eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use native iroh-blobs for CAS fetches

Browse source
This commit is contained in:
Eric Wendland 2026-05-22 16:10:40 +02:00
commit 72f28224ce
7 changed files with 199 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

23
README.md
View file

@ -192,18 +192,17 @@ imported peer card and exchange a signed candidate-only peer-card ping.
`geth peer auth-check <node-id> <resource> <capability>` sends a protected
Iroh control request: the remote daemon verifies that the caller's signed peer
card binds the actual Iroh EndpointID before reducing resource-local auth ops.
`geth cas fetch <node-id> <hash>` uses the same protected Iroh control path to
request a blob from a peer. The remote daemon only returns bytes when the caller
has `cas.fetch` on `resource:cas:local`, and the caller verifies that the bytes
hash to the requested BLAKE3 CAS hash before storing them locally. Successful
fetches record the serving peer as a local provider, visible with
`geth cas providers <hash>`. This is the bootstrap transfer path; future work
will move provider/fetch behavior to `iroh-blobs`. `geth-iroh` is now pinned to
`iroh 0.95.1` and compiles the native backend libraries `iroh-blobs 0.97.0`,
`iroh-docs 0.95.0`, and `iroh-gossip 0.95.0` against the same daemon-owned
endpoint generation. `geth status` reports those backends as ready to wire; the
module implementations still use the explicit bootstrap control path until the
module-specific migrations replace it.
`geth cas fetch <node-id> <hash>` uses the same protected Iroh control path as
an authorization preflight. The remote daemon verifies the caller's signed peer
card against the observed Iroh EndpointID and requires `cas.fetch` on
`resource:cas:local`. After that preflight succeeds, the requester fetches the
blob payload over native `iroh-blobs` (`/iroh-bytes/4`) on the same daemon-owned
Iroh endpoint, verifies the BLAKE3 hash, stores it in local CAS, and records the
serving peer as a provider visible with `geth cas providers <hash>`.
`geth-iroh` is pinned to `iroh 0.95.1` and compiles the native backend
libraries `iroh-blobs 0.97.0`, `iroh-docs 0.95.0`, and `iroh-gossip 0.95.0`
against the same daemon-owned endpoint generation. KV and pubsub still use their
documented bootstrap equivalents until their native protocol migrations land.
Remote resource commands that accept `--bearer-secret` can also authorize with a
resource-scoped bearer proof generated from the private bearer token returned at
creation time. The persisted auth log stores a public bearer id and token