vnode 0.1.9__tar.gz → 0.2.3__tar.gz

{vnode-0.1.9 → vnode-0.2.3}/PKG-INFO

@@ -1,23 +1,23 @@
 Metadata-Version: 2.4
 Name: vnode
-Version: 0.1.9
+Version: 0.2.3
 Summary: Virtual Meshtastic node using mudp transport and meshdb storage.
 License-Expression: GPL-3.0-only
 License-File: LICENSE
 Author: Ben Lipsey
 Author-email: ben@pdxlocations.com
-Requires-Python: >=3.9,<3.15
+Requires-Python: >=3.10,<3.15
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
 Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: XEdDSA (>=1.2,<2)
 Requires-Dist: cryptography (>=43,<45)
-Requires-Dist: meshdb (>=0.1.9)
+Requires-Dist: meshdb (>=0.3.0,<0.4)
 Requires-Dist: meshtastic (>=2.7,<3.0)
-Requires-Dist: mudp (>=1.1.5)
+Requires-Dist: mudp (>=1.6.0,<2)
 Project-URL: Homepage, https://github.com/pdxlocations/vnode
 Project-URL: Issues, https://github.com/pdxlocations/vnode/issues
 Description-Content-Type: text/markdown
@@ -46,13 +46,20 @@ If you are working from this repository instead:
 
 ## Config
 
-Edit [node.json](node.json).
+Edit `node.json` (created locally and excluded from version control).
 
 If `node.json` does not exist yet, the runtime will create it automatically from
 [example-node.json](example-node.json).
 
-If the template leaves `node_id` blank, the runtime will generate and persist a random
-Meshtastic-style node ID when it creates or first loads `node.json`.
+The runtime derives `node_id` from the IEEE CRC-32 of its X25519 public key,
+matching Meshtastic 2.8 identity binding. It is a read-only property of
+`NodeConfig`, not a JSON setting. Existing `node_id` fields are removed on
+load while preserving the private key and configured names. Changing the
+private key changes the node ID and starts a new node database; the old database
+is preserved. With meshdb 0.3, each owner file uses channel-scoped tables for
+node records, broadcasts, positions, and telemetry, plus per-peer DM tables.
+Existing contact records are copied from the legacy owner node table on startup;
+old message and telemetry tables remain intact.
 If `long_name` or `short_name` are blank, the runtime will also generate them from the
 last 4 hex characters of the node ID, for example `Meshtastic 691c` and `691c`.
 
@@ -62,6 +69,18 @@ the private key is blank.
 The derived public key is written automatically to `node.public.key` next to
 `node.json`. That file is generated by the runtime and should not need manual edits.
 
+Broadcasts and directed nodeinfo/position packets carry XEdDSA signatures using
+the existing X25519 identity key and the Meshtastic 2.8.1 signing format.
+Traceroutes and packets that cannot fit a signature within the 255-byte radio
+frame remain unsigned. Direct messages retain X25519/AES-CCM encryption.
+
+Signed nodeinfo lets compatible receivers authenticate first contact without a
+handshake or a running vnode listener. Nodeinfo includes the fixed-length MAC
+field required by firmware's protobuf encoder so UDP-to-LoRa gateways can
+re-encode it without invalidating the signature. The iOS app may need to be
+closed and reopened to display the **Signed Node** badge after first receipt.
+This badge is separate from manual contact/key verification.
+
 The `position` section in `node.json` controls periodic position broadcasts. Set
 `position.enabled` to `true`, then set `position.latitude` and `position.longitude`, and adjust
 `position.position_interval_seconds` to control how often the node sends `POSITION_APP`
@@ -136,6 +155,15 @@ Use these as small runnable references for common tasks:
 
 See [examples/README.md](examples/README.md) for the full list.
 
+## Tests
+
+```bash
+.venv/bin/python -m unittest discover -s vnode/tests -v
+```
+
+The signing tests cover identity migration, key rotation, the firmware signing
+layout, tamper rejection, radio frame limits, and nodeinfo gateway re-encoding.
+
 ## License
 
 GPL-3.0-only. See [`LICENSE`](LICENSE).

{vnode-0.1.9 → vnode-0.2.3}/README.md

@@ -22,13 +22,20 @@ If you are working from this repository instead:
 
 ## Config
 
-Edit [node.json](node.json).
+Edit `node.json` (created locally and excluded from version control).
 
 If `node.json` does not exist yet, the runtime will create it automatically from
 [example-node.json](example-node.json).
 
-If the template leaves `node_id` blank, the runtime will generate and persist a random
-Meshtastic-style node ID when it creates or first loads `node.json`.
+The runtime derives `node_id` from the IEEE CRC-32 of its X25519 public key,
+matching Meshtastic 2.8 identity binding. It is a read-only property of
+`NodeConfig`, not a JSON setting. Existing `node_id` fields are removed on
+load while preserving the private key and configured names. Changing the
+private key changes the node ID and starts a new node database; the old database
+is preserved. With meshdb 0.3, each owner file uses channel-scoped tables for
+node records, broadcasts, positions, and telemetry, plus per-peer DM tables.
+Existing contact records are copied from the legacy owner node table on startup;
+old message and telemetry tables remain intact.
 If `long_name` or `short_name` are blank, the runtime will also generate them from the
 last 4 hex characters of the node ID, for example `Meshtastic 691c` and `691c`.
 
@@ -38,6 +45,18 @@ the private key is blank.
 The derived public key is written automatically to `node.public.key` next to
 `node.json`. That file is generated by the runtime and should not need manual edits.
 
+Broadcasts and directed nodeinfo/position packets carry XEdDSA signatures using
+the existing X25519 identity key and the Meshtastic 2.8.1 signing format.
+Traceroutes and packets that cannot fit a signature within the 255-byte radio
+frame remain unsigned. Direct messages retain X25519/AES-CCM encryption.
+
+Signed nodeinfo lets compatible receivers authenticate first contact without a
+handshake or a running vnode listener. Nodeinfo includes the fixed-length MAC
+field required by firmware's protobuf encoder so UDP-to-LoRa gateways can
+re-encode it without invalidating the signature. The iOS app may need to be
+closed and reopened to display the **Signed Node** badge after first receipt.
+This badge is separate from manual contact/key verification.
+
 The `position` section in `node.json` controls periodic position broadcasts. Set
 `position.enabled` to `true`, then set `position.latitude` and `position.longitude`, and adjust
 `position.position_interval_seconds` to control how often the node sends `POSITION_APP`
@@ -112,6 +131,15 @@ Use these as small runnable references for common tasks:
 
 See [examples/README.md](examples/README.md) for the full list.
 
+## Tests
+
+```bash
+.venv/bin/python -m unittest discover -s vnode/tests -v
+```
+
+The signing tests cover identity migration, key rotation, the firmware signing
+layout, tamper rejection, radio frame limits, and nodeinfo gateway re-encoding.
+
 ## License
 
 GPL-3.0-only. See [`LICENSE`](LICENSE).

{vnode-0.1.9 → vnode-0.2.3}/pyproject.toml

@@ -1,18 +1,19 @@
 [project]
 name = "vnode"
-version = "0.1.9"
+version = "0.2.3"
 description = "Virtual Meshtastic node using mudp transport and meshdb storage."
 authors = [
     {name = "Ben Lipsey",email = "ben@pdxlocations.com"}
 ]
 license = "GPL-3.0-only"
 readme = "README.md"
-requires-python = ">=3.9,<3.15"
+requires-python = ">=3.10,<3.15"
 dependencies = [
   "cryptography>=43,<45",
-  "meshdb>=0.1.9",
+  "XEdDSA>=1.2,<2",
+  "meshdb>=0.3.0,<0.4",
   "meshtastic>=2.7,<3.0",
-  "mudp>=1.1.5",
+  "mudp>=1.6.0,<2",
 ]
 
 [project.urls]

{vnode-0.1.9 → vnode-0.2.3}/vnode/vnode/config.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import json
-import secrets
 from dataclasses import asdict, dataclass, field
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Union
@@ -30,7 +29,7 @@ class ChannelConfig:
 
 @dataclass
 class UdpConfig:
-    mcast_group: str = "224.0.0.69"
+    mcast_group: str = "239.0.0.69"
     mcast_port: int = 4403
 
 
@@ -47,7 +46,6 @@ class SecurityConfig:
 
 @dataclass
 class NodeConfig:
-    node_id: str = ""
     long_name: str = "Virtual Meshtastic Node"
     short_name: str = "VND"
     hw_model: Union[str, int] = "ANDROID_SIM"
@@ -61,6 +59,13 @@ class NodeConfig:
     meshdb: MeshDbConfig = field(default_factory=MeshDbConfig)
     security: SecurityConfig = field(default_factory=SecurityConfig)
 
+    @property
+    def node_id(self) -> str:
+        from .crypto import b64_decode, derive_public_key, node_id_from_public_key
+
+        public_key = derive_public_key(b64_decode(self.security.private_key))
+        return f"!{node_id_from_public_key(public_key):08x}"
+
     @classmethod
     def load(cls, path: Union[str, Path]) -> "NodeConfig":
         config_path = Path(path)
@@ -75,7 +80,6 @@ class NodeConfig:
         security_payload = dict(payload.get("security", {}))
         security_payload.pop("enabled", None)
         return cls(
-            node_id=str(payload.get("node_id", cls.node_id)),
             long_name=str(payload.get("long_name", cls.long_name)),
             short_name=str(payload.get("short_name", cls.short_name)),
             hw_model=payload.get("hw_model", cls.hw_model),
@@ -107,7 +111,11 @@ class NodeConfig:
             return
 
         template_path = next(
-            (candidate for candidate in cls._example_config_candidates(config_path) if candidate.exists()),
+            (
+                candidate
+                for candidate in cls._example_config_candidates(config_path)
+                if candidate.exists()
+            ),
             None,
         )
         if template_path is None:
@@ -120,24 +128,12 @@ class NodeConfig:
         cls._populate_generated_defaults(payload)
         security = payload.setdefault("security", {})
         security.pop("public_key", None)
-        if not str(security.get("private_key", "")).strip():
-            from .crypto import b64_encode, generate_keypair
-
-            _public_key, private_key = generate_keypair()
-            security["private_key"] = b64_encode(private_key)
 
         config_path.write_text(
             json.dumps(payload, indent=2, sort_keys=False) + "\n",
             encoding="utf-8",
         )
 
-    @staticmethod
-    def _generate_node_id() -> str:
-        while True:
-            value = secrets.randbits(32)
-            if value not in (0, 0xFFFFFFFF):
-                return f"!{value:08x}"
-
     @staticmethod
     def _generated_names(node_id: str) -> Dict[str, str]:
         suffix = str(node_id).strip().lower()[-4:]
@@ -148,11 +144,27 @@ class NodeConfig:
 
     @classmethod
     def _populate_generated_defaults(cls, payload: Dict[str, Any]) -> bool:
+        from .crypto import (
+            b64_decode,
+            b64_encode,
+            derive_public_key,
+            generate_keypair,
+            node_id_from_public_key,
+        )
+
         changed = False
-        if not str(payload.get("node_id", "")).strip():
-            payload["node_id"] = cls._generate_node_id()
+        security = payload.setdefault("security", {})
+        private_key = str(security.get("private_key", "")).strip()
+        if not private_key:
+            _, private_bytes = generate_keypair()
+            private_key = security["private_key"] = b64_encode(private_bytes)
+            changed = True
+        public_key = derive_public_key(b64_decode(private_key))
+        node_id = f"!{node_id_from_public_key(public_key):08x}"
+        if "node_id" in payload:
+            del payload["node_id"]
             changed = True
-        generated_names = cls._generated_names(str(payload["node_id"]))
+        generated_names = cls._generated_names(node_id)
         if not str(payload.get("long_name", "")).strip():
             payload["long_name"] = generated_names["long_name"]
             changed = True

{vnode-0.1.9 → vnode-0.2.3}/vnode/vnode/crypto.py

@@ -2,10 +2,14 @@ from __future__ import annotations
 
 import base64
 import secrets
+import struct
+import zlib
 from dataclasses import dataclass
 from hashlib import sha256
 from typing import Optional, Tuple
 
+import xeddsa
+
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.x25519 import (
     X25519PrivateKey,
@@ -37,12 +41,67 @@ def generate_keypair() -> Tuple[bytes, bytes]:
 
 
 def derive_public_key(private_key: bytes) -> bytes:
-    return X25519PrivateKey.from_private_bytes(private_key).public_key().public_bytes(
-        encoding=serialization.Encoding.Raw,
-        format=serialization.PublicFormat.Raw,
+    return (
+        X25519PrivateKey.from_private_bytes(private_key)
+        .public_key()
+        .public_bytes(
+            encoding=serialization.Encoding.Raw,
+            format=serialization.PublicFormat.Raw,
+        )
+    )
+
+
+def node_id_from_public_key(public_key: bytes) -> int:
+    """Meshtastic 2.8 identity binding (IEEE CRC-32 of the X25519 key)."""
+    if len(public_key) != 32:
+        raise ValueError("Public key must be 32 bytes")
+    return zlib.crc32(public_key) & 0xFFFFFFFF
+
+
+def signing_buffer(from_node: int, packet_id: int, to_node: int, data) -> bytes:
+    """Firmware v1 signing layout; relay-mutated fields are deliberately excluded."""
+    has_bitfield = data.HasField("bitfield")
+    flags = int(data.want_response) | (int(has_bitfield) << 1)
+    return struct.pack(
+        "<B8IB",
+        1,
+        from_node,
+        packet_id,
+        to_node,
+        int(data.portnum),
+        data.request_id,
+        data.reply_id,
+        data.emoji,
+        data.bitfield if has_bitfield else 0,
+        flags,
+    ) + bytes(data.payload)
+
+
+def sign_data(
+    private_key: bytes, from_node: int, packet_id: int, to_node: int, data
+) -> bytes:
+    """Sign with the existing X25519 scalar, normalizing the Edwards sign bit to zero."""
+    scalar = bytearray(private_key)
+    if len(scalar) != 32:
+        raise ValueError("Private key must be 32 bytes")
+    scalar[0] &= 248
+    scalar[31] = (scalar[31] & 127) | 64
+    normalized = xeddsa.priv_force_sign(bytes(scalar), False)
+    return xeddsa.ed25519_priv_sign(
+        normalized, signing_buffer(from_node, packet_id, to_node, data)
     )
 
 
+def attach_signature(data, signature: bytes) -> None:
+    """Field 10 is preserved as an unknown field by pre-2.8 protobuf packages."""
+    if len(signature) != 64:
+        raise ValueError("XEdDSA signature must be 64 bytes")
+    if "xeddsa_signature" in data.DESCRIPTOR.fields_by_name:
+        data.xeddsa_signature = signature
+    else:
+        data.MergeFromString(b"\x52\x40" + signature)
+
+
 def build_nonce(packet_id: int, from_node: int, extra_nonce: int) -> bytes:
     nonce = bytearray(16)
     nonce[0:8] = int(packet_id).to_bytes(8, "little", signed=False)
@@ -66,7 +125,11 @@ class PkiEnvelope:
     extra_nonce: int
 
     def pack(self) -> bytes:
-        return self.ciphertext + self.tag + self.extra_nonce.to_bytes(4, "little", signed=False)
+        return (
+            self.ciphertext
+            + self.tag
+            + self.extra_nonce.to_bytes(4, "little", signed=False)
+        )
 
 
 def encrypt_dm(
@@ -78,7 +141,9 @@ def encrypt_dm(
     plaintext: bytes,
     extra_nonce: Optional[int] = None,
 ) -> bytes:
-    nonce_value = secrets.randbits(32) if extra_nonce is None else int(extra_nonce) & 0xFFFFFFFF
+    nonce_value = (
+        secrets.randbits(32) if extra_nonce is None else int(extra_nonce) & 0xFFFFFFFF
+    )
     key = build_shared_key(sender_private_key, receiver_public_key)
     nonce = build_nonce(packet_id, from_node, nonce_value)
     encrypted = AESCCM(key, tag_length=8).encrypt(nonce, plaintext, None)

{vnode-0.1.9 → vnode-0.2.3}/vnode/vnode/example-node.json

@@ -1,5 +1,4 @@
 {
-  "node_id": "",
   "long_name": "",
   "short_name": "",
   "hw_model": "ANDROID_SIM",
@@ -22,7 +21,7 @@
     "psk": "AQ=="
   },
   "udp": {
-    "mcast_group": "224.0.0.69",
+    "mcast_group": "239.0.0.69",
     "mcast_port": 4403
   },
   "meshdb": {

{vnode-0.1.9 → vnode-0.2.3}/vnode/vnode/runtime.py

@@ -12,13 +12,25 @@ import meshdb
 from google.protobuf.message import DecodeError
 from meshtastic import BROADCAST_ADDR, BROADCAST_NUM, LOCAL_ADDR, config_pb2, mesh_pb2, portnums_pb2, protocols
 from mudp import UDPPacketStream
-from mudp.encryption import encrypt_packet as mudp_encrypt_packet
+from mudp.encryption import encrypt_packet as mudp_encrypt_packet, generate_hash
 from mudp.reliability import is_ack, is_nak, publish_ack, register_pending_ack, send_ack
 from mudp.singleton import conn, node as mudp_node
 from pubsub import pub
 
 from .config import NodeConfig
-from .crypto import b64_decode, b64_encode, decrypt_dm, derive_public_key, encrypt_dm, generate_keypair
+from .crypto import (
+    attach_signature,
+    b64_decode,
+    b64_encode,
+    decrypt_dm,
+    derive_public_key,
+    encrypt_dm,
+    sign_data,
+)
+
+RADIO_HEADER_BYTES = 16
+MAX_RADIO_FRAME_BYTES = 255
+ENCODED_SIGNATURE_BYTES = 66
 
 PKI_DISALLOWED_PORTNUMS = {
     portnums_pb2.PortNum.TRACEROUTE_APP,
@@ -78,38 +90,28 @@ class VirtualNode:
         self.node_num = parse_node_id(self.config.node_id)
         self.role_num = resolve_role(self.config.role)
         self.meshdb_path = str((self.base_dir / self.config.meshdb.path).resolve())
+        # Keep the owner database filename while using meshdb 0.2's channel tables.
+        self._db_scope = {
+            "channel": generate_hash(self.config.channel.name, self.config.channel.psk),
+            "channel_name": self.config.channel.name,
+            "storage_name": str(self.node_num),
+        }
         self.stream: Optional[UDPPacketStream] = None
         self._stop = threading.Event()
         self._broadcast_thread: Optional[threading.Thread] = None
         self._message_id = random.getrandbits(32)
-        self._public_key_b64 = ""
+        self._public_key_b64 = b64_encode(
+            derive_public_key(b64_decode(self.config.security.private_key))
+        )
         self._last_nodeinfo_sent_monotonic = 0.0
         self._last_position_reply_monotonic = 0.0
         self._last_nodeinfo_seen: Dict[int, int] = {}
         self._response_handlers: Dict[int, Dict[str, Any]] = {}
 
-        self._ensure_security_keys()
         self._write_public_key_file()
         self._seed_owner_record()
         self._configure_mudp_globals()
 
-    def _ensure_security_keys(self) -> None:
-        private_key = self.config.security.private_key.strip()
-        changed = False
-
-        if private_key:
-            self._public_key_b64 = b64_encode(derive_public_key(b64_decode(private_key)))
-        else:
-            public_bytes, private_bytes = generate_keypair()
-            self._public_key_b64 = b64_encode(public_bytes)
-            private_key = b64_encode(private_bytes)
-            changed = True
-
-        if changed:
-            self.config.security.private_key = private_key
-            self.config.security.public_key = ""
-            self.config.save(self.config_path)
-
     def _write_public_key_file(self) -> None:
         if not self._public_key_b64:
             return
@@ -118,7 +120,39 @@ class VirtualNode:
     def _seed_owner_record(self) -> None:
         Path(self.meshdb_path).mkdir(parents=True, exist_ok=True)
         meshdb.set_default_db_path(self.meshdb_path)
-        meshdb.NodeDB(self.node_num, self.meshdb_path).upsert(
+        node_db = meshdb.NodeDB(self.node_num, self.meshdb_path, **self._db_scope)
+        node_db.ensure_table()
+        # Import legacy contacts once; later deletions must not resurrect them.
+        with node_db.connect() as con:
+            legacy_table = f"{self.node_num}_nodedb"
+            exists = con.execute(
+                "SELECT 1 FROM sqlite_master WHERE type='table' AND name=?",
+                (legacy_table,),
+            ).fetchone()
+            con.execute(
+                "CREATE TABLE IF NOT EXISTS vnode_migrations (name TEXT PRIMARY KEY)"
+            )
+            imported = con.execute(
+                "SELECT 1 FROM vnode_migrations WHERE name='channel_contacts'"
+            ).fetchone()
+            if exists and not imported:
+                old_columns = {
+                    row[1]
+                    for row in con.execute(f'PRAGMA table_info("{legacy_table}")')
+                }
+                columns = [
+                    row[1]
+                    for row in con.execute(f"PRAGMA table_info({node_db.table})")
+                    if row[1] in old_columns
+                ]
+                names = ", ".join(f'"{name}"' for name in columns)
+                con.execute(
+                    f'INSERT OR IGNORE INTO {node_db.table} ({names}) SELECT {names} FROM "{legacy_table}"'
+                )
+                con.execute(
+                    "INSERT INTO vnode_migrations (name) VALUES ('channel_contacts')"
+                )
+        node_db.upsert(
             node_num=self.node_num,
             long_name=self.config.long_name,
             short_name=self.config.short_name,
@@ -220,16 +254,23 @@ class VirtualNode:
     def getPublicKey(self):
         return b64_decode(self._public_key_b64) if self._public_key_b64 else None
 
-    def getMyUser(self):
+    def _build_user(self) -> mesh_pb2.User:
         user = mesh_pb2.User(
             id=self.config.node_id,
             long_name=self.config.long_name,
             short_name=self.config.short_name,
+            # Nanopb always emits this fixed-length field, even when all zero.
+            # Include it before signing so gateway re-encoding preserves payload bytes.
+            macaddr=bytes(6),
             hw_model=resolve_hw_model(self.config.hw_model),
         )
         user.role = resolve_role(self.config.role)
         if self._public_key_b64:
             user.public_key = b64_decode(self._public_key_b64)
+        return user
+
+    def getMyUser(self):
+        user = self._build_user()
         return MessageToDict(user, preserving_proto_field_name=False, use_integers_for_enums=False)
 
     def getMyNodeInfo(self):
@@ -367,8 +408,13 @@ class VirtualNode:
         if getattr(conn, "socket", None) is None:
             conn.setup_multicast(self.config.udp.mcast_group, int(self.config.udp.mcast_port))
 
-    def send_nodeinfo(self, destination: int = BROADCAST_NUM) -> int:
-        return self._send_nodeinfo(destination)
+    def send_nodeinfo(
+        self,
+        destination: int = BROADCAST_NUM,
+        *,
+        want_response: bool = False,
+    ) -> int:
+        return self._send_nodeinfo(destination, want_response=want_response)
 
     def _send_nodeinfo(
         self,
@@ -376,22 +422,16 @@ class VirtualNode:
         *,
         request_id: Optional[int] = None,
         want_ack: bool = False,
+        want_response: bool = False,
     ) -> int:
-        user = mesh_pb2.User(
-            id=self.config.node_id,
-            long_name=self.config.long_name,
-            short_name=self.config.short_name,
-            hw_model=resolve_hw_model(self.config.hw_model),
-        )
-        user.role = resolve_role(self.config.role)
-        if self._public_key_b64:
-            user.public_key = b64_decode(self._public_key_b64)
+        user = self._build_user()
 
         data = mesh_pb2.Data()
         data.portnum = portnums_pb2.PortNum.NODEINFO_APP
         data.payload = user.SerializeToString()
         data.source = self.node_num
         data.dest = int(destination)
+        data.want_response = bool(want_response)
         if request_id is not None:
             data.request_id = int(request_id)
         packet_id = self._send_data(
@@ -615,12 +655,45 @@ class VirtualNode:
                 plaintext=data.SerializeToString(),
             )
         else:
+            signable = (
+                destination == BROADCAST_NUM
+                or data.portnum
+                in (
+                    portnums_pb2.PortNum.NODEINFO_APP,
+                    portnums_pb2.PortNum.POSITION_APP,
+                )
+                or (
+                    self.config.is_licensed
+                    and data.portnum != portnums_pb2.PortNum.ROUTING_APP
+                )
+            ) and data.portnum != portnums_pb2.PortNum.TRACEROUTE_APP
+            # Sign a copy so a caller can safely reuse its Data object. Field 10 costs
+            # 66 bytes; the radio frame permits 255 bytes including its 16-byte header.
+            data_copy = mesh_pb2.Data()
+            data_copy.CopyFrom(data)
+            if "xeddsa_signature" in data_copy.DESCRIPTOR.fields_by_name:
+                data_copy.ClearField("xeddsa_signature")
+            if signable and (
+                data_copy.ByteSize() + ENCODED_SIGNATURE_BYTES + RADIO_HEADER_BYTES
+                <= MAX_RADIO_FRAME_BYTES
+            ):
+                attach_signature(
+                    data_copy,
+                    sign_data(
+                        b64_decode(self.config.security.private_key),
+                        self.node_num,
+                        packet.id,
+                        int(destination),
+                        data_copy,
+                    ),
+                )
             packet.encrypted = mudp_encrypt_packet(
                 self.config.channel.name,
                 self.config.channel.psk,
                 packet,
-                data,
+                data_copy,
             )
+            data = data_copy
 
         raw_packet = packet.SerializeToString()
         register_pending_ack(packet, raw_packet)
@@ -760,7 +833,7 @@ class VirtualNode:
 
     def _known_node_count(self) -> int:
         try:
-            node_db = meshdb.NodeDB(self.node_num, self.meshdb_path)
+            node_db = meshdb.NodeDB(self.node_num, self.meshdb_path, **self._db_scope)
             node_db.ensure_table()
             with node_db.connect() as con:
                 row = con.execute(f"SELECT COUNT(*) FROM {node_db.table}").fetchone()
@@ -778,7 +851,8 @@ class VirtualNode:
         stored_packet = mesh_pb2.MeshPacket()
         stored_packet.CopyFrom(packet)
         stored_packet.rx_time = int(time.time())
-        stored_packet.transport_mechanism = mesh_pb2.MeshPacket.TransportMechanism.TRANSPORT_MULTICAST_UDP
+        if "transport_mechanism" in stored_packet.DESCRIPTOR.fields_by_name:
+            stored_packet.transport_mechanism = mesh_pb2.MeshPacket.TransportMechanism.TRANSPORT_MULTICAST_UDP
         stored_packet.decoded.CopyFrom(data)
         self._persist_packet(stored_packet)
 
@@ -788,6 +862,7 @@ class VirtualNode:
             normalized,
             node_database_number=self.node_num,
             db_path=self.meshdb_path,
+            **self._db_scope,
         )
 
     def _publish_receive(self, packet: mesh_pb2.MeshPacket) -> None:
@@ -922,7 +997,12 @@ class VirtualNode:
         text = str(destination).strip()
         if text.startswith("!"):
             return parse_node_id(text)
-        resolved = meshdb.get_node_num(text, owner_node_num=self.node_num, db_path=self.meshdb_path)
+        resolved = meshdb.get_node_num(
+            text,
+            owner_node_num=self.node_num,
+            db_path=self.meshdb_path,
+            **self._db_scope,
+        )
         if isinstance(resolved, list):
             raise ValueError(f"Destination '{destination}' is ambiguous: {resolved}")
         if resolved is None:
@@ -933,7 +1013,12 @@ class VirtualNode:
         if int(node_num) == self.node_num:
             key = self._public_key_b64
             return b64_decode(key) if key else None
-        row = meshdb.get_nodeinfo(int(node_num), owner_node_num=self.node_num, db_path=self.meshdb_path)
+        row = meshdb.get_nodeinfo(
+            int(node_num),
+            owner_node_num=self.node_num,
+            db_path=self.meshdb_path,
+            **self._db_scope,
+        )
         if not isinstance(row, dict):
             return None
         public_key = str(row.get("public_key", "")).strip()