 +332,7 @@ const main = async () => {
         const registered = await sessionRegistry.register(
             casChain.rpcUrl, casChain.chainId, casConfig.SESSION_REGISTRY[templateName],
             process.env.PRIVATE_KEY, fs.readFileSync('etny-securelock-test.yaml'),
-            ipfsApi, '');
+            ipfsApi, '', ipfsToken);
         if (localKubo) await localKubo.provide(registered.cid);
         if (registered.registered) {
             console.log(`\t✔  Session ${registered.name} registered on-chain (body ${registered.cid})`);
@@ -588,6 +597,29 @@ const main = async () => {
     if (registryV2 && localKubo) {
         await localKubo.provide(process.env.IPFS_HASH);
         await localKubo.provide(process.env.IPFS_DOCKER_COMPOSE_HASH);
+    } else if (!registryV2 && localKubo) {
+        // On a V1 registry nothing is recorded before the certificate, so the
+        // bootnode's mirror pins nothing from this Kubo, and the certificate
+        // extraction service and the nodes, which fetch from the bootnode,
+        // would wait on an image it never receives: the compose and the image
+        // are pinned on the public API, which fetches them from this Kubo over
+        // the connection it holds. The pin takes a token (IPFS_TOKEN); without
+        // one the publish stops here, before anything is on chain.
+        const publicToken = process.env.IPFS_TOKEN || '';
+        if (!publicToken) {
+            console.error("Error: this network's image registry records an image only with its certificate, so the image must be pinned on the public IPFS API before the certificate is extracted, and the public API takes a pin only with a token.");
+            console.error(`       Set IPFS_TOKEN to a writer token of ${PUBLIC_IPFS_HOST} and publish again.`);
+            process.exit(1);
+        }
+        for (const cid of [process.env.IPFS_DOCKER_COMPOSE_HASH, process.env.IPFS_HASH]) {
+            console.log(`Pinning ${cid} on the public IPFS API`);
+            try {
+                execFileSync(process.execPath, ['../ipfs.mjs', '--host', `https://${PUBLIC_IPFS_HOST}`, '--action', 'pin', '--hhash', cid], { stdio: 'inherit', env: { ...process.env, IPFS_TOKEN: publicToken } });
+            } catch (e) {
+                console.error(`Error: the public IPFS API did not pin ${cid} (${e.status != null ? `exit ${e.status}` : (e.signal || e.code)}).`);
+                process.exit(1);
+            }
+        }
     }
     if (casTestnet) await registerSessionOnChain();
 
@@ -699,7 +731,7 @@ const main = async () => {
             fs.unlinkSync('IPFS_HASH.ipfs');
         }
         console.log('Upload docker registry to IPFS');
-        execSync(`node ../ipfs.mjs --host "${ipfsApi}" --action upload --folderPath ${registryPath}`, { stdio: "inherit" });
+        ipfsCli(['--action', 'upload', '--folderPath', registryPath], 'inherit');
         if (!fs.existsSync(`./IPFS_HASH.ipfs`)) {
             console.error("Error: Could not upload registry to IPFS, please try again!");
             process.exit(1);

package/pynithy/src/ec_helloworld_example.js

@@ -5,7 +5,8 @@ import { ECStatus } from "@ethernity-cloud/runner/enums";
 // Filled in from the project's .env by src/preStart.mjs on `npm start`: the
 // securelock this dApp is published as, the trustedzone it was built against,
 // the network's token address and chain id, the -unsafe network when the dApp
-// runs without a CAS (null otherwise), and the IPFS endpoint.
+// runs without a CAS (null otherwise), and the IPFS API of the dApp's own ('' when
+// the task's artefacts go through the bootnode's payload intake).
 const PROJECT_NAME = "";
 const TRUSTED_ZONE_IMAGE = "";
 const NETWORK_ADDRESS = "";
@@ -23,7 +24,10 @@ function App() {
         if (UNSAFE_NETWORK) {
             await runner.setNetwork(...UNSAFE_NETWORK);
         }
-        runner.initializeStorage(IPFS_ENDPOINT);
+        // An IPFS API of the dApp's own (IPFS_ENDPOINT) carries the task's
+        // artefacts; without one they go through the bootnode's payload intake.
+        if (IPFS_ENDPOINT) runner.initializeStorage(IPFS_ENDPOINT);
+        else runner.initializePublicIntake();
 
         // Events are named by task status; detail is { message, status, progress }.
         runner.addEventListener(ECStatus.DEFAULT, (e) => {

package/pynithy/src/preStart.mjs

@@ -3,7 +3,10 @@
 // .env, the way ecld-run reads the same values. PROJECT_NAME and
 // TRUSTED_ZONE_IMAGE take their -unsafe form on an -unsafe network; the
 // network's token address, chain id and -unsafe (network, type) come from the
-// runner's own enums through the SDK's network table.
+// runner's own enums through the SDK's network table; IPFS_ENDPOINT is the
+// IPFS API of the dApp's own, or '' (no setting, or the public API, which
+// takes no writes without a token), on which the dApp delivers its task
+// artefacts through the bootnode's payload intake.
 import fs from 'fs';
 import { createRequire } from 'module';
 import dotenv from 'dotenv';
@@ -13,6 +16,7 @@ dotenv.config();
 const require = createRequire(import.meta.url);
 const casConfig = require('@ethernity-cloud/sdk-js/cas/config.js');
 const { networkFor } = require('@ethernity-cloud/sdk-js/network.js');
+const { dappEndpoint } = require('@ethernity-cloud/sdk-js/localKubo.js');
 
 const { PROJECT_NAME, TRUSTED_ZONE_IMAGE, BLOCKCHAIN_NETWORK, IPFS_ENDPOINT } = process.env;
 if (!PROJECT_NAME || !BLOCKCHAIN_NETWORK) {
@@ -31,7 +35,7 @@ const constants = {
   NETWORK_ADDRESS: network.address,
   CHAIN_ID: network.chainId || null,
   UNSAFE_NETWORK: network.unsafe || null,
-  IPFS_ENDPOINT: IPFS_ENDPOINT || 'https://ipfs.ethernity.cloud',
+  IPFS_ENDPOINT: dappEndpoint(IPFS_ENDPOINT),
 };
 
 const filePath = 'src/ec_helloworld_example.js';