feat(digstore-remote): clone_store accepts an optional generation root - #70
Draft
MichaelTaylor3d wants to merge 5 commits into
Draft
feat(digstore-remote): clone_store accepts an optional generation root#70MichaelTaylor3d wants to merge 5 commits into
MichaelTaylor3d wants to merge 5 commits into
Conversation
Refs DIG-Network/dig_ecosystem#1903 Co-Authored-By: Claude <noreply@anthropic.com>
…903) Co-Authored-By: Claude <noreply@anthropic.com>
Add DigClient::clone_store_at(store_id, root, verify, on_progress): a
rooted GET /stores/{id}/module?root=<hex> that refuses (before the body
is downloaded, before verify/on_progress run) any response whose ETag
names a different generation than the one requested. clone_store now
delegates to it with root=None, byte-identical to the prior rootless
request.
pull's full-module download is now pinned to the remote head it already
resolved (?root=<remote_root>) and checks the served ETag agrees before
returning PullResult::Module, instead of trusting an unpinned rootless
GET.
Server side: get_module/head_module accept an optional ?root= query.
Precedence: 422 on a malformed root (evaluated before any backend call)
-> 404 unknown store -> 404 UnknownRoot on a well-formed root that is
not the served head -> 304 on a matching If-None-Match (GET only) -> 200
with ETag = the served root. A rooted request is never silently
downgraded to serving the head.
digstore-cli's clone_from now calls clone_store_at with the remote_root
fetch already resolved, so a head that advances between fetch and the
module download surfaces as a clean error instead of installing an
unrequested generation.
Refs DIG-Network/dig_ecosystem#1903
Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DO NOT MERGE — gate round in progress
Task
Give
DigClient::clone_store(andpull's full-module GET) a way to request a SPECIFIC generation root, so a §21 clone against the public gateway is a single rootedGET /stores/{id}/module?root=<hex>instead of a rootless GET that the gateway answers with a307redirect.Why
DigClient::newdeliberately setsreqwest::redirect::Policy::none()(crates/digstore-remote/src/client.rs:185-198, SSRF guard). hub.dig.net §16 (#1886) resolves a rootless module read with307 -> ?root=<head>. Combined, a rootlessclone_store/pullfrom the digstore CLI against rpc.dig.net returnsClientError::Status(307)and never downloads. The CLI already holds the root it wants (fetch()->descriptor.current_root) before it callsclone_store; it just has no parameter to pass it through.clone_whole_store) wants to pinwant_rootfor the same reason.Scope
digstore-remote:clone_storegains aroot: Option<&Bytes32>argument;Some(r)->?root=<hex>and the served ETag root MUST equalr(elseVerification);None-> unchanged rootless behaviour.pull's full-module GET carries?root=<remote_root>(it already knows it).digstore-cliclone_frompasses the descriptor root.SPEC.mdupdated in the same PR (§4.2).Blast radius checked
In-tree callers of
clone_store:crates/digstore-cli/src/ops/remote_ops.rs,crates/digstore-remote/tests/client_roundtrip.rs. Out-of-tree: dig-nodecrates/dig-node-core/src/lib.rs(git-pinned rev161c2a31; adopts on its own bump — noted on the ticket).How verified
(filled in by the lane: unit tests in
client_roundtrip.rs; guest wasm rebuilt; CLI reinstalled--force --locked; integration tests against the INSTALLED binary.)Refs https://github.com/DIG-Network/dig_ecosystem/issues/1903
Parent epic: https://github.com/DIG-Network/dig_ecosystem/issues/3212
Closes DIG-Network/dig_ecosystem#1903
Co-Authored-By: Claude noreply@anthropic.com