jaap-jan
8d2416a602
Three new client projects, and the wire-contract fix they needed. DodoSSH.Client.Domain holds the decrypted item model and the three-way merge, with no I/O at all — so the suite that decides whether a credential can be lost runs in milliseconds with nothing to mock. Scalars defer to the server on a genuine clash so every replica resolves the same triple identically and two clients cannot ping-pong; directives merge per name so two people each adding one both keep theirs; the jump chain merges as a whole value because its order is the route. Whatever loses is returned rather than dropped. DodoSSH.Client.Storage is EF Core on SQLite, no SQLCipher: the rows are already ciphertext, so an encrypted file would protect protected bytes at the cost of a native dependency. It keeps the server's state and the outbox in separate tables, which is what preserves the common ancestor a merge needs. One pending operation per item, enforced by a unique index. DodoSSH.Client.Sync is the pull/apply/push loop. Pulling never decrypts — a change with no local work pending is plumbed as ciphertext — so a first sync of thousands of items does not run twice as many AEAD operations for nothing. Contracts: EncryptedPayload gains WrappedDataKey and DataKeyId. The specification has required a per-item data key since crypto.md §3, the columns have existed since the first migration and DshAad.ItemPayload binds the id, but this record had nowhere to put either — so a spec-compliant item could not be transmitted at all. Found by writing the client that has to produce one. Also closes a hole in AadResourceType, which had no value for the HostTag and HostCredential that SyncEntityType has always listed. Four bugs the tests found, not review: - SQLite refuses to order or compare its own DateTimeOffset mapping, and throws at execution rather than model build. Collecting tombstones and listing conflicts are both that shape, so this was a crash waiting for the first user with a deleted host. Timestamps are integers now, by convention so a later field cannot be the one left unconverted. - SQLitePCLRaw 2.1.11, which EF resolves, is covered by GHSA-2m69-gcr7-jv3q. Pinned forward as a family. - Resurrecting content from a remote deletion cleared the original before queueing the copy. Two transactions, so a crash between them lost the work; reversed, and the rescued id is derived from the tombstone so a replay coalesces instead of duplicating. - Several equality assertions went through Shouldly's ShouldBe, which compares IEnumerable element-wise and so tested nothing about the Equals these types exist to provide. Corrected; the falsification that caught it went from 2 failures to 6. The push response's cursor is deliberately ignored. It sits after this client's own writes, so adopting it skips anything another client committed at a lower sequence in the window between a pull and a push — permanently. Re-reading one's own writes is idempotent and costs a page. The Contracts doc that invited the shortcut now says so. 593 tests, up from 448. The delete-versus-edit rules, the ancestor retention, the fresh operation id on coalesce and the cursor safeguard were each verified by breaking them and watching the right test fail.
11 KiB
Platform flags
Things known or suspected to behave differently outside Windows, plus deployment gotchas that have already cost time once. Development and testing are currently Windows-only, so anything here marked unverified has not run on the platform in question and must not be assumed to work.
Each entry says what the risk is, why it matters, and what to do about it. Delete an entry when it has been verified or made moot — not when it merely stops being convenient.
Cryptography
ChaCha20Poly1305.IsSupported is false on macOS, and on Windows builds before 10.0.20142.
This is why the client uses NSec (libsodium) rather than the BCL for content encryption; see
docs/crypto.md §1. Already mitigated — but if a BCL AEAD path is ever added as a fallback it
must gate on IsSupported rather than assuming availability, or the client will fail to open
any vault on macOS.
Argon2id timings are measured on one Windows machine only. 256 MiB with t=4 took 323 ms here.
The floor and ceiling in EnrollmentLimits were chosen against that number. Unverified
elsewhere: recalibrate on the slowest target platform before recommending a default profile,
because a cost that is comfortable on a desktop can make unlock unusable on a low-power laptop —
and the parameters are stored per user at enrollment, so a bad default is a per-user migration.
libsodium ships native binaries per RID. This complicates single-file and AOT publishing, and
on macOS every native library (libsodium, libSkiaSharp, libHarfBuzzSharp, libe_sqlite3)
must be signed individually with --options runtime --timestamp before the bundle is signed,
or notarization fails with an error that does not name the offending file.
Desktop client
The WebView works on Windows. Avalonia.Controls.WebView 12.0.1 (MIT, no licence key) hosts the
terminal page successfully: WebView2 launches, navigates to the loopback page, runs its JavaScript and
completes the WebSocket handshake. Verified by observing an established TCP connection from
msedgewebview2 to the data plane port.
The Windows app manifest must declare a supportedOS list. Without it the process reports a
downlevel Windows version and Avalonia's native control host fails outright — "Unable to create child
window for native control host" — so the WebView, and therefore the terminal, does not start at all.
[STAThread] on Main is equally mandatory: WebView2 checks the apartment state and refuses to
initialise on an MTA thread.
WebView2 spawns a process tree, not a process. Around 35 processes were observed for one embedded view. That is the concrete reason the design uses one WebView hosting N terminals rather than one per tab: twenty tabs would mean twenty of those trees.
The Avalonia WebView on Linux remains unproven, and is still the largest risk in the plan. The
package's own release notes say NativeWebView gained Linux support via a WPE backend
(libwpewebkit-2.0), which is much less widely installed than WebKitGTK — and it ships a separate
NativeWebDialog described as "particularly useful for platforms like Linux where embedded WebView
controls might not be available", which is the vendor confirming the concern. Unverified: a spike
must cover Ubuntu on both Wayland and X11, Fedora KDE, and macOS 15. This is why the terminal sits
behind ITerminalHost; that seam should not be collapsed away for convenience.
Avalonia.Diagnostics has no 12.x release (latest is 11.3.18), so the developer tools overlay is
unavailable on Avalonia 12. Development-only, so nothing ships differently — but debugging a layout
problem currently means reasoning rather than inspecting.
The xterm bundles are vendored, not built. @xterm/xterm 6.0.0 with the fit and webgl addons, all
MIT, committed as UMD bundles under WebAssets/vendor and embedded as Avalonia resources. No npm or
esbuild step, so a clean clone builds with the .NET SDK alone. The cost is that upgrades are a manual
re-download; the licence and versions are recorded here so that stays visible.
SSH.NET's window-change is verified working as of 2025.1.0 — resolved, not a flag.
ShellStream.ChangeWindowSize(columns, rows, width, height) exists and the remote genuinely
observes it: PtyAndResizeSpikeTests reads stty size back from a real sshd after resizing, and
repeated resizes each take effect. The IChannelSession fallback is not needed. That suite stays
in place as a regression guard, because an upgrade that silently stopped sending the request would
present as wrapped output only after a resize — easy to misattribute to the terminal emulator.
ShellStream.Write buffers and requires an explicit Flush. Without one a keystroke is accepted,
reported as written, and never reaches the remote — the terminal displays output perfectly and simply
stops responding to input. SSH.NET's own WriteLine flushes, which is why a spike that used it never
hit this. SshNetShellSession.WriteAsync now flushes per write; batching would be wrong anyway, since
a terminal has to put a keystroke on the wire immediately.
ShellStream does not override ReadAsync. The base Stream implementation therefore runs
the blocking Read on a thread-pool thread, so every open session parks one thread for as long as
it is idle. Fine for the handful of tabs M1 targets; revisit before advertising many concurrent
sessions, since the fix is either an upstream change or driving IChannelSession directly.
SSH.NET cannot share one connection between SshClient and SftpClient. A shell plus SFTP to
the same host means two TCP connections, two authentications and — later — two relay sockets.
Connect SFTP lazily and reuse the cached decrypted credential so the user is not prompted twice.
Agent forwarding is de-scoped from v1. It needs an upstream SSH.NET change. A vault-backed agent of our own plus ProxyJump covers the real use cases.
The SSH suite pulls linuxserver/openssh-server from Docker Hub, which is rate-limited for
unauthenticated pulls. If CI starts failing on image pulls rather than on tests, that is why.
MSIX packaging is ruled out, not merely deprioritised. A packaged app runs WebView2 in an
AppContainer where loopback connections are blocked without a CheckNetIsolation exemption. The
terminal data plane is a loopback WebSocket, so MSIX would break the product outright. Velopack
for Windows/macOS/AppImage; Flatpak and deb/rpm defer updates to the package manager.
Linux ships AppImage and Flatpak first, specifically so the WebKit runtime is bundled rather than assumed present on the user's machine.
Opening the system browser depends on the platform handler. SystemBrowserLauncher uses
UseShellExecute, which delegates to ShellExecute on Windows, open on macOS and xdg-open on
Linux. Unverified off Windows: xdg-open comes from xdg-utils, which is not guaranteed on a
minimal desktop or inside a Flatpak sandbox — where the portal is the correct route instead. If
sign-in silently does nothing on Linux, this is the first thing to check. IBrowserLauncher exists
so a platform-specific opener can be substituted without touching the flow.
Local cache
The cache file has no location yet. ClientCacheFactory.ForFile takes a full path and the
application does not yet choose one, because nothing wires the cache into the shell so far. When it
does, the path must be per-OS — %LOCALAPPDATA% on Windows, ~/Library/Application Support on macOS,
$XDG_DATA_HOME or ~/.local/share on Linux — and it must not land in a directory that syncs to
a cloud drive. Two machines writing one SQLite file through a file-sync client corrupts it, and the
whole point of the outbox is that each machine has its own. Environment.SpecialFolder.LocalApplicationData
maps correctly on all three, but on Linux it ignores XDG_DATA_HOME and returns ~/.local/share
unconditionally. Unverified off Windows.
SQLite timestamps are stored as integers, deliberately. EF's default DateTimeOffset mapping for
SQLite is a text form it then refuses to order or compare, so any query that sorts or filters by time
throws at execution rather than at model build. UnixMillisecondsConverter is applied as a convention
so a timestamp added later cannot be the one left unconverted. This is provider behaviour, not
platform behaviour, but it cost a debugging session and will again if the converter is removed.
No SQLCipher, on any platform. The rows are already ciphertext from the server, so an encrypted
database file would protect bytes that are protected already at the cost of a native dependency and a
licence obligation — and bundle_e_sqlcipher was deprecated in SQLitePCLRaw 3.0. The consequence to
be honest about: the cache offers no protection against another process running as the same user. See
LocalCacheProtector for what it does and does not defend against.
Build and CI
Integration tests need a Docker daemon (Testcontainers). They run on ubuntu-latest in CI.
macOS runners have no Docker daemon, and the Windows CI job is deliberately build-only. So
anything proved by an integration test is proved on Linux only — which is the right place for
server code, and no coverage at all for client platform behaviour.
[CallerFilePath] is rewritten to /_/... under ContinuousIntegrationBuild. Any test that
locates a fixture by source path passes locally and fails in CI. Copy fixtures to the output
directory and read them via AppContext.BaseDirectory instead; GoldenVectorTests shows the
pattern.
dotnet format --verify-no-changes is part of the CI gate and exits non-zero on style
warnings, not just whitespace. Run it before pushing; a build with zero warnings can still fail
that step.
Deployment
PostgreSQL 18 moved its data directory to /var/lib/postgresql, not /var/lib/postgresql/data
as in 17 and earlier. A compose file carried over from an older version silently gets an empty
volume — the database appears to work and loses everything on restart. Relevant to any compose
file other than deploy/docker-compose.dev.yml, which is already correct.
Keycloak in the dev stack listens on host port 18080, not 8080. On this machine an unrelated
Apache Tomcat holds 127.0.0.1:8080, and a loopback-specific bind wins over Docker's 0.0.0.0
publish when resolving localhost — so every realm request returned 404 while the container
looked healthy. If discovery fails against a locally-published container, check for another
process bound specifically to loopback before suspecting the container.
Sync:CursorSigningKey generates an ephemeral per-process key when unset. Fine for a single
node; on a multi-node deployment cursors issued by one node are rejected by another, so clients
resync from the beginning repeatedly. Must be configured explicitly before running more than one
instance. WarnOnRiskyConfiguration logs this at startup.
Rate limiting is not implemented yet (M2). POST /api/v1/me/enrollment and the sync endpoints
are reachable by any authenticated caller at any rate. Enrollment requires a valid access token
and is idempotent, so the exposure is resource consumption rather than a credential-guessing
surface — but it is still an unmetered write path.
/api/v1/me does not update last_seen_at_utc. Deliberate: a GET that writes on every call is
a smell, and nothing depends on the value yet. Revisit when device management lands, since that is
the first feature that needs it.