c4566b4ea3
POST /api/upload accepts a multipart file, spools it to a temp path while
hashing to SHA-256, hands the on-disk copy to clamd via INSTREAM, keeps
the file at uploads/<sha256>.bin on a clean verdict and discards it on
anything else. The response carries the (hash, size, verdict) tuple
signed by the service's ed25519 key — the artifact the manifest step
will attach to the APS1 record later.
For local dev on a box without ClamAV, MOCK_SCAN=clean|infected|error
short-circuits the TCP call while still draining the bytes end-to-end.
CLAMD_HOST / CLAMD_PORT / PROMETHEUS_MAX_UPLOAD_BYTES override the
defaults (127.0.0.1:3310, 2 GiB).
Service key lives at .keys/service.key (gitignored, 0600), generated on
first start if absent. The matching public key is served at
/.well-known/prometheus-service-key.json so clients can cache it per
origin. ed25519 chosen over BIP-137 because the scan report is a service
attestation, not a Bitcoin thing — the key never signs value, never
signs for a user, never touches the chain.
Canonicalisation walks the payload recursively (sorted keys at every
level, no whitespace). The first draft used JSON.stringify with a keys
array, which only serialises top-level keys from the array — nested
objects came out as {}, so the signature verified nothing useful.
/healthz pings clamd (or the mock) so monitors can tell when the scanner
is down.
The /submit page gets a working upload form that drives the endpoint
and renders the full signed response, so the whole chain is testable in
the browser as well as via curl.
One dependency added: busboy. Rolling our own multipart parser was the
obvious alternative; busboy is one small, maintained library with no
runtime deps of its own, and multipart RFC 7578 edge cases are not
places this project earns anything by rediscovering.
|
||
|---|---|---|
| public | ||
| service | ||
| .gitignore | ||
| package-lock.json | ||
| package.json | ||
| README.md | ||
Prometheus
The service behind prometheus.x — a standalone website that accepts app
listings, scans the binaries, generates APS1 records for publishers to sign,
and serves the browse pages.
The architecture decisions and the reasoning behind them live at
_coordination/sessions/prometheus-x-architecture.md.
Read that before touching the code; it answers the questions this directory
otherwise invites ("why isn't this on Sia?", "why isn't the admin on another
subdomain?", "why Node?").
service/ Node HTTP server, templates, scanner, storage, payments
public/ Static assets served under /static/
content/ Prose content in a form the templates render into pages
Run it locally
cd Prometheus
npm install # none yet; placeholder for when deps show up
node service/server.js
Opens on http://127.0.0.1:3700 by default. Override with PORT=xxxx.
Layout
The server is one node:http listener behind a trivial map-based router.
Pages are plain functions that return {title, description, body} and
layout() wraps them in the common document shell. Static files under
public/ are served directly.
There's no framework and no templating engine on purpose — a site this small does not earn a dependency surface, and the response-rendering path is short enough to read at a glance.