@le-space/rootfs 0.6.1 → 0.6.2

package/reference/ucan-store/rootfs/ucan-store-configure.sh

@@ -0,0 +1,261 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ENV_FILE="${ENV_FILE:-/etc/default/ucan-store}"
+READY_FILE="${READY_FILE:-/etc/default/ucan-store.ready}"
+BOOTSTRAP_PACKAGE_FILE="${BOOTSTRAP_PACKAGE_FILE:-/etc/ucan-store/bootstrap-package.json}"
+BOOTSTRAP_VALIDATOR="${BOOTSTRAP_VALIDATOR:-/usr/local/sbin/ucan_store_bootstrap_validate.py}"
+BOOTSTRAP_CRYPTO_VERIFIER="${BOOTSTRAP_CRYPTO_VERIFIER:-/usr/local/sbin/ucan-store-bootstrap-verify.mjs}"
+BOOTSTRAP_VERIFICATION_FILE="${BOOTSTRAP_VERIFICATION_FILE:-/etc/ucan-store/bootstrap-verification.json}"
+SERVICE_NAME="${SERVICE_NAME:-ucan-store.service}"
+CADDY_SERVICE="${CADDY_SERVICE:-caddy.service}"
+CADDYFILE="${CADDYFILE:-/etc/caddy/Caddyfile}"
+SERVICE_PORT="${SERVICE_PORT:-8787}"
+PROXY_PORT="${PROXY_PORT:-8788}"
+PUBLIC_IPV4=""
+PUBLIC_IPV6=""
+PROXY_HOSTNAME=""
+WEBAUTHN_ORIGIN=""
+WEBAUTHN_ORIGIN_FALLBACKS=""
+ADMIN_DID=""
+ADMIN_API_TOKEN=""
+BOOTSTRAP_PACKAGE_INPUT_FILE=""
+START_SERVICE=1
+
+usage() {
+  cat <<'EOF'
+Usage:
+  ucan-store-configure.sh \
+    --public-ipv4 <ip> \
+    [--public-ipv6 <ipv6>] \
+    [--proxy-hostname <hostname>] \
+    [--webauthn-origin <origin>] \
+    [--webauthn-origin-fallbacks <csv>] \
+    [--admin-did <did>] \
+    [--admin-api-token <token>] \
+    [--bootstrap-package-file <path>] \
+    [--no-start]
+
+Writes the public service wiring for the current ucan-store deployment,
+enables the guest service, and stores the resulting PWA-facing `VITE_*` values.
+EOF
+}
+
+write_env_var() {
+  local key="$1"
+  local value="$2"
+
+  python3 - "${ENV_FILE}" "${key}" "${value}" <<'PY'
+import re
+import sys
+from pathlib import Path
+
+env_file, key, value = sys.argv[1:4]
+target = Path(env_file)
+pattern = re.compile(rf"^[#\s]*{re.escape(key)}=.*$", re.MULTILINE)
+
+raw = target.read_text(encoding="utf-8") if target.exists() else ""
+replacement = f"{key}={value}"
+
+if pattern.search(raw):
+    updated = pattern.sub(replacement, raw, count=1)
+else:
+    updated = raw + ("" if raw.endswith("\n") or not raw else "\n") + replacement + "\n"
+
+target.write_text(updated, encoding="utf-8")
+PY
+}
+
+write_caddyfile() {
+  local hostname="$1"
+  mkdir -p "$(dirname "${CADDYFILE}")"
+  cat > "${CADDYFILE}" <<EOF
+{
+  auto_https disable_redirects
+}
+
+${hostname} {
+  reverse_proxy 127.0.0.1:${PROXY_PORT}
+}
+EOF
+}
+
+derive_service_did_from_hostname() {
+  python3 - "${1:-}" <<'PY'
+import sys
+from urllib.parse import urlsplit
+
+raw = (sys.argv[1] or "").strip()
+if not raw:
+    raise SystemExit(0)
+
+parsed = urlsplit(raw if "://" in raw else f"https://{raw}")
+host = (parsed.hostname or "").strip().lower()
+if not host:
+    raise SystemExit(0)
+
+port = f"%3A{parsed.port}" if parsed.port else ""
+print(f"did:web:{host}{port}")
+PY
+}
+
+probe_service_did() {
+  python3 - "${SERVICE_PORT}" <<'PY'
+import json
+import sys
+import time
+import urllib.error
+import urllib.request
+
+port = int(sys.argv[1])
+url = f"http://127.0.0.1:{port}/.well-known/did.json"
+deadline = time.time() + 60
+last_error = None
+
+while time.time() < deadline:
+    try:
+        with urllib.request.urlopen(url, timeout=5) as response:
+            payload = json.loads(response.read().decode("utf-8"))
+        did = payload.get("id")
+        if isinstance(did, str) and did.strip():
+            print(did.strip())
+            raise SystemExit(0)
+        last_error = "did.json missing id"
+    except (urllib.error.URLError, TimeoutError, json.JSONDecodeError) as error:
+        last_error = str(error)
+    time.sleep(2)
+
+raise SystemExit(last_error or "service DID probe timed out")
+PY
+}
+
+install_bootstrap_package() {
+  local source_file="$1"
+  mkdir -p "$(dirname "${BOOTSTRAP_PACKAGE_FILE}")"
+  python3 "${BOOTSTRAP_VALIDATOR}" --package-file "${source_file}" >/dev/null
+  node "${BOOTSTRAP_CRYPTO_VERIFIER}" \
+    --package-file "${source_file}" \
+    --admin-did "${ADMIN_DID}" \
+    --summary-file "${BOOTSTRAP_VERIFICATION_FILE}" >/dev/null
+  cp "${source_file}" "${BOOTSTRAP_PACKAGE_FILE}"
+  chmod 0640 "${BOOTSTRAP_PACKAGE_FILE}"
+  chmod 0644 "${BOOTSTRAP_VERIFICATION_FILE}"
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --public-ipv4)
+      PUBLIC_IPV4="${2:-}"
+      shift 2
+      ;;
+    --public-ipv6)
+      PUBLIC_IPV6="${2:-}"
+      shift 2
+      ;;
+    --proxy-hostname)
+      PROXY_HOSTNAME="${2:-}"
+      shift 2
+      ;;
+    --webauthn-origin)
+      WEBAUTHN_ORIGIN="${2:-}"
+      shift 2
+      ;;
+    --webauthn-origin-fallbacks)
+      WEBAUTHN_ORIGIN_FALLBACKS="${2:-}"
+      shift 2
+      ;;
+    --admin-did)
+      ADMIN_DID="${2:-}"
+      shift 2
+      ;;
+    --admin-api-token)
+      ADMIN_API_TOKEN="${2:-}"
+      shift 2
+      ;;
+    --bootstrap-package-file)
+      BOOTSTRAP_PACKAGE_INPUT_FILE="${2:-}"
+      shift 2
+      ;;
+    --no-start)
+      START_SERVICE=0
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [ -z "${PUBLIC_IPV4}" ]; then
+  usage >&2
+  exit 1
+fi
+
+touch "${ENV_FILE}"
+
+write_env_var "PUBLIC_IPV4" "${PUBLIC_IPV4}"
+write_env_var "PUBLIC_IPV6" "${PUBLIC_IPV6}"
+write_env_var "PROXY_HOSTNAME" "${PROXY_HOSTNAME}"
+write_env_var "UCAN_STORE_SERVICE_KEY_ALGORITHM" "${UCAN_STORE_SERVICE_KEY_ALGORITHM:-ed25519}"
+write_env_var "UCAN_STORE_ADMIN_DID" "${ADMIN_DID}"
+write_env_var "UCAN_STORE_ADMIN_API_TOKEN" "${ADMIN_API_TOKEN}"
+write_env_var "UCAN_STORE_BOOTSTRAP_PACKAGE_FILE" "${BOOTSTRAP_PACKAGE_FILE}"
+write_env_var "UCAN_STORE_BOOTSTRAP_VERIFICATION_FILE" "${BOOTSTRAP_VERIFICATION_FILE}"
+
+if [ -n "${BOOTSTRAP_PACKAGE_INPUT_FILE}" ]; then
+  install_bootstrap_package "${BOOTSTRAP_PACKAGE_INPUT_FILE}"
+fi
+
+if [ -n "${WEBAUTHN_ORIGIN}" ]; then
+  write_env_var "WEBAUTHN_ORIGIN" "${WEBAUTHN_ORIGIN}"
+fi
+write_env_var "WEBAUTHN_ORIGIN_FALLBACKS" "${WEBAUTHN_ORIGIN_FALLBACKS}"
+
+if [ -n "${PROXY_HOSTNAME}" ]; then
+  write_env_var "UCAN_STORE_SERVICE_DID" "$(derive_service_did_from_hostname "${PROXY_HOSTNAME}")"
+  write_caddyfile "${PROXY_HOSTNAME}"
+  write_env_var "PUBLIC_UPLOAD_SERVICE_URL" "https://${PROXY_HOSTNAME}"
+  write_env_var "PUBLIC_REVOCATION_URL" "https://${PROXY_HOSTNAME}"
+  write_env_var "PUBLIC_RECEIPTS_URL" "https://${PROXY_HOSTNAME}/receipt/"
+else
+  write_env_var "UCAN_STORE_SERVICE_DID" ""
+fi
+
+touch "${READY_FILE}"
+
+if [ "${START_SERVICE}" = "1" ]; then
+  systemctl daemon-reload
+  systemctl restart "${SERVICE_NAME}"
+  if [ -n "${PROXY_HOSTNAME}" ]; then
+    systemctl restart "${CADDY_SERVICE}"
+  fi
+
+  SERVICE_DID="$(probe_service_did)"
+  write_env_var "UCAN_STORE_SERVICE_DID" "${SERVICE_DID}"
+  write_env_var "PUBLIC_UPLOAD_SERVICE_DID" "${SERVICE_DID}"
+  write_env_var "PUBLIC_REVOCATION_DID" "${SERVICE_DID}"
+
+  if [ -f "${BOOTSTRAP_PACKAGE_FILE}" ]; then
+    RUNTIME_SERVICE_ORIGIN=""
+    if [ -n "${PROXY_HOSTNAME}" ]; then
+      RUNTIME_SERVICE_ORIGIN="https://${PROXY_HOSTNAME}"
+    fi
+    python3 "${BOOTSTRAP_VALIDATOR}" \
+      --package-file "${BOOTSTRAP_PACKAGE_FILE}" \
+      --runtime-service-did "${SERVICE_DID}" \
+      --runtime-service-origin "${RUNTIME_SERVICE_ORIGIN}" \
+      --admin-did "${ADMIN_DID}" >/dev/null
+    node "${BOOTSTRAP_CRYPTO_VERIFIER}" \
+      --package-file "${BOOTSTRAP_PACKAGE_FILE}" \
+      --runtime-service-did "${SERVICE_DID}" \
+      --runtime-service-origin "${RUNTIME_SERVICE_ORIGIN}" \
+      --admin-did "${ADMIN_DID}" \
+      --summary-file "${BOOTSTRAP_VERIFICATION_FILE}" >/dev/null
+  fi
+fi

package/reference/ucan-store/rootfs/ucan-store-describe.py

@@ -0,0 +1,150 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import json
+import os
+import time
+import urllib.error
+import urllib.request
+
+from ucan_store_bootstrap_validate import summarize_bootstrap_package
+
+
+ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/ucan-store")
+SERVICE_PORT = int(os.environ.get("STORACHA_LOCAL_PORT", "8787"))
+WAIT_TIMEOUT_SECONDS = int(os.environ.get("DESCRIBE_WAIT_TIMEOUT_SECONDS", "120"))
+WAIT_INTERVAL_SECONDS = float(os.environ.get("DESCRIBE_WAIT_INTERVAL_SECONDS", "2"))
+BOOTSTRAP_PACKAGE_FILE = os.environ.get(
+    "BOOTSTRAP_PACKAGE_FILE",
+    "/etc/ucan-store/bootstrap-package.json",
+)
+BOOTSTRAP_VERIFICATION_FILE = os.environ.get(
+    "BOOTSTRAP_VERIFICATION_FILE",
+    "/etc/ucan-store/bootstrap-verification.json",
+)
+
+
+def parse_env_file(path: str) -> dict[str, str]:
+    values: dict[str, str] = {}
+    if not os.path.exists(path):
+        return values
+
+    with open(path, encoding="utf-8") as handle:
+        for line in handle:
+            stripped = line.strip()
+            if not stripped or stripped.startswith("#") or "=" not in stripped:
+                continue
+            key, value = stripped.split("=", 1)
+            values[key.strip()] = value.strip()
+    return values
+
+
+def fetch_service_did(port: int) -> str:
+    url = f"http://127.0.0.1:{port}/.well-known/did.json"
+    deadline = time.monotonic() + WAIT_TIMEOUT_SECONDS
+    last_error = None
+
+    while time.monotonic() < deadline:
+        try:
+            with urllib.request.urlopen(url, timeout=5) as response:
+                payload = json.loads(response.read().decode("utf-8"))
+            did = payload.get("id")
+            if isinstance(did, str) and did.strip():
+                return did.strip()
+            last_error = "did.json missing id"
+        except (urllib.error.URLError, TimeoutError, json.JSONDecodeError) as error:
+            last_error = str(error)
+        time.sleep(WAIT_INTERVAL_SECONDS)
+
+    raise SystemExit(last_error or "unable to discover upload service DID")
+
+
+def read_json_file(path: str) -> dict[str, object] | None:
+    if not path or not os.path.exists(path):
+        return None
+    with open(path, encoding="utf-8") as handle:
+        payload = json.load(handle)
+    return payload if isinstance(payload, dict) else None
+
+
+def main() -> None:
+    env_values = parse_env_file(ENV_FILE)
+    service_did = env_values.get("PUBLIC_UPLOAD_SERVICE_DID", "").strip() or fetch_service_did(SERVICE_PORT)
+    upload_url = env_values.get("PUBLIC_UPLOAD_SERVICE_URL", "").strip()
+    revocation_url = env_values.get("PUBLIC_REVOCATION_URL", "").strip() or upload_url
+    receipts_url = env_values.get("PUBLIC_RECEIPTS_URL", "").strip() or (upload_url.rstrip("/") + "/receipt/" if upload_url else "")
+    bootstrap_package_file = (
+        env_values.get("UCAN_STORE_BOOTSTRAP_PACKAGE_FILE", "").strip()
+        or BOOTSTRAP_PACKAGE_FILE
+    )
+    bootstrap_verification_file = (
+        env_values.get("UCAN_STORE_BOOTSTRAP_VERIFICATION_FILE", "").strip()
+        or BOOTSTRAP_VERIFICATION_FILE
+    )
+    bootstrap_validation = summarize_bootstrap_package(
+        bootstrap_package_file,
+        runtime_service_did=service_did,
+        runtime_service_origin=upload_url or None,
+        admin_did=env_values.get("UCAN_STORE_ADMIN_DID", "").strip() or None,
+        allow_missing=True,
+    )
+    bootstrap_proof_validation = read_json_file(bootstrap_verification_file)
+    if bootstrap_validation.get("status") == "invalid":
+        raise SystemExit(
+            "bootstrap package validation failed: "
+            + "; ".join(bootstrap_validation.get("errors", [])),
+        )
+    if bootstrap_proof_validation and bootstrap_proof_validation.get("status") == "invalid":
+        raise SystemExit(
+            "bootstrap proof verification failed: "
+            + "; ".join(bootstrap_proof_validation.get("errors", [])),
+        )
+
+    payload = {
+        "service_did": service_did,
+        "service_identity": {
+            "did": service_did,
+            "configured_did": env_values.get("UCAN_STORE_SERVICE_DID", "").strip() or None,
+            "key_algorithm": env_values.get(
+                "UCAN_STORE_SERVICE_KEY_ALGORITHM",
+                "",
+            ).strip()
+            or None,
+        },
+        "delegation_issuance": {
+            "enabled": bool(env_values.get("UCAN_STORE_ADMIN_API_TOKEN", "").strip()),
+            "policy_endpoint": f"{upload_url}/admin/delegations/policy" if upload_url else None,
+            "issue_endpoint": f"{upload_url}/admin/delegations" if upload_url else None,
+            "proof_format": "ucan-car-multibase-base64",
+        },
+        "service_manifest": {
+            "endpoint": f"{upload_url}/.well-known/ucan-store.json" if upload_url else None,
+            "alias": f"{upload_url}/service-manifest.json" if upload_url else None,
+            "binding": "domain-first",
+        },
+        "upload_service_url": upload_url or None,
+        "upload_service_did": service_did,
+        "revocation_url": revocation_url or None,
+        "revocation_did": env_values.get("PUBLIC_REVOCATION_DID", "").strip() or service_did,
+        "receipts_url": receipts_url or None,
+        "proxy_hostname": env_values.get("PROXY_HOSTNAME", "").strip() or None,
+        "public_ipv4": env_values.get("PUBLIC_IPV4", "").strip() or None,
+        "public_ipv6": env_values.get("PUBLIC_IPV6", "").strip() or None,
+        "admin_did": env_values.get("UCAN_STORE_ADMIN_DID", "").strip() or None,
+        "webauthn_origin": env_values.get("WEBAUTHN_ORIGIN", "").strip() or None,
+        "webauthn_origin_fallbacks": env_values.get("WEBAUTHN_ORIGIN_FALLBACKS", "").strip() or None,
+        "bootstrap_validation": bootstrap_validation,
+        "bootstrap_proof_validation": bootstrap_proof_validation,
+        "pwa_env": {
+            "VITE_UPLOAD_SERVICE_URL": upload_url or None,
+            "VITE_UPLOAD_SERVICE_DID": service_did,
+            "VITE_REVOCATION_URL": revocation_url or None,
+            "VITE_REVOCATION_DID": env_values.get("PUBLIC_REVOCATION_DID", "").strip() or service_did,
+            "VITE_RECEIPTS_URL": receipts_url or None,
+        },
+    }
+    print(json.dumps(payload))
+
+
+if __name__ == "__main__":
+    main()