namecoin · robertmin1 · Mar 17, 2026
diff --git a/.cirrus.yml b/.cirrus.yml
@@ -125,7 +125,8 @@ task:
   install_script:
     - apt-get update
     # bind9-dnsutils contains dig
-    - apt-get install -y dnssec-trigger bind9-dnsutils xxd
+    - apt-get install -y dnssec-trigger bind9-dnsutils libnss3-tools xxd
+    - if [ "$CI_DISTRO" = "ubuntu" ]; then curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list && apt-get update && apt-get install -y google-chrome-stable; else apt-get install -y chromium; fi
     # Namecoin Core
     # Temporarily downgrade Namecoin Core until deterministic salts with descriptor wallets are fixed.
     #- BITCOIND_URL=$(curl https://www.namecoin.org/download/ | grep x86_64-linux-gnu.tar.gz | grep -v 0.13.99 | grep --only-matching https://.*.tar.gz)
@@ -162,7 +163,7 @@ task:
     - chown encaya:encaya testdata/*.pem
     # Curiously, relative paths don't work here, they cause the .pem files to
     # not be detected.  Maybe file a bug with Hugo?
-    - encaya -conf "$(pwd)/testdata/encaya.conf"
+    - encaya -conf "$(pwd)/testdata/encaya.conf" -encaya.namecoinrpcaddress 127.0.0.1:18554 -encaya.namecoinrpcusername doggman -encaya.namecoinrpcpassword donkey
   regtest_script:
     - sleep 15s
     - testdata/regtest.sh

diff --git a/server/server.go b/server/server.go
@@ -48,12 +48,12 @@
 	cfg Config

 	rootCert          []byte
 	rootPriv          interface{}
 	rootCertPem       []byte
 	rootCertPemString string
 	rootPrivPem       []byte
 	tldCert           []byte
 	tldPriv           interface{}
 	tldCertPem        []byte
 	tldCertPemString  string

@@ -228,8 +228,8 @@

 func (s *Server) doRunListenerTCP() {
 	tcpSrv := &http.Server{
 		ReadTimeout:  5 * time.Second,
 		WriteTimeout: 10 * time.Second,
 	}

 	err := tcpSrv.Serve(s.tcpListener)
@@ -238,8 +238,8 @@

 func (s *Server) doRunListenerTLS() {
 	tlsSrv := &http.Server{
 		ReadTimeout:  5 * time.Second,
 		WriteTimeout: 10 * time.Second,
 	}

 	err := tlsSrv.ServeTLS(s.tlsListener, s.cfg.ListenChain, s.cfg.ListenKey)
@@ -251,14 +251,14 @@
 	results := [][]byte{}

 	s.domainCertCacheMutex.RLock()
 	for _, cert := range s.domainCertCache[commonName] {
 		if time.Until(cert.expiration) > safetlsa.ValidityShortTerm()/2 {
 			needRefresh = false
 		}

 		results = append(results, cert.certDer)
 	}
 	s.domainCertCacheMutex.RUnlock()

 	return results, needRefresh
 }
@@ -297,7 +297,7 @@
 	results := [][]byte{}

 	s.negativeCertCacheMutex.RLock()
 	for _, cert := range s.negativeCertCache[commonName] {
 		// Negative certs don't expire
 		needRefresh = false

@@ -306,7 +306,7 @@
 		// We only need 1 negative cert
 		break
 	}
 	s.negativeCertCacheMutex.RUnlock()

 	return results, needRefresh
 }
@@ -331,7 +331,7 @@
 	results := [][]byte{}

 	s.originalCertCacheMutex.RLock()
 	for _, cert := range s.originalCertCache[serial] {
 		// Original certs don't expire
 		needRefresh = false

@@ -340,7 +340,7 @@
 		// We only need 1 original cert
 		break
 	}
 	s.originalCertCacheMutex.RUnlock()

 	return results, needRefresh
 }
@@ -403,7 +403,7 @@
 	if err != nil {
 		return nil, err
 	}
 	if !ok {
 		return nil, nil
 	}

@@ -420,15 +420,15 @@

 	return &dns.TLSA{
 		Hdr: dns.RR_Header{Name: "", Rrtype: dns.TypeTLSA, Class: dns.ClassINET,
 			Ttl: 600},
 		Usage:        2,
 		Selector:     1,
 		MatchingType: 0,
 		Certificate:  strings.ToUpper(pubHex),
 	}, nil
 }

 func (s *Server) lookupDNS(req *http.Request, domain string) (tlsa *dns.TLSA, err error) {
 	log.Debugf("querying for pubkey via DNS: %s", domain)

 	qparams := qlib.DefaultParams()
@@ -456,24 +456,24 @@

 	if result.ResponseMsg == nil {
 		// A DNS error occurred (nil response).
 		return nil, fmt.Errorf("qlib error: nil response")
 	}
 
 	dnsResponse := result.ResponseMsg
-	if dnsResponse.MsgHdr.Rcode != dns.RcodeSuccess && dnsResponse.MsgHdr.Rcode != dns.RcodeNameError {
+	if dnsResponse.Rcode != dns.RcodeSuccess && dnsResponse.Rcode != dns.RcodeNameError {
 		// A DNS error occurred (return code wasn't Success or NXDOMAIN).
 		return nil, fmt.Errorf("qlib error: return code not Success or NXDOMAIN")
 	}
 
-	if dnsResponse.MsgHdr.Rcode == dns.RcodeNameError {
+	if dnsResponse.Rcode == dns.RcodeNameError {
 		// Wildcard subdomain doesn't exist.
 		// That means the domain doesn't use Namecoin-form DANE.
 		// Return no cert.
 		log.Debugf("wildcard subdomain doesn't exist: %s", domain)
 		return nil, nil
 	}
 
-	if !dnsResponse.MsgHdr.AuthenticatedData && !dnsResponse.MsgHdr.Authoritative {
+	if !dnsResponse.AuthenticatedData && !dnsResponse.Authoritative {
 		// For security reasons, we only trust records that are
 		// authenticated (e.g. server is Unbound and has verified
 		// DNSSEC sigs) or authoritative (e.g. server is ncdns and is
@@ -511,7 +511,7 @@

 		// CA not in user's trust store; public key; unspecified hash
 		if tlsa.Usage == 2 && tlsa.Selector == 1 {
 			if tlsa.MatchingType == 0 { // Not hashed
 				tlsaPubBytes, err := hex.DecodeString(tlsa.Certificate)
 				if err != nil {
 					// TLSA record is malformed
@@ -528,7 +528,7 @@
 				tlsaPubSHA256 := sha256.Sum256(tlsaPubBytes)
 				// TODO: Special-case empty stapled pubkey. We should remove this
 				// special-case once stapled pubkeys are used everywhere.
 				//if !bytes.Equal(pubSHA256, tlsaPubSHA256[:]) {
 				if len(pubSHA256) > 0 && !bytes.Equal(pubSHA256, tlsaPubSHA256[:]) {
 					// TLSA record doesn't match requested public key hash
 					continue
@@ -548,7 +548,7 @@
 				// Fill in verified preimage into TLSA record
 				tlsa.MatchingType = 0
 				tlsa.Certificate = hex.EncodeToString(pubBytes)
 			} else if tlsa.MatchingType == 2 { // SHA-512
 				tlsaPubSHA512, err := hex.DecodeString(tlsa.Certificate)
 				if err != nil {
 					// TLSA record is malformed
@@ -576,10 +576,10 @@
 	return nil, nil
 }

 func (s *Server) lookupCert(req *http.Request) (certDer []byte, shortTerm bool, err error) {
 	commonName := req.FormValue("domain")

 	if commonName == "Namecoin Root CA" {
 		return s.rootCert, false, nil
 	}

@@ -661,7 +661,7 @@
 func (s *Server) lookupHandler(writer http.ResponseWriter, req *http.Request) {
 	writer.Header().Set("Content-Type", "application/x-pem-file")

 	commonName := req.FormValue("domain")

 	log.Debugf("PEM lookup: %s", commonName)

@@ -709,7 +709,7 @@
 func (s *Server) aiaHandler(writer http.ResponseWriter, req *http.Request) {
 	writer.Header().Set("Content-Type", "application/pkix-cert")

 	commonName := req.FormValue("domain")

 	log.Debugf("DER lookup: %s", commonName)

@@ -728,13 +728,13 @@

 	if shortTerm {
 		// Set short-term caching duration of half the cert validity
 		maxAge := safetlsa.ValidityShortTerm() / 2
 		maxAgeSeconds := int(maxAge / time.Second)
 		maxAgeStr := strconv.Itoa(maxAgeSeconds)
 		writer.Header().Set("Cache-Control", "max-age="+maxAgeStr)
 	}
 
-	_, err = io.WriteString(writer, string(requestedCert))
+	_, err = writer.Write(requestedCert)
 	if err != nil {
 		log.Debuge(err, "write error")
 	}
@@ -752,7 +752,7 @@
 	})
 	restrictCertPemString := string(restrictCertPem)

 	restrictPrivBytes, err := x509.MarshalECPrivateKey(restrictPriv.(*ecdsa.PrivateKey))
 	if err != nil {
 		log.Debuge(err, "Unable to marshal ECDSA private key")
 	}
@@ -782,9 +782,9 @@
 func (s *Server) crossSignCAHandler(writer http.ResponseWriter, req *http.Request) {
 	var err error

 	toSignPEM := req.FormValue("to-sign")
 	signerCertPEM := req.FormValue("signer-cert")
 	signerKeyPEM := req.FormValue("signer-key")

 	cacheKeyArray := sha256.Sum256([]byte(toSignPEM + "\n\n" + signerCertPEM + "\n\n" + signerKeyPEM + "\n\n"))
 	cacheKey := hex.EncodeToString(cacheKeyArray[:])
@@ -835,7 +835,7 @@
 }

 func (s *Server) originalFromSerialHandler(writer http.ResponseWriter, req *http.Request) {
 	serial := req.FormValue("serial")

 	cacheResults, needRefresh := s.getCachedOriginalFromSerial(serial)
 	if !needRefresh {
@@ -843,7 +843,7 @@
 	}
 }

 func GenerateCerts(cfg *Config) {
 	var (
 		err                 error
 		listenCertPem       []byte
@@ -888,7 +888,7 @@
 	})
 	srv.tldCertPemString = string(srv.tldCertPem)

 	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)

 	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
 	if err != nil {
@@ -912,7 +912,7 @@
 			SerialNumber: "Namecoin TLS Certificate",
 		},
 		NotBefore: time.Now().Add(-1 * time.Hour),
 		NotAfter:  time.Now().Add(43800 * time.Hour),

 		KeyUsage:              x509.KeyUsageDigitalSignature,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
@@ -943,12 +943,12 @@
 		Bytes: listenPrivBytes,
 	})

 	err = os.WriteFile(srv.cfg.RootCert, srv.rootCertPem, 0600)
 	if err != nil {
 		log.Fatalef(err, "Unable to write %s", srv.cfg.RootCert)
 	}

 	err = os.WriteFile(srv.cfg.RootKey, srv.rootPrivPem, 0600)
 	if err != nil {
 		log.Fatalef(err, "Unable to write %s", srv.cfg.RootKey)
 	}
@@ -956,7 +956,7 @@
 	listenChainPemString := listenCertPemString + "\n\n" + srv.tldCertPemString + "\n\n" + srv.rootCertPemString
 	listenChainPem := []byte(listenChainPemString)

 	err = os.WriteFile(srv.cfg.ListenChain, listenChainPem, 0600)
 	if err != nil {
 		log.Fatalef(err, "Unable to write %s", srv.cfg.ListenChain)
 	}