oxmc
685c14ba97
Node.js daemon: Ed25519 identity + self-signed TLS, signed registration/ renewal with the central registry, mDNS advertising, disk-backed fetch-through asset cache with an origin allowlist. Includes a local dev-registry stand-in for the real oxmc.me endpoints and an end-to-end smoke test (register -> token -> cache miss/hit -> SSRF rejection). See README.md for the full protocol and trust model.
pawletcache-dev-registry
Throwaway local stand-in for the oxmc.me /apis/aosp/cache/register and
/apis/aosp/cache/lookup endpoints documented in ../README.md. Exists so
pawletcache-server (and, separately, the Android CentralLookupClient) can
be exercised end-to-end without touching real oxmc.me infra or its actual
signing key.
Not production code. Two shortcuts that would be wrong on the real
oxmc.me:
lookup()hands back whichever server registered most recently, full stop — no public-IP/NAT matching, because on localhost there's no NAT to match. The real registry has to match the caller's public IP against a registered server's public IP (see main README's Apple-content-caching comparison).- Zero persistence hardening —
data/registrations.jsonis a flat JSON file, fine for a laptop, not for anything real.
Everything about the actual wire protocol (request/response shape, what's
signed, the CacheToken format) is the real thing, though — this is a
faithful implementation of the spec, just with a self-issued root key and a
dumb lookup().
Running
cd dev-registry
DEV_ENROLLMENT_TOKENS=dev-local-token node src/index.js
First run generates a root Ed25519 keypair under data/identity/ and prints
its public half — paste that into
android_packages_apps_PawletCache/src/os/pawlet/cache/Constants.kt's
CACHE_TRUST_ROOT_PUBKEY_BASE64 if you want a real device/emulator to trust
tokens this registry issues.
Env vars:
| Var | Default | |
|---|---|---|
DEV_REGISTRY_PORT |
4000 |
|
DEV_REGISTRY_DATA_DIR |
./data |
|
DEV_ENROLLMENT_TOKENS |
dev-local-token |
comma-separated allowlist |
DEV_TOKEN_TTL_MS |
600000 (10 min) |
short by default so you can actually see pawletcache-server's renewal loop fire during a normal test session |
Pointing pawletcache-server at it
In ../config.yml:
centralUrl: http://localhost:4000
enrollmentToken: dev-local-token
(Plain http:// — this dev registry doesn't bother with TLS; the real
oxmc.me obviously would. pawletcache-server's own asset-serving HTTPS
endpoint is unaffected either way, that's a separate TLS cert.)
See also
../scripts/smoke-test.sh — drives this registry + pawletcache-server
together and checks the whole register → token → cache flow with curl.