From 5c38a1044bcc96002abf8cb1de8b74ee2dc933a1 Mon Sep 17 00:00:00 2001 From: Alan Shaw Date: Fri, 10 Apr 2026 12:22:48 +0100 Subject: [PATCH 1/2] feat: configure insecure DID resolution --- cmd/gateway/serve.go | 7 ++++++- cmd/retrieve.go | 7 ++++++- internal/cmdutil/cmdutil.go | 4 ++-- pkg/config/network.go | 8 ++++++++ pkg/presets/presets.go | 3 +++ 5 files changed, 25 insertions(+), 4 deletions(-) diff --git a/cmd/gateway/serve.go b/cmd/gateway/serve.go index f20b0bfe..d5cdda53 100644 --- a/cmd/gateway/serve.go +++ b/cmd/gateway/serve.go @@ -26,6 +26,7 @@ import ( "github.com/spf13/viper" arc "github.com/storacha/go-ds-arc" contentcap "github.com/storacha/go-libstoracha/capabilities/space/content" + "github.com/storacha/go-libstoracha/principalresolver" "github.com/storacha/go-ucanto/core/delegation" "github.com/storacha/go-ucanto/did" "github.com/storacha/go-ucanto/ucan" @@ -156,7 +157,11 @@ var serveCmd = &cobra.Command{ indexer, indexerPrincipal := cmdutil.MustGetIndexClient(cfg.Network) network := cmdutil.MustGetNetworkConfig(cfg.Network, "") - uploadServiceVerifier, err := cmdutil.ResolveDIDWebAndWrap(ctx, network.UploadID) + var resolverOpts []principalresolver.Option + if network.InsecureDIDResolution { + resolverOpts = append(resolverOpts, principalresolver.InsecureResolution()) + } + uploadServiceVerifier, err := cmdutil.ResolveDIDWebAndWrap(ctx, network.UploadID, resolverOpts...) if err != nil { return err } diff --git a/cmd/retrieve.go b/cmd/retrieve.go index b62501f2..ea2ffe8e 100644 --- a/cmd/retrieve.go +++ b/cmd/retrieve.go @@ -10,6 +10,7 @@ import ( "github.com/mitchellh/go-wordwrap" "github.com/spf13/cobra" contentcap "github.com/storacha/go-libstoracha/capabilities/space/content" + "github.com/storacha/go-libstoracha/principalresolver" "github.com/storacha/go-ucanto/core/delegation" "github.com/storacha/go-ucanto/did" "github.com/storacha/go-ucanto/ucan" @@ -81,7 +82,11 @@ var retrieveCmd = &cobra.Command{ }() network := cmdutil.MustGetNetworkConfig(cfg.Network, "") - uploadServiceVerifier, err := cmdutil.ResolveDIDWebAndWrap(ctx, network.UploadID) + var resolverOpts []principalresolver.Option + if network.InsecureDIDResolution { + resolverOpts = append(resolverOpts, principalresolver.InsecureResolution()) + } + uploadServiceVerifier, err := cmdutil.ResolveDIDWebAndWrap(ctx, network.UploadID, resolverOpts...) if err != nil { return err } diff --git a/internal/cmdutil/cmdutil.go b/internal/cmdutil/cmdutil.go index 45d0c014..38cd85d9 100644 --- a/internal/cmdutil/cmdutil.go +++ b/internal/cmdutil/cmdutil.go @@ -242,8 +242,8 @@ func ResolveSpace(c *client.Client, identifier string) (did.DID, error) { return space.DID(), nil } -func ResolveDIDWebAndWrap(ctx context.Context, didWeb did.DID) (principal.Verifier, error) { - resolver, err := principalresolver.NewHTTPResolver([]did.DID{didWeb}) +func ResolveDIDWebAndWrap(ctx context.Context, didWeb did.DID, opts ...principalresolver.Option) (principal.Verifier, error) { + resolver, err := principalresolver.NewHTTPResolver([]did.DID{didWeb}, opts...) if err != nil { return nil, fmt.Errorf("creating principal resolver: %w", err) } diff --git a/pkg/config/network.go b/pkg/config/network.go index dea2e695..cb680b9f 100644 --- a/pkg/config/network.go +++ b/pkg/config/network.go @@ -29,6 +29,9 @@ type NetworkConfig struct { // AuthorizedRetrievals indicates whether UCAN authorized retrievals are supported. // Use a pointer to distinguish between unset and false. AuthorizedRetrievals *bool `mapstructure:"authorized_retrievals" toml:"authorized_retrievals"` + // InsecureDIDResolution enables HTTP (instead of HTTPS) for did:web resolution. + // NB: this should only be used for development purposes. + InsecureDIDResolution bool `mapstructure:"insecure_did_resolution" toml:"insecure_did_resolution,omitempty"` } // IsEmpty returns true if no network configuration fields are set. @@ -140,5 +143,10 @@ func (n NetworkConfig) ToPresetConfig(baseName string) (presets.NetworkConfig, e network.Name = "custom" } + if n.InsecureDIDResolution { + network.InsecureDIDResolution = true + network.Name = "custom" + } + return network, nil } diff --git a/pkg/presets/presets.go b/pkg/presets/presets.go index d1720824..8abcc951 100644 --- a/pkg/presets/presets.go +++ b/pkg/presets/presets.go @@ -42,6 +42,9 @@ type NetworkConfig struct { UploadID did.DID UploadURL url.URL AuthorizedRetrievals bool // Support for UCAN authorized retrievals. + // InsecureDIDResolution enables HTTP (instead of HTTPS) for did:web resolution. + // NB: this should only be used for development purposes. + InsecureDIDResolution bool } // Known network configurations. From 9447f284a599fb305ff0dda6eb3dda953d2596a8 Mon Sep 17 00:00:00 2001 From: Alan Shaw Date: Wed, 15 Apr 2026 11:19:04 +0100 Subject: [PATCH 2/2] fix: define insecure DID resolution flag and bind to viper config --- cmd/root.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/cmd/root.go b/cmd/root.go index 03ef5e85..d9c582ef 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -90,6 +90,10 @@ func init() { rootCmd.PersistentFlags().String("indexer-url", "", "Indexing service URL (overrides network preset)") cobra.CheckErr(viper.BindPFlag("network.indexer_url", rootCmd.PersistentFlags().Lookup("indexer-url"))) + rootCmd.PersistentFlags().Bool("insecure-did-resolution", false, "Enable insecure DID resolution (overrides network preset)") + cobra.CheckErr(rootCmd.PersistentFlags().MarkHidden("insecure-did-resolution")) + cobra.CheckErr(viper.BindPFlag("network.insecure_did_resolution", rootCmd.PersistentFlags().Lookup("insecure-did-resolution"))) + // Preparation configuration flags rootCmd.PersistentFlags().Uint("replicas", presets.DefaultReplicas, "Number of replicas to request per shard") cobra.CheckErr(rootCmd.PersistentFlags().MarkHidden("replicas"))