@le-space/rootfs 0.6.41 → 0.6.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.6.41",
+  "version": "0.6.42",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/uc-go-peer/rootfs/uc-go-peer-bootstrap-refresh.py

@@ -22,6 +22,20 @@ except ImportError as error:  # pragma: no cover - runtime dependency
 
 ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/uc-go-peer")
 DESCRIBE_SCRIPT = os.environ.get("DESCRIBE_SCRIPT", "/usr/local/sbin/uc-go-peer-describe.py")
+# Port of the orbitdb-relay cadence fix (relay-button #75): the initial
+# registration publish is triggered once by configure.sh, while the refresh
+# timer's first firing is 20 minutes away — a one-shot publish that catches
+# the peer before a browser-dialable address exists leaves consumers a dead
+# zone. Retry describe+publish until a secure browser address exists or the
+# deadline passes (then publish whatever is available, the old behaviour).
+# The go peer usually announces certhash-bearing webtransport/webrtc-direct
+# addresses right at startup, so the first attempt normally succeeds.
+PUBLISH_RETRY_TIMEOUT_SECONDS = int(
+    os.environ.get("BOOTSTRAP_PUBLISH_RETRY_TIMEOUT_SECONDS", "900")
+)
+PUBLISH_RETRY_INTERVAL_SECONDS = int(
+    os.environ.get("BOOTSTRAP_PUBLISH_RETRY_INTERVAL_SECONDS", "15")
+)
 DEFAULT_API_HOST = os.environ.get("ALEPH_BOOTSTRAP_API_HOST", "https://api.aleph.im")
 DEFAULT_CHANNEL = os.environ.get("ALEPH_BOOTSTRAP_CHANNEL", "simple-todo")
 DEFAULT_REF = os.environ.get("ALEPH_BOOTSTRAP_REF", "simple-todo-bootstrap")
@@ -75,6 +89,20 @@ def is_browser_dialable(addr: str) -> bool:
     return "/ws" in normalized or "/wss" in normalized
 
 
+def is_secure_browser_dialable(addr: str) -> bool:
+    """Mirror of the consumer-side address policy (testkit/app): a secure
+    websocket, or webtransport/webrtc-direct carrying a certhash. Plain /ws
+    does not count — an HTTPS page cannot dial it."""
+    normalized = addr.lower()
+    if "/tls/ws" in normalized or "/wss" in normalized:
+        return True
+    if (
+        "/webtransport" in normalized or "/webrtc-direct" in normalized
+    ) and "/certhash/" in normalized:
+        return True
+    return False
+
+
 def is_public_multiaddr(addr: str) -> bool:
     parts = split_multiaddr(addr)
     if not parts:
@@ -567,6 +595,47 @@ def main() -> None:
         print(json_dumps({"status": "skipped", "reason": "missing publisher key"}))
         return
 
+    deadline = time.monotonic() + PUBLISH_RETRY_TIMEOUT_SECONDS
+    result: dict[str, object] | None = None
+    while True:
+        result = attempt_publish(
+            env_values,
+            publisher_private_key,
+            registration_id,
+            require_secure_browser_dialable=True,
+        )
+        if result is not None:
+            break
+        if time.monotonic() >= deadline:
+            # Deadline passed without a secure browser address — publish what
+            # exists anyway (probe addresses still serve the Actions path).
+            result = attempt_publish(
+                env_values,
+                publisher_private_key,
+                registration_id,
+                require_secure_browser_dialable=False,
+            )
+            break
+        time.sleep(PUBLISH_RETRY_INTERVAL_SECONDS)
+
+    if result is None:
+        print(json_dumps({"status": "skipped", "reason": "no public browser multiaddrs"}))
+        return
+    print(json_dumps(result))
+
+
+def attempt_publish(
+    env_values: dict[str, str],
+    publisher_private_key: str,
+    registration_id: str | None,
+    require_secure_browser_dialable: bool,
+) -> dict[str, object] | None:
+    """One describe→publish cycle. Returns the result record when a
+    registration was published, or None when the caller should retry (no
+    public addresses yet, or — while `require_secure_browser_dialable` — none
+    of them is dialable from an HTTPS page). Nothing is published on the
+    retry path: an early registration without a browser-dialable address
+    makes consumers resolve too soon and fail."""
     describe = subprocess.run([DESCRIBE_SCRIPT], check=True, capture_output=True, text=True)
     metadata = json.loads(describe.stdout.strip() or "{}")
     peer_id = metadata.get("peer_id")
@@ -592,10 +661,16 @@ def main() -> None:
         )
     api_host = env_values.get("ALEPH_BOOTSTRAP_API_HOST", DEFAULT_API_HOST).strip() or DEFAULT_API_HOST
     published_multiaddrs = select_compact_multiaddrs(browser_multiaddrs or multiaddrs)
+    # Intentionally left empty: consumers read content.multiaddrs (fallback),
+    # and the relayProof signature is byte-order-sensitive — populating
+    # browserMultiaddrs would change the signed payload shape.
     published_browser_multiaddrs: list[str] = []
     if not published_multiaddrs:
-        print(json_dumps({"status": "skipped", "reason": "no public browser multiaddrs"}))
-        return
+        return None
+    if require_secure_browser_dialable and not any(
+        is_secure_browser_dialable(addr) for addr in published_multiaddrs
+    ):
+        return None
 
     owner_authorization = load_owner_authorization(
         env_values,
@@ -658,24 +733,20 @@ def main() -> None:
         api_host, publisher_address, publisher_private_key, previous_hashes, channel
     )
 
-    print(
-        json_dumps(
-            {
-                "status": "published",
-                "httpStatus": http_status,
-                "itemHash": unsigned_message["item_hash"],
-                "sender": publisher_address,
-                "peerId": peer_id,
-                "publishedMultiaddrs": published_multiaddrs,
-                "publishedBrowserMultiaddrs": published_browser_multiaddrs or published_multiaddrs,
-                "forgottenHashes": previous_hashes,
-                "forgetStaleOlderThanSeconds": STALE_RECORD_MAX_AGE_SECONDS,
-                "ownerAuthorizationPresent": owner_authorization is not None,
-                "forgetResponse": forget_response[1] if forget_response else None,
-                "response": response,
-            }
-        )
-    )
+    return {
+        "status": "published",
+        "httpStatus": http_status,
+        "itemHash": unsigned_message["item_hash"],
+        "sender": publisher_address,
+        "peerId": peer_id,
+        "publishedMultiaddrs": published_multiaddrs,
+        "publishedBrowserMultiaddrs": published_browser_multiaddrs or published_multiaddrs,
+        "forgottenHashes": previous_hashes,
+        "forgetStaleOlderThanSeconds": STALE_RECORD_MAX_AGE_SECONDS,
+        "ownerAuthorizationPresent": owner_authorization is not None,
+        "forgetResponse": forget_response[1] if forget_response else None,
+        "response": response,
+    }
 
 
 if __name__ == "__main__":

package/reference/uc-go-peer/rootfs/uc-go-peer-describe.py

@@ -4,16 +4,58 @@ from __future__ import annotations
 import json
 import os
 import re
+import socket
+import ssl
 import subprocess
 import time
 
 
 ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/uc-go-peer")
 SERVICE_NAME = os.environ.get("SERVICE_NAME", "uc-go-peer.service")
+CADDY_HTTPS_PORT = int(os.environ.get("CADDY_HTTPS_PORT", "443"))
 WAIT_TIMEOUT_SECONDS = int(os.environ.get("DESCRIBE_WAIT_TIMEOUT_SECONDS", "240"))
 WAIT_INTERVAL_SECONDS = float(os.environ.get("DESCRIBE_WAIT_INTERVAL_SECONDS", "2"))
 AUTOTLS_EXTRA_WAIT_SECONDS = int(os.environ.get("DESCRIBE_AUTOTLS_EXTRA_WAIT_SECONDS", "120"))
 
+
+def tls_endpoint_serves(hostname: str, port: int) -> bool:
+    """True only once the local listener on `port` serves a publicly-trusted
+    TLS certificate for `hostname`.
+
+    Port of the orbitdb-relay fix (relay-button #74/#75): announcing a wss
+    address before its Let's Encrypt certificate actually serves makes
+    browsers fail the TLS handshake with net::ERR_SSL_PROTOCOL_ERROR. The
+    handshake runs against the local listener with the public hostname as
+    SNI — local, so hairpin-NAT to the VM's own public IP is irrelevant, and
+    CA-validated, so self-signed placeholders are rejected.
+    """
+    if not hostname:
+        return False
+    context = ssl.create_default_context()
+    try:
+        with socket.create_connection(("127.0.0.1", port), timeout=8) as raw:
+            with context.wrap_socket(raw, server_hostname=hostname) as tls:
+                return bool(tls.getpeercert())
+    except (ssl.SSLError, OSError, ValueError):
+        return False
+
+
+def caddy_cert_serves(hostname: str) -> bool:
+    return tls_endpoint_serves(hostname, CADDY_HTTPS_PORT)
+
+
+def autotls_cert_serves(autotls_addrs: list[str]) -> bool:
+    """Verify the AutoTLS *.libp2p.direct certificate actually serves. Host
+    AND port come from the multiaddr — TLS is terminated on the announced
+    port; every candidate is tried until one verifies."""
+    for addr in autotls_addrs:
+        host_match = re.search(r"/dns[46]/([^/]+)/", addr) or re.search(r"/sni/([^/]+)/", addr)
+        port_match = re.search(r"/tcp/(\d+)/", addr)
+        if host_match and port_match:
+            if tls_endpoint_serves(host_match.group(1), int(port_match.group(1))):
+                return True
+    return False
+
 PEER_ID_PATTERNS = [
     re.compile(r"PeerID:\s+(\S+)"),
     re.compile(r"Host created with PeerID:\s+(\S+)"),
@@ -221,9 +263,42 @@ def main() -> None:
 
         grouped = build_probe_multiaddrs(env_values, peer_id, listening_addrs)
         proxy_hostname = env_values.get("PROXY_HOSTNAME", "").strip()
-        if grouped["autotls_wss_multiaddrs"]:
-            break
-        if proxy_hostname and grouped["proxy_wss_multiaddrs"] and time.monotonic() - started_at >= AUTOTLS_EXTRA_WAIT_SECONDS:
+
+        # Symmetric certificate gate (port of relay-button #74/#75): both wss
+        # paths — Caddy/2n6 proxy and libp2p AutoTLS — are only advertised
+        # once a CA-validated local TLS handshake proves their certificate
+        # serves; breaking on the mere presence of AutoTLS multiaddrs made
+        # the outcome a per-VM ACME race. certhash-bearing webtransport /
+        # webrtc-direct addresses need no ACME (the hash IS the
+        # authentication), so they count as browser-dialable immediately and
+        # end the wait on their own — unverified wss addresses join the
+        # registration on a later refresh cycle once their cert is live.
+        proxy_cert_ready = bool(
+            proxy_hostname
+            and grouped["proxy_wss_multiaddrs"]
+            and caddy_cert_serves(proxy_hostname)
+        )
+        autotls_cert_ready = bool(
+            grouped["autotls_wss_multiaddrs"]
+            and autotls_cert_serves(grouped["autotls_wss_multiaddrs"])
+        )
+        certhash_ready = bool(
+            grouped["webtransport_multiaddrs"] or grouped["webrtc_direct_multiaddrs"]
+        )
+
+        unverified: set[str] = set()
+        if grouped["proxy_wss_multiaddrs"] and not proxy_cert_ready:
+            unverified.update(grouped["proxy_wss_multiaddrs"])
+        if grouped["autotls_wss_multiaddrs"] and not autotls_cert_ready:
+            unverified.update(grouped["autotls_wss_multiaddrs"])
+        if unverified:
+            grouped["browser_bootstrap_multiaddrs"] = [
+                addr
+                for addr in grouped["browser_bootstrap_multiaddrs"]
+                if addr not in unverified
+            ]
+
+        if proxy_cert_ready or autotls_cert_ready or certhash_ready:
             break
         if not proxy_hostname and time.monotonic() - started_at >= AUTOTLS_EXTRA_WAIT_SECONDS:
             break