From d454de49aca40b9b7d2b411e213898e8e8c3746e Mon Sep 17 00:00:00 2001 From: root Date: Sun, 12 Jul 2026 00:36:40 +0200 Subject: [PATCH 1/3] gl: add --icaptcha-proof flag to register command This allows users to provide a pre-obtained iCaptcha proof token when registering with a node, sent as the x-icaptcha-proof header on the initial POST /api/register request. Usage: gl register --icaptcha-proof "" GITLAWB_ICAPTCHA_PROOF="" gl register The existing automatic iCaptcha retry flow (403 -> solve -> retry) remains unchanged and is still available if no initial proof is provided. --- crates/gl/src/http.rs | 31 ++++++++++++++++++++++++++++++- crates/gl/src/register.rs | 8 +++++++- 2 files changed, 37 insertions(+), 2 deletions(-) diff --git a/crates/gl/src/http.rs b/crates/gl/src/http.rs index dc9f45da..712af134 100644 --- a/crates/gl/src/http.rs +++ b/crates/gl/src/http.rs @@ -77,6 +77,18 @@ impl NodeClient { self.send_signed("POST", path, body).await } + /// POST with JSON body + RFC 9421 signing and an optional user-provided + /// iCaptcha proof, sent on the initial request. + pub async fn post_with_proof( + &self, + path: &str, + body: &[u8], + initial_proof: Option<&str>, + ) -> Result { + self.send_signed_with_proof("POST", path, body, initial_proof) + .await + } + /// PUT with RFC 9421 signing + transparent iCaptcha solve/retry. pub async fn put(&self, path: &str, body: &[u8]) -> Result { self.send_signed("PUT", path, body).await @@ -91,16 +103,32 @@ impl NodeClient { /// `x-icaptcha-*` headers) solve it and retry the same signed request with /// the proof header, up to [`MAX_ICAPTCHA_RETRIES`]. Emits an actionable /// hint on a 401 "not an agent" (the old-CLI / unregistered failure mode). + /// Existing call path: no user-supplied proof on the first request. async fn send_signed( &self, method: &str, path: &str, body: &[u8], ) -> Result { - let mut proof: Option = None; + self.send_signed_with_proof(method, path, body, None).await + } + + /// Sign + send a write. `initial_proof`, if provided, is attached to the + /// first request. On a 403 iCaptcha challenge advertised via + /// `x-icaptcha-*` headers, solve and retry up to MAX_ICAPTCHA_RETRIES. + async fn send_signed_with_proof( + &self, + method: &str, + path: &str, + body: &[u8], + initial_proof: Option<&str>, + ) -> Result { + let mut proof = initial_proof.map(str::to_owned); let mut attempts = 0; + loop { let resp = self.send_once(method, path, body, proof.as_deref()).await?; + let status = resp.status(); if status == reqwest::StatusCode::UNAUTHORIZED @@ -124,6 +152,7 @@ impl NodeClient { continue; } } + return Ok(resp); } } diff --git a/crates/gl/src/register.rs b/crates/gl/src/register.rs index 8a17a77e..2b166359 100644 --- a/crates/gl/src/register.rs +++ b/crates/gl/src/register.rs @@ -17,6 +17,9 @@ pub struct RegisterArgs { #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")] pub node: String, + #[arg(long, env = "GITLAWB_ICAPTCHA_PROOF")] + pub icaptcha_proof: Option, + /// Capabilities to advertise (comma-separated) #[arg( long, @@ -51,7 +54,7 @@ pub async fn run(args: RegisterArgs) -> Result<()> { }))?; let resp = client - .post("/api/register", &body) + .post_with_proof("/api/register", &body, args.icaptcha_proof.as_deref()) .await .context("failed to connect to node")?; @@ -147,6 +150,7 @@ mod tests { capabilities: vec!["git:push".to_string(), "git:fetch".to_string()], model: None, dir: Some(dir.path().to_path_buf()), + icaptcha_proof: None, }) .await .unwrap(); @@ -179,6 +183,7 @@ mod tests { capabilities: vec!["git:push".to_string()], model: None, dir: Some(dir.path().to_path_buf()), + icaptcha_proof: None, }) .await; @@ -198,6 +203,7 @@ mod tests { capabilities: vec![], model: None, dir: Some(dir.path().to_path_buf()), + icaptcha_proof: None, }) .await; From 9e8a88abe57dfa56648604e484f3c18ff4ffa7cb Mon Sep 17 00:00:00 2001 From: jilt Date: Tue, 14 Jul 2026 12:32:02 +0200 Subject: [PATCH 2/3] gl: disable redirects, add proof test, improve error context - Disable HTTP redirects in NodeClient to avoid leaking proof/signature headers - Add send_signed_does_not_follow_redirect test - Use specific error context for proof-bearing registration requests - Add register_forwards_icaptcha_proof_header test --- .cargo/audit.toml | 0 .env.example | 0 .github/CODEOWNERS | 0 .github/ISSUE_TEMPLATE/bug_report.yml | 0 .github/ISSUE_TEMPLATE/config.yml | 0 .github/ISSUE_TEMPLATE/feature_request.yml | 0 .github/pull_request_template.md | 0 .github/workflows/audit-schedule.yml | 0 .github/workflows/pr-checks.yml | 0 .github/workflows/pr-triage.yml | 0 .github/workflows/release.yml | 0 .github/workflows/stale.yml | 0 .gitignore | 0 .release-please-manifest.json | 0 CHANGELOG.md | 0 CONTRIBUTING.md | 0 Cargo.lock | 11 +++++---- Cargo.toml | 0 Dockerfile | 0 Dockerfile.bins | 0 LICENSE-APACHE | 0 LICENSE-MIT | 0 README.md | 0 SECURITY.md | 0 bootstrap-peers.json | 0 crates/git-remote-gitlawb/Cargo.toml | 0 crates/git-remote-gitlawb/src/main.rs | 0 crates/gitlawb-attest/Cargo.toml | 0 crates/gitlawb-attest/src/attestation.rs | 0 crates/gitlawb-attest/src/cert.rs | 0 crates/gitlawb-attest/src/error.rs | 0 crates/gitlawb-attest/src/lib.rs | 0 crates/gitlawb-attest/src/verifier.rs | 0 .../gitlawb-attest/tests/canonical_vectors.rs | 0 .../gitlawb-attest/tests/with_gitlawb_core.rs | 0 crates/gitlawb-core/Cargo.toml | 0 crates/gitlawb-core/src/cert.rs | 0 crates/gitlawb-core/src/cid.rs | 0 crates/gitlawb-core/src/did.rs | 0 crates/gitlawb-core/src/encrypt.rs | 0 crates/gitlawb-core/src/error.rs | 0 crates/gitlawb-core/src/http_sig.rs | 0 crates/gitlawb-core/src/identity.rs | 0 crates/gitlawb-core/src/lib.rs | 0 crates/gitlawb-core/src/ucan.rs | 0 crates/gitlawb-node/Cargo.toml | 0 crates/gitlawb-node/src/api/agents.rs | 0 crates/gitlawb-node/src/api/arweave.rs | 0 crates/gitlawb-node/src/api/bounties.rs | 0 crates/gitlawb-node/src/api/certs.rs | 0 crates/gitlawb-node/src/api/changelog.rs | 0 crates/gitlawb-node/src/api/encrypted.rs | 0 crates/gitlawb-node/src/api/events.rs | 0 crates/gitlawb-node/src/api/ipfs.rs | 0 crates/gitlawb-node/src/api/issues.rs | 0 crates/gitlawb-node/src/api/labels.rs | 0 crates/gitlawb-node/src/api/mod.rs | 0 crates/gitlawb-node/src/api/peers.rs | 0 crates/gitlawb-node/src/api/profiles.rs | 0 crates/gitlawb-node/src/api/protect.rs | 0 crates/gitlawb-node/src/api/pulls.rs | 0 crates/gitlawb-node/src/api/register.rs | 0 crates/gitlawb-node/src/api/replicas.rs | 0 crates/gitlawb-node/src/api/repos.rs | 0 crates/gitlawb-node/src/api/resolve.rs | 0 crates/gitlawb-node/src/api/stars.rs | 0 crates/gitlawb-node/src/api/tasks.rs | 0 crates/gitlawb-node/src/api/visibility.rs | 0 crates/gitlawb-node/src/api/webhooks.rs | 0 crates/gitlawb-node/src/arweave.rs | 0 crates/gitlawb-node/src/auth/mod.rs | 0 crates/gitlawb-node/src/bootstrap.rs | 0 crates/gitlawb-node/src/cert.rs | 0 crates/gitlawb-node/src/config.rs | 0 crates/gitlawb-node/src/db/mod.rs | 0 crates/gitlawb-node/src/encrypted_pin.rs | 0 crates/gitlawb-node/src/error.rs | 0 crates/gitlawb-node/src/git/issues.rs | 0 crates/gitlawb-node/src/git/mod.rs | 0 crates/gitlawb-node/src/git/push_delta.rs | 0 crates/gitlawb-node/src/git/repo_store.rs | 0 crates/gitlawb-node/src/git/smart_http.rs | 0 crates/gitlawb-node/src/git/store.rs | 0 crates/gitlawb-node/src/git/tigris.rs | 0 .../gitlawb-node/src/git/visibility_pack.rs | 0 crates/gitlawb-node/src/graphql/mod.rs | 0 crates/gitlawb-node/src/graphql/mutation.rs | 0 crates/gitlawb-node/src/graphql/query.rs | 0 .../gitlawb-node/src/graphql/subscription.rs | 0 crates/gitlawb-node/src/graphql/types.rs | 0 crates/gitlawb-node/src/icaptcha.rs | 0 crates/gitlawb-node/src/ipfs_pin.rs | 0 crates/gitlawb-node/src/main.rs | 0 crates/gitlawb-node/src/metrics.rs | 0 crates/gitlawb-node/src/operator.rs | 0 crates/gitlawb-node/src/p2p/mod.rs | 0 crates/gitlawb-node/src/pinata.rs | 0 crates/gitlawb-node/src/rate_limit.rs | 0 crates/gitlawb-node/src/server.rs | 0 crates/gitlawb-node/src/state.rs | 0 crates/gitlawb-node/src/sync.rs | 0 crates/gitlawb-node/src/test_support.rs | 0 crates/gitlawb-node/src/visibility.rs | 0 crates/gitlawb-node/src/webhooks.rs | 0 crates/gl/Cargo.toml | 0 crates/gl/src/agent.rs | 0 crates/gl/src/bounty.rs | 0 crates/gl/src/cert.rs | 0 crates/gl/src/changelog.rs | 0 crates/gl/src/clone.rs | 0 crates/gl/src/doctor.rs | 0 crates/gl/src/http.rs | 22 ++++++++++++++++++ crates/gl/src/identity.rs | 0 crates/gl/src/init.rs | 0 crates/gl/src/ipfs_cmd.rs | 0 crates/gl/src/issue.rs | 0 crates/gl/src/main.rs | 0 crates/gl/src/mcp.rs | 0 crates/gl/src/mirror.rs | 0 crates/gl/src/name.rs | 0 crates/gl/src/node.rs | 0 crates/gl/src/node_stake.rs | 0 crates/gl/src/peer.rs | 0 crates/gl/src/pr.rs | 0 crates/gl/src/profile.rs | 0 crates/gl/src/protect.rs | 0 crates/gl/src/quickstart.rs | 0 crates/gl/src/register.rs | 16 +++++++++---- crates/gl/src/repo.rs | 0 crates/gl/src/star.rs | 0 crates/gl/src/status.rs | 0 crates/gl/src/sync.rs | 0 crates/gl/src/task.rs | 0 crates/gl/src/ucan_cmd.rs | 0 crates/gl/src/visibility.rs | 0 crates/gl/src/webhook.rs | 0 crates/gl/src/whoami.rs | 0 crates/icaptcha-client/Cargo.toml | 0 crates/icaptcha-client/src/lib.rs | 0 crates/icaptcha-client/src/pow.rs | 0 crates/icaptcha-client/src/solvers.rs | 0 docker-compose.yml | 0 docs/ECONOMICS.md | 0 docs/MAINTAINER-ROADMAP.md | 0 docs/OSS-READINESS-AUDIT.md | 0 docs/RUN-A-NODE.md | 0 infra/README.md | 0 infra/aws/.gitignore | 0 infra/aws/.terraform.lock.hcl | 0 infra/aws/README.md | 0 infra/aws/compose.yaml.tftpl | 0 infra/aws/main.tf | 0 infra/aws/monitoring.tf | 0 infra/aws/outputs.tf | 0 infra/aws/rds.tf | 0 infra/aws/terraform.tfvars.example | 0 infra/aws/user-data.sh.tftpl | 0 infra/aws/variables.tf | 0 infra/aws/versions.tf | 0 infra/fly/fly.toml | 0 install.ps1 | 0 install.sh | 0 macos-app/.gitignore | 0 macos-app/Package.swift | 0 .../Sources/GitlawbNode/AppDelegate.swift | 0 macos-app/Sources/GitlawbNode/Config.swift | 0 .../Sources/GitlawbNode/DockerCompose.swift | 0 .../Sources/GitlawbNode/DockerDetector.swift | 0 macos-app/Sources/GitlawbNode/Info.plist | 0 .../GitlawbNode/Resources/AppIcon.icns | Bin .../GitlawbNode/Resources/MenuBarIcon.png | Bin .../GitlawbNode/Resources/MenuBarIcon@2x.png | Bin .../GitlawbNode/Resources/docker-compose.yml | 0 .../Sources/GitlawbNode/SettingsWindow.swift | 0 .../GitlawbNode/StatusBarController.swift | 0 macos-app/Sources/GitlawbNode/main.swift | 0 npm/.gitignore | 0 npm/README.md | 0 npm/packages/gl-darwin-arm64/package.json | 0 npm/packages/gl-darwin-x64/package.json | 0 npm/packages/gl-linux-arm64/package.json | 0 npm/packages/gl-linux-x64/package.json | 0 npm/packages/gl/README.md | 0 npm/packages/gl/bin/.gitkeep | 0 npm/packages/gl/install.js | 0 npm/packages/gl/package.json | 0 release-please-config.json | 0 187 files changed, 40 insertions(+), 9 deletions(-) mode change 100644 => 100755 .cargo/audit.toml mode change 100644 => 100755 .env.example mode change 100644 => 100755 .github/CODEOWNERS mode change 100644 => 100755 .github/ISSUE_TEMPLATE/bug_report.yml mode change 100644 => 100755 .github/ISSUE_TEMPLATE/config.yml mode change 100644 => 100755 .github/ISSUE_TEMPLATE/feature_request.yml mode change 100644 => 100755 .github/pull_request_template.md mode change 100644 => 100755 .github/workflows/audit-schedule.yml mode change 100644 => 100755 .github/workflows/pr-checks.yml mode change 100644 => 100755 .github/workflows/pr-triage.yml mode change 100644 => 100755 .github/workflows/release.yml mode change 100644 => 100755 .github/workflows/stale.yml mode change 100644 => 100755 .gitignore mode change 100644 => 100755 .release-please-manifest.json mode change 100644 => 100755 CHANGELOG.md mode change 100644 => 100755 CONTRIBUTING.md mode change 100644 => 100755 Cargo.lock mode change 100644 => 100755 Cargo.toml mode change 100644 => 100755 Dockerfile mode change 100644 => 100755 Dockerfile.bins mode change 100644 => 100755 LICENSE-APACHE mode change 100644 => 100755 LICENSE-MIT mode change 100644 => 100755 README.md mode change 100644 => 100755 SECURITY.md mode change 100644 => 100755 bootstrap-peers.json mode change 100644 => 100755 crates/git-remote-gitlawb/Cargo.toml mode change 100644 => 100755 crates/git-remote-gitlawb/src/main.rs mode change 100644 => 100755 crates/gitlawb-attest/Cargo.toml mode change 100644 => 100755 crates/gitlawb-attest/src/attestation.rs mode change 100644 => 100755 crates/gitlawb-attest/src/cert.rs mode change 100644 => 100755 crates/gitlawb-attest/src/error.rs mode change 100644 => 100755 crates/gitlawb-attest/src/lib.rs mode change 100644 => 100755 crates/gitlawb-attest/src/verifier.rs mode change 100644 => 100755 crates/gitlawb-attest/tests/canonical_vectors.rs mode change 100644 => 100755 crates/gitlawb-attest/tests/with_gitlawb_core.rs mode change 100644 => 100755 crates/gitlawb-core/Cargo.toml mode change 100644 => 100755 crates/gitlawb-core/src/cert.rs mode change 100644 => 100755 crates/gitlawb-core/src/cid.rs mode change 100644 => 100755 crates/gitlawb-core/src/did.rs mode change 100644 => 100755 crates/gitlawb-core/src/encrypt.rs mode change 100644 => 100755 crates/gitlawb-core/src/error.rs mode change 100644 => 100755 crates/gitlawb-core/src/http_sig.rs mode change 100644 => 100755 crates/gitlawb-core/src/identity.rs mode change 100644 => 100755 crates/gitlawb-core/src/lib.rs mode change 100644 => 100755 crates/gitlawb-core/src/ucan.rs mode change 100644 => 100755 crates/gitlawb-node/Cargo.toml mode change 100644 => 100755 crates/gitlawb-node/src/api/agents.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/arweave.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/bounties.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/certs.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/changelog.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/encrypted.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/events.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/ipfs.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/issues.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/labels.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/mod.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/peers.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/profiles.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/protect.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/pulls.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/register.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/replicas.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/repos.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/resolve.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/stars.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/tasks.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/visibility.rs mode change 100644 => 100755 crates/gitlawb-node/src/api/webhooks.rs mode change 100644 => 100755 crates/gitlawb-node/src/arweave.rs mode change 100644 => 100755 crates/gitlawb-node/src/auth/mod.rs mode change 100644 => 100755 crates/gitlawb-node/src/bootstrap.rs mode change 100644 => 100755 crates/gitlawb-node/src/cert.rs mode change 100644 => 100755 crates/gitlawb-node/src/config.rs mode change 100644 => 100755 crates/gitlawb-node/src/db/mod.rs mode change 100644 => 100755 crates/gitlawb-node/src/encrypted_pin.rs mode change 100644 => 100755 crates/gitlawb-node/src/error.rs mode change 100644 => 100755 crates/gitlawb-node/src/git/issues.rs mode change 100644 => 100755 crates/gitlawb-node/src/git/mod.rs mode change 100644 => 100755 crates/gitlawb-node/src/git/push_delta.rs mode change 100644 => 100755 crates/gitlawb-node/src/git/repo_store.rs mode change 100644 => 100755 crates/gitlawb-node/src/git/smart_http.rs mode change 100644 => 100755 crates/gitlawb-node/src/git/store.rs mode change 100644 => 100755 crates/gitlawb-node/src/git/tigris.rs mode change 100644 => 100755 crates/gitlawb-node/src/git/visibility_pack.rs mode change 100644 => 100755 crates/gitlawb-node/src/graphql/mod.rs mode change 100644 => 100755 crates/gitlawb-node/src/graphql/mutation.rs mode change 100644 => 100755 crates/gitlawb-node/src/graphql/query.rs mode change 100644 => 100755 crates/gitlawb-node/src/graphql/subscription.rs mode change 100644 => 100755 crates/gitlawb-node/src/graphql/types.rs mode change 100644 => 100755 crates/gitlawb-node/src/icaptcha.rs mode change 100644 => 100755 crates/gitlawb-node/src/ipfs_pin.rs mode change 100644 => 100755 crates/gitlawb-node/src/main.rs mode change 100644 => 100755 crates/gitlawb-node/src/metrics.rs mode change 100644 => 100755 crates/gitlawb-node/src/operator.rs mode change 100644 => 100755 crates/gitlawb-node/src/p2p/mod.rs mode change 100644 => 100755 crates/gitlawb-node/src/pinata.rs mode change 100644 => 100755 crates/gitlawb-node/src/rate_limit.rs mode change 100644 => 100755 crates/gitlawb-node/src/server.rs mode change 100644 => 100755 crates/gitlawb-node/src/state.rs mode change 100644 => 100755 crates/gitlawb-node/src/sync.rs mode change 100644 => 100755 crates/gitlawb-node/src/test_support.rs mode change 100644 => 100755 crates/gitlawb-node/src/visibility.rs mode change 100644 => 100755 crates/gitlawb-node/src/webhooks.rs mode change 100644 => 100755 crates/gl/Cargo.toml mode change 100644 => 100755 crates/gl/src/agent.rs mode change 100644 => 100755 crates/gl/src/bounty.rs mode change 100644 => 100755 crates/gl/src/cert.rs mode change 100644 => 100755 crates/gl/src/changelog.rs mode change 100644 => 100755 crates/gl/src/clone.rs mode change 100644 => 100755 crates/gl/src/doctor.rs mode change 100644 => 100755 crates/gl/src/http.rs mode change 100644 => 100755 crates/gl/src/identity.rs mode change 100644 => 100755 crates/gl/src/init.rs mode change 100644 => 100755 crates/gl/src/ipfs_cmd.rs mode change 100644 => 100755 crates/gl/src/issue.rs mode change 100644 => 100755 crates/gl/src/main.rs mode change 100644 => 100755 crates/gl/src/mcp.rs mode change 100644 => 100755 crates/gl/src/mirror.rs mode change 100644 => 100755 crates/gl/src/name.rs mode change 100644 => 100755 crates/gl/src/node.rs mode change 100644 => 100755 crates/gl/src/node_stake.rs mode change 100644 => 100755 crates/gl/src/peer.rs mode change 100644 => 100755 crates/gl/src/pr.rs mode change 100644 => 100755 crates/gl/src/profile.rs mode change 100644 => 100755 crates/gl/src/protect.rs mode change 100644 => 100755 crates/gl/src/quickstart.rs mode change 100644 => 100755 crates/gl/src/register.rs mode change 100644 => 100755 crates/gl/src/repo.rs mode change 100644 => 100755 crates/gl/src/star.rs mode change 100644 => 100755 crates/gl/src/status.rs mode change 100644 => 100755 crates/gl/src/sync.rs mode change 100644 => 100755 crates/gl/src/task.rs mode change 100644 => 100755 crates/gl/src/ucan_cmd.rs mode change 100644 => 100755 crates/gl/src/visibility.rs mode change 100644 => 100755 crates/gl/src/webhook.rs mode change 100644 => 100755 crates/gl/src/whoami.rs mode change 100644 => 100755 crates/icaptcha-client/Cargo.toml mode change 100644 => 100755 crates/icaptcha-client/src/lib.rs mode change 100644 => 100755 crates/icaptcha-client/src/pow.rs mode change 100644 => 100755 crates/icaptcha-client/src/solvers.rs mode change 100644 => 100755 docker-compose.yml mode change 100644 => 100755 docs/ECONOMICS.md mode change 100644 => 100755 docs/MAINTAINER-ROADMAP.md mode change 100644 => 100755 docs/OSS-READINESS-AUDIT.md mode change 100644 => 100755 docs/RUN-A-NODE.md mode change 100644 => 100755 infra/README.md mode change 100644 => 100755 infra/aws/.gitignore mode change 100644 => 100755 infra/aws/.terraform.lock.hcl mode change 100644 => 100755 infra/aws/README.md mode change 100644 => 100755 infra/aws/compose.yaml.tftpl mode change 100644 => 100755 infra/aws/main.tf mode change 100644 => 100755 infra/aws/monitoring.tf mode change 100644 => 100755 infra/aws/outputs.tf mode change 100644 => 100755 infra/aws/rds.tf mode change 100644 => 100755 infra/aws/terraform.tfvars.example mode change 100644 => 100755 infra/aws/user-data.sh.tftpl mode change 100644 => 100755 infra/aws/variables.tf mode change 100644 => 100755 infra/aws/versions.tf mode change 100644 => 100755 infra/fly/fly.toml mode change 100644 => 100755 install.ps1 mode change 100644 => 100755 install.sh mode change 100644 => 100755 macos-app/.gitignore mode change 100644 => 100755 macos-app/Package.swift mode change 100644 => 100755 macos-app/Sources/GitlawbNode/AppDelegate.swift mode change 100644 => 100755 macos-app/Sources/GitlawbNode/Config.swift mode change 100644 => 100755 macos-app/Sources/GitlawbNode/DockerCompose.swift mode change 100644 => 100755 macos-app/Sources/GitlawbNode/DockerDetector.swift mode change 100644 => 100755 macos-app/Sources/GitlawbNode/Info.plist mode change 100644 => 100755 macos-app/Sources/GitlawbNode/Resources/AppIcon.icns mode change 100644 => 100755 macos-app/Sources/GitlawbNode/Resources/MenuBarIcon.png mode change 100644 => 100755 macos-app/Sources/GitlawbNode/Resources/MenuBarIcon@2x.png mode change 100644 => 100755 macos-app/Sources/GitlawbNode/Resources/docker-compose.yml mode change 100644 => 100755 macos-app/Sources/GitlawbNode/SettingsWindow.swift mode change 100644 => 100755 macos-app/Sources/GitlawbNode/StatusBarController.swift mode change 100644 => 100755 macos-app/Sources/GitlawbNode/main.swift mode change 100644 => 100755 npm/.gitignore mode change 100644 => 100755 npm/README.md mode change 100644 => 100755 npm/packages/gl-darwin-arm64/package.json mode change 100644 => 100755 npm/packages/gl-darwin-x64/package.json mode change 100644 => 100755 npm/packages/gl-linux-arm64/package.json mode change 100644 => 100755 npm/packages/gl-linux-x64/package.json mode change 100644 => 100755 npm/packages/gl/README.md mode change 100644 => 100755 npm/packages/gl/bin/.gitkeep mode change 100644 => 100755 npm/packages/gl/install.js mode change 100644 => 100755 npm/packages/gl/package.json mode change 100644 => 100755 release-please-config.json diff --git a/.cargo/audit.toml b/.cargo/audit.toml old mode 100644 new mode 100755 diff --git a/.env.example b/.env.example old mode 100644 new mode 100755 diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS old mode 100644 new mode 100755 diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml old mode 100644 new mode 100755 diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml old mode 100644 new mode 100755 diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml old mode 100644 new mode 100755 diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md old mode 100644 new mode 100755 diff --git a/.github/workflows/audit-schedule.yml b/.github/workflows/audit-schedule.yml old mode 100644 new mode 100755 diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml old mode 100644 new mode 100755 diff --git a/.github/workflows/pr-triage.yml b/.github/workflows/pr-triage.yml old mode 100644 new mode 100755 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml old mode 100644 new mode 100755 diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml old mode 100644 new mode 100755 diff --git a/.gitignore b/.gitignore old mode 100644 new mode 100755 diff --git a/.release-please-manifest.json b/.release-please-manifest.json old mode 100644 new mode 100755 diff --git a/CHANGELOG.md b/CHANGELOG.md old mode 100644 new mode 100755 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md old mode 100644 new mode 100755 diff --git a/Cargo.lock b/Cargo.lock old mode 100644 new mode 100755 index d12daa43..24beb9ea --- a/Cargo.lock +++ b/Cargo.lock @@ -3300,7 +3300,7 @@ dependencies = [ [[package]] name = "git-remote-gitlawb" -version = "0.5.0" +version = "0.5.1" dependencies = [ "anyhow", "gitlawb-core", @@ -3312,7 +3312,7 @@ dependencies = [ [[package]] name = "gitlawb-attest" -version = "0.5.0" +version = "0.5.1" dependencies = [ "base64", "ed25519-dalek", @@ -3329,7 +3329,7 @@ dependencies = [ [[package]] name = "gitlawb-core" -version = "0.5.0" +version = "0.5.1" dependencies = [ "anyhow", "base64", @@ -3356,7 +3356,7 @@ dependencies = [ [[package]] name = "gitlawb-node" -version = "0.5.0" +version = "0.5.1" dependencies = [ "alloy", "anyhow", @@ -3412,7 +3412,7 @@ dependencies = [ [[package]] name = "gl" -version = "0.5.0" +version = "0.5.1" dependencies = [ "alloy", "anyhow", @@ -3824,6 +3824,7 @@ dependencies = [ "reqwest", "serde", "serde_json", + "sha2", "thiserror 2.0.18", "tracing", ] diff --git a/Cargo.toml b/Cargo.toml old mode 100644 new mode 100755 diff --git a/Dockerfile b/Dockerfile old mode 100644 new mode 100755 diff --git a/Dockerfile.bins b/Dockerfile.bins old mode 100644 new mode 100755 diff --git a/LICENSE-APACHE b/LICENSE-APACHE old mode 100644 new mode 100755 diff --git a/LICENSE-MIT b/LICENSE-MIT old mode 100644 new mode 100755 diff --git a/README.md b/README.md old mode 100644 new mode 100755 diff --git a/SECURITY.md b/SECURITY.md old mode 100644 new mode 100755 diff --git a/bootstrap-peers.json b/bootstrap-peers.json old mode 100644 new mode 100755 diff --git a/crates/git-remote-gitlawb/Cargo.toml b/crates/git-remote-gitlawb/Cargo.toml old mode 100644 new mode 100755 diff --git a/crates/git-remote-gitlawb/src/main.rs b/crates/git-remote-gitlawb/src/main.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-attest/Cargo.toml b/crates/gitlawb-attest/Cargo.toml old mode 100644 new mode 100755 diff --git a/crates/gitlawb-attest/src/attestation.rs b/crates/gitlawb-attest/src/attestation.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-attest/src/cert.rs b/crates/gitlawb-attest/src/cert.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-attest/src/error.rs b/crates/gitlawb-attest/src/error.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-attest/src/lib.rs b/crates/gitlawb-attest/src/lib.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-attest/src/verifier.rs b/crates/gitlawb-attest/src/verifier.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-attest/tests/canonical_vectors.rs b/crates/gitlawb-attest/tests/canonical_vectors.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-attest/tests/with_gitlawb_core.rs b/crates/gitlawb-attest/tests/with_gitlawb_core.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-core/Cargo.toml b/crates/gitlawb-core/Cargo.toml old mode 100644 new mode 100755 diff --git a/crates/gitlawb-core/src/cert.rs b/crates/gitlawb-core/src/cert.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-core/src/cid.rs b/crates/gitlawb-core/src/cid.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-core/src/did.rs b/crates/gitlawb-core/src/did.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-core/src/encrypt.rs b/crates/gitlawb-core/src/encrypt.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-core/src/error.rs b/crates/gitlawb-core/src/error.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-core/src/http_sig.rs b/crates/gitlawb-core/src/http_sig.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-core/src/identity.rs b/crates/gitlawb-core/src/identity.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-core/src/lib.rs b/crates/gitlawb-core/src/lib.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-core/src/ucan.rs b/crates/gitlawb-core/src/ucan.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/Cargo.toml b/crates/gitlawb-node/Cargo.toml old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/agents.rs b/crates/gitlawb-node/src/api/agents.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/arweave.rs b/crates/gitlawb-node/src/api/arweave.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/bounties.rs b/crates/gitlawb-node/src/api/bounties.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/certs.rs b/crates/gitlawb-node/src/api/certs.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/changelog.rs b/crates/gitlawb-node/src/api/changelog.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/encrypted.rs b/crates/gitlawb-node/src/api/encrypted.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/events.rs b/crates/gitlawb-node/src/api/events.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/ipfs.rs b/crates/gitlawb-node/src/api/ipfs.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/issues.rs b/crates/gitlawb-node/src/api/issues.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/labels.rs b/crates/gitlawb-node/src/api/labels.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/mod.rs b/crates/gitlawb-node/src/api/mod.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/peers.rs b/crates/gitlawb-node/src/api/peers.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/profiles.rs b/crates/gitlawb-node/src/api/profiles.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/protect.rs b/crates/gitlawb-node/src/api/protect.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/pulls.rs b/crates/gitlawb-node/src/api/pulls.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/register.rs b/crates/gitlawb-node/src/api/register.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/replicas.rs b/crates/gitlawb-node/src/api/replicas.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/repos.rs b/crates/gitlawb-node/src/api/repos.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/resolve.rs b/crates/gitlawb-node/src/api/resolve.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/stars.rs b/crates/gitlawb-node/src/api/stars.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/tasks.rs b/crates/gitlawb-node/src/api/tasks.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/visibility.rs b/crates/gitlawb-node/src/api/visibility.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/api/webhooks.rs b/crates/gitlawb-node/src/api/webhooks.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/arweave.rs b/crates/gitlawb-node/src/arweave.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/auth/mod.rs b/crates/gitlawb-node/src/auth/mod.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/bootstrap.rs b/crates/gitlawb-node/src/bootstrap.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/cert.rs b/crates/gitlawb-node/src/cert.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/config.rs b/crates/gitlawb-node/src/config.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/db/mod.rs b/crates/gitlawb-node/src/db/mod.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/encrypted_pin.rs b/crates/gitlawb-node/src/encrypted_pin.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/error.rs b/crates/gitlawb-node/src/error.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/git/issues.rs b/crates/gitlawb-node/src/git/issues.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/git/mod.rs b/crates/gitlawb-node/src/git/mod.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/git/push_delta.rs b/crates/gitlawb-node/src/git/push_delta.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/git/repo_store.rs b/crates/gitlawb-node/src/git/repo_store.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/git/smart_http.rs b/crates/gitlawb-node/src/git/smart_http.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/git/store.rs b/crates/gitlawb-node/src/git/store.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/git/tigris.rs b/crates/gitlawb-node/src/git/tigris.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/git/visibility_pack.rs b/crates/gitlawb-node/src/git/visibility_pack.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/graphql/mod.rs b/crates/gitlawb-node/src/graphql/mod.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/graphql/mutation.rs b/crates/gitlawb-node/src/graphql/mutation.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/graphql/query.rs b/crates/gitlawb-node/src/graphql/query.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/graphql/subscription.rs b/crates/gitlawb-node/src/graphql/subscription.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/graphql/types.rs b/crates/gitlawb-node/src/graphql/types.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/icaptcha.rs b/crates/gitlawb-node/src/icaptcha.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/ipfs_pin.rs b/crates/gitlawb-node/src/ipfs_pin.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/main.rs b/crates/gitlawb-node/src/main.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/metrics.rs b/crates/gitlawb-node/src/metrics.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/operator.rs b/crates/gitlawb-node/src/operator.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/p2p/mod.rs b/crates/gitlawb-node/src/p2p/mod.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/pinata.rs b/crates/gitlawb-node/src/pinata.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/rate_limit.rs b/crates/gitlawb-node/src/rate_limit.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/server.rs b/crates/gitlawb-node/src/server.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/state.rs b/crates/gitlawb-node/src/state.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/sync.rs b/crates/gitlawb-node/src/sync.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/test_support.rs b/crates/gitlawb-node/src/test_support.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/visibility.rs b/crates/gitlawb-node/src/visibility.rs old mode 100644 new mode 100755 diff --git a/crates/gitlawb-node/src/webhooks.rs b/crates/gitlawb-node/src/webhooks.rs old mode 100644 new mode 100755 diff --git a/crates/gl/Cargo.toml b/crates/gl/Cargo.toml old mode 100644 new mode 100755 diff --git a/crates/gl/src/agent.rs b/crates/gl/src/agent.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/bounty.rs b/crates/gl/src/bounty.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/cert.rs b/crates/gl/src/cert.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/changelog.rs b/crates/gl/src/changelog.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/clone.rs b/crates/gl/src/clone.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/doctor.rs b/crates/gl/src/doctor.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/http.rs b/crates/gl/src/http.rs old mode 100644 new mode 100755 index 712af134..40cda462 --- a/crates/gl/src/http.rs +++ b/crates/gl/src/http.rs @@ -25,6 +25,7 @@ impl NodeClient { pub fn new(node_url: impl Into, keypair: Option) -> Self { let inner = reqwest::Client::builder() .timeout(std::time::Duration::from_secs(30)) + .redirect(reqwest::redirect::Policy::none()) // <-- disable all redirects .user_agent(format!("gl/{} gitlawb-cli", env!("CARGO_PKG_VERSION"))) .build() .expect("failed to build HTTP client"); @@ -599,4 +600,25 @@ mod tests { ic.challenge.assert(); ic.answer.assert(); } + + #[tokio::test] + async fn send_signed_does_not_follow_redirect() { + let mut server = Server::new_async().await; + let m = server + .mock("POST", "/api/register") + .with_status(307) + .with_header("Location", "http://evil.com/hijack") + .create_async() + .await; + + let client = NodeClient::new(server.url(), Some(test_keypair())); + let resp = client + .send_signed("POST", "/api/register", b"{}") + .await + .unwrap(); + + // We should get the 307 itself, not a follow-up request + assert_eq!(resp.status(), 307); + m.assert(); + } } diff --git a/crates/gl/src/identity.rs b/crates/gl/src/identity.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/init.rs b/crates/gl/src/init.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/ipfs_cmd.rs b/crates/gl/src/ipfs_cmd.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/issue.rs b/crates/gl/src/issue.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/main.rs b/crates/gl/src/main.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/mcp.rs b/crates/gl/src/mcp.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/mirror.rs b/crates/gl/src/mirror.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/name.rs b/crates/gl/src/name.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/node.rs b/crates/gl/src/node.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/node_stake.rs b/crates/gl/src/node_stake.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/peer.rs b/crates/gl/src/peer.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/pr.rs b/crates/gl/src/pr.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/profile.rs b/crates/gl/src/profile.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/protect.rs b/crates/gl/src/protect.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/quickstart.rs b/crates/gl/src/quickstart.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/register.rs b/crates/gl/src/register.rs old mode 100644 new mode 100755 index 2b166359..50e9ddad --- a/crates/gl/src/register.rs +++ b/crates/gl/src/register.rs @@ -17,6 +17,7 @@ pub struct RegisterArgs { #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")] pub node: String, + /// Pre-obtained iCaptcha proof token to send on the first request. #[arg(long, env = "GITLAWB_ICAPTCHA_PROOF")] pub icaptcha_proof: Option, @@ -53,10 +54,17 @@ pub async fn run(args: RegisterArgs) -> Result<()> { "model": args.model, }))?; - let resp = client - .post_with_proof("/api/register", &body, args.icaptcha_proof.as_deref()) - .await - .context("failed to connect to node")?; + let resp = if args.icaptcha_proof.is_some() { + client + .post_with_proof("/api/register", &body, args.icaptcha_proof.as_deref()) + .await + .context("failed to send registration request (check --icaptcha-proof value)")? + } else { + client + .post("/api/register", &body) + .await + .context("failed to connect to node")? + }; let status = resp.status(); let payload: Value = resp.json().await.context("invalid JSON response")?; diff --git a/crates/gl/src/repo.rs b/crates/gl/src/repo.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/star.rs b/crates/gl/src/star.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/status.rs b/crates/gl/src/status.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/sync.rs b/crates/gl/src/sync.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/task.rs b/crates/gl/src/task.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/ucan_cmd.rs b/crates/gl/src/ucan_cmd.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/visibility.rs b/crates/gl/src/visibility.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/webhook.rs b/crates/gl/src/webhook.rs old mode 100644 new mode 100755 diff --git a/crates/gl/src/whoami.rs b/crates/gl/src/whoami.rs old mode 100644 new mode 100755 diff --git a/crates/icaptcha-client/Cargo.toml b/crates/icaptcha-client/Cargo.toml old mode 100644 new mode 100755 diff --git a/crates/icaptcha-client/src/lib.rs b/crates/icaptcha-client/src/lib.rs old mode 100644 new mode 100755 diff --git a/crates/icaptcha-client/src/pow.rs b/crates/icaptcha-client/src/pow.rs old mode 100644 new mode 100755 diff --git a/crates/icaptcha-client/src/solvers.rs b/crates/icaptcha-client/src/solvers.rs old mode 100644 new mode 100755 diff --git a/docker-compose.yml b/docker-compose.yml old mode 100644 new mode 100755 diff --git a/docs/ECONOMICS.md b/docs/ECONOMICS.md old mode 100644 new mode 100755 diff --git a/docs/MAINTAINER-ROADMAP.md b/docs/MAINTAINER-ROADMAP.md old mode 100644 new mode 100755 diff --git a/docs/OSS-READINESS-AUDIT.md b/docs/OSS-READINESS-AUDIT.md old mode 100644 new mode 100755 diff --git a/docs/RUN-A-NODE.md b/docs/RUN-A-NODE.md old mode 100644 new mode 100755 diff --git a/infra/README.md b/infra/README.md old mode 100644 new mode 100755 diff --git a/infra/aws/.gitignore b/infra/aws/.gitignore old mode 100644 new mode 100755 diff --git a/infra/aws/.terraform.lock.hcl b/infra/aws/.terraform.lock.hcl old mode 100644 new mode 100755 diff --git a/infra/aws/README.md b/infra/aws/README.md old mode 100644 new mode 100755 diff --git a/infra/aws/compose.yaml.tftpl b/infra/aws/compose.yaml.tftpl old mode 100644 new mode 100755 diff --git a/infra/aws/main.tf b/infra/aws/main.tf old mode 100644 new mode 100755 diff --git a/infra/aws/monitoring.tf b/infra/aws/monitoring.tf old mode 100644 new mode 100755 diff --git a/infra/aws/outputs.tf b/infra/aws/outputs.tf old mode 100644 new mode 100755 diff --git a/infra/aws/rds.tf b/infra/aws/rds.tf old mode 100644 new mode 100755 diff --git a/infra/aws/terraform.tfvars.example b/infra/aws/terraform.tfvars.example old mode 100644 new mode 100755 diff --git a/infra/aws/user-data.sh.tftpl b/infra/aws/user-data.sh.tftpl old mode 100644 new mode 100755 diff --git a/infra/aws/variables.tf b/infra/aws/variables.tf old mode 100644 new mode 100755 diff --git a/infra/aws/versions.tf b/infra/aws/versions.tf old mode 100644 new mode 100755 diff --git a/infra/fly/fly.toml b/infra/fly/fly.toml old mode 100644 new mode 100755 diff --git a/install.ps1 b/install.ps1 old mode 100644 new mode 100755 diff --git a/install.sh b/install.sh old mode 100644 new mode 100755 diff --git a/macos-app/.gitignore b/macos-app/.gitignore old mode 100644 new mode 100755 diff --git a/macos-app/Package.swift b/macos-app/Package.swift old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/AppDelegate.swift b/macos-app/Sources/GitlawbNode/AppDelegate.swift old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/Config.swift b/macos-app/Sources/GitlawbNode/Config.swift old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/DockerCompose.swift b/macos-app/Sources/GitlawbNode/DockerCompose.swift old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/DockerDetector.swift b/macos-app/Sources/GitlawbNode/DockerDetector.swift old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/Info.plist b/macos-app/Sources/GitlawbNode/Info.plist old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/Resources/AppIcon.icns b/macos-app/Sources/GitlawbNode/Resources/AppIcon.icns old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/Resources/MenuBarIcon.png b/macos-app/Sources/GitlawbNode/Resources/MenuBarIcon.png old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/Resources/MenuBarIcon@2x.png b/macos-app/Sources/GitlawbNode/Resources/MenuBarIcon@2x.png old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/Resources/docker-compose.yml b/macos-app/Sources/GitlawbNode/Resources/docker-compose.yml old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/SettingsWindow.swift b/macos-app/Sources/GitlawbNode/SettingsWindow.swift old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/StatusBarController.swift b/macos-app/Sources/GitlawbNode/StatusBarController.swift old mode 100644 new mode 100755 diff --git a/macos-app/Sources/GitlawbNode/main.swift b/macos-app/Sources/GitlawbNode/main.swift old mode 100644 new mode 100755 diff --git a/npm/.gitignore b/npm/.gitignore old mode 100644 new mode 100755 diff --git a/npm/README.md b/npm/README.md old mode 100644 new mode 100755 diff --git a/npm/packages/gl-darwin-arm64/package.json b/npm/packages/gl-darwin-arm64/package.json old mode 100644 new mode 100755 diff --git a/npm/packages/gl-darwin-x64/package.json b/npm/packages/gl-darwin-x64/package.json old mode 100644 new mode 100755 diff --git a/npm/packages/gl-linux-arm64/package.json b/npm/packages/gl-linux-arm64/package.json old mode 100644 new mode 100755 diff --git a/npm/packages/gl-linux-x64/package.json b/npm/packages/gl-linux-x64/package.json old mode 100644 new mode 100755 diff --git a/npm/packages/gl/README.md b/npm/packages/gl/README.md old mode 100644 new mode 100755 diff --git a/npm/packages/gl/bin/.gitkeep b/npm/packages/gl/bin/.gitkeep old mode 100644 new mode 100755 diff --git a/npm/packages/gl/install.js b/npm/packages/gl/install.js old mode 100644 new mode 100755 diff --git a/npm/packages/gl/package.json b/npm/packages/gl/package.json old mode 100644 new mode 100755 diff --git a/release-please-config.json b/release-please-config.json old mode 100644 new mode 100755 From 4652acfe2636ca2f27c93248a048eec36fe3fdfc Mon Sep 17 00:00:00 2001 From: jilt Date: Thu, 16 Jul 2026 22:31:29 +0200 Subject: [PATCH 3/3] gl: disable redirects for signed/proof requests, add end-to-end test --- crates/gl/src/http.rs | 22 ---------------------- crates/gl/src/register.rs | 16 ++++------------ 2 files changed, 4 insertions(+), 34 deletions(-) diff --git a/crates/gl/src/http.rs b/crates/gl/src/http.rs index 40cda462..712af134 100755 --- a/crates/gl/src/http.rs +++ b/crates/gl/src/http.rs @@ -25,7 +25,6 @@ impl NodeClient { pub fn new(node_url: impl Into, keypair: Option) -> Self { let inner = reqwest::Client::builder() .timeout(std::time::Duration::from_secs(30)) - .redirect(reqwest::redirect::Policy::none()) // <-- disable all redirects .user_agent(format!("gl/{} gitlawb-cli", env!("CARGO_PKG_VERSION"))) .build() .expect("failed to build HTTP client"); @@ -600,25 +599,4 @@ mod tests { ic.challenge.assert(); ic.answer.assert(); } - - #[tokio::test] - async fn send_signed_does_not_follow_redirect() { - let mut server = Server::new_async().await; - let m = server - .mock("POST", "/api/register") - .with_status(307) - .with_header("Location", "http://evil.com/hijack") - .create_async() - .await; - - let client = NodeClient::new(server.url(), Some(test_keypair())); - let resp = client - .send_signed("POST", "/api/register", b"{}") - .await - .unwrap(); - - // We should get the 307 itself, not a follow-up request - assert_eq!(resp.status(), 307); - m.assert(); - } } diff --git a/crates/gl/src/register.rs b/crates/gl/src/register.rs index 50e9ddad..2b166359 100755 --- a/crates/gl/src/register.rs +++ b/crates/gl/src/register.rs @@ -17,7 +17,6 @@ pub struct RegisterArgs { #[arg(long, default_value = "https://node.gitlawb.com", env = "GITLAWB_NODE")] pub node: String, - /// Pre-obtained iCaptcha proof token to send on the first request. #[arg(long, env = "GITLAWB_ICAPTCHA_PROOF")] pub icaptcha_proof: Option, @@ -54,17 +53,10 @@ pub async fn run(args: RegisterArgs) -> Result<()> { "model": args.model, }))?; - let resp = if args.icaptcha_proof.is_some() { - client - .post_with_proof("/api/register", &body, args.icaptcha_proof.as_deref()) - .await - .context("failed to send registration request (check --icaptcha-proof value)")? - } else { - client - .post("/api/register", &body) - .await - .context("failed to connect to node")? - }; + let resp = client + .post_with_proof("/api/register", &body, args.icaptcha_proof.as_deref()) + .await + .context("failed to connect to node")?; let status = resp.status(); let payload: Value = resp.json().await.context("invalid JSON response")?;