qubicl-cli 0.1.1 → 0.2.0

package/dist/assets/computer/entrypoint.sh

@@ -2,6 +2,10 @@
 set -euo pipefail
 
 runtime_role="${QUBICL_RUNTIME_ROLE:-control}"
+baked_viewer_authentication="${QUBICL_IMAGE_VIEWER_AUTHENTICATION:-legacy}"
+runtime_viewer_authentication="${QUBICL_VIEWER_AUTHENTICATION:-}"
+viewer_key_handoff="${QUBICL_VIEWER_KEY:-}"
+unset QUBICL_VIEWER_AUTHENTICATION QUBICL_VIEWER_KEY
 if [[ "$runtime_role" == egress || "$runtime_role" == web ]]; then
   exec node /opt/qubicl/control.mjs
 fi
@@ -61,6 +65,89 @@ if [[ "$requested_profile" != "$baked_profile" ]]; then
   exit 78
 fi
 
+browser_home_ownership_error() {
+  local path="$1"
+  echo "Qubicl browser storage ownership does not match this host (${expected_owner}): ${path}" >&2
+  echo "Stop this computer, then run: qubicl repair ownership ${QUBICL_NAME:-<name>}" >&2
+  exit 78
+}
+
+prepare_browser_parent_directory() {
+  local path="$1" owner
+  if [[ -L "$path" ]] || { [[ -e "$path" ]] && [[ ! -d "$path" ]]; }; then
+    browser_home_ownership_error "$path"
+  fi
+  if [[ ! -e "$path" ]]; then
+    runuser -u qubicl -- install -d -m 0700 "$path"
+  fi
+  owner="$(stat -c '%u:%g' -- "$path")"
+  if [[ "$owner" == 0:0 && "$owner" != "$expected_owner" ]]; then
+    # v0.2 prerelease session supervisors could create this exact managed
+    # ancestry as root before dropping Chromium to the computer user. Repair
+    # only the directory entry itself; never recurse through durable data.
+    chown --no-dereference qubicl:qubicl "$path"
+  elif [[ "$owner" != "$expected_owner" ]]; then
+    browser_home_ownership_error "$path"
+  fi
+  runuser -u qubicl -- test -d "$path" -a -w "$path" -a -x "$path" || browser_home_ownership_error "$path"
+}
+
+prepare_browser_leaf_directory() {
+  local path="$1" owner
+  if [[ -L "$path" ]] || { [[ -e "$path" ]] && [[ ! -d "$path" ]]; }; then
+    browser_home_ownership_error "$path"
+  fi
+  if [[ ! -e "$path" ]]; then
+    runuser -u qubicl -- install -d -m 0700 "$path"
+  fi
+  owner="$(stat -c '%u:%g' -- "$path")"
+  if [[ "$owner" == 0:0 && "$owner" != "$expected_owner" ]]; then
+    if find "$path" -mindepth 1 -maxdepth 1 -print -quit | grep -q .; then
+      browser_home_ownership_error "$path"
+    fi
+    chown --no-dereference qubicl:qubicl "$path"
+  elif [[ "$owner" != "$expected_owner" ]]; then
+    browser_home_ownership_error "$path"
+  fi
+  runuser -u qubicl -- chmod 0700 "$path"
+  runuser -u qubicl -- test -d "$path" -a -w "$path" -a -x "$path" || browser_home_ownership_error "$path"
+}
+
+prepare_browser_home() {
+  prepare_browser_parent_directory /home/qubicl/.local
+  prepare_browser_parent_directory /home/qubicl/.local/share
+  prepare_browser_parent_directory /home/qubicl/.local/share/qubicl
+  prepare_browser_leaf_directory /home/qubicl/.local/share/qubicl/browser-profile
+  prepare_browser_leaf_directory /home/qubicl/Downloads
+}
+
+if [[ "$runtime_role" == session || "$runtime_role" == computer ]] && [[ "$baked_profile" != file-system ]]; then
+  prepare_browser_home
+fi
+
+unused_viewer_id() {
+  local database="$1" reserved="$2" candidate
+  for candidate in $(seq 60000 -1 59000); do
+    if [[ "$candidate" != "$reserved" ]] && ! getent "$database" "$candidate" >/dev/null; then
+      printf '%s\n' "$candidate"
+      return
+    fi
+  done
+  echo "Qubicl could not allocate an isolated viewer identity." >&2
+  exit 78
+}
+
+if [[ "$baked_profile" != file-system ]]; then
+  viewer_gid="$(id -g qubicl-viewer)"
+  if [[ "$viewer_gid" == "$target_gid" ]]; then
+    groupmod --gid "$(unused_viewer_id group "$target_gid")" qubicl-viewer
+  fi
+  viewer_uid="$(id -u qubicl-viewer)"
+  if [[ "$viewer_uid" == "$target_uid" ]]; then
+    usermod --uid "$(unused_viewer_id passwd "$target_uid")" qubicl-viewer
+  fi
+fi
+
 pids=()
 start_as_user() {
   user_network_env=()
@@ -80,6 +167,15 @@ start_as_user() {
   pids+=("$!")
 }
 
+start_as_viewer() {
+  runuser -u qubicl-viewer -- env -i \
+    HOME=/nonexistent USER=qubicl-viewer LOGNAME=qubicl-viewer SHELL=/usr/sbin/nologin \
+    PATH=/usr/local/bin:/usr/bin:/bin LANG=C.UTF-8 LC_ALL=C.UTF-8 \
+    DISPLAY="${DISPLAY:-:0}" \
+    "$@" &
+  pids+=("$!")
+}
+
 start_control_as_user() {
   control_env=(
     HOME=/home/qubicl USER=qubicl LOGNAME=qubicl SHELL=/bin/bash
@@ -110,6 +206,8 @@ start_control_as_user() {
   )
   if [[ -v QUBICL_SESSION_URL ]]; then control_env+=(QUBICL_SESSION_URL="$QUBICL_SESSION_URL"); fi
   if [[ -v QUBICL_SESSION_KEY ]]; then control_env+=(QUBICL_SESSION_KEY="$QUBICL_SESSION_KEY"); fi
+  if [[ -v QUBICL_PREVIEW_ACCESS_PATH ]]; then control_env+=(QUBICL_PREVIEW_ACCESS_PATH="$QUBICL_PREVIEW_ACCESS_PATH"); fi
+  if [[ -v QUBICL_REMOTE_PREVIEW_BASE ]]; then control_env+=(QUBICL_REMOTE_PREVIEW_BASE="$QUBICL_REMOTE_PREVIEW_BASE"); fi
   if [[ -v QUBICL_MANIFEST_PATH ]]; then control_env+=(QUBICL_MANIFEST_PATH="$QUBICL_MANIFEST_PATH"); fi
   if [[ "${QUBICL_TOKEN_METRICS:-0}" == 1 ]]; then control_env+=(QUBICL_TOKEN_METRICS=1); fi
   if [[ -v DISPLAY ]]; then control_env+=(DISPLAY="$DISPLAY"); fi
@@ -216,15 +314,75 @@ start_display() {
   exit 1
 }
 
+prepare_viewer_runtime() {
+  install -d -m 0750 -o root -g qubicl-viewer /run/qubicl-viewer
+  install -d -m 0700 -o qubicl-viewer -g qubicl-viewer /run/qubicl-viewer/sockets
+  rm -f /run/qubicl-viewer/key
+  rm -f /run/qubicl-viewer/sockets/view.sock /run/qubicl-viewer/sockets/control.sock
+  case "$baked_viewer_authentication" in
+    legacy)
+      viewer_authentication=legacy
+      ;;
+    header-v1)
+      if [[ "$runtime_viewer_authentication" != header-v1 ]]; then
+        echo "Qubicl viewer authentication does not match the baked image contract." >&2
+        exit 78
+      fi
+      viewer_authentication=header-v1
+      viewer_key="${viewer_key_handoff:?protected viewer key is missing}"
+      if [[ ! "$viewer_key" =~ ^[A-Za-z0-9_-]{43}$ ]]; then
+        echo "Qubicl received malformed protected viewer authentication material." >&2
+        exit 78
+      fi
+      (umask 077; printf '%s\n' "$viewer_key" >/run/qubicl-viewer/key)
+      chown root:qubicl-viewer /run/qubicl-viewer/key
+      chmod 0640 /run/qubicl-viewer/key
+      unset viewer_key
+      ;;
+    *)
+      echo "Qubicl received an unsupported viewer authentication mode." >&2
+      exit 78
+      ;;
+  esac
+  unset runtime_viewer_authentication viewer_key_handoff
+}
+
 start_viewer() {
   runuser -u qubicl -- env DISPLAY="$DISPLAY" xset s off -dpms >/dev/null 2>&1 || true
-  start_as_user env DISPLAY="$DISPLAY" x11vnc -display "$DISPLAY" -forever -shared -viewonly -localhost -nopw -rfbport 5900 -o /tmp/x11vnc-view.log
-  start_as_user env DISPLAY="$DISPLAY" x11vnc -display "$DISPLAY" -forever -shared -localhost -nopw -rfbport 5901 -o /tmp/x11vnc-control.log
-  start_as_user websockify --web=/usr/share/novnc 6080 localhost:5900
-  start_as_user websockify 6081 localhost:5901
+  start_as_viewer socat \
+    UNIX-LISTEN:/run/qubicl-viewer/sockets/view.sock,fork,mode=0600 \
+    EXEC:/usr/local/bin/qubicl-x11vnc-view,nofork
+  start_as_viewer socat \
+    UNIX-LISTEN:/run/qubicl-viewer/sockets/control.sock,fork,mode=0600 \
+    EXEC:/usr/local/bin/qubicl-x11vnc-control,nofork
+  for _ in $(seq 1 100); do
+    if [[ -S /run/qubicl-viewer/sockets/view.sock && -S /run/qubicl-viewer/sockets/control.sock ]]; then break; fi
+    sleep 0.1
+  done
+  if [[ ! -S /run/qubicl-viewer/sockets/view.sock || ! -S /run/qubicl-viewer/sockets/control.sock ]]; then
+    echo "Qubicl viewer relays did not become ready." >&2
+    exit 1
+  fi
+  viewer_auth_args=()
+  viewer_web_auth_args=()
+  if [[ "$viewer_authentication" == header-v1 ]]; then
+    viewer_auth_args=(--auth-plugin=qubicl_viewer_auth.HeaderKeyAuth --auth-source=/run/qubicl-viewer/key)
+    viewer_web_auth_args=(--web-auth)
+  fi
+  start_as_viewer /usr/bin/python3 -I /usr/bin/websockify \
+    --web=/usr/share/novnc \
+    "${viewer_web_auth_args[@]}" \
+    "${viewer_auth_args[@]}" \
+    --unix-target=/run/qubicl-viewer/sockets/view.sock \
+    0.0.0.0:6080
+  start_as_viewer /usr/bin/python3 -I /usr/bin/websockify \
+    "${viewer_auth_args[@]}" \
+    --unix-target=/run/qubicl-viewer/sockets/control.sock \
+    0.0.0.0:6081
 }
 
 if [[ "$runtime_role" == session || "$runtime_role" == computer ]]; then
+if [[ "$baked_profile" != file-system ]]; then prepare_viewer_runtime; fi
 case "$baked_profile" in
   file-system)
     unset DISPLAY

package/dist/assets/computer/manifests/browser.json

@@ -66,7 +66,7 @@
   ],
   "viewer": true,
   "controlProtocolVersion": 10,
-  "qubiclVersion": "0.1.1",
-  "revision": "dac0e16a11b8cbc0ed7f8b0e9eb9e16a3aa2f45d",
+  "qubiclVersion": "0.2.0",
+  "revision": "5e54dafceb7c28ca3bcf561e6281be3d7da976d5",
   "startupProfile": "browser"
 }

package/dist/assets/computer/manifests/computer.json

@@ -70,7 +70,7 @@
   ],
   "viewer": true,
   "controlProtocolVersion": 10,
-  "qubiclVersion": "0.1.1",
-  "revision": "dac0e16a11b8cbc0ed7f8b0e9eb9e16a3aa2f45d",
+  "qubiclVersion": "0.2.0",
+  "revision": "5e54dafceb7c28ca3bcf561e6281be3d7da976d5",
   "startupProfile": "desktop"
 }

package/dist/assets/computer/manifests/file-system.json

@@ -36,7 +36,7 @@
   ],
   "viewer": false,
   "controlProtocolVersion": 10,
-  "qubiclVersion": "0.1.1",
-  "revision": "dac0e16a11b8cbc0ed7f8b0e9eb9e16a3aa2f45d",
+  "qubiclVersion": "0.2.0",
+  "revision": "5e54dafceb7c28ca3bcf561e6281be3d7da976d5",
   "startupProfile": "file-system"
 }

package/dist/assets/computer/manifests/workstation.json

@@ -72,7 +72,7 @@
   ],
   "viewer": true,
   "controlProtocolVersion": 10,
-  "qubiclVersion": "0.1.1",
-  "revision": "dac0e16a11b8cbc0ed7f8b0e9eb9e16a3aa2f45d",
+  "qubiclVersion": "0.2.0",
+  "revision": "5e54dafceb7c28ca3bcf561e6281be3d7da976d5",
   "startupProfile": "workstation"
 }

package/dist/assets/computer/qubicl_viewer_auth.py

@@ -0,0 +1,63 @@
+import hmac
+import os
+import re
+import stat
+
+from websockify.auth_plugins import AuthenticationError
+
+
+KEY_PATTERN = re.compile(r"^[A-Za-z0-9_-]{43}$")
+
+
+class HeaderKeyAuth:
+    """Authenticate a gateway-injected header against a protected key file."""
+
+    def __init__(self, src=None):
+        self.source = src
+
+    def authenticate(self, headers, target_host, target_port):
+        del target_host, target_port
+        expected = self._read_key()
+        received = headers.get("X-Qubicl-Viewer-Key")
+        if (
+            not isinstance(received, str)
+            or not KEY_PATTERN.fullmatch(received)
+            or not hmac.compare_digest(received, expected)
+        ):
+            raise AuthenticationError(
+                response_code=403,
+                response_msg="Forbidden",
+                log_msg="viewer authentication failed",
+            )
+
+    def _read_key(self):
+        if not self.source:
+            self._unavailable()
+        flags = os.O_RDONLY | os.O_CLOEXEC
+        if hasattr(os, "O_NOFOLLOW"):
+            flags |= os.O_NOFOLLOW
+        try:
+            descriptor = os.open(self.source, flags)
+            try:
+                info = os.fstat(descriptor)
+                if not stat.S_ISREG(info.st_mode) or info.st_size > 128:
+                    self._unavailable()
+                with os.fdopen(descriptor, "r", encoding="ascii") as handle:
+                    descriptor = -1
+                    value = handle.read().removesuffix("\n")
+            finally:
+                if descriptor >= 0:
+                    os.close(descriptor)
+        except (OSError, TypeError, UnicodeError):
+            self._unavailable()
+        if not KEY_PATTERN.fullmatch(value):
+            self._unavailable()
+        return value
+
+    @staticmethod
+    def _unavailable():
+        raise AuthenticationError(
+            response_code=503,
+            response_msg="Viewer unavailable",
+            log_msg="viewer authentication key unavailable",
+        )

package/dist/assets/computer/x11vnc-relay.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+set -euo pipefail
+
+case "${0##*/}" in
+  qubicl-x11vnc-view)
+    viewer_mode=(-viewonly)
+    ;;
+  qubicl-x11vnc-control)
+    viewer_mode=()
+    ;;
+  *)
+    exit 64
+    ;;
+esac
+
+# x11vnc's packaged Unix-listener support depends on a downstream libvncserver
+# build detail. socat supplies a real connected socket on stdin/stdout instead,
+# so inetd mode never opens a raw TCP RFB listener.
+exec x11vnc \
+  -inetd \
+  -display "${DISPLAY:-:0}" \
+  -rfbport 0 \
+  -shared \
+  -nopw \
+  -noremote \
+  -nocmds \
+  -q \
+  "${viewer_mode[@]}"

package/dist/assets/gateway/Dockerfile

@@ -6,13 +6,16 @@ ARG QUBICL_CREATED=unknown
 ARG QUBICL_SOURCE=https://github.com/EldanRing/qubicl
 
 LABEL org.opencontainers.image.title="Qubicl gateway" \
-      org.opencontainers.image.description="Authenticated local gateway for Qubicl computers" \
+      org.opencontainers.image.description="Authenticated local and optional TLS gateway for Qubicl computers" \
       org.opencontainers.image.licenses="Apache-2.0" \
       org.opencontainers.image.source="$QUBICL_SOURCE" \
       org.opencontainers.image.url="$QUBICL_SOURCE" \
       org.opencontainers.image.version="$QUBICL_VERSION" \
       org.opencontainers.image.revision="$QUBICL_REVISION" \
-      org.opencontainers.image.created="$QUBICL_CREATED"
+      org.opencontainers.image.created="$QUBICL_CREATED" \
+      dev.qubicl.gateway-protocol-version="2" \
+      dev.qubicl.gateway-exposure="direct-tls-v1" \
+      dev.qubicl.viewer-authentication="header-v1"
 
 WORKDIR /app
 RUN apk upgrade --no-cache libcrypto3 libssl3 \
@@ -32,5 +35,5 @@ COPY --chown=node:node gateway.mjs /app/gateway.mjs
 COPY LICENSE THIRD_PARTY_NOTICES.txt /usr/share/doc/qubicl/
 
 USER node
-EXPOSE 3211
+EXPOSE 3211 3216
 ENTRYPOINT ["node", "/app/gateway.mjs"]