Repository navigation
Conversation
…ivate coordinates Reads ipfs-coords.json only when it is a regular 0600 file owned by this user and carries the Kubo API secret; every Kubo API call sends it as a bearer token. The last_used refresh writes the coordinates as a new owner-only file renamed into place and keeps the secret.
…written 0600 in one step require_private_data_root() runs first at serve and gateway start: it creates a missing root 0700, narrows a root this account owns to 0700, removes the retired local CA files, and refuses only a link, another account's folder or a world-writable folder, with one sentence saying what to run. Every writer that can create the data root uses mode 0700, including managed child roots. Runtime coordinates use the atomic 0600 O_NOFOLLOW writer and the owner-only reader; older loose coordinates of this account are narrowed when read. Capability signing-key rotation replaces the key atomically. The SUDO_UID chown repair is removed. The installer narrows an existing data folder.
The microVM serve path was the only TLS user and its guest already used plain HTTP, so elastos-tls, the hidden 'elastos tls' commands and tls_config are removed; no ElastOS-created CA remains. serve, room open and node room open default to 127.0.0.1, gateway --public keeps the requested loopback address (the tunnel provider runs on this host and dials it), and a guest-network microVM's API binds the TAP host address only. The gateway origin no longer treats Host 0.0.0.0 as loopback and recognises [::1]. The unused crosvm TCP proxy and the setcap advice are removed. serve and gateway call the private data-root check first.
Every Kubo start rewrites the repository config (existing repositories too): API and gateway on 127.0.0.1, no swarm listener, outbound TCP only, mDNS, router port mapping, relays, hole punching, AutoTLS and telemetry off, and API.Authorizations with a fresh 256-bit bearer secret. The secret is kept in ipfs-coords.json, written as a new 0600 file renamed into place and trusted only when it is a regular 0600 file owned by this user. Every Kubo API call sends the secret. Coordinates without a secret (from an earlier release) name no usable Kubo: the provider asks the daemon still serving the repository to shut down, waits for it to release the repository, and starts a locked-down one. A real-Kubo test (ELASTOS_TEST_KUBO_PATH) replaces an open daemon and checks 403 without the secret, no listen address, config and coordinate modes.
Release publication reads the Kubo API secret from ipfs-coords.json in the publication data directory with the owner-only file reader, checks that the coordinates name the API endpoint the provider reported, and sends the secret on block/put and repo/stat. The secret does not travel over the provider wire. The model-preparation process fixture writes owner-only coordinates with a secret, as the provider now requires.
INSTALL.md states what listens where (loopback web listeners, Carrier UDP 4433 as the one wildcard listener and why, router port mapping unchanged, Kubo locked down), the retired local CA, the supported phone path (owner-run HTTPS origin to the loopback gateway, gateway_allowed_hosts, arm-owner or arm-owner-recovery), and that the Runtime runs as the user, keeps its data folder private, and that code running as the user or root can use the keys.
…escriptor unlinkat on the already-checked directory fd resolves no path component again; a failure is logged and never stops startup.
Kubo starts with no swarm listener, no bootstrap peers, no routing and no remote configuration unless its shared-roots MFS directory (/elastos-shared) names a root; then it listens on TCP 4001 (or a free port when 4001 is taken) with router port mapping, joins the public IPFS network and announces only the shared roots (Provide.Strategy mfs, no fast root provide on add). mDNS, relays, hole punching, non-TCP transports, AutoTLS and telemetry stay off in both modes. New Runtime-only operations runtime_share_root and runtime_unshare_root add or remove one root; the first share and the last unshare restart Kubo in the other mode, and a newly shared root is announced at once. Real-Kubo tests: without a share Kubo has no peers and no swarm listener; with a share it listens, and only the shared root is in the shared-roots directory, not another stored object; unsharing closes the swarm again.
A pinned content publish asks the local IPFS provider to share that root; unpublish stops sharing it. Kubo opens its swarm only while a root is shared and announces only shared roots. The share operations are Runtime-only.
# Conflicts: # elastos/CHANGELOG.md
15 of 17 tasks
This was referenced Oct 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#183 groups B and C (decided 11 Oct: ease of use and stability first; every protection repairs itself where it can).
chmod 700fix). Coordinates and keys written 0600 in one step.Slot-5 Linux full check PASS on 210c101.