feat: expose certificate chain and versioned WASM assets #101

Merged

ada merged 2 commits from feat/v260-public-assets into master

2026-10-03 07:59:44 +00:00

ada commented

2026-10-03 07:11:47 +00:00

Collaborator

Problem

Upstream v2.6.0 browser clients need /sdk/certificate-chain and version-pinned WASM assets. The official GitHub release CDN redirects return application/octet-stream without CORS, so an installer redirect is not a functional same-origin browser asset route.

Change

Serve parsed public certificate blocks from the TLS material loaded by the listener, never raw PEM/private key bytes.
Support js-wasm and wasm-exec slugs, strict version mismatch/duplicate rejection, pinned upstream core mapping and unversioned legacy fallback.
Bundle both upstream v2.6.0 browser assets in the image after SHA-256 validation against official .sha256 files. Serve from the relay origin with WASM/JS MIME, checksum/ETag and immutable cache for exact-version requests. Package version mismatch disables bundled assets; source builds without assets retain upstream-style redirect fallback, which is not counted as a passing browser fetch.

Validation

cargo fmt --all --check
cargo test --locked -p portal-relay: 198 passed, 3 ignored (new positive/negative asset and cert tests)
cargo clippy --locked -p portal-relay --all-targets -- -D warnings
git diff --check origin/master...HEAD
Downloaded official v2.6.0 assets checked against upstream published .sha256: WASM 9a66518933aed730cf3e58d695facad2de90ee86a5847ab591b40cc73b3a386a, JS 0c949f4996f9a89698e4b5c586de32249c3b69b7baadb64d220073cc04acba14.
Local Docker CLI unavailable: Dockerfile build and image smoke must pass PR CI. Real browser fetch requires v2.6.0 metadata retarget and E2E, still outstanding.

Prerequisite slice only, not complete v2.6.0 compatibility: WebSocket/yamux reverse carrier, metadata/client retarget, official interop, public Axis B and production release remain separate. No tag, image publication or deployment claimed.

## Problem Upstream v2.6.0 browser clients need `/sdk/certificate-chain` and version-pinned WASM assets. The official GitHub release CDN redirects return `application/octet-stream` without CORS, so an installer redirect is **not** a functional same-origin browser asset route. ## Change - Serve parsed public certificate blocks from the TLS material loaded by the listener, never raw PEM/private key bytes. - Support `js-wasm` and `wasm-exec` slugs, strict version mismatch/duplicate rejection, pinned upstream core mapping and unversioned legacy fallback. - Bundle both upstream v2.6.0 browser assets in the image after SHA-256 validation against official `.sha256` files. Serve from the relay origin with WASM/JS MIME, checksum/ETag and immutable cache for exact-version requests. Package version mismatch disables bundled assets; source builds without assets retain upstream-style redirect fallback, which is **not** counted as a passing browser fetch. ## Validation - `cargo fmt --all --check` - `cargo test --locked -p portal-relay`: 198 passed, 3 ignored (new positive/negative asset and cert tests) - `cargo clippy --locked -p portal-relay --all-targets -- -D warnings` - `git diff --check origin/master...HEAD` - Downloaded official v2.6.0 assets checked against upstream published `.sha256`: WASM `9a66518933aed730cf3e58d695facad2de90ee86a5847ab591b40cc73b3a386a`, JS `0c949f4996f9a89698e4b5c586de32249c3b69b7baadb64d220073cc04acba14`. - Local Docker CLI unavailable: Dockerfile build and image smoke must pass PR CI. Real browser fetch requires v2.6.0 metadata retarget and E2E, still outstanding. Prerequisite slice only, **not complete v2.6.0 compatibility**: WebSocket/yamux reverse carrier, metadata/client retarget, official interop, public Axis B and production release remain separate. No tag, image publication or deployment claimed.

ada added 1 commit

2026-10-03 07:11:48 +00:00