kubo icon indicating copy to clipboard operation
kubo copied to clipboard
verified publisher icon ipfs

HTTP fetch of fs-migrations should use CAR

Open lidel opened this issue 3 years ago • 0 comments

Version: 0.14.x

Fetching migration data from IPFS was added in https://github.com/ipfs/kubo/pull/8064, but we did not have https://github.com/ipfs/go-ipfs/pull/8758 at the time and HTTP fetch is still delegating trust to the gateway.

I consider that a bug: migrations should be fetched in trustless mode as a CAR by requesting them as ?format=car and verifying every block before applying the migration.

This allows us to use third-party gateways af fallback and/or in scenarios where ipfs.io is blocked by ISP etc.

lidel avatar Aug 02 '22 16:08 lidel