namecoin · robertmin1 · Mar 17, 2026
diff --git a/.cirrus.yml b/.cirrus.yml
@@ -125,7 +125,8 @@ task:
   install_script:
     - apt-get update
     # bind9-dnsutils contains dig
-    - apt-get install -y dnssec-trigger bind9-dnsutils xxd
+    - apt-get install -y dnssec-trigger bind9-dnsutils libnss3-tools xxd
+    - if [ "$CI_DISTRO" = "ubuntu" ]; then curl -fsSL https://dl.google.com/linux/linux_signing_key.pub | gpg --dearmor -o /usr/share/keyrings/google-chrome.gpg && echo "deb [arch=amd64 signed-by=/usr/share/keyrings/google-chrome.gpg] http://dl.google.com/linux/chrome/deb/ stable main" > /etc/apt/sources.list.d/google-chrome.list && apt-get update && apt-get install -y google-chrome-stable; else apt-get install -y chromium; fi
     # Namecoin Core
     # Temporarily downgrade Namecoin Core until deterministic salts with descriptor wallets are fixed.
     #- BITCOIND_URL=$(curl https://www.namecoin.org/download/ | grep x86_64-linux-gnu.tar.gz | grep -v 0.13.99 | grep --only-matching https://.*.tar.gz)
@@ -162,7 +163,7 @@ task:
     - chown encaya:encaya testdata/*.pem
     # Curiously, relative paths don't work here, they cause the .pem files to
     # not be detected.  Maybe file a bug with Hugo?
-    - encaya -conf "$(pwd)/testdata/encaya.conf"
+    - encaya -conf "$(pwd)/testdata/encaya.conf" -encaya.namecoinrpcaddress 127.0.0.1:18554 -encaya.namecoinrpcusername doggman -encaya.namecoinrpcpassword donkey
   regtest_script:
     - sleep 15s
     - testdata/regtest.sh
@@ -171,6 +172,97 @@ task:
   env:
     GO_VERSION: latest
 
+task:
+  name: "Functional Tests Windows Go $GO_VERSION"
+  alias: "Functional Tests"
+  compute_engine_instance:
+    image_project: windows-cloud
+    image: family/windows-2022
+    platform: windows
+    cpu: 4
+    memory: 8G
+  install_script:
+    - $ErrorActionPreference = 'Stop'; Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12; Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')); $env:PATH = "C:\ProgramData\chocolatey\bin;$env:PATH"
+    - |
+        $ErrorActionPreference = 'Stop'
+
+        function Invoke-ChocoWithRetry {
+          param(
+            [Parameter(Mandatory = $true)]
+            [string[]]$PackageNames,
+            [int]$MaxAttempts = 3,
+            [int]$DelaySeconds = 15
+          )
+
+          for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
+            choco install -y @PackageNames
+            if ($LASTEXITCODE -eq 0) {
+              return
+            }
+
+            if ($attempt -ge $MaxAttempts) {
+              exit $LASTEXITCODE
+            }
+
+            Write-Host "Chocolatey install failed for $($PackageNames -join ', ') on attempt $attempt/$MaxAttempts; retrying in $DelaySeconds seconds"
+            Start-Sleep -Seconds $DelaySeconds
+          }
+        }
+
+        function Install-ChromeWithRetry {
+          param(
+            [int]$MaxAttempts = 3,
+            [int]$DelaySeconds = 15
+          )
+
+          $chromeBinary = 'C:\Program Files\Google\Chrome\Application\chrome.exe'
+          $chromeMsiPath = Join-Path $env:TEMP 'googlechromestandaloneenterprise64.msi'
+
+          for ($attempt = 1; $attempt -le $MaxAttempts; $attempt++) {
+            if (Test-Path $chromeBinary) {
+              return
+            }
+
+            if (Test-Path $chromeMsiPath) {
+              Remove-Item $chromeMsiPath -Force
+            }
+
+            Invoke-WebRequest -Uri 'https://dl.google.com/chrome/install/googlechromestandaloneenterprise64.msi' -OutFile $chromeMsiPath
+            $installer = Start-Process msiexec.exe -ArgumentList @('/i', $chromeMsiPath, '/qn', '/norestart') -Wait -PassThru
+
+            if ($installer.ExitCode -in @(0, 3010) -and (Test-Path $chromeBinary)) {
+              return
+            }
+
+            if ($attempt -ge $MaxAttempts) {
+              exit $(if ($installer.ExitCode) { $installer.ExitCode } else { 1 })
+            }
+
+            Write-Host "Chrome install attempt $attempt/$MaxAttempts did not produce $chromeBinary; retrying in $DelaySeconds seconds"
+            Start-Sleep -Seconds $DelaySeconds
+          }
+        }
+
+        Invoke-ChocoWithRetry -PackageNames @('openssl.light', 'unbound')
+        Install-ChromeWithRetry
+    - if (Test-Path windows-deps) { Remove-Item windows-deps -Recurse -Force }
+    - New-Item -ItemType Directory -Path windows-deps | Out-Null
+    - $ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -Uri 'https://www.namecoin.org/files/namecoin-core/namecoin-core-22.0/namecoin-nc22.0-win64.zip' -OutFile 'windows-deps\namecoin.zip'
+    - Expand-Archive -Path 'windows-deps\namecoin.zip' -DestinationPath 'windows-deps'
+    - $ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -Uri 'https://api.cirrus-ci.com/v1/artifact/github/namecoin/ncdns/Cross-Compile%20Go%20latest/binaries/dist/ncdns--windows_amd64.tar.gz' -OutFile 'windows-deps\ncdns.tar.gz'
+    - tar -xf windows-deps\ncdns.tar.gz -C windows-deps; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+    - $ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -Uri "https://api.cirrus-ci.com/v1/artifact/build/$env:CIRRUS_BUILD_ID/Cross-Compile%20Go%20latest/binaries/dist/encaya--windows_amd64.tar.gz" -OutFile 'windows-deps\encaya.tar.gz'
+    - tar -xf windows-deps\encaya.tar.gz -C windows-deps; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+  regtest_script:
+    - powershell.exe -NoLogo -ExecutionPolicy Bypass -File testdata\regtest.ps1; if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+  depends_on:
+    - "Cross-Compile Go $GO_VERSION"
+  env:
+    CIRRUS_SHELL: powershell
+    ENCAYA_WINDOWS_MANAGE_SERVICES: "1"
+    ENCAYA_WINDOWS_USE_SERVICE_CONTROL: "1"
+    GO_VERSION: latest
+
 task:
   name: Cross-Compile Go $GO_VERSION
   alias: Cross-Compile

diff --git a/.gitignore b/.gitignore
@@ -1,2 +1,4 @@
 go.mod
 go.sum
+testdata/windows-runtime/
+windows-deps/
diff --git a/server/server.go b/server/server.go
@@ -48,12 +48,12 @@
 	cfg Config

 	rootCert          []byte
 	rootPriv          interface{}
 	rootCertPem       []byte
 	rootCertPemString string
 	rootPrivPem       []byte
 	tldCert           []byte
 	tldPriv           interface{}
 	tldCertPem        []byte
 	tldCertPemString  string

@@ -228,8 +228,8 @@

 func (s *Server) doRunListenerTCP() {
 	tcpSrv := &http.Server{
 		ReadTimeout:  5 * time.Second,
 		WriteTimeout: 10 * time.Second,
 	}

 	err := tcpSrv.Serve(s.tcpListener)
@@ -238,8 +238,8 @@

 func (s *Server) doRunListenerTLS() {
 	tlsSrv := &http.Server{
 		ReadTimeout:  5 * time.Second,
 		WriteTimeout: 10 * time.Second,
 	}

 	err := tlsSrv.ServeTLS(s.tlsListener, s.cfg.ListenChain, s.cfg.ListenKey)
@@ -251,14 +251,14 @@
 	results := [][]byte{}

 	s.domainCertCacheMutex.RLock()
 	for _, cert := range s.domainCertCache[commonName] {
 		if time.Until(cert.expiration) > safetlsa.ValidityShortTerm()/2 {
 			needRefresh = false
 		}

 		results = append(results, cert.certDer)
 	}
 	s.domainCertCacheMutex.RUnlock()

 	return results, needRefresh
 }
@@ -297,7 +297,7 @@
 	results := [][]byte{}

 	s.negativeCertCacheMutex.RLock()
 	for _, cert := range s.negativeCertCache[commonName] {
 		// Negative certs don't expire
 		needRefresh = false

@@ -306,7 +306,7 @@
 		// We only need 1 negative cert
 		break
 	}
 	s.negativeCertCacheMutex.RUnlock()

 	return results, needRefresh
 }
@@ -331,7 +331,7 @@
 	results := [][]byte{}

 	s.originalCertCacheMutex.RLock()
 	for _, cert := range s.originalCertCache[serial] {
 		// Original certs don't expire
 		needRefresh = false

@@ -340,7 +340,7 @@
 		// We only need 1 original cert
 		break
 	}
 	s.originalCertCacheMutex.RUnlock()

 	return results, needRefresh
 }
@@ -403,7 +403,7 @@
 	if err != nil {
 		return nil, err
 	}
 	if !ok {
 		return nil, nil
 	}

@@ -420,15 +420,15 @@

 	return &dns.TLSA{
 		Hdr: dns.RR_Header{Name: "", Rrtype: dns.TypeTLSA, Class: dns.ClassINET,
 			Ttl: 600},
 		Usage:        2,
 		Selector:     1,
 		MatchingType: 0,
 		Certificate:  strings.ToUpper(pubHex),
 	}, nil
 }

 func (s *Server) lookupDNS(req *http.Request, domain string) (tlsa *dns.TLSA, err error) {
 	log.Debugf("querying for pubkey via DNS: %s", domain)

 	qparams := qlib.DefaultParams()
@@ -456,24 +456,24 @@

 	if result.ResponseMsg == nil {
 		// A DNS error occurred (nil response).
 		return nil, fmt.Errorf("qlib error: nil response")
 	}
 
 	dnsResponse := result.ResponseMsg
-	if dnsResponse.MsgHdr.Rcode != dns.RcodeSuccess && dnsResponse.MsgHdr.Rcode != dns.RcodeNameError {
+	if dnsResponse.Rcode != dns.RcodeSuccess && dnsResponse.Rcode != dns.RcodeNameError {
 		// A DNS error occurred (return code wasn't Success or NXDOMAIN).
 		return nil, fmt.Errorf("qlib error: return code not Success or NXDOMAIN")
 	}
 
-	if dnsResponse.MsgHdr.Rcode == dns.RcodeNameError {
+	if dnsResponse.Rcode == dns.RcodeNameError {
 		// Wildcard subdomain doesn't exist.
 		// That means the domain doesn't use Namecoin-form DANE.
 		// Return no cert.
 		log.Debugf("wildcard subdomain doesn't exist: %s", domain)
 		return nil, nil
 	}
 
-	if !dnsResponse.MsgHdr.AuthenticatedData && !dnsResponse.MsgHdr.Authoritative {
+	if !dnsResponse.AuthenticatedData && !dnsResponse.Authoritative {
 		// For security reasons, we only trust records that are
 		// authenticated (e.g. server is Unbound and has verified
 		// DNSSEC sigs) or authoritative (e.g. server is ncdns and is
@@ -511,7 +511,7 @@

 		// CA not in user's trust store; public key; unspecified hash
 		if tlsa.Usage == 2 && tlsa.Selector == 1 {
 			if tlsa.MatchingType == 0 { // Not hashed
 				tlsaPubBytes, err := hex.DecodeString(tlsa.Certificate)
 				if err != nil {
 					// TLSA record is malformed
@@ -528,7 +528,7 @@
 				tlsaPubSHA256 := sha256.Sum256(tlsaPubBytes)
 				// TODO: Special-case empty stapled pubkey. We should remove this
 				// special-case once stapled pubkeys are used everywhere.
 				//if !bytes.Equal(pubSHA256, tlsaPubSHA256[:]) {
 				if len(pubSHA256) > 0 && !bytes.Equal(pubSHA256, tlsaPubSHA256[:]) {
 					// TLSA record doesn't match requested public key hash
 					continue
@@ -548,7 +548,7 @@
 				// Fill in verified preimage into TLSA record
 				tlsa.MatchingType = 0
 				tlsa.Certificate = hex.EncodeToString(pubBytes)
 			} else if tlsa.MatchingType == 2 { // SHA-512
 				tlsaPubSHA512, err := hex.DecodeString(tlsa.Certificate)
 				if err != nil {
 					// TLSA record is malformed
@@ -576,10 +576,10 @@
 	return nil, nil
 }

 func (s *Server) lookupCert(req *http.Request) (certDer []byte, shortTerm bool, err error) {
 	commonName := req.FormValue("domain")

 	if commonName == "Namecoin Root CA" {
 		return s.rootCert, false, nil
 	}

@@ -661,7 +661,7 @@
 func (s *Server) lookupHandler(writer http.ResponseWriter, req *http.Request) {
 	writer.Header().Set("Content-Type", "application/x-pem-file")

 	commonName := req.FormValue("domain")

 	log.Debugf("PEM lookup: %s", commonName)

@@ -709,7 +709,7 @@
 func (s *Server) aiaHandler(writer http.ResponseWriter, req *http.Request) {
 	writer.Header().Set("Content-Type", "application/pkix-cert")

 	commonName := req.FormValue("domain")

 	log.Debugf("DER lookup: %s", commonName)

@@ -728,13 +728,13 @@

 	if shortTerm {
 		// Set short-term caching duration of half the cert validity
 		maxAge := safetlsa.ValidityShortTerm() / 2
 		maxAgeSeconds := int(maxAge / time.Second)
 		maxAgeStr := strconv.Itoa(maxAgeSeconds)
 		writer.Header().Set("Cache-Control", "max-age="+maxAgeStr)
 	}
 
-	_, err = io.WriteString(writer, string(requestedCert))
+	_, err = writer.Write(requestedCert)
 	if err != nil {
 		log.Debuge(err, "write error")
 	}
@@ -752,7 +752,7 @@
 	})
 	restrictCertPemString := string(restrictCertPem)

 	restrictPrivBytes, err := x509.MarshalECPrivateKey(restrictPriv.(*ecdsa.PrivateKey))
 	if err != nil {
 		log.Debuge(err, "Unable to marshal ECDSA private key")
 	}
@@ -835,7 +835,7 @@
 }

 func (s *Server) originalFromSerialHandler(writer http.ResponseWriter, req *http.Request) {
 	serial := req.FormValue("serial")

 	cacheResults, needRefresh := s.getCachedOriginalFromSerial(serial)
 	if !needRefresh {
@@ -843,7 +843,7 @@
 	}
 }

 func GenerateCerts(cfg *Config) {
 	var (
 		err                 error
 		listenCertPem       []byte
@@ -888,7 +888,7 @@
 	})
 	srv.tldCertPemString = string(srv.tldCertPem)

 	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)

 	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
 	if err != nil {
@@ -912,7 +912,7 @@
 			SerialNumber: "Namecoin TLS Certificate",
 		},
 		NotBefore: time.Now().Add(-1 * time.Hour),
 		NotAfter:  time.Now().Add(43800 * time.Hour),

 		KeyUsage:              x509.KeyUsageDigitalSignature,
 		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
@@ -943,12 +943,12 @@
 		Bytes: listenPrivBytes,
 	})

 	err = os.WriteFile(srv.cfg.RootCert, srv.rootCertPem, 0600)
 	if err != nil {
 		log.Fatalef(err, "Unable to write %s", srv.cfg.RootCert)
 	}

 	err = os.WriteFile(srv.cfg.RootKey, srv.rootPrivPem, 0600)
 	if err != nil {
 		log.Fatalef(err, "Unable to write %s", srv.cfg.RootKey)
 	}
@@ -956,7 +956,7 @@
 	listenChainPemString := listenCertPemString + "\n\n" + srv.tldCertPemString + "\n\n" + srv.rootCertPemString
 	listenChainPem := []byte(listenChainPemString)

 	err = os.WriteFile(srv.cfg.ListenChain, listenChainPem, 0600)
 	if err != nil {
 		log.Fatalef(err, "Unable to write %s", srv.cfg.ListenChain)
 	}

diff --git a/testdata/encaya.windows.conf b/testdata/encaya.windows.conf
@@ -0,0 +1,18 @@
+
+### Windows functional test configuration for encaya.
+### Generated certificates are kept under testdata/windows-runtime/encaya/.
+
+[encaya]
+
+dnsaddress="127.0.0.1"
+dnsport="5391"
+
+rootcert="windows-runtime/encaya/root_chain.pem"
+rootkey="windows-runtime/encaya/root_key.pem"
+listenchain="windows-runtime/encaya/listen_chain.pem"
+listenkey="windows-runtime/encaya/listen_key.pem"
+
+[xlog]
+
+severity="debug"
+
diff --git a/testdata/ncdns.windows.conf b/testdata/ncdns.windows.conf
@@ -0,0 +1,15 @@
+
+### Windows functional test configuration for ncdns.
+
+[ncdns]
+
+bind="127.0.0.1:5391"
+
+namecoinrpcaddress="127.0.0.1:18554"
+namecoinrpcusername="doggman"
+namecoinrpcpassword="donkey"
+
+[xlog]
+
+severity="debug"
+