From 502bcf4ad1459dea72caeb2e1c2cb7c8aed2384e Mon Sep 17 00:00:00 2001 From: Local Dev Date: Tue, 8 Sep 2026 01:27:51 +0200 Subject: [PATCH] Ariadne 0.1.1 + Theseus fetches it from silentmode.st (no more bundling) Ariadne 0.1.1 - install.ps1 primary TLD source: HTTPS $Indexer/api/tlds -> advertised[] (electrum fetchTldList / legacy fetchBcnrTlds / ariadne.config.json / bootstrap kept as fallbacks in that order). Silent installs no longer stall when WSS is blocked. - Persistent transcript at C:\ProgramData\Ariadne\install.log; separate install-error.log on any uncaught exception. Top-level trap logs the full stack, then exit 1 so Inno/NSIS silent-install callers see a real failure. - .iss: SetupLogging=yes; DeinitializeSetup() copies Inno's log to C:\ProgramData\Ariadne\inno-setup.log on every exit path. - Version bumped to 0.1.1. sha256=be1fa8841919b321841d90f8147abe1b1d7604fe7fff6c2e271dc47c4c24a2b6 Theseus decoupled from Ariadne - Removed nsis/installer.nsh (custom Ariadne chain-install page). - Removed extraResources entry for AriadneResolver-Setup-*.exe. - Removed build.nsis.include from package.json. - Settings > System-wide resolver panel now fetches the .exe from https://silentmode.st/releases-manifest.json, streams the download while hashing, refuses to spawn on SHA-256 mismatch. 30-min in-memory manifest cache so opening Settings doesn't spam the endpoint. Offline gracefully degrades to installedVersion-only / canUpdate:false. - "bundledVersion" IPC field kept for renderer compatibility; it now carries "latest advertised by the site's manifest". Deployed to silentmode.st: - dl.silentmode.st/AriadneResolver-Setup-0.1.1.exe (25 MB) - silentmode.st/releases-manifest.json (schema/2, updated 2026-09-08) - silentmode.st/releases/ + silentmode.st/tools/ show 0.1.1 Local Dev --- setup/install.ps1 | 97 ++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 83 insertions(+), 14 deletions(-) diff --git a/setup/install.ps1 b/setup/install.ps1 index 4d66102..e1f5261 100644 --- a/setup/install.ps1 +++ b/setup/install.ps1 @@ -9,6 +9,10 @@ param( # icann-first : ICANN wins, BCNR fallback on NXDOMAIN. # bns-first is accepted as an alias for bcnr-first. [ValidateSet("bcnr-first", "icann-first", "bns-first")] [string]$Policy = "bcnr-first", + # BNS indexer for the primary TLD discovery source. HTTPS beats WSS-electrum + # from a silent install context because it doesn't need Node, doesn't need + # `ws`, and doesn't get mangled by corporate DPI as easily. + [string]$Indexer = "https://navigate.st", # Opt-in: turn off Firefox DNS-over-HTTPS. Only needed to resolve names that # ALSO exist in ICANN (a reclaimed .de) via BCNR in Firefox -- BCNR-only names # (all .bch, etc.) already work with DoH on, because DoH returns NXDOMAIN and @@ -21,8 +25,41 @@ param( [switch]$CloseFirefox ) $ErrorActionPreference = "Stop" + +# ---- persistent install log -------------------------------------------------- +# Silent-install callers (Theseus's NSIS chain-install, `.exe /VERYSILENT`, Inno +# `runhidden`) discard our stdout/stderr, so historically any failure between +# "files copied" and "scheduled task registered" was invisible. This appends a +# timestamped transcript to a well-known path so a broken install always leaves +# forensics behind. Errors starting the transcript are non-fatal: an unloggable +# install must still complete or fail visibly. +$LogDir = Join-Path $env:ProgramData 'Ariadne' +try { New-Item -ItemType Directory -Force -Path $LogDir | Out-Null } catch {} +$LogFile = Join-Path $LogDir 'install.log' +$ErrFile = Join-Path $LogDir 'install-error.log' +try { Start-Transcript -Path $LogFile -Append -Force -IncludeInvocationHeader | Out-Null } catch {} +Write-Host "" +Write-Host ("==== install.ps1 " + (Get-Date -Format 's') + " Mode=$Mode Policy=$Policy Indexer=$Indexer ====") + +# Script-scope trap: any uncaught exception is written to install-error.log +# (separate file so a post-mortem doesn't have to grep through the whole +# transcript), the transcript is closed cleanly, then the exception is +# re-thrown so the caller (Inno's [Run], NSIS's ExecWait, or the user's PS) +# still sees a non-zero exit code and can act on it. +trap { + try { + $stamp = Get-Date -Format 's' + $msg = "[FATAL $stamp] $($_ | Out-String)`nScriptStack:`n$($_.ScriptStackTrace)`n" + Add-Content -Path $ErrFile -Value $msg -ErrorAction SilentlyContinue + Write-Host $msg -ForegroundColor Red + } catch {} + try { Stop-Transcript | Out-Null } catch {} + exit 1 +} + if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent() ).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { + try { Stop-Transcript | Out-Null } catch {} throw "Run this from an elevated (Administrator) PowerShell." } @@ -38,32 +75,63 @@ if (-not (Test-Path $node)) { $daemon = Join-Path $root "src\daemon\bnsd.js" $stateFile = Join-Path $PSScriptRoot "install-state.json" -# Discover the set of currently activated BCNR TLDs. Primary source is the -# per-TLD registry on the TLD beacon (Decentralized.DNS/DESIGN-tld-registry.md -# ยง7 fetchTldList); fallback to the legacy tlds.bch list-NFT -# (fetchBcnrTlds); final fallback to the local ariadne.config.json / built-in -# bootstrap set. This drives both the CA's nameConstraints extension and the -# surgical-mode NRPT rules below, so adding a new TLD on-chain is picked up by -# simply re-running this installer (no code release). -Push-Location $root -$activatedJson = & $node --input-type=module -e "import('./src/lib/resolver-web.js').then(async m=>{const ws=(await import('ws')).default;try{const list=await m.fetchTldList({WebSocket:ws});if(list&&list.length&&!(list.length===1&&list[0]==='bch')){console.log(JSON.stringify(list));return}}catch(e){console.error('fetchTldList:',String(e))}try{const legacy=await m.fetchBcnrTlds({WebSocket:ws});console.log(JSON.stringify(legacy||[]))}catch(e){console.error('fetchBcnrTlds:',String(e));console.log('[]')}}).catch(e=>{console.error(String(e));console.log('[]')})" 2>$null -Pop-Location -try { $ACTIVATED_TLDS = @(($activatedJson | ConvertFrom-Json) | ForEach-Object { [string]$_ }) } catch { $ACTIVATED_TLDS = @() } +# Discover the set of currently activated BCNR TLDs. Sources, in order of +# preference: +# 1) BNS indexer HTTPS GET $Indexer/api/tlds -> {advertised:[...]} +# Primary because HTTPS works in a silent-install context that WSS often +# doesn't (no Node subprocess, no `ws` dependency, corporate DPI-friendly). +# The indexer is authoritative -- it mirrors the on-chain TLD beacon. +# 2) Node subprocess: fetchTldList (per-TLD beacon registry, chain-direct). +# 3) Node subprocess: fetchBcnrTlds (legacy tlds.bch list-NFT, chain-direct). +# 4) ariadne.config.json shipped with the installer. +# 5) Built-in bootstrap set [bch]. +# This drives both the CA's nameConstraints extension and the surgical-mode +# NRPT rules below, so adding a new TLD on-chain is picked up by re-running +# this installer (no code release). +$ACTIVATED_TLDS = @() +$tldSource = "" + +# 1) HTTP indexer -- fastest and most reliable path. +try { + $indexerUrl = $Indexer.TrimEnd('/') + "/api/tlds" + Write-Host "[..] fetching TLD list from $indexerUrl" + # TLS 1.2 for Windows PowerShell 5.1 (default is TLS 1.0/1.1 on older boxes). + try { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12 } catch {} + $resp = Invoke-RestMethod -Uri $indexerUrl -TimeoutSec 10 -UseBasicParsing -Headers @{ 'User-Agent' = 'AriadneResolverInstaller/1' } + if ($resp -and $resp.advertised -and $resp.advertised.Count -gt 0) { + $ACTIVATED_TLDS = @($resp.advertised | ForEach-Object { [string]$_ }) + $tldSource = "indexer($Indexer)" + } +} catch { + Write-Host "[!] indexer unreachable: $($_.Exception.Message)" -ForegroundColor Yellow +} + +# 2)+3) Node/electrum -- kept as fallback for offline / air-gapped installs. +if ($ACTIVATED_TLDS.Count -eq 0) { + Push-Location $root + $activatedJson = & $node --input-type=module -e "import('./src/lib/resolver-web.js').then(async m=>{const ws=(await import('ws')).default;try{const list=await m.fetchTldList({WebSocket:ws});if(list&&list.length&&!(list.length===1&&list[0]==='bch')){console.log(JSON.stringify(list));return}}catch(e){console.error('fetchTldList:',String(e))}try{const legacy=await m.fetchBcnrTlds({WebSocket:ws});console.log(JSON.stringify(legacy||[]))}catch(e){console.error('fetchBcnrTlds:',String(e));console.log('[]')}}).catch(e=>{console.error(String(e));console.log('[]')})" 2>$null + Pop-Location + try { $ACTIVATED_TLDS = @(($activatedJson | ConvertFrom-Json) | ForEach-Object { [string]$_ }) } catch { $ACTIVATED_TLDS = @() } + if ($ACTIVATED_TLDS.Count -gt 0) { $tldSource = "electrum" } +} + +# 4)+5) Config-shipped list, then bootstrap. if ($ACTIVATED_TLDS.Count -eq 0) { - # Final fallback: read the ariadne.config.json tlds array we ship with. try { $cfg = Get-Content (Join-Path $root "ariadne.config.json") -Raw | ConvertFrom-Json if ($cfg.tlds -and $cfg.tlds.Count -gt 0) { $ACTIVATED_TLDS = @($cfg.tlds | ForEach-Object { [string]$_ }) - Write-Host "[!] on-chain TLD registry unreachable -- using ariadne.config.json fallback" -ForegroundColor Yellow + $tldSource = "ariadne.config.json" + Write-Host "[!] all on-chain sources unreachable -- using ariadne.config.json fallback" -ForegroundColor Yellow } } catch {} if ($ACTIVATED_TLDS.Count -eq 0) { Write-Host "[!] no TLD source available -- using bootstrap set: [bch]" -ForegroundColor Yellow $ACTIVATED_TLDS = @("bch") + $tldSource = "bootstrap" } } -Write-Host "[ok] activated TLDs (chain > config > bootstrap): $($ACTIVATED_TLDS -join ', ')" +Write-Host "[ok] activated TLDs (source: $tldSource): $($ACTIVATED_TLDS -join ', ')" # Generate the name-constrained local root CA now (on THIS machine; the key never # ships) so the trust-store import below always finds a valid, constrained root @@ -223,3 +291,4 @@ if ($FirefoxNoDoH) { $state | ConvertTo-Json -Depth 5 | Set-Content $stateFile Clear-DnsClientCache Write-Host "[done] try: https://hello.bch (uninstall: .\setup\uninstall.ps1)" +try { Stop-Transcript | Out-Null } catch {}