querysub 0.662.0 → 0.663.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "querysub",
-  "version": "0.662.0",
+  "version": "0.663.0",
   "main": "index.js",
   "license": "MIT",
   "note1": "note on node-forge fork, see https://github.com/digitalbazaar/forge/issues/744 for details",
@@ -79,7 +79,7 @@
     "node-forge": "https://github.com/sliftist/forge#e618181b469b07bdc70b968b0391beb8ef5fecd6",
     "pako": "^2.1.0",
     "peggy": "^5.0.6",
-    "sliftutils": "^1.7.132",
+    "sliftutils": "^1.7.133",
     "socket-function": "^1.2.35",
     "terser": "^5.31.0",
     "typenode": "^6.6.1",

package/src/-c-identity/IdentityController.ts

@@ -140,6 +140,12 @@ export interface ChangeIdentityPayload {
     debugEntryPoint: string | undefined;
     callerIsNode: boolean;
 }
+export interface ChangeIdentityResponse {
+    payload: ChangeIdentityPayload;
+    signature: string;
+    cert: string;
+    certIssuer: string;
+}
 class IdentityControllerBase {
     // IMPORTANT! We HAVE to call changeIdentity NOT JUST because we can't use peer certificates in the browser, BUT, also
     //  because this removes the need to load peer certificates into the trust store. This greatly simplifies
@@ -147,7 +153,7 @@ class IdentityControllerBase {
     //  if we want to trust a node (instead of having to trust a node before it can connect to us, because
     //  NodeJS will throw/ignore the peer cert if it isn't trusted).
     @measureFnc
-    public async changeIdentity(signature: string, payload: ChangeIdentityPayload) {
+    public async changeIdentity(signature: string, payload: ChangeIdentityPayload): Promise<ChangeIdentityResponse> {
         let time = Date.now();
         const caller = SocketFunction.getCaller();
         // Verify it wasn't signed too long ago (to make signature stealing WAY more difficult).
@@ -236,6 +242,14 @@ class IdentityControllerBase {
                 clientId: caller.nodeId,
             });
         });
+
+        let ourThreadKeyCert = getThreadKeyCert(getDomain());
+        return {
+            payload,
+            signature: sign(ourThreadKeyCert, payload),
+            cert: ourThreadKeyCert.cert.toString(),
+            certIssuer: getIdentityCA(getDomain()).cert.toString(),
+        };
     }
 
     @measureFnc
@@ -285,11 +299,28 @@ const changeIdentityOnce = cacheWeak(async function changeIdentityOnce(connectio
         callerIsNode: isServer() && !isIpDomain(nodeId),
     };
     let signature = sign(threadKeyCert, payload);
-    await timeoutToError(
+    let response = await timeoutToError(
         MAX_CHANGE_IDENTITY_TIMEOUT,
         IdentityController.nodes[nodeId].changeIdentity(signature, payload),
         () => new Error(`Timeout calling changeIdentity for ${nodeId}`)
     );
+    if (!response) {
+        throw new Error(`No identity response from ${nodeId}, so we can't know who we are talking to.`);
+    }
+    if (JSON.stringify(response.payload) !== JSON.stringify(payload)) {
+        throw new Error(`Identity response from ${nodeId} signed a different payload than we sent. Sent ${JSON.stringify(payload)}, they signed ${JSON.stringify(response.payload)}`);
+    }
+    validateCertificate(getDomain(), response.cert, response.certIssuer);
+    verify(response.cert, response.signature, response.payload);
+    let nodeObj = decodeNodeId(nodeId, getDomain());
+    // If we're not talking to a specific thread, then it likely means there's no machine ID either, ex, it's 127-0-0-1.querysubtest.com. And we chose to talk to this host. The node ID comes from us, So we're not really worried about attackers using this to trick us into thinking there's somebody else.
+    if (nodeObj?.threadId) {
+        let signerMachineId = getMachineId(getCommonName(response.certIssuer), getDomain());
+        let expectedMachineId = nodeObj.machineId;
+        if (signerMachineId !== expectedMachineId) {
+            throw new Error(`Identity response is from another machine. We connected to ${nodeId} (machine ${expectedMachineId}), but the response was signed by machine ${signerMachineId}`);
+        }
+    }
     if (isServer() && !payload.mountedPort) {
         logErrors((async () => {
             await SocketFunction.mountPromise;

package/src/deployManager/setupMachineMain.ts

@@ -14,6 +14,8 @@ import { SERVICE_NAME, SERVICE_UNIT_NAME } from "./machineDaemonShared";
 Querysub;
 
 const pinnedNodeVersion = 22;
+// The Node we target: covers lz4's WASM reference types (externref, default-on from Node 18) with headroom, without going all the way to pinnedNodeVersion on machines that already work. Existing machines below this are upgraded to exactly this.
+const minimumNodeMajor = 20;
 
 const DAEMON_SCRIPT_NAME = "machine-daemon.sh";
 // How long after the process dies before it is started again. Short, because until it is back nothing on the machine is being deployed or repaired.
@@ -120,6 +122,52 @@ async function sshValue(sshRemote: string, command: string, config?: { nothrow?:
     return (output.trim().split("\n").at(-1) || "").trim();
 }
 
+const UNOFFICIAL_BUILDS_URL = "https://unofficial-builds.nodejs.org/download/release";
+// The nodejs project's builds for systems too old for the official binaries (which need glibc 2.28+)
+const UNOFFICIAL_BUILD_FLAVOR = "linux-x64-glibc-217";
+async function installUnofficialNode(sshRemote: string, major: number): Promise<void> {
+    let response = await fetch(`${UNOFFICIAL_BUILDS_URL}/index.json`);
+    if (!response.ok) {
+        throw new Error(`Expected the unofficial builds index at ${UNOFFICIAL_BUILDS_URL}/index.json to be readable, was ${response.status}`);
+    }
+    let releases = await response.json() as { version: string; files: string[] }[];
+    // Newest first, so find gives the latest release of the requested major
+    let release = releases.find(release => release.version.startsWith(`v${major}.`) && release.files.includes(UNOFFICIAL_BUILD_FLAVOR));
+    if (!release) {
+        throw new Error(`Expected a ${UNOFFICIAL_BUILD_FLAVOR} build of Node ${major} at ${UNOFFICIAL_BUILDS_URL}, there is none`);
+    }
+    let name = `node-${release.version}-${UNOFFICIAL_BUILD_FLAVOR}`;
+    console.log(`Installing ${name} to /usr/local/bin (which shadows the distro's node)...`);
+    await runPromise(`ssh ${sshRemote} "curl -fsSL ${UNOFFICIAL_BUILDS_URL}/${release.version}/${name}.tar.xz -o /tmp/${name}.tar.xz"`);
+    await runPromise(`ssh ${sshRemote} "sudo mkdir -p /usr/local/lib/nodejs && sudo tar -xJf /tmp/${name}.tar.xz -C /usr/local/lib/nodejs && rm /tmp/${name}.tar.xz"`);
+    for (let bin of ["node", "npm", "npx"]) {
+        await runPromise(`ssh ${sshRemote} "sudo ln -sf /usr/local/lib/nodejs/${name}/bin/${bin} /usr/local/bin/${bin}"`);
+    }
+}
+
+// How often a pending question is re-printed, as other logging keeps running while we wait and buries it
+const QUESTION_REMIND_INTERVAL = 15 * 1000;
+async function askQuestion(prompt: string): Promise<string> {
+    const rl = readline.createInterface({
+        // Cast, as different @types/node versions disagree on the stream types
+        input: process.stdin as unknown as NodeJS.ReadableStream,
+        output: process.stdout,
+    });
+    let remind = setInterval(() => {
+        console.log(`\n(still waiting for an answer)\n${prompt}`);
+    }, QUESTION_REMIND_INTERVAL);
+    try {
+        return await new Promise<string>(resolve => {
+            rl.question(prompt, answer => {
+                resolve(answer.trim());
+            });
+        });
+    } finally {
+        clearInterval(remind);
+        rl.close();
+    }
+}
+
 function getGitHubKeyCachePath(repoUrl: string): string {
     let repoOwner = "";
     let repoName = "";
@@ -199,19 +247,7 @@ async function getGitHubApiKey(repoUrl: string, sshRemote: string, forceRefresh
 
     await open(tokenUrl);
 
-    const rl = readline.createInterface({
-        // Cast, as different @types/node versions disagree on the stream types
-        input: process.stdin as unknown as NodeJS.ReadableStream,
-        output: process.stdout
-    });
-
-    const apiKey = await new Promise<string>((resolve) => {
-        const repoInfo = repoOwner && repoName ? ` for repository ${repoOwner}/${repoName}` : "";
-        rl.question(`Please paste your GitHub API token (${repoInfo}): `, (answer) => {
-            rl.close();
-            resolve(answer.trim());
-        });
-    });
+    const apiKey = await askQuestion(`Please paste your GitHub API token (${repoOwner && repoName && `for repository ${repoOwner}/${repoName}` || ""}): `);
 
     // Cache the key
     fs.writeFileSync(cacheFile, JSON.stringify({ apiKey }));
@@ -453,8 +489,32 @@ async function main() {
     // 3. Ensure nodejs is installed on remote server
     console.log("Ensuring Node.js is installed...");
     try {
-        let nodeVersion = await runPromise(`ssh ${sshRemote} "node --version"`);
-        console.log("✅ Node.js already installed:", nodeVersion.trim());
+        let nodeVersion = await sshValue(sshRemote, "node --version");
+        console.log("✅ Node.js already installed:", nodeVersion);
+        let nodeMajor = parseInt(nodeVersion.replace(/^v/, "").split(".")[0]);
+        if (Number.isFinite(nodeMajor) && nodeMajor < minimumNodeMajor) {
+            let answer = await askQuestion(`Node ${nodeVersion} on ${sshRemote} is too old (our code targets Node ${minimumNodeMajor}, and needs at least 18 for WASM reference types). Upgrade it to Node ${minimumNodeMajor} - and no further, so nothing else on the machine breaks? [y/N] `);
+            if (answer.trim().toLowerCase().startsWith("y")) {
+                console.log(`Upgrading Node.js to v${minimumNodeMajor}...`);
+                await runPromise(`ssh ${sshRemote} "curl -fsSL https://deb.nodesource.com/setup_${minimumNodeMajor}.x | sudo -E bash -"`);
+                await runPromise(`ssh ${sshRemote} "sudo apt-get install -y nodejs"`);
+                let upgradedVersion = await sshValue(sshRemote, "node --version");
+                let upgradedMajor = parseInt(upgradedVersion.replace(/^v/, "").split(".")[0]);
+                if (!Number.isFinite(upgradedMajor) || upgradedMajor < minimumNodeMajor) {
+                    // nodesource silently keeps the old repo when it has no build for this distro (its Node 18+ debs need glibc 2.28+), so old machines get the unofficial glibc-2.17 build instead
+                    console.warn(`⚠️  Node is still ${upgradedVersion} after the nodesource upgrade, so this distro is too old for nodesource. Installing the unofficial glibc-2.17 build of Node ${minimumNodeMajor} into /usr/local/bin instead...`);
+                    await installUnofficialNode(sshRemote, minimumNodeMajor);
+                    upgradedVersion = await sshValue(sshRemote, "node --version");
+                    upgradedMajor = parseInt(upgradedVersion.replace(/^v/, "").split(".")[0]);
+                    if (!Number.isFinite(upgradedMajor) || upgradedMajor < minimumNodeMajor) {
+                        throw new Error(`Node is still ${upgradedVersion} after installing the unofficial build. Check what "which -a node" resolves to on ${sshRemote} - something earlier on the PATH is shadowing /usr/local/bin.`);
+                    }
+                }
+                console.log("✅ Node.js upgraded:", upgradedVersion);
+            } else {
+                console.warn(`⚠️  Keeping Node ${nodeVersion}. The machine process will likely crash with "invalid value type 'externref'" until Node is upgraded.`);
+            }
+        }
     } catch {
         console.log(`Installing Node.js (v${pinnedNodeVersion})...`);
         await runPromise(`ssh ${sshRemote} "curl -fsSL https://deb.nodesource.com/setup_${pinnedNodeVersion}.x | sudo -E bash -"`);