Repository navigation
harness: make the warnet lab image deployable - #906
Conversation
Fork-observer's published rpcauth was refused because the lab proxy only accepted the tank rpcpassword. Accept Core HMAC rpcauth and apply rpcwhitelist with default 0, so that user can call its chain methods and the commander user is not locked out. RBITCOIN_LOG_STDOUT copies each node line to the shim stdout and to debug.log. The lab image turns it on; functional tests leave it off. RBITCOIN_LAB_HEAD_SCALE=tiny, set by the image, selects tiny heads when conf omits head_scale. Conf head_scale=mainnet still wins.
Helm semverCompare rejects rbitcoin-warnet:local, so the kind instructions build and load 0.7.99-warnet0. The compose example stays on local. The image text test fails if those instructions regress or if the log switch is only a Dockerfile string.
semverCompare ">=0.17.0" is false for 0.7.99, including after Warnet main strips a prerelease. The chart then omits [regtest] while helm template still exits 0, so rpcport, rpcpassword, rpcauth, and addnode land outside the network section. The kind tag is the release 28.0.0. The image text test rejects a tag below 0.17.0 and any prerelease.
![rearden-grok[bot]](https://avatars.githubusercontent.com/u/730881?s=60&v=4){kind=small}
There was a problem hiding this comment.
Summary
The lab image tag, head-scale default, and stdout tee do what the change claims. Kind/Helm docs use release tag 28.0.0 (no prerelease), which passes Warnet semverCompare ">=0.17.0" on both 1.1.20 and current main so the chart emits [regtest]; compose stays rbitcoin-warnet:local (example.sh / example-compose.yml). RBITCOIN_LAB_HEAD_SCALE=tiny is applied only when that env value is tiny and conf has no head_scale; an explicit conf value, including mainnet under [regtest], wins because read_conf_keys still returns those lines. The log tee writes the child's raw stdout bytes only when RBITCOIN_LOG_STDOUT is on.
The default Core functional path is unchanged. With no rpcauth and no rpcwhitelist (the running harness; rpc_users.py and rpc_whitelist.py are skipped), authenticated_user plus an empty whitelist matches authorization_ok: no cookie stays open, cookie Basic and password-equals-rpcpassword succeed, and a wrong password is 401. handle_http parses JSON, then authorizes, then does the existing forward / testmempoolaccept rewrite. rpcwhitelistdefault=0 limits only names present in rpcwhitelist; the tank rpcuser and __cookie__ stay unrestricted, and the published forkobserver / tabconf2024 login is HMAC-checked and rejected for methods outside Warnet's list (the new test covers generatetoaddress → 403). No harness break on that default path.
Issue counts by severity
- bugs: 0
- suggestions: 2
- nits: 0
A failed HMAC on the first rpcauth row for a user hid a later row, so password rotation could not log in. Repeated rpcwhitelist lines were unioned; Core intersects them.
1 participant
Summary
The Warnet lab image could follow blocks in a kind cluster, and Warnet itself still could not deploy or observe those tanks. This makes the documented image something
warnet deploycan render, log, and show in fork-observer.28.0.0. That is the chart's Core-version gate, not the rbitcoin version.semverCompare ">=0.17.0"is true, so the chart writes[regtest]beforerpcport,rpcpassword,rpcauth, andaddnode.0.7.99and a prerelease of it compare below0.17.0and omit that section even whenhelm templateexits 0.localis not a semantic version. The compose example staysrbitcoin-warnet:local.RBITCOIN_LOG_STDOUT=1(set by the image) copies each node line to the container stdout and todebug.log. The switch stays off for the functional harness, so a clean stop still keeps stderr to mappedError:lines.rpcauth(HMAC-SHA256) forgetchaintips,getblockheader,getblockhash,getblock, andgetnetworkinfo, and refuses other methods underrpcwhitelistdefault=0. The tankrpcuser/rpcpassworduser and cookie Basic auth stay unrestricted.RBITCOIN_LAB_HEAD_SCALE=tiny, so a Helm tank that omitshead_scaledoes not fallocate mainnet heads. Confhead_scale=mainnetstill wins.addnode=is still--connect.Fixes #820.
--connectpeers already reportmanualon master (PR #876).Tests
scripts/core-functional/rpc_proxy.test.shdrivesRpcProxywith the published fork-observer line.scripts/core-functional/bitcoind.test.shdrives the shim for the log tee and for tiny-versus-mainnet head scale.scripts/core-functional/warnet/Dockerfile.test.shrejects a kind instruction that tags or loadslocal, and requires the shim to readRBITCOIN_LOG_STDOUT.No Docker on the agent VM, so
example.shand a livehelm templatewere not run here. Labelwarnetruns the two-tank compose example.