diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index be883e8..58d2c3b 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -3,7 +3,7 @@ name: Cross-platform build on: workflow_dispatch: push: - branches: [main] + branches: [main, codex/server-migration-20260917] permissions: contents: read diff --git a/AGENTS.md b/AGENTS.md index 7310225..f740b8c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -255,3 +255,20 @@ feed were signed with the existing local updater key and verified through public HTTPS downloads. See `docs/release-0.1.6.md` and its committed receipt. This records successful release/admission verification, not a Windows/macOS cold install or OS signing/notarization certification. + +## Server migration — launcher 0.1.7 (2026-09-17) + +Minigames Quick Play now uses the fixed native endpoint `shacraft.ru:25568`. +It no longer pins the retired server IP in the application binary. The Fabric +admission client accepts the new actual socket IP `135.106.219.182` and retains +`135.106.154.86` for the temporary forwarding path; unrelated hosts and ports +remain rejected. The server published updated signed companion manifests. + +The migration's full-platform packages are prepared on +`codex/server-migration-20260917`. Existing 0.1.6 installers still connect to the +old IP and need that forwarding path until upgraded. Version 0.1.7 uses a newly generated operator-held updater key and the fixed +`https://shacraft.ru/launcher/updates/stable-v2.json` channel. It requires one +manual installation. Preserve `stable.json` at the last old-key release; never +replace it with new-key metadata. Subsequent v2-channel releases use the new +key, kept only at `/home/emil/.local/share/shacraft-updater/production.key`. +Do not claim publication based on CI packages alone. diff --git a/admission-client/README.md b/admission-client/README.md index 13b2485..ae38e66 100644 --- a/admission-client/README.md +++ b/admission-client/README.md @@ -13,7 +13,7 @@ The native launcher supplies `SHACRAFT_ADMISSION_TICKET` and The client accepts a CONFIGURATION payload on `shacraft_admission:challenge` with three Minecraft UTF strings: server ID (16), nickname (16), nonce (43). It verifies server `minigames`, the exact current game nickname and actual -socket `135.106.154.86:25568`, then signs once with the ephemeral Ed25519 key. +socket `135.106.219.182:25568` (the previous IP remains accepted during migration), then signs once with the ephemeral Ed25519 key. The response on `shacraft_admission:proof` contains ticket (43) and standard Base64 signature (88). The transcript has no final newline: diff --git a/admission-client/src/main/java/ru/shacraft/admission/AdmissionProof.java b/admission-client/src/main/java/ru/shacraft/admission/AdmissionProof.java index 4187554..1e454ab 100644 --- a/admission-client/src/main/java/ru/shacraft/admission/AdmissionProof.java +++ b/admission-client/src/main/java/ru/shacraft/admission/AdmissionProof.java @@ -62,6 +62,6 @@ public final class AdmissionProof { if (allowLoopback && (host.equals("127.0.0.1") || host.equals("::1") || host.equals("[::1]") || host.equals("0:0:0:0:0:0:0:1"))) { return port > 0 && port <= 65535; } - return port == 25568 && (host.equalsIgnoreCase("shacraft.ru") || host.equals("135.106.154.86")); + return port == 25568 && (host.equalsIgnoreCase("shacraft.ru") || host.equals("135.106.154.86") || host.equals("135.106.219.182")); } } diff --git a/admission-client/src/test/java/ru/shacraft/admission/AdmissionProofTest.java b/admission-client/src/test/java/ru/shacraft/admission/AdmissionProofTest.java index 560e1e7..906c5e2 100644 --- a/admission-client/src/test/java/ru/shacraft/admission/AdmissionProofTest.java +++ b/admission-client/src/test/java/ru/shacraft/admission/AdmissionProofTest.java @@ -23,7 +23,11 @@ class AdmissionProofTest { assertThrows(IllegalArgumentException.class,()->AdmissionProof.transcript(v[0],v[1],v[2],v[3])); } @Test void trustsOnlyMinigamesSocketAndExplicitLocalTests() { + assertTrue(AdmissionProof.allowedTarget("shacraft.ru",25568,false)); + assertTrue(AdmissionProof.allowedTarget("135.106.219.182",25568,false)); assertTrue(AdmissionProof.allowedTarget("135.106.154.86",25568,false)); + assertFalse(AdmissionProof.allowedTarget("135.106.219.183",25568,false)); + assertFalse(AdmissionProof.allowedTarget("135.106.219.182",25567,false)); assertFalse(AdmissionProof.allowedTarget("135.106.154.86",25567,false)); assertFalse(AdmissionProof.allowedTarget("127.0.0.1",25568,false)); assertTrue(AdmissionProof.allowedTarget("127.0.0.1",25570,true)); diff --git a/docs/launcher-architecture.md b/docs/launcher-architecture.md index d1a06f8..a40936c 100644 --- a/docs/launcher-architecture.md +++ b/docs/launcher-architecture.md @@ -359,3 +359,20 @@ The integration is staged until server authentication, signed profile payload, and a newer signed launcher release are deployed and checked together. The existing public 0.1.5 binary cannot select the new profile by a website-only catalog change. Preserve both catalog entries when publishing either profile. + +## Server migration — launcher 0.1.7 (2026-09-17) + +Minigames Quick Play now uses the fixed native endpoint `shacraft.ru:25568`. +It no longer pins the retired server IP in the application binary. The Fabric +admission client accepts the new actual socket IP `135.106.219.182` and retains +`135.106.154.86` for the temporary forwarding path; unrelated hosts and ports +remain rejected. The server published updated signed companion manifests. + +The migration's full-platform packages are prepared on +`codex/server-migration-20260917`. Existing 0.1.6 installers still connect to the +old IP and need that forwarding path until upgraded. Version 0.1.7 uses a newly generated operator-held updater key and the fixed +`https://shacraft.ru/launcher/updates/stable-v2.json` channel. It requires one +manual installation. Preserve `stable.json` at the last old-key release; never +replace it with new-key metadata. Subsequent v2-channel releases use the new +key, kept only at `/home/emil/.local/share/shacraft-updater/production.key`. +Do not claim publication based on CI packages alone. diff --git a/docs/launcher-updates.md b/docs/launcher-updates.md index 42645be..2258648 100644 --- a/docs/launcher-updates.md +++ b/docs/launcher-updates.md @@ -1,3 +1,8 @@ +> From 0.1.7, new installations trust the new operator key and use +> `https://shacraft.ru/launcher/updates/stable-v2.json`. Migration from 0.1.6 +> requires manual installation. Keep the old `stable.json` feed unchanged. +> For future releases use `stable-v2.json` in publication commands below. + # Signed launcher updates The application updater is separate from the signed Aeronautics modpack diff --git a/package-lock.json b/package-lock.json index ae523a3..4350bc6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "shacraft-launcher-ui", - "version": "0.1.6", + "version": "0.1.7", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "shacraft-launcher-ui", - "version": "0.1.6", + "version": "0.1.7", "dependencies": { "@tauri-apps/api": "2.11.1", "lucide-react": "1.41.0", diff --git a/package.json b/package.json index 455916e..c7812d2 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,7 @@ "name": "shacraft-launcher-ui", "license": "MIT", "private": true, - "version": "0.1.6", + "version": "0.1.7", "type": "module", "scripts": { "dev": "vite", diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock index 904b50a..08d2209 100644 --- a/src-tauri/Cargo.lock +++ b/src-tauri/Cargo.lock @@ -3361,7 +3361,7 @@ dependencies = [ [[package]] name = "shacraft-launcher" -version = "0.1.6" +version = "0.1.7" dependencies = [ "base64 0.22.1", "ed25519-dalek", diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml index 98ff6d0..5e22711 100644 --- a/src-tauri/Cargo.toml +++ b/src-tauri/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "shacraft-launcher" -version = "0.1.6" +version = "0.1.7" description = "ShaCraft Minecraft launcher" authors = ["ShaCraft"] license = "MIT" diff --git a/src-tauri/src/launch.rs b/src-tauri/src/launch.rs index 42040b9..403c569 100644 --- a/src-tauri/src/launch.rs +++ b/src-tauri/src/launch.rs @@ -247,7 +247,7 @@ fn build_command(request: &LaunchRequest) -> Result { } // This endpoint is native-owned; a manifest cannot redirect game admission. if request.admission.server_id() == "minigames" { - command.args(["--quickPlayMultiplayer", "135.106.154.86:25568"]); + command.args(["--quickPlayMultiplayer", "shacraft.ru:25568"]); } command.current_dir(request.profile_dir); @@ -313,7 +313,7 @@ mod tests { assert!(arguments .windows(2) .any(|args| args == ["--accessToken", "0"])); - assert_eq!(arguments.windows(2).any(|pair| pair == ["--quickPlayMultiplayer", "135.106.154.86:25568"]), server_id == "minigames"); + assert_eq!(arguments.windows(2).any(|pair| pair == ["--quickPlayMultiplayer", "shacraft.ru:25568"]), server_id == "minigames"); for secret in proof { assert!(arguments.iter().all(|argument| !argument.contains(secret))); for path in [ diff --git a/src-tauri/src/updater.rs b/src-tauri/src/updater.rs index f8e9a3a..75bfc1a 100644 --- a/src-tauri/src/updater.rs +++ b/src-tauri/src/updater.rs @@ -14,7 +14,7 @@ use tauri::{AppHandle, Manager, Runtime}; use tauri_plugin_updater::{Update, UpdaterBuilder, UpdaterExt}; use url::Url; -pub(crate) const UPDATE_ENDPOINT: &str = "https://shacraft.ru/launcher/updates/stable.json"; +pub(crate) const UPDATE_ENDPOINT: &str = "https://shacraft.ru/launcher/updates/stable-v2.json"; pub(crate) const MAX_METADATA_BYTES: usize = 192 * 1024; const MAX_PAYLOAD_BYTES: usize = 64 * 1024; pub(crate) const MAX_ARTIFACT_BYTES: usize = 256 * 1024 * 1024; diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json index daae003..1f4c61c 100644 --- a/src-tauri/tauri.conf.json +++ b/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "ShaCraft Launcher", - "version": "0.1.6", + "version": "0.1.7", "identifier": "ru.shacraft.launcher", "build": { "beforeDevCommand": "npm run dev", @@ -49,9 +49,9 @@ }, "plugins": { "updater": { - "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IDk0N0MzODEwMjg1OUVCNDEKUldSQjYxa29FRGg4bEdKSkFWUzZUNDZhRFN4cGIwL0FvVnl0blhrOWtSMWhSOWxHMkU1aGs5L2oK", + "pubkey": "dW50cnVzdGVkIGNvbW1lbnQ6IG1pbmlzaWduIHB1YmxpYyBrZXk6IEY3NUEyMDIwOUM3QTFFRTYKUldUbUhucWNJQ0JhOTFnUUo4d0Rmc1JxOVdyRElCYTRranJKRzZEYzloRGNXQ09NL1kvN042OEsK", "endpoints": [ - "https://shacraft.ru/launcher/updates/stable.json" + "https://shacraft.ru/launcher/updates/stable-v2.json" ], "windows": { "installMode": "passive"