Release v0.42.0

.github/workflows/gotest.yml

@@ -43,7 +43,7 @@ jobs:
           make test_unit &&
             [[ ! $(jq -s -c 'map(select(.Action == "fail")) | .[]' test/unit/gotest.json) ]]
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         if: failure() || success()
         with:
           name: unittests

.github/workflows/sharness.yml

@@ -55,7 +55,7 @@ jobs:
           # increasing parallelism beyond 10 doesn't speed up the tests much
           PARALLEL: ${{ github.repository == 'ipfs/kubo' && 10 || 3 }}
       - name: Upload coverage report
-        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         if: failure() || success()
         with:
           name: sharness

.github/workflows/sync-release-assets.yml

@@ -26,7 +26,7 @@ jobs:
         with:
           node-version: 14
       - name: Sync the latest 5 github releases
-        uses: actions/github-script@v8
+        uses: actions/github-script@v9
         with:
           script: |
             const fs = require('fs').promises

AGENTS.md

@@ -79,6 +79,8 @@ make install         # install to $GOPATH/bin
 make -O test_go_lint # run linter (use this instead of golangci-lint directly)
 ```
 
+**Always build with `make build`, never `go build`.** The Makefile injects required `-ldflags` for `CurrentCommit`, `taggedRelease`, and `buildOrigin`.
+
 If you modify `go.mod` (add/remove/update dependencies), you must run `make mod_tidy` first, before building or testing. Use `make mod_tidy` instead of `go mod tidy` directly, as the project has multiple `go.mod` files.
 
 If you modify any `.go` files outside of `test/`, you must run `make build` before running integration tests.
@@ -230,3 +232,20 @@ ipfs shutdown              # graceful shutdown via API
 ```
 
 Kill dangling daemons before re-running tests: `pkill -f "ipfs daemon"`
+
+### Testing AutoTLS Locally
+
+AutoTLS only requests a `*.libp2p.direct` certificate once libp2p confirms the node is publicly reachable on a TCP port. For a local test the node must be able to open that port, so enable UPnP/NAT-PMP (the `server` init profile disables it via `Swarm.DisableNatPortMap: true`):
+
+```bash
+ipfs config --json Swarm.DisableNatPortMap false   # let UPnP/NAT-PMP map the swarm port
+ipfs config AutoTLS.RegistrationDelay 5s           # shorten the default wait before registration
+```
+
+Then start the daemon and watch the relevant logs:
+
+```bash
+GOLOG_LOG_LEVEL="error,autotls=info,nat=info" ipfs daemon
+```
+
+Poll `ipfs id` until a `tls/ws` address under your own peer ID appears. A `libp2p.direct` address ending in `/p2p-circuit/p2p/<your-id>` is a relay path, not your own AutoTLS cert. Requires a router that actually honors UPnP/NAT-PMP; without it AutoNAT reports `Private` and no certificate is issued.

CHANGELOG.md

@@ -1,5 +1,6 @@
 # Kubo Changelogs
 
+- [v0.43](docs/changelogs/v0.43.md)
 - [v0.42](docs/changelogs/v0.42.md)
 - [v0.41](docs/changelogs/v0.41.md)
 - [v0.40](docs/changelogs/v0.40.md)

Dockerfile

@@ -7,7 +7,7 @@
 # The default below is what `docker build .` (without --build-arg) uses, and
 # `.github/workflows/docker-check.yml` lints that this default stays in sync
 # with go.mod. When bumping Go, update both go.mod and this default together.
-ARG GO_VERSION=1.26.2
+ARG GO_VERSION=1.26.4
 FROM --platform=${BUILDPLATFORM:-linux/amd64} golang:${GO_VERSION} AS builder
 
 ARG TARGETOS TARGETARCH
@@ -97,10 +97,10 @@ ENV GOLOG_LOG_LEVEL=""
 # tini ensures proper signal handling and zombie process cleanup
 ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/start_ipfs"]
 
-# Health check verifies IPFS daemon is responsive.
-# Uses empty directory CID (QmUNLLsPACCz1vLxQVkXqqLX5R1X345qqfHbsf67hvA3Nn) as test
+# Health check via "ipfs diag healthy": verifies RPC + DAG pipeline, and
+# fails after SIGINT/SIGTERM to catch half-shutdown states.
 HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
-  CMD ipfs --api=/ip4/127.0.0.1/tcp/5001 dag stat /ipfs/QmUNLLsPACCz1vLxQVkXqqLX5R1X345qqfHbsf67hvA3Nn || exit 1
+  CMD ipfs --api=/ip4/127.0.0.1/tcp/5001 diag healthy > /dev/null 2>&1 || exit 1
 
 # Default: run IPFS daemon with auto-migration enabled
 CMD ["daemon", "--migrate=true", "--agent-version-suffix=docker"]

bin/mkreleaselog

@@ -607,7 +607,10 @@ statsummary() {
             Deletions: (map(.Deletions) | add),
             Files: (map(.Files) | add)
         }
-    ' | jq '. + {Lines: (.Deletions + .Insertions)}'
+    ' |
+        # Drop bot accounts (e.g. dependabot[bot]); GitHub bots use the [bot] suffix
+        jq 'select((.GitHub | endswith("[bot]")) or (.Author | endswith("[bot]")) | not)' |
+        jq '. + {Lines: (.Deletions + .Insertions)}'
 }
 
 strip_version() {

cmd/ipfs/Rules.mk

@@ -12,7 +12,7 @@ PATH := $(realpath $(d)):$(PATH)
 # DEPS_OO_$(d) += merkledag/pb/merkledag.pb.go namesys/pb/namesys.pb.go
 # DEPS_OO_$(d) += pin/internal/pb/header.pb.go unixfs/pb/unixfs.pb.go
 
-$(d)_flags =-ldflags="-X "github.com/ipfs/kubo".CurrentCommit=$(git-hash) -X "github.com/ipfs/kubo".taggedRelease=$(git-tag)"
+$(d)_flags =-ldflags="-X "github.com/ipfs/kubo".CurrentCommit=$(git-hash) -X "github.com/ipfs/kubo".taggedRelease=$(git-tag) -X "github.com/ipfs/kubo".buildOrigin=$(git-origin)"
 
 $(IPFS_BIN_$(d)): GOFLAGS += $(cmd/ipfs_flags)
 

cmd/ipfs/kubo/add_migrations.go

@@ -36,7 +36,7 @@ func addMigrations(ctx context.Context, node *core.IpfsNode, fetcher migrations.
 			if err != nil {
 				return err
 			}
-		case *migrations.HttpFetcher, *migrations.RetryFetcher: // https://github.com/ipfs/kubo/issues/8780
+		case *migrations.HttpFetcher: // https://github.com/ipfs/kubo/issues/8780
 			// Add the downloaded migration files directly
 			if migrations.DownloadDirectory != "" {
 				var paths []string

cmd/ipfs/kubo/daemon.go

@@ -31,6 +31,7 @@ import (
 	options "github.com/ipfs/kubo/core/coreiface/options"
 	corerepo "github.com/ipfs/kubo/core/corerepo"
 	libp2p "github.com/ipfs/kubo/core/node/libp2p"
+	"github.com/ipfs/kubo/core/shutdown"
 	nodeMount "github.com/ipfs/kubo/fuse/node"
 	fsrepo "github.com/ipfs/kubo/repo/fsrepo"
 	"github.com/ipfs/kubo/repo/fsrepo/migrations"
@@ -432,6 +433,12 @@ func daemonFunc(req *cmds.Request, re cmds.ResponseEmitter, env cmds.Environment
 		ipnsps = cfg.Ipns.UsePubsub.WithDefault(false)
 	}
 
+	// Resolve graceful-shutdown timeout. The generous 12h default leaves
+	// normal operation unchanged while guaranteeing the daemon cannot be
+	// stuck indefinitely on a hung FX OnStop hook. A value of 0 opts out
+	// entirely and restores the legacy "wait forever" behavior.
+	shutdownTimeout := max(cfg.Internal.ShutdownTimeout.WithDefault(config.DefaultShutdownTimeout), 0)
+
 	// Start assembling node config
 	ncfg := &core.BuildCfg{
 		Repo:                        repo,
@@ -442,6 +449,7 @@ func daemonFunc(req *cmds.Request, re cmds.ResponseEmitter, env cmds.Environment
 			"pubsub": pubsub,
 			"ipnsps": ipnsps,
 		},
+		ShutdownTimeout: shutdownTimeout,
 		// TODO(Kubuxu): refactor Online vs Offline by adding Permanent vs Ephemeral
 	}
 
@@ -512,9 +520,13 @@ func daemonFunc(req *cmds.Request, re cmds.ResponseEmitter, env cmds.Environment
 		return fmt.Errorf("unrecognized routing option: %s", routingOption)
 	}
 
-	// Set optional agent version suffix
+	// Resolve agent version suffix:
+	// Version.AgentSuffix > --agent-version-suffix > implicit (build origin).
 	versionSuffixFromCli, _ := req.Options[agentVersionSuffix].(string)
 	versionSuffix := cfg.Version.AgentSuffix.WithDefault(versionSuffixFromCli)
+	if versionSuffix == "" {
+		versionSuffix = version.ImplicitAgentSuffix()
+	}
 	if versionSuffix != "" {
 		version.SetUserAgentSuffix(versionSuffix)
 	}
@@ -583,6 +595,17 @@ take effect.
 	}
 
 	defer func() {
+		// Watchdog: if node.Close() does not return within shutdownTimeout,
+		// force-exit so orchestrators can restart the daemon.
+		// shutdownTimeout==0 disables the watchdog (wait forever).
+		if shutdownTimeout > 0 {
+			killSwitch := time.AfterFunc(shutdownTimeout, func() {
+				log.Errorf("shutdown watchdog: node.Close() did not return after %s; exiting", shutdownTimeout)
+				os.Exit(1)
+			})
+			defer killSwitch.Stop()
+		}
+
 		// We wait for the node to close first, as the node has children
 		// that it will wait for before closing, such as the API server.
 		node.Close()
@@ -708,6 +731,7 @@ take effect.
 	// Give the user some immediate feedback when they hit C-c
 	go func() {
 		<-req.Context.Done()
+		shutdown.MarkStarted()
 		notifyStopping()
 		fmt.Println("Received interrupt signal, shutting down...")
 		fmt.Println("(Hit ctrl-c again to force-shutdown the daemon.)")

config/internal.go

@@ -1,8 +1,19 @@
 package config
 
+import "time"
+
 const (
 	// DefaultMFSNoFlushLimit is the default limit for consecutive unflushed MFS operations
 	DefaultMFSNoFlushLimit = 256
+
+	// DefaultShutdownTimeout caps how long graceful shutdown is allowed to
+	// take before the daemon force-exits with status 1. Set generously so
+	// it does not change existing kubo behavior in practice but guarantees
+	// Docker / kubernetes infrastructure can never be stuck indefinitely
+	// on a hung FX OnStop hook. Smaller than the 22h DHT reprovide cycle,
+	// so a hung daemon recovers before missing more than one cycle.
+	// Set Internal.ShutdownTimeout to 0 to opt out and wait forever.
+	DefaultShutdownTimeout = 12 * time.Hour
 )
 
 type Internal struct {
@@ -18,6 +29,11 @@ type Internal struct {
 	// This is an EXPERIMENTAL feature and may change or be removed in future releases.
 	// See https://github.com/ipfs/kubo/issues/10842
 	MFSNoFlushLimit *OptionalInteger `json:",omitempty"`
+	// ShutdownTimeout caps how long graceful shutdown of the daemon is
+	// allowed to take. Defaults to DefaultShutdownTimeout. When the
+	// deadline expires the daemon logs which subsystem failed to close and
+	// exits with status 1. Set to 0 to disable the cap and wait forever.
+	ShutdownTimeout *OptionalDuration `json:",omitempty"`
 }
 
 type InternalBitswap struct {

config/provide.go

@@ -29,15 +29,16 @@ const (
 	MinProvideBloomFPRate = 1_000_000
 
 	// DHT provider defaults
-	DefaultProvideDHTInterval                 = 22 * time.Hour // https://github.com/ipfs/kubo/pull/9326
-	DefaultProvideDHTMaxWorkers               = 16             // Unified default for both sweep and legacy providers
-	DefaultProvideDHTSweepEnabled             = true
-	DefaultProvideDHTResumeEnabled            = true
-	DefaultProvideDHTDedicatedPeriodicWorkers = 2
-	DefaultProvideDHTDedicatedBurstWorkers    = 1
-	DefaultProvideDHTMaxProvideConnsPerWorker = 20
-	DefaultProvideDHTKeystoreBatchSize        = 1 << 14 // ~544 KiB per batch (1 multihash = 34 bytes)
-	DefaultProvideDHTOfflineDelay             = 2 * time.Hour
+	DefaultProvideDHTInterval                  = 22 * time.Hour // https://github.com/ipfs/kubo/pull/9326
+	DefaultProvideDHTMaxWorkers                = 16             // Unified default for both sweep and legacy providers
+	DefaultProvideDHTSweepEnabled              = true
+	DefaultProvideDHTResumeEnabled             = true
+	DefaultProvideDHTDedicatedPeriodicWorkers  = 2
+	DefaultProvideDHTDedicatedBurstWorkers     = 1
+	DefaultProvideDHTMaxProvideConnsPerWorker  = 20
+	DefaultProvideDHTKeystoreBatchSize         = 1 << 14 // ~544 KiB per batch (1 multihash = 34 bytes)
+	DefaultProvideDHTOfflineDelay              = 2 * time.Hour
+	DefaultProvideDHTSendProviderRecordTimeout = 10 * time.Second
 
 	// DefaultFastProvideTimeout is the maximum time allowed for fast-provide operations.
 	// Prevents hanging on network issues when providing root CID.
@@ -121,6 +122,13 @@ type ProvideDHT struct {
 	// Default: DefaultProvideDHTOfflineDelay
 	OfflineDelay *OptionalDuration `json:",omitempty"`
 
+	// SendProviderRecordTimeout sets the per-peer timeout applied to a single
+	// ADD_PROVIDER RPC. A peer that accepts the libp2p stream but never reads
+	// the request must not pin a provide worker goroutine indefinitely; this
+	// timeout bounds the wait (sweep mode only).
+	// Default: DefaultProvideDHTSendProviderRecordTimeout
+	SendProviderRecordTimeout *OptionalDuration `json:",omitempty"`
+
 	// ResumeEnabled controls whether the provider resumes from its previous state on restart.
 	// When enabled, the provider persists its reprovide cycle state and provide queue to the datastore,
 	// and restores them on restart. When disabled, the provider starts fresh on each restart.
@@ -209,6 +217,19 @@ func ValidateProvideConfig(cfg *Provide) error {
 		if interval < 0 {
 			return fmt.Errorf("Provide.DHT.Interval must be non-negative, got %v", interval)
 		}
+		// Provide.DHT.Interval=0 used to disable the entire provide system as a
+		// side effect. It now disables only the periodic reprovide schedule:
+		// new CIDs still announce via fast-provide-root and 'ipfs provide once'.
+		// Operators upgrading from earlier kubo versions must opt in to one of
+		// the two semantics by setting Provide.Enabled explicitly:
+		//   - Provide.Enabled=false fully disables providing (the old behaviour).
+		//   - Provide.Enabled=true keeps ad-hoc providing while disabling the
+		//     periodic reprovide schedule.
+		if interval == 0 && cfg.Enabled == Default {
+			return fmt.Errorf("Provide.DHT.Interval=0 no longer disables the provide system on its own; set Provide.Enabled explicitly: " +
+				"Provide.Enabled=false to fully disable providing, or Provide.Enabled=true to keep ad-hoc 'ipfs provide once' " +
+				"and fast-provide-root working while skipping the periodic reprovide schedule")
+		}
 	}
 
 	// Validate MaxWorkers
@@ -259,6 +280,14 @@ func ValidateProvideConfig(cfg *Provide) error {
 		}
 	}
 
+	// Validate SendProviderRecordTimeout
+	if !cfg.DHT.SendProviderRecordTimeout.IsDefault() {
+		timeout := cfg.DHT.SendProviderRecordTimeout.WithDefault(DefaultProvideDHTSendProviderRecordTimeout)
+		if timeout <= 0 {
+			return fmt.Errorf("Provide.DHT.SendProviderRecordTimeout must be positive, got %v", timeout)
+		}
+	}
+
 	return nil
 }
 

config/provide_test.go

@@ -155,21 +155,25 @@ func TestValidateProvideConfig_Interval(t *testing.T) {
 	tests := []struct {
 		name     string
 		interval time.Duration
+		enabled  Flag
 		wantErr  bool
 		errMsg   string
 	}{
-		{"valid default (22h)", 22 * time.Hour, false, ""},
-		{"valid max (48h)", 48 * time.Hour, false, ""},
-		{"valid small (1h)", 1 * time.Hour, false, ""},
-		{"valid zero (disabled)", 0, false, ""},
-		{"invalid over limit (49h)", 49 * time.Hour, true, "must be less than or equal to DHT provider record validity"},
-		{"invalid over limit (72h)", 72 * time.Hour, true, "must be less than or equal to DHT provider record validity"},
-		{"invalid negative", -1 * time.Hour, true, "must be non-negative"},
+		{"valid default (22h)", 22 * time.Hour, Default, false, ""},
+		{"valid max (48h)", 48 * time.Hour, Default, false, ""},
+		{"valid small (1h)", 1 * time.Hour, Default, false, ""},
+		{"valid zero with explicit Enabled=true", 0, True, false, ""},
+		{"valid zero with explicit Enabled=false", 0, False, false, ""},
+		{"invalid zero without explicit Provide.Enabled", 0, Default, true, "set Provide.Enabled explicitly"},
+		{"invalid over limit (49h)", 49 * time.Hour, Default, true, "must be less than or equal to DHT provider record validity"},
+		{"invalid over limit (72h)", 72 * time.Hour, Default, true, "must be less than or equal to DHT provider record validity"},
+		{"invalid negative", -1 * time.Hour, Default, true, "must be non-negative"},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			cfg := &Provide{
+				Enabled: tt.enabled,
 				DHT: ProvideDHT{
 					Interval: NewOptionalDuration(tt.interval),
 				},

core/builder.go

@@ -93,9 +93,21 @@ func NewNode(ctx context.Context, cfg *BuildCfg) (*IpfsNode, error) {
 	var stopErr error
 	n.stop = func() error {
 		once.Do(func() {
-			stopErr = app.Stop(context.Background())
+			// Bound app.Stop with a deadline so an FX OnStop hook that
+			// never returns cannot hang the daemon. ShutdownTimeout==0
+			// opts out of the cap entirely and restores the legacy
+			// behavior of waiting forever for hooks to complete. The
+			// daemon's watchdog in cmd/ipfs/kubo/daemon.go fires at the
+			// same deadline and is the unconditional os.Exit fallback.
+			stopCtx := context.Background()
+			if cfg.ShutdownTimeout > 0 {
+				var stopCancel context.CancelFunc
+				stopCtx, stopCancel = context.WithTimeout(stopCtx, cfg.ShutdownTimeout)
+				defer stopCancel()
+			}
+			stopErr = app.Stop(stopCtx)
 			if stopErr != nil {
-				log.Error("failure on stop: ", stopErr)
+				log.Errorf("failure on stop: %v", stopErr)
 			}
 			// Cancel the context _after_ the app has stopped.
 			cancel()