openvibers/openvibe.network Commits

Pin openvibe-sdk to v0.86.0, not a deleted branch; accept the released fingerprint format (#580)

OP OpenVibers committed 7 days ago · 7d0a23a07d · 6 files, +23 −7

#577 pinned openvibe-sdk to refs/heads/feat/locker-core-sdk; the branch went with its merge and the deploy's npm install
failed (the release was restored, nothing restarted). The pin is now the v0.86.0 tag, the release that carries the Locker
core, and test/pins-are-tags.test.js refuses a branch tarball in package.json or the lockfile.

The released fingerprint is two groups of four words joined by " · "; the key directory still expected the earlier
hyphen, so every PUT failed with locker.failed on the tag. The pattern, the test and the README follow the release.

Changes

ddiff --git a/README.md b/README.md
iindex a90fa64a..71a6d7f4 100644
---- a/README.md
++++ b/README.md
@@@ -978,7 +978,7 @@ curl -s -H "Authorization: Bearer $TOKEN" https://openvibe.network/api/v1/people
    "subject": "usr_01JAB2C3D4E5F6G7H8J9K0MNPQ",
    "ecdh_public": { "kty": "EC", "crv": "P-256", "x": "…", "y": "…" },
    "signing_public": { "kty": "EC", "crv": "P-256", "x": "…", "y": "…" },
--  "fingerprint": "alpha bravo charlie delta-echo foxtrot golf hotel",
++  "fingerprint": "alpha bravo charlie delta · echo foxtrot golf hotel",
    "updated_at": "2026-11-06T09:12:00.000Z",
    "changed_at": "2026-11-06T09:12:00.000Z"
  }
ddiff --git a/package-lock.json b/package-lock.json
iindex 32ad32de..62fb815c 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -21,7 +21,7 @@
          "jsonwebtoken": "^9.0.0",
          "multer": "^1.4.5-lts.1",
          "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.289.1",
--        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/heads/feat/locker-core-sdk",
++        "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.86.0",
          "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.114.0",
          "pg": "^8.23.0",
          "qrcode": "1.5.4",
@@@ -1739,8 +1739,8 @@
      },
      "node_modules/openvibe-sdk": {
        "version": "0.86.0",
--      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/heads/feat/locker-core-sdk",
--      "integrity": "sha512-MuTtcHtJSv4NgEBPy1nLso6RHppWPIbWzVBL24DtWFPdfVkH+B0yR0H3R73HDNP/Sc0MgKKn11GxcrnSmQlJkA==",
++      "resolved": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.86.0",
++      "integrity": "sha512-APn4qK1ErX9f/gR6l2AhGfj+n8/3ul87Otm69xN4wyJUt43WF6A2b0lMKDG9Ds6oQiOoCZJCjxCSanP0wtMuGA==",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex a9ecb639..f4c0b7e3 100644
---- a/package.json
++++ b/package.json
@@@ -25,7 +25,7 @@
      "jsonwebtoken": "^9.0.0",
      "multer": "^1.4.5-lts.1",
      "openvibe-contracts": "https://codeload.github.com/OpenVibers/OpenVibe.Contracts/tar.gz/refs/tags/v0.289.1",
--    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/heads/feat/locker-core-sdk",
++    "openvibe-sdk": "https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.86.0",
      "openvibe-shared": "https://codeload.github.com/OpenVibers/OpenVibe.Shared/tar.gz/refs/tags/v4.114.0",
      "pg": "^8.23.0",
      "qrcode": "1.5.4",
ddiff --git a/server/locker/keys.js b/server/locker/keys.js
iindex e45507d4..c1420d78 100644
---- a/server/locker/keys.js
++++ b/server/locker/keys.js
@@@ -62,7 +62,8 @@ const SUBJECT_RE = /^usr_[0-9A-HJKMNP-TV-Z]{26}$/;
  /** A name (letters, digits, dot, dash, underscore): exact names only, never a pattern. */
  const NAME_RE = /^[A-Za-z0-9_.-]{1,40}$/;
  /** The eight words of a fingerprint, in two groups of four. */
--const FINGERPRINT_RE = /^[a-z]+ [a-z]+ [a-z]+ [a-z]+-[a-z]+ [a-z]+ [a-z]+ [a-z]+$/;
++// openvibe-sdk/locker's fingerprintOf: eight words in two groups of four, joined by " · " (SDK 0.86.0).
++const FINGERPRINT_RE = /^[a-z]+ [a-z]+ [a-z]+ [a-z]+ · [a-z]+ [a-z]+ [a-z]+ [a-z]+$/;
  /** A base64 ECDSA P-256 signature: 64 bytes, 86 characters and the padding. */
  const SIGNATURE_RE = /^[A-Za-z0-9+/]{86}==$/;
  /** How many lookups one caller may do a minute. */
ddiff --git a/test/locker-keys.test.js b/test/locker-keys.test.js
iindex 96db608e..e96758c2 100644
---- a/test/locker-keys.test.js
++++ b/test/locker-keys.test.js
@@@ -143,7 +143,7 @@ const notices = async () => (await db.prepare('SELECT message, category, service
          assert.strictEqual(r.body.code, 'locker.bad_signature');
  
          // ── A fingerprint that does not match the keys is refused ──
--        r = await call('PUT', '/api/v1/me/keys', { headers: await as(1), body: { ...ann.body, fingerprint: 'alpha bravo charlie delta-echo foxtrot golf hotel' } });
++        r = await call('PUT', '/api/v1/me/keys', { headers: await as(1), body: { ...ann.body, fingerprint: 'alpha bravo charlie delta · echo foxtrot golf hotel' } });
          assert.strictEqual(r.status, 400, 'a fingerprint that is not the one the keys produce is refused');
          assert.strictEqual(r.body.code, 'locker.fingerprint_mismatch');
  
ddiff --git a/test/pins-are-tags.test.js b/test/pins-are-tags.test.js
nnew file mode 100644
iindex 00000000..129338bb
---- /dev/null
++++ b/test/pins-are-tags.test.js
@@@ -0,0 +1,15 @@
++'use strict';
++// Every git-tarball dependency is pinned to a released tag, never a branch: a branch is deleted when its PR merges,
++// and the next deploy's npm install then fails (2026-11-06: #577 pinned openvibe-sdk to refs/heads/feat/locker-core-sdk).
++const assert = require('assert');
++const pkg = require('../package.json');
++const lock = require('../package-lock.json');
++const bad = [];
++for (const [name, spec] of Object.entries({ ...pkg.dependencies, ...pkg.devDependencies, ...pkg.optionalDependencies })) {
++    if (/codeload\.github\.com\/.+\/tar\.gz\/refs\/heads\//.test(String(spec)) || /github\.com\/.+#(?!v?\d)/.test(String(spec))) bad.push(`${name}: ${spec}`);
++}
++for (const [where, entry] of Object.entries(lock.packages || {})) {
++    if (entry && /\/tar\.gz\/refs\/heads\//.test(String(entry.resolved || ''))) bad.push(`${where} resolved from a branch: ${entry.resolved}`);
++}
++assert.deepStrictEqual(bad, [], 'pin git tarballs to a tag (refs/tags/vX.Y.Z), never a branch');
++console.log('pins-are-tags: every tarball dependency is a tag');