@le-space/rootfs 0.6.42 → 0.6.44

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/rootfs",
-  "version": "0.6.42",
+  "version": "0.6.44",
   "description": "Shared rootfs contract parsing, reference profile assets, and build helpers.",
   "license": "MIT",
   "type": "module",

package/reference/orbitdb-relay/rootfs/orbitdb-relay-bootstrap.sh

@@ -15,7 +15,11 @@ fi
 
 export DEBIAN_FRONTEND=noninteractive
 apt-get update
-apt-get install -y ca-certificates curl gnupg python3 python3-pip build-essential caddy
+apt-get install -y ca-certificates curl gnupg python3 python3-pip build-essential caddy openssh-server
+# The CRN injects the deployer's SSH key via the INSTANCE message, but the key
+# is useless without a running sshd — image generations without openssh-server
+# made live debugging impossible (connection refused on the mapped port 22).
+systemctl enable ssh || true
 
 if ! command -v node >/dev/null 2>&1 || [ "$(node -p "process.versions.node.split('.')[0]" 2>/dev/null || echo 0)" -lt "${NODE_MIN_MAJOR}" ]; then
   curl -fsSL https://deb.nodesource.com/setup_22.x | bash -

package/reference/orbitdb-relay/rootfs/orbitdb-relay-describe.py

@@ -148,8 +148,17 @@ def build_grouped_multiaddrs(env_values: dict[str, str], all_multiaddrs: list[st
             f"/dns6/{proxy_hostname}/tcp/443/tls/ws/p2p/{peer_id}",
         ]
     quic_multiaddrs = [addr for addr in all_multiaddrs if "/quic-v1" in addr and "/webtransport" not in addr]
-    webtransport_multiaddrs = [addr for addr in all_multiaddrs if "/webtransport" in addr]
-    webrtc_direct_multiaddrs = [addr for addr in all_multiaddrs if "/webrtc-direct" in addr]
+    # certhash defense (relay-button 102923e, orbitdb-relay #26): a
+    # webtransport/webrtc-direct address without /certhash/ is undialable
+    # from browsers — the hash IS the connection's authentication. The relay
+    # (0.10.1+) already enriches or drops these at its /multiaddrs endpoint;
+    # this filter protects registrations built from older relay versions.
+    webtransport_multiaddrs = [
+        addr for addr in all_multiaddrs if "/webtransport" in addr and "/certhash/" in addr
+    ]
+    webrtc_direct_multiaddrs = [
+        addr for addr in all_multiaddrs if "/webrtc-direct" in addr and "/certhash/" in addr
+    ]
 
     browser_bootstrap_multiaddrs = dedupe(
         proxy_wss_multiaddrs