[codespell]

check-hidden = true

[[package]]

name = "cypheraddr"

version = "0.4.0"

dependencies = [

 "amplify",

 "base32",

[[package]]

name = "cyphergraphy"

version = "0.3.0"

dependencies = [

 "amplify",

 "ec25519",

[[package]]

name = "cyphernet"

version = "0.5.2"

dependencies = [

 "cypheraddr",

 "cyphergraphy",

[[package]]

name = "noise-framework"

version = "0.4.0"

dependencies = [

 "amplify",

 "chacha20poly1305",

 "crossbeam-channel",

 "cyphernet",

 "fastrand",

 "lexopt",

 "log",

 "mio 1.0.4",

[[package]]

name = "socks5-client"

version = "0.4.1"

dependencies = [

 "amplify",

 "cypheraddr",

fastrand = { version = "2.0.0", default-features = false }

git2 = { version = "0.19.0", default-features = false, features = ["vendored-libgit2"] }

gix-hash = { version = "0.22.1", default-features = false, features = ["sha1"] }

human-panic = "2.0.6"

itertools = "0.14"

lexopt = "0.3.0"

inherits = "release"

debug = true

incremental = false

        // x.y.z, with efe10f95be being a unique prefix of the OID of

        // `HEAD`, and the working directory was dirty.

        // If this is a build pointing to a commit that has release tag, this

        // If all fails, we just use `hash`, which, in the worst case is

        // still "unknown" (see above) but in most cases will just be

        // the short OID of `HEAD`.

use std::path::{Path, PathBuf};

use std::str::FromStr;

use std::sync;

use snapbox::cmd::{Command, OutputAssert};

use snapbox::{Assert, Substitutions};

use thiserror::Error;

/// Used to ensure the build task is only run once.

static BUILD: sync::Once = sync::Once::new();

                    vec![]

                };

                let command = Command::new(cmd.clone())

                    .env_clear()

    }

}

/// starting with the current working directory.

fn bins(cwd: PathBuf) -> Vec<PathBuf> {

    if let Ok(manifest_dir) = env::var("CARGO_MANIFEST_DIR") {

        let profile = cfg!(debug_assertions)

            .then_some("debug")

        )

    }

    #[cfg(windows)]

    {

        // Radicle CLI tests rely on various Unix coreutils

        bins.push(PathBuf::from(r#"C:\Program Files\Git\usr\bin"#));

    }

    bins

}

name = "rad"

path = "src/main.rs"

[dependencies]

anyhow = "1"

chrono = { workspace = true, features = ["clock", "std"] }

    let host = match address.host() {

        HostName::Ip(ip) => ip.to_string(),

        HostName::Dns(dns) => dns.clone(),

        HostName::Tor(onion) => {

            let onion = onion.to_string();

            let start = onion.chars().take(8).collect::<String>();

                .collect::<String>();

            format!("{start}…{end}")

        }

        _ => unreachable!(),

    };

        ]),

    ),

)]

#[cfg(feature = "cyphernet")]

impl cyphernet::display::MultiDisplay<cyphernet::display::Encoding> for PublicKey {

#[cfg(feature = "ssh")]

impl From<PublicKey> for ssh_key::PublicKey {

    fn from(key: PublicKey) -> Self {

    }

}

    const COMPRESSED_LEN: usize = 32;

    const CURVE_NAME: &'static str = "Edwards25519";

    fn base_point() -> Self {

        unimplemented!()

    }

    fn to_pk_compressed(&self) -> Self::Compressed {

    }

    fn from_pk_compressed(pk: Self::Compressed) -> Result<Self, cyphernet::EcPkInvalid> {

    }

    fn from_pk_compressed_slice(slice: &[u8]) -> Result<Self, cyphernet::EcPkInvalid> {

        ed25519::PublicKey::from_slice(slice)

            .map_err(|_| cyphernet::EcPkInvalid::default())

    }

}

    /// Elliptic-curve Diffie-Hellman.

    pub fn ecdh(&self, pk: &PublicKey) -> Result<[u8; 32], ed25519::Error> {

        let scalar = self.seed().scalar();

        Ok(edwards25519::ge_scalarmult(&scalar, &ge).to_bytes())

    }

impl From<ed25519::PublicKey> for PublicKey {

    fn from(other: ed25519::PublicKey) -> Self {

    }

}

impl From<[u8; 32]> for PublicKey {

    fn from(other: [u8; 32]) -> Self {

    }

}

    type Error = ed25519::Error;

    fn try_from(other: &[u8]) -> Result<Self, Self::Error> {

    }

}

    pub fn to_human(&self) -> String {

        let mut buf = [0; 2 + ed25519::PublicKey::BYTES];

        buf[..2].copy_from_slice(&Self::MULTICODEC_TYPE);

        multibase::encode(multibase::Base::Base58Btc, buf)

    }

        if let Some(bytes) = bytes.strip_prefix(&Self::MULTICODEC_TYPE) {

            let key = ed25519::PublicKey::from_slice(bytes)?;

        } else {

            Err(PublicKeyError::Multicodec(Self::MULTICODEC_TYPE))

        }

}

impl Deref for PublicKey {

    fn deref(&self) -> &Self::Target {

        &self.0

    /// Convert to OpenSSH standard PEM format.

    pub fn to_pem(&self) -> Result<String, ExtendedSignatureError> {

        ssh_key::SshSig::new(

            String::from("radicle"),

            ssh_key::HashAlg::Sha256,

            ssh_key::Signature::new(ssh_key::Algorithm::Ed25519, **self.sig)?,

            .ok_or_else(|| MemorySignerError::NotFound(public_path.to_path_buf()))?;

        secret

            .map_err(|_| MemorySignerError::KeyMismatch {

                secret: keystore.secret_key_path().to_path_buf(),

                public: public_path.to_path_buf(),

    /// the public key from the secret key.

    pub fn from_secret(secret: Zeroizing<SecretKey>) -> Self {

        Self {

            secret,

        }

    }

        let seed = Seed::new(bytes);

        let keypair = KeyPair::from_seed(seed);

    }

}

rust-version.workspace = true

[features]

systemd = ["dep:radicle-systemd"]

test = ["radicle/test", "radicle-crypto/test", "radicle-crypto/cyphernet", "radicle-protocol/test", "qcheck", "snapbox"]

[dependencies]

backtrace = { version = "0.3.75", optional = true }

chrono = { workspace = true, features = ["clock"] }

colored = { workspace = true }

crossbeam-channel = { workspace = true }

fastrand = { workspace = true }

lexopt = { workspace = true }

log = { workspace = true, features = ["kv", "std"] }

mio = { version = "1", features = ["net", "os-poll"] }

        home: &Home,

        secret_key: &impl std::ops::Deref<Target = crypto::SecretKey>,

    ) -> Result<(), Error> {

        let mut file = std::fs::OpenOptions::new()

            .create_new(true)

            .write(true)

        &self,

        secret_key: &impl std::ops::Deref<Target = crypto::SecretKey>,

    ) -> FingerprintVerification {

        if crypto::ssh::fmt::fingerprint(&public_key) == self.0 {

            FingerprintVerification::Match

        } else {

/// Maximum amount of time to wait for I/O.

const WAIT_TIMEOUT: Duration = Duration::from_secs(SECONDS_IN_AN_HOUR);

/// A resource which can be managed by the reactor.

pub trait EventHandler {

    /// The type of reactions which this resource may generate upon receiving

    fn run(mut self) {

        loop {

            let timeout = self

                .timeouts

                .unwrap_or(WAIT_TIMEOUT);

            self.register_interests()

            let mut events = Events::with_capacity(1024);

            let res = self.poll.poll(&mut events, Some(timeout));

            let tick = Instant::now();

            if let Err(err) = res {

                log::warn!(target: "reactor", "Failure during polling: {err}");

                self.service.handle_error(Error::Poll(err));

            }

            log::trace!(target: "reactor", "Duration between tick and events handled: {:?}", Instant::now().duration_since(tick));

            // Process the commands only if we awoken by the waker.

                loop {

                    match self.receiver.try_recv() {

                        Err(TryRecvError::Empty) => break,

                }

            }

            self.handle_actions(tick);

        }

    }

    collections::{BTreeMap, BTreeSet},

    fs, io, iter, net, process, thread, time,

    time::Duration,

};

use crossbeam_channel as chan;

            .connect(remote.id, remote.addr.into(), ConnectOptions::default())

            .ok();

        self

    }

        }

    }

    // Then, while there are nodes remaining to converge, check each node to see if

    // its routing table has all routes. If so, remove it from the remaining nodes.

    while !remaining.is_empty() {

            true

        });

        thread::sleep(Duration::from_millis(100));

    }

    all_routes

}

use radicle::collections::{RandomMap, RandomSet};

use radicle::crypto;

use radicle::node::config::AddressConfig;

use radicle::node::Link;

use radicle::node::NodeId;

    signer: G,

    config: &radicle::node::Config,

) -> io::Result<WireSession<G>> {

    // Determine what address to establish a TCP connection with, given the remote peer

    // address and our node configuration.

    let inet_addr: NetAddr<InetHost> = match (&remote_addr.host, config.proxy) {

        (HostName::Dns(_), Some(proxy)) => proxy.into(),

        (HostName::Dns(dns), None) => NetAddr::new(InetHost::Dns(dns.clone()), remote_addr.port),

        // For onion addresses, handle with care.

        _ => {

            return Err(io::Error::new(

                io::ErrorKind::Unsupported,

                let timeout = channels.timeout();

                let (mut stream_r, stream_w) = channels.split();

                        return FetchResult::Responder {

                            rid: None,

                            result: Err(UploadError::PacketLine(e)),

                        }

                    }

                };

                log::debug!(target: "worker", "Spawning upload-pack process for {} on stream {stream}..", header.repo);

                if let Err(e) = self.is_authorized(remote, header.repo) {

    remote: NodeId,

    storage: &Storage,

    emitter: &Emitter<Event>,

    mut recv: R,

    send: W,

    timeout: Duration,

    }

}

    }

                    }

                }

            })

    }

}

rust-version.workspace = true

[features]

test = ["radicle/test", "radicle-crypto/test", "radicle-crypto/cyphernet", "qcheck"]

[dependencies]

bloomy = "1.2"

bytes = { workspace = true }

crossbeam-channel = { workspace = true }

fastrand = { workspace = true }

log = { workspace = true, features = ["std"] }

nonempty = { workspace = true, features = ["serialize"] }

use radicle::node::address;

use radicle::node::address::Store as _;

use radicle::node::address::{AddressBook, AddressType, KnownAddress};

use radicle::node::config::{PeerConfig, RateLimit};

use radicle::node::device::Device;

use radicle::node::refs::Store as _;

    G: crypto::signature::Signer<crypto::Signature>,

{

    pub fn new(

        db: Stores<D>,

        storage: S,

        policies: policy::Config<Write>,

                .with_max_capacity(fetcher::MaxQueueSize::default());

            FetcherService::new(config)

        };

        Self {

            config,

            storage,

                // from a new repository being initialized.

                self.seed_discovered(message.rid, *announcer, message.timestamp);

                    debug!(

                        target: "service",

                    );

                    match self.db.seeds_mut().synced(

                        &message.rid,

    ///

    /// If the [`Address`] is an `.onion` address and the service supports onion

    /// routing then this will return `true`.

    fn is_supported_address(&self, address: &Address) -> bool {

        match AddressType::from(address) {

            // Only consider onion addresses if configured.

            AddressType::Dns | AddressType::Ipv4 | AddressType::Ipv6 => true,

        }

    }

    }

    #[test]

        let mut r = RateLimiter::default();

        let t = (3, 0.2); // Three tokens burst. One token every 5 seconds.

        let a = HostName::Dns(String::from("seed.radicle.example.com"));

    #[test]

    #[rustfmt::skip]

        let t = (1, 1.0); // One token per second. One token burst.

        let n = arbitrary::gen::<NodeId>(1);

        let n = Some(&n);

    #[test]

    #[rustfmt::skip]

        let t1 = (1, 1.0); // One token per second. One token burst.

        let t2 = (2, 2.0); // Two tokens per second. Two token burst.

        let n = arbitrary::gen::<NodeId>(1);

use bytes::{Buf, BufMut};

use cypheraddr::tor;

use radicle::crypto::{PublicKey, Signature, Unverified};

    Alias(#[from] node::AliasError),

    #[error("invalid user agent string: {err}")]

    InvalidUserAgent { err: String },

    #[error("invalid onion address: {0}")]

    OnionAddr(#[from] tor::OnionAddrDecodeError),

    #[error("invalid timestamp: {actual_millis} millis")]

    Timestamp { actual_millis: u64 },

impl Encode for PublicKey {

    fn encode(&self, buf: &mut impl BufMut) {

    }

}

    }

}

impl Encode for cypheraddr::tor::OnionAddrV3 {

    fn encode(&self, buf: &mut impl BufMut) {

        self.into_raw_bytes().encode(buf)

    }

}

impl Encode for UserAgent {

    fn encode(&self, buf: &mut impl BufMut) {

        self.as_ref().encode(buf)

    }

}

impl Decode for tor::OnionAddrV3 {

    fn decode(buf: &mut impl Buf) -> Result<Self, Error> {

        let bytes: [u8; tor::ONION_V3_RAW_LEN] = Decode::decode(buf)?;

    }

}

impl Encode for Timestamp {

    fn encode(&self, buf: &mut impl BufMut) {

        self.deref().encode(buf)

use bytes::Buf;

use bytes::BufMut;

use radicle::crypto::Signature;

use radicle::git::Oid;

use radicle::identity::RepoId;

    Ipv4 = 1,

    Ipv6 = 2,

    Dns = 3,

    Onion = 4,

}

impl From<AddressType> for u8 {

            HostName::Ip(net::IpAddr::V4(_)) => AddressType::Ipv4,

            HostName::Ip(net::IpAddr::V6(_)) => AddressType::Ipv6,

            HostName::Dns(_) => AddressType::Dns,

            HostName::Tor(_) => AddressType::Onion,

            _ => todo!(), // FIXME(cloudhead): Maxim will remove `non-exhaustive`

        }

    }

            1 => Ok(AddressType::Ipv4),

            2 => Ok(AddressType::Ipv6),

            3 => Ok(AddressType::Dns),

            4 => Ok(AddressType::Onion),

            _ => Err(other),

        }

    }

impl wire::Encode for Address {

    fn encode(&self, buf: &mut impl BufMut) {

            HostName::Ip(net::IpAddr::V4(ip)) => {

                u8::from(AddressType::Ipv4).encode(buf);

                ip.octets().encode(buf);

                u8::from(AddressType::Dns).encode(buf);

                dns.encode(buf);

            }

            HostName::Tor(addr) => {

                u8::from(AddressType::Onion).encode(buf);

                addr.encode(buf);

            }

            _ => {

                unimplemented!(

                    "Encoding not defined for addresses of the same type as the following: {:?}",

                HostName::Dns(dns)

            }

            Ok(AddressType::Onion) => {

                let onion: tor::OnionAddrV3 = wire::Decode::decode(buf)?;

                HostName::Tor(onion)

            }

            Err(other) => return Err(wire::Invalid::AddressType { actual: other }.into()),

        };

        let port = u16::decode(buf)?;

            #[derive(JsonSchema)]

            #[schemars(untagged)]

            enum CommandResult {

                Nid(radicle::node::NodeId),

                Config(Box<radicle::node::Config>),

impl Error {

    pub fn is_not_running(&self) -> bool {

    }

}

    /// May panic if the argument is greater than [`u32::MAX`].

    /// This is a convenience method, to spare callers casting or converting

    /// [`usize`] to [`u32`]. If callers end up in a situation where they

    /// like to push does not fit 32 bits, then the implementation will not

    /// comply with the SSH format anyway.

    fn extend_usize(&mut self, u: usize) {

[features]

default = []

test = ["tempfile", "qcheck", "radicle-crypto/test", "radicle-cob/test"]

logger = ["colored", "chrono"]

qcheck = [

  "radicle-localtime/schemars",

  "dep:schemars"

]

[dependencies]

amplify = { workspace = true, features = ["std"] }

chrono = { workspace = true, features = ["clock"], optional = true }

colored = { workspace = true, optional = true }

crossbeam-channel = { workspace = true }

dunce = { workspace = true }

fast-glob = { version = "0.3.2" }

fastrand = { workspace = true, features = ["std"] }

    feature = "schemars",

    derive(schemars::JsonSchema),

    schemars(description = "\

")

)]

pub struct Address(

        regex(pattern = r"^.+:((6553[0-5])|(655[0-2][0-9])|(65[0-4][0-9]{2})|(6[0-4][0-9]{3})|([1-5][0-9]{4})|([0-5]{0,5})|([0-9]{1,4}))$"),

        extend("examples" = [

            "xmrhfasfg5suueegrnc4gsgyi2tyclcy5oz7f5drnrodmdtob6t2ioyd.onion:8776",

            "seed.example.com:8776",

            "192.0.2.0:31337",

        ]),

    }

    /// Returns `true` if the [`HostName`] is a Tor onion address.

    pub fn is_onion(&self) -> bool {

        match self.0.host {

            HostName::Tor(_) => true,

        }

    }

    /// Return the port number of the [`Address`].

    pub fn port(&self) -> u16 {

        self.0.port

    Ipv4 = 1,

    Ipv6 = 2,

    Dns = 3,

    Onion = 4,

}

impl From<AddressType> for u8 {

            HostName::Ip(net::IpAddr::V4(_)) => AddressType::Ipv4,

            HostName::Ip(net::IpAddr::V6(_)) => AddressType::Ipv6,

            HostName::Dns(_) => AddressType::Dns,

            HostName::Tor(_) => AddressType::Onion,

            _ => todo!(), // FIXME(cloudhead): Maxim will remove `non-exhaustive`

        }

    }

            1 => Ok(AddressType::Ipv4),

            2 => Ok(AddressType::Ipv6),

            3 => Ok(AddressType::Dns),

            4 => Ok(AddressType::Onion),

            _ => Err(other),

        }

    }

                "ipv4" => Ok(AddressType::Ipv4),

                "ipv6" => Ok(AddressType::Ipv6),

                "dns" => Ok(AddressType::Dns),

                "onion" => Ok(AddressType::Onion),

                _ => Err(err),

            },

            _ => Err(err),

            Self::Ipv4 => "ipv4".bind(stmt, i),

            Self::Ipv6 => "ipv6".bind(stmt, i),

            Self::Dns => "dns".bind(stmt, i),

            Self::Onion => "onion".bind(stmt, i),

        }

    }

}

pub mod seeds {

    use std::{str::FromStr, sync::LazyLock};

    use super::{ConnectAddress, NodeId, PeerAddr};

            NodeId::from_str("z6MkrLMMsiPWUcNPHcRajuMi9mDfYckSoJyPwwnknocNYPm7").unwrap(),

            vec![

                HostName::Dns("iris.radicle.xyz".to_owned()),

                #[allow(clippy::unwrap_used)] // Value is manually verified.

                OnionAddrV3::from_str(

                    "irisradizskwweumpydlj4oammoshkxxjur3ztcmo7cou5emc6s5lfid.onion",

            NodeId::from_str("z6Mkmqogy2qEM2ummccUthFEaaHvyYmYBYh3dbe9W4ebScxo").unwrap(),

            vec![

                HostName::Dns("rosa.radicle.xyz".to_owned()),

                #[allow(clippy::unwrap_used)] // Value is manually verified.

                OnionAddrV3::from_str(

                    "rosarad5bxgdlgjnzzjygnsxrwxmoaj4vn7xinlstwglxvyt64jlnhyd.onion",

    schemars(description = "\

    A node address to connect to. Format: An Ed25519 public key in multibase encoding, \

    followed by the symbol '@', followed by an IP address, or a DNS name, or a Tor onion \

")

)]

pub struct ConnectAddress(

        extend("examples" = [

            "z6MkrLMMsiPWUcNPHcRajuMi9mDfYckSoJyPwwnknocNYPm7@rosa.radicle.xyz:8776",

            "z6MkvUJtYD9dHDJfpevWRT98mzDDpdAtmUjwyDSkyqksUr7C@xmrhfasfg5suueegrnc4gsgyi2tyclcy5oz7f5drnrodmdtob6t2ioyd.onion:8776",

            "z6MknSLrJoTcukLrE435hVNQT4JUhbvWLX4kUzqkEStBU8Vi@seed.example.com:8776",

            "z6MkkfM3tPXNPrPevKr3uSiQtHPuwnNhu2yUVjgd2jXVsVz5@192.0.2.0:31337",

        ]),

}

/// Proxy configuration.

#[serde(rename_all = "camelCase", tag = "mode")]

#[cfg_attr(feature = "schemars", derive(schemars::JsonSchema))]

pub enum AddressConfig {

    /// Proxy connections to this address type.

    Proxy {

    /// Forward address to the next layer. Either this is the global proxy,

    /// or the operating system, via DNS.

    Forward,

}

/// Default seeding policy. Applies when no repository policies for the given repo are found.

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub proxy: Option<net::SocketAddr>,

    /// Onion address config.

    /// Peer-to-peer network.

    #[serde(default)]

    pub network: Network,

    /// the environment variable `RAD_PASSPHRASE`.

    #[serde(default, skip_serializing_if = "Option::is_none")]

    pub secret: Option<std::path::PathBuf>,

}

impl Config {

            external_addresses: vec![],

            network: Network::default(),

            proxy: None,

            relay: Relay::default(),

            limits: Limits::default(),

            workers: Workers::default(),

            seeding_policy: DefaultSeedingPolicy::default(),

            extra: json::Map::default(),

            secret: None,

        }

    }

use crypto::test::signer::MockSigner;

use crypto::{PublicKey, Unverified};

use qcheck::Arbitrary;

use crate::collections::RandomMap;

                    .unwrap()

                    .to_string(),

            ),

            AddressType::Onion => {

                let pk = PublicKey::arbitrary(g);

                let addr = OnionAddrV3::from(

                );

                cyphernet::addr::HostName::Tor(addr)

            }

        };

        Address::from(cyphernet::addr::NetAddr {

              hooks =

                {

                  alejandra.enable = true;

                  codespell = {

                    enable = true;

                    entry = "${lib.getExe pkgs.codespell} -w";