V6.2.5

go/chat/giphy/search.go

@@ -173,10 +173,14 @@ func Asset(mctx libkb.MetaContext, sourceURL string) (res io.ReadCloser, length
 	}
 	req.Header.Add("Accept", "image/*")
 	req.Host = MediaHost
-	resp, err := ctxhttp.Do(mctx.Ctx(), WebClient(mctx), req)
+	resp, err := ctxhttp.Do(mctx.Ctx(), AssetClient(mctx), req)
 	if err != nil {
 		return nil, 0, err
 	}
+
+	if resp.StatusCode != 200 {
+		return nil, 0, fmt.Errorf("Status %s", resp.Status)
+	}
 	return resp.Body, resp.ContentLength, nil
 }
 

go/chat/unfurl/packager.go

@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net/http"
 	"strings"
 
 	"github.com/keybase/client/go/avatars"
@@ -57,10 +58,20 @@ func (p *Packager) assetFilename(url string) string {
 }
 
 func (p *Packager) assetBodyAndLength(ctx context.Context, url string) (body io.ReadCloser, size int64, err error) {
-	resp, err := libkb.ProxyHTTPGet(p.G().ExternalG(), p.G().Env, url, "UnfurlPackager")
+	client := libkb.ProxyHTTPClient(p.G().ExternalG(), p.G().Env, "UnfurlPackager")
+	req, err := http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		return nil, 0, err
+	}
+	req.Header.Add("User-Agent", libkb.UserAgent)
+
+	resp, err := client.Do(req)
 	if err != nil {
 		return body, size, err
 	}
+	if resp.StatusCode != 200 {
+		return nil, 0, fmt.Errorf("Status %s", resp.Status)
+	}
 	return resp.Body, resp.ContentLength, nil
 }
 

go/kbfs/libkbfs/md_ops.go

@@ -26,14 +26,10 @@ import (
 )
 
 const (
-	maxAllowedMerkleGapServer = 13 * time.Hour
-	// Our contract with the server states that it won't accept KBFS
-	// writes if more than 13 hours have passed since the last Merkle
-	// roots (both global and KBFS) were published.  Add some padding
-	// to that, and if we see any gaps larger than this, we will know
-	// we shouldn't be trusting the server.  TODO: reduce this once
-	// merkle computation is faster.
-	maxAllowedMerkleGap = maxAllowedMerkleGapServer + 15*time.Minute
+	// Update 2024-02-16: we decided to increase the merkle gap check to 4 days
+	// in case mdmerkle goes down, to give us more time to fix it.
+	maxAllowedMerkleGapServer = 4 * (time.Hour * 24)
+	maxAllowedMerkleGap       = maxAllowedMerkleGapServer + 15*time.Minute
 
 	// merkleGapEnforcementStartString indicates when the mdserver
 	// started rejecting new writes based on the lack of recent merkle

go/libkb/ca.go

@@ -41,42 +41,39 @@ func GetBundledCAsFromHost(host string) (rootCA []byte, ok bool) {
 
 const APICA = `
 -----BEGIN CERTIFICATE-----
-MIIGmzCCBIOgAwIBAgIJAPzhpcIBaOeNMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYD
+MIIGIzCCBAugAwIBAgIJAPzhpcIBaOeNMA0GCSqGSIb3DQEBCwUAMIGMMQswCQYD
 VQQGEwJVUzELMAkGA1UECBMCTlkxETAPBgNVBAcTCE5ldyBZb3JrMRQwEgYDVQQK
-EwtLZXliYXNlIExMQzEXMBUGA1UECxMOQ2VydCBBdXRob3JpdHkxEzARBgNVBAMT
-CmtleWJhc2UuaW8xHDAaBgkqhkiG9w0BCQEWDWNhQGtleWJhc2UuaW8wHhcNMTQw
-MTAyMTY0MjMzWhcNMjMxMjMxMTY0MjMzWjCBjzELMAkGA1UEBhMCVVMxCzAJBgNV
-BAgTAk5ZMREwDwYDVQQHEwhOZXcgWW9yazEUMBIGA1UEChMLS2V5YmFzZSBMTEMx
-FzAVBgNVBAsTDkNlcnQgQXV0aG9yaXR5MRMwEQYDVQQDEwprZXliYXNlLmlvMRww
-GgYJKoZIhvcNAQkBFg1jYUBrZXliYXNlLmlvMIICIjANBgkqhkiG9w0BAQEFAAOC
-Ag8AMIICCgKCAgEA3sLA6ZG8uOvmlFvFLVIOURmcQrZyMFKbVu9/TeDiemls3w3/
-JzVTduD+7KiUi9R7QcCW/V1ZpReTfunm7rfACiJ1fpIkjSQrgsvKDLghIzxIS5FM
-I8utet5p6QtuJhaAwmmXn8xX05FvqWNbrcXRdpL4goFdigPsFK2xhTUiWatLMste
-oShI7+zmrgkx75LeLMD0bL2uOf87JjOzbY8x2sUIZLGwPoATyG8WS38ey6KkJxRj
-AhG3p+OTYEjYSrsAtQA6ImbeDpfSHKOB8HF3nVp//Eb4HEiEsWwBRbQXvAWh3DYL
-GukFW0wiO0HVCoWY+bHL/Mqa0NdRGOlLsbL4Z4pLrhqKgSDU8umX9YuNRRaB0P5n
-TkzyU6axHqzq990Gep/I62bjsBdYYp+DjSPK43mXRrfWJl2NTcl8xKAyfsOW+9hQ
-9vwK0tpSicNxfYuUZs0BhfjSZ/Tc6Z1ERdgUYRiXTtohl+SRA2IgZMloHCllVMNj
-EjXhguvHgLAOrcuyhVBupiUQGUHQvkMsr1Uz8VPNDFOJedwucRU2AaR881bknnSb
-ds9+zNLsvUFV+BK7Qdnt/WkFpYL78rGwY47msi9Ooddx6fPyeg3qkJGM6cwn/boy
-w9lQeleYDq8kyJdixIAxtAskNzRPJ4nDu2izTfByQoM8epwAWboc/gNFObMCAwEA
-AaOB9zCB9DAdBgNVHQ4EFgQURqpATOw1gVVrzlqqFKbkfaKXvwowgcQGA1UdIwSB
-vDCBuYAURqpATOw1gVVrzlqqFKbkfaKXvwqhgZWkgZIwgY8xCzAJBgNVBAYTAlVT
-MQswCQYDVQQIEwJOWTERMA8GA1UEBxMITmV3IFlvcmsxFDASBgNVBAoTC0tleWJh
-c2UgTExDMRcwFQYDVQQLEw5DZXJ0IEF1dGhvcml0eTETMBEGA1UEAxMKa2V5YmFz
-ZS5pbzEcMBoGCSqGSIb3DQEJARYNY2FAa2V5YmFzZS5pb4IJAPzhpcIBaOeNMAwG
-A1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADggIBAA3Z5FIhulYghMuHdcHYTYWc
-7xT5WD4hXQ0WALZs4p5Y+b2Af54o6v1wUE1Au97FORq5CsFXX/kGl/JzzTimeucn
-YJwGuXMpilrlHCBAL5/lSQjA7qbYIolQ3SB9ON+LYuF1jKB9k8SqNp7qzucxT3tO
-b8ZMDEPNsseC7NE2uwNtcW3yrTh6WZnSqg/jwswiWjHYDdG7U8FjMYlRol3wPux2
-PizGbSgiR+ztI2OthxtxNWMrT9XKxNQTpcxOXnLuhiSwqH8PoY17ecP8VPpaa0K6
-zym0zSkbroqydazaxcXRk3eSlc02Ktk7HzRzuqQQXhRMkxVnHbFHgGsz03L533pm
-mlIEgBMggZkHwNvs1LR7f3v2McdKulDH7Mv8yyfguuQ5Jxxt7RJhUuqSudbEhoaM
-6jAJwBkMFxsV2YnyFEd3eZ/qBYPf7TYHhyzmHW6WkSypGqSnXd4gYpJ8o7LxSf4F
-inLjxRD+H9Xn1UVXWLM0gaBB7zZcXd2zjMpRsWgezf5IR5vyakJsc7fxzgor3Qeq
-Ri6LvdEkhhFVl5rHMQBwNOPngySrq8cs/ikTLTfQVTYXXA4Ba1YyiMOlfaR1LhKw
-If1AkUV0tfCTNRZ01EotKSK77+o+k214n+BAu+7mO+9B5Kb7lMFQcuWCHXKYB2Md
-cT7Yh09F0QpFUd0ymEfv
+EwtLZXliYXNlIExMQzEXMBUGA1UECxMOQ2VydCBBdXRob3JpdHkxLjAsBgNVBAMM
+JWtleWJhc2UuaW8vZW1haWxBZGRyZXNzPWNhQGtleWJhc2UuaW8wIBcNMjMxMjMx
+MTkwMzE5WhgPNjAyMzEyMzExOTAzMTlaMIGMMQswCQYDVQQGEwJVUzELMAkGA1UE
+CBMCTlkxETAPBgNVBAcTCE5ldyBZb3JrMRQwEgYDVQQKEwtLZXliYXNlIExMQzEX
+MBUGA1UECxMOQ2VydCBBdXRob3JpdHkxLjAsBgNVBAMMJWtleWJhc2UuaW8vZW1h
+aWxBZGRyZXNzPWNhQGtleWJhc2UuaW8wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAw
+ggIKAoICAQDewsDpkby46+aUW8UtUg5RGZxCtnIwUptW739N4OJ6aWzfDf8nNVN2
+4P7sqJSL1HtBwJb9XVmlF5N+6ebut8AKInV+kiSNJCuCy8oMuCEjPEhLkUwjy616
+3mnpC24mFoDCaZefzFfTkW+pY1utxdF2kviCgV2KA+wUrbGFNSJZq0syy16hKEjv
+7OauCTHvkt4swPRsva45/zsmM7NtjzHaxQhksbA+gBPIbxZLfx7LoqQnFGMCEben
+45NgSNhKuwC1ADoiZt4Ol9Ico4HwcXedWn/8RvgcSISxbAFFtBe8BaHcNgsa6QVb
+TCI7QdUKhZj5scv8yprQ11EY6UuxsvhnikuuGoqBINTy6Zf1i41FFoHQ/mdOTPJT
+prEerOr33QZ6n8jrZuOwF1hin4ONI8rjeZdGt9YmXY1NyXzEoDJ+w5b72FD2/ArS
+2lKJw3F9i5RmzQGF+NJn9NzpnURF2BRhGJdO2iGX5JEDYiBkyWgcKWVUw2MSNeGC
+68eAsA6ty7KFUG6mJRAZQdC+QyyvVTPxU80MU4l53C5xFTYBpHzzVuSedJt2z37M
+0uy9QVX4ErtB2e39aQWlgvvysbBjjuayL06h13Hp8/J6DeqQkYzpzCf9ujLD2VB6
+V5gOryTIl2LEgDG0CyQ3NE8nicO7aLNN8HJCgzx6nABZuhz+A0U5swIDAQABo4GD
+MIGAMA4GA1UdDwEB/wQEAwIChDAdBgNVHSUEFjAUBggrBgEFBQcDAgYIKwYBBQUH
+AwEwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQURqpATOw1gVVrzlqqFKbkfaKX
+vwowHwYDVR0jBBgwFoAURqpATOw1gVVrzlqqFKbkfaKXvwowDQYJKoZIhvcNAQEL
+BQADggIBALjuBecPwt0XJ6rpygOt9r1O6Oyj6WshzD2OvsK/RoHCJLjI32V8xYt3
+YubUdFucy5m6dUEeTo6LwDd/7UpX+7NImQdRssHk6GynJJ7Sd2Jqvzlh6t+xFJHG
+WqRt/u48T9Bm7pw1Z79QAXXi1L9DnPz8nMzu6gVTS2dzG4FAjXwzKsYV6mLoQW0L
+adLKQELboM5hCauSILncD9ujWBZduFr7o4eHrRaZ4FiZ/46nGn/lqDhFTtgvSL53
++thrAiQCVv7sGkg8Niu3WTuJtIDlXzjGFuGli/l9KI9Dnr+RBe1kileQ99VZmayA
+PgVFzkicAEd5ZzGnADGWAW0nSA8tOxAyo3qnnJ6Z1e2mNflmGv6+cryIkksfDu7A
+oQuFQW0E3wEDmBXFHAGWgNKZQ05nxPY6zDm3FQCzS3v6CZuyJ8iwpDTKZYp4azPb
+WLef0IJCGB62/+6YwD3bUunFq6jUR/vCgc5WRrLQd4LAbrrrP8SaLNPIlapZkYIU
+Ba88Cg+nfTa7s0ETEJDNV+UyEoZbAMhcjCbua+aMx66WA+iinmZ++ilXxlBPNyFM
+XNpVqc8i9YuN5ASXKwR0nna/vFyr2sFYhV/Q+QIBUh6bwZEFF9f3qtgxi908ZSEC
+ip88muP7dUJ5jR/XrBLdYqrnMFym5dyHN7AjBdTwjSkTtFKHjAxb
 -----END CERTIFICATE-----
 `
 

go/libkb/proxy.go

@@ -295,18 +295,23 @@ func ProxyDialWithOpts(ctx context.Context, env *Env, network string, address st
 	}
 }
 
-// The equivalent of http.Get except it uses the proxy configured in Env
-// `instrumentationTag` should be a static tag for all requests identifying the
-// type of request we are proxying so we don't leak URL information to the
-// instrumenter.
-func ProxyHTTPGet(g *GlobalContext, env *Env, u, instrumentationTag string) (*http.Response, error) {
+func ProxyHTTPClient(g *GlobalContext, env *Env, instrumentationTag string) *http.Client {
 	xprt := NewInstrumentedRoundTripper(g, func(*http.Request) string { return instrumentationTag },
 		&http.Transport{
 			Proxy: MakeProxy(env),
 		})
 	client := &http.Client{
 		Transport: xprt,
 	}
+	return client
+}
+
+// The equivalent of http.Get except it uses the proxy configured in Env
+// `instrumentationTag` should be a static tag for all requests identifying the
+// type of request we are proxying so we don't leak URL information to the
+// instrumenter.
+func ProxyHTTPGet(g *GlobalContext, env *Env, u, instrumentationTag string) (*http.Response, error) {
+	client := ProxyHTTPClient(g, env, instrumentationTag)
 	return client.Get(u)
 }
 

go/libkb/version.go

@@ -4,4 +4,4 @@
 package libkb
 
 // Version is the current version (should be MAJOR.MINOR.PATCH)
-const Version = "6.2.3"
+const Version = "6.2.5"

go/teams/hidden/loader.go

@@ -10,7 +10,7 @@ import (
 )
 
 const (
-	MaxDelayInCommittingHiddenLinks = 7 * 24 * time.Hour
+	MaxDelayInCommittingHiddenLinks = 30 * 24 * time.Hour
 )
 
 // LoaderPackage contains a snapshot of the hidden team chain, used during the process of loading a team.

shared/android/app/build.gradle

@@ -5,7 +5,7 @@ import com.android.build.OutputFile
 import org.apache.tools.ant.taskdefs.condition.Os
 
 // KB: app version
-def VERSION_NAME = "6.2.3"
+def VERSION_NAME = "6.2.5"
 
 /**
  * The react.gradle file registers a task for each build variant (e.g. bundleDebugJsAndAssets

shared/desktop/yarn-helper/index.tsx

@@ -54,7 +54,9 @@ const commands = {
 }
 
 const patch = () => {
-  exec('patch-package')
+  try {
+    exec('patch-package')
+  } catch {}
 }
 
 const prepareSubmodules = () => {

shared/ios/Keybase/Info.plist

@@ -17,7 +17,7 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>6.2.3</string>
+	<string>6.2.5</string>
 	<key>CFBundleSignature</key>
 	<string>????</string>
 	<key>CFBundleURLTypes</key>

shared/ios/KeybaseShare/Info.plist

@@ -17,7 +17,7 @@
         <key>CFBundlePackageType</key>
         <string>XPC!</string>
         <key>CFBundleShortVersionString</key>
-        <string>6.2.3</string>
+        <string>6.2.5</string>
         <key>CFBundleVersion</key>
         <string>1</string>
         <key>NSExtension</key>

shared/ios/Podfile

@@ -45,6 +45,7 @@ target 'Keybase' do
       installer.pods_project.targets.each do |target|
             target.build_configurations.each do |config|
                 config.build_settings['CODE_SIGN_IDENTITY'] = ''
+                config.build_settings['GCC_PREPROCESSOR_DEFINITIONS'] ||= ['$(inherited)', '_LIBCPP_ENABLE_CXX17_REMOVED_UNARY_BINARY_FUNCTION']
             end
       end
   end

shared/ios/Podfile.lock

@@ -492,10 +492,10 @@ PODS:
   - Yoga (1.14.0)
   - YogaKit (1.18.1):
     - Yoga (~> 1.14)
-  - ZXingObjC/Core (3.6.5)
-  - ZXingObjC/OneD (3.6.5):
+  - ZXingObjC/Core (3.6.9)
+  - ZXingObjC/OneD (3.6.9):
     - ZXingObjC/Core
-  - ZXingObjC/PDF417 (3.6.5):
+  - ZXingObjC/PDF417 (3.6.9):
     - ZXingObjC/Core
 
 DEPENDENCIES:
@@ -760,7 +760,7 @@ EXTERNAL SOURCES:
     :path: "../node_modules/react-native/ReactCommon/yoga"
 
 SPEC CHECKSUMS:
-  boost: a7c83b31436843459a1961bfd74b96033dc77234
+  boost: aa35e27b639bf67de7573b279486f84a3c6546c2
   CocoaAsyncSocket: 065fd1e645c7abab64f7a6a2007a48038fdc6a99
   DoubleConversion: 5189b271737e1565bdce30deb4a08d647e3f5f54
   EXApplication: 034b1c40a8e9fe1bff76a1e511ee90dff64ad834
@@ -849,8 +849,8 @@ SPEC CHECKSUMS:
   UMAppLoader: 354d71d2d2ce8d6c19fb13d72b9c8209b18a8c56
   Yoga: d6133108734e69e8c0becc6ba587294b94829687
   YogaKit: f782866e155069a2cca2517aafea43200b01fd5a
-  ZXingObjC: fdbb269f25dd2032da343e06f10224d62f537bdb
+  ZXingObjC: 8898711ab495761b2dbbdec76d90164a6d7e14c5
 
-PODFILE CHECKSUM: 1a2449ff77770a4411ba151e252afb8c552a1745
+PODFILE CHECKSUM: 547372ce31b7066a60f8e0c910c0419bc491a307
 
-COCOAPODS: 1.13.0
+COCOAPODS: 1.14.3

shared/patches/expo-modules-core+1.1.1.patch

@@ -0,0 +1,18 @@
+diff --git a/node_modules/expo-modules-core/android/build.gradle b/node_modules/expo-modules-core/android/build.gradle
+index e0dfb67..4f990ca 100644
+--- a/node_modules/expo-modules-core/android/build.gradle
++++ b/node_modules/expo-modules-core/android/build.gradle
+@@ -383,9 +383,10 @@ task prepareHermes() {
+
+ def downloadBoost = tasks.create('downloadBoost', Download) {
+   dependsOn(createNativeDepsDirectories)
+-  def srcUrl = REACT_NATIVE_TARGET_VERSION >= 69
+-    ? "https://boostorg.jfrog.io/artifactory/main/release/${BOOST_VERSION.replace("_", ".")}/source/boost_${BOOST_VERSION}.tar.gz"
+-    : "https://github.com/react-native-community/boost-for-react-native/releases/download/v${BOOST_VERSION.replace("_", ".")}-0/boost_${BOOST_VERSION}.tar.gz"
++  def srcUrl = "https://sourceforge.net/projects/boost/files/boost/${BOOST_VERSION.replace("_", ".")}/boost_${BOOST_VERSION}.tar.gz"
++  //def srcUrl = REACT_NATIVE_TARGET_VERSION >= 69
++  //  ? "https://sourceforge.net/projects/boost/files/boost/${BOOST_VERSION.replace("_", ".")}/boost_${BOOST_VERSION}.tar.gz"
++  //  : "https://github.com/react-native-community/boost-for-react-native/releases/download/v${BOOST_VERSION.replace("_", ".")}-0/boost_${BOOST_VERSION}.tar.gz"
+   src(srcUrl)
+   onlyIfNewer(true)
+   overwrite(false)

shared/patches/react-native+0.70.7.patch → shared/patches/react-native+0.70.8.patch

@@ -28,3 +28,16 @@ index 69e6309..cc802af 100644
    horizontallyInverted: {
      transform: [{scaleX: -1}],
    },
+diff --git a/node_modules/react-native/third-party-podspecs/boost.podspec b/node_modules/react-native/third-party-podspecs/boost.podspec
+index 2f1fcc4..2377c4e 100644
+--- a/node_modules/react-native/third-party-podspecs/boost.podspec
++++ b/node_modules/react-native/third-party-podspecs/boost.podspec
+@@ -10,7 +10,7 @@ Pod::Spec.new do |spec|
+   spec.homepage = 'http://www.boost.org'
+   spec.summary = 'Boost provides free peer-reviewed portable C++ source libraries.'
+   spec.authors = 'Rene Rivera'
+-  spec.source = { :http => 'https://boostorg.jfrog.io/artifactory/main/release/1.76.0/source/boost_1_76_0.tar.bz2',
++  spec.source = { :http => 'https://sourceforge.net/projects/boost/files/boost/1.76.0/boost_1_76_0.tar.bz2',
+                   :sha256 => 'f0397ba6e982c4450f27bf32a2a83292aba035b827a5623a14636ea583318c41' }
+
+   # Pinning to the same version as React.podspec.

shared/patches/react-native-reanimated+3.0.1.patch

@@ -0,0 +1,14 @@
+diff --git a/node_modules/react-native-reanimated/android/build.gradle b/node_modules/react-native-reanimated/android/build.gradle
+index da7ee4e..afa85a3 100644
+--- a/node_modules/react-native-reanimated/android/build.gradle
++++ b/node_modules/react-native-reanimated/android/build.gradle
+@@ -749,7 +749,8 @@ if (REACT_NATIVE_MINOR_VERSION < 71) {
+     task downloadBoost(dependsOn: resolveBoost, type: Download) {
+         def transformedVersion = BOOST_VERSION.replace("_", ".")
+         def artifactLocalName = "boost_${BOOST_VERSION}.tar.gz"
+-        def srcUrl = "https://boostorg.jfrog.io/artifactory/main/release/${transformedVersion}/source/boost_${BOOST_VERSION}.tar.gz"
++        def srcUrl = "https://sourceforge.net/projects/boost/files/boost/${transformedVersion}/boost_${BOOST_VERSION}.tar.gz"
++
+         if (REACT_NATIVE_MINOR_VERSION < 69) {
+             srcUrl = "https://github.com/react-native-community/boost-for-react-native/releases/download/v${transformedVersion}-0/boost_${BOOST_VERSION}.tar.gz"
+         }