python: support DESTDIR in pip install step

Use --root $DESTDIR when the environment variable is set so that
staged installs (e.g. 'make DESTDIR=/tmp/pkg install') place the
Python package under the staging root.

Also pass --no-build-isolation and --prefix to avoid rebuilding in an
isolated venv and to honour CMAKE_INSTALL_PREFIX.

.github/workflows/windows-build.yml

@@ -9,178 +9,148 @@ on:
     branches: [ main, master ]
 
 env:
+  VCPKG_VERSION: "2026.01.16"
+  VCPKG_INSTALLATION_ROOT: "C:\\vcpkg"
   VCPKG_DISABLE_METRICS: "1"
+  VCPKG_INSTALLED_DIR: ${{ github.workspace }}\vcpkg_installed
+  VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}\vcpkg_binary_cache
 
 jobs:
-  # Pre-warm the vcpkg binary cache for x64-windows triplet.
-  # Builds all packages once and saves them to the GHA binary cache.
-  # Subsequent runs will restore from the binary cache (< 1 min).
-  vcpkg-shared:
-    name: Install vcpkg deps (x64-windows)
+  prepare-dependencies:
+    name: Prepare Windows Dependencies
     runs-on: windows-latest
-    env:
-      VCPKG_DEFAULT_TRIPLET: x64-windows
+    outputs:
+      vcpkg_cache_key: ${{ steps.generate_cache_key.outputs.key }}
+    strategy:
+      matrix:
+        arch: [x64]
+
     steps:
-      - uses: actions/checkout@v4
-      - uses: microsoft/setup-msbuild@v2
+      - name: Checkout repository
+        uses: actions/checkout@v6
 
-      - name: Setup vcpkg
-        uses: lukka/run-vcpkg@v11
+      - name: Set up MSVC
+        uses: microsoft/setup-msbuild@v3
 
-      - name: Compute vcpkg cache key
-        id: vcpkg-key
+      - name: Generate Cache Key
+        id: generate_cache_key
         shell: pwsh
         run: |
-          $combined = (Get-FileHash vcpkg.json -Algorithm SHA256).Hash + (Get-FileHash vcpkg-configuration.json -Algorithm SHA256).Hash
-          $bytes = [System.Text.Encoding]::UTF8.GetBytes($combined)
-          $hash = (([System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') }) -join '').Substring(0, 16)
-          echo "key=vcpkg-x64-windows-$hash-${{ runner.os }}" >> $env:GITHUB_OUTPUT
+          $key_value = "${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-shared-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}-${{ hashFiles('.github/workflows/windows-build.yml') }}"
+          echo "key=$key_value" >> $env:GITHUB_OUTPUT
 
-      - name: Restore vcpkg_installed from cache
-        id: cache-restore
-        uses: actions/cache/restore@v4
+      - name: Cache vcpkg installed packages
+        id: cache-vcpkg
+        uses: actions/cache@v5
         with:
-          path: vcpkg_installed
-          key: ${{ steps.vcpkg-key.outputs.key }}
+          path: |
+            ${{ env.VCPKG_INSTALLED_DIR }}
+            ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
+          key: ${{ steps.generate_cache_key.outputs.key }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-shared-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}
+            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-shared-
 
-      - name: Install vcpkg packages (with retry)
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        uses: nick-fields/retry@v3
-        with:
-          timeout_minutes: 60
-          max_attempts: 3
-          shell: pwsh
-          command: |
-            & "$env:VCPKG_ROOT/vcpkg.exe" install `
-              --recurse `
-              --clean-after-build `
-              --triplet=x64-windows `
-              --x-feature=test `
-              --x-manifest-root=.
-            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+      - name: Setup vcpkg and install dependencies
+        if: steps.cache-vcpkg.outputs.cache-hit != 'true'
+        run: |
+          New-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}" -ItemType Directory -Force
+          New-Item -Path "${{ env.VCPKG_DEFAULT_BINARY_CACHE }}" -ItemType Directory -Force
+          vcpkg install `
+            --recurse `
+            --clean-after-build `
+            --triplet=${{ matrix.arch }}-windows `
+            --x-install-root=${{ env.VCPKG_INSTALLED_DIR }} `
+            --x-feature=test
+        shell: pwsh
 
-      - name: Save vcpkg_installed to cache
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
-        with:
-          path: vcpkg_installed
-          key: ${{ steps.vcpkg-key.outputs.key }}
-
-  # Pre-warm the vcpkg binary cache for x64-windows-static-release triplet.
-  vcpkg-static:
-    name: Install vcpkg deps (x64-windows-static-release)
+  prepare-static-dependencies:
+    name: Prepare Windows Static Dependencies
     runs-on: windows-latest
-    env:
-      VCPKG_DEFAULT_TRIPLET: x64-windows-static-release
+    outputs:
+      vcpkg_static_cache_key: ${{ steps.generate_static_cache_key.outputs.key }}
+    strategy:
+      matrix:
+        arch: [x64]
+
     steps:
-      - uses: actions/checkout@v4
-      - uses: microsoft/setup-msbuild@v2
+      - name: Checkout repository
+        uses: actions/checkout@v6
 
-      - name: Setup vcpkg
-        uses: lukka/run-vcpkg@v11
+      - name: Set up MSVC
+        uses: microsoft/setup-msbuild@v3
 
-      - name: Compute vcpkg cache key
-        id: vcpkg-key
+      - name: Generate Cache Key for Static Libs
+        id: generate_static_cache_key
         shell: pwsh
         run: |
-          $combined = (Get-FileHash vcpkg.json -Algorithm SHA256).Hash + (Get-FileHash vcpkg-configuration.json -Algorithm SHA256).Hash
-          $bytes = [System.Text.Encoding]::UTF8.GetBytes($combined)
-          $hash = (([System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') }) -join '').Substring(0, 16)
-          echo "key=vcpkg-x64-windows-static-release-$hash-${{ runner.os }}" >> $env:GITHUB_OUTPUT
+          $key_value = "${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-static-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}-${{ hashFiles('.github/workflows/windows-build.yml') }}"
+          echo "key=$key_value" >> $env:GITHUB_OUTPUT
 
-      - name: Restore vcpkg_installed from cache
-        id: cache-restore
-        uses: actions/cache/restore@v4
+      - name: Cache vcpkg static installed packages
+        id: cache-vcpkg-static
+        uses: actions/cache@v5
         with:
-          path: vcpkg_installed
-          key: ${{ steps.vcpkg-key.outputs.key }}
+          path: |
+            ${{ env.VCPKG_INSTALLED_DIR }}
+            ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
+          key: ${{ steps.generate_static_cache_key.outputs.key }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-static-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}
+            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-static-
 
-      - name: Install vcpkg packages (with retry)
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        uses: nick-fields/retry@v3
-        with:
-          timeout_minutes: 60
-          max_attempts: 3
-          shell: pwsh
-          command: |
-            & "$env:VCPKG_ROOT/vcpkg.exe" install `
-              --recurse `
-              --clean-after-build `
-              --triplet=x64-windows-static-release `
-              --x-feature=test `
-              --x-manifest-root=.
-            if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
-
-      - name: Save vcpkg_installed to cache
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
-        with:
-          path: vcpkg_installed
-          key: ${{ steps.vcpkg-key.outputs.key }}
+      - name: Setup vcpkg and install static dependencies
+        if: steps.cache-vcpkg-static.outputs.cache-hit != 'true'
+        shell: pwsh
+        run: |
+          New-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}" -ItemType Directory -Force
+          New-Item -Path "${{ env.VCPKG_DEFAULT_BINARY_CACHE }}" -ItemType Directory -Force
+          vcpkg install `
+            --recurse `
+            --clean-after-build `
+            --triplet=${{ matrix.arch }}-windows-static-release `
+            --x-install-root=${{ env.VCPKG_INSTALLED_DIR }} `
+            --x-feature=test
 
   build-windows:
-    name: Windows MSVC (${{ matrix.arch }}-windows, ${{ matrix.build_type }}, C++${{ matrix.cxx_standard }})
+    name: Windows MSVC Build
     runs-on: windows-latest
-    needs: vcpkg-shared
+    needs: prepare-dependencies
+    
     strategy:
-      fail-fast: false
       matrix:
         build_type: [Debug, Release]
         arch: [x64]
         cxx_standard: [17, 20, 23]
-    env:
-      VCPKG_DEFAULT_TRIPLET: ${{ matrix.arch }}-windows
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
 
-      - name: Setup vcpkg
-        uses: lukka/run-vcpkg@v11
-
-      - name: Compute vcpkg cache key
-        id: vcpkg-key
-        shell: pwsh
-        run: |
-          $combined = (Get-FileHash vcpkg.json -Algorithm SHA256).Hash + (Get-FileHash vcpkg-configuration.json -Algorithm SHA256).Hash
-          $bytes = [System.Text.Encoding]::UTF8.GetBytes($combined)
-          $hash = (([System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') }) -join '').Substring(0, 16)
-          echo "key=vcpkg-x64-windows-$hash-${{ runner.os }}" >> $env:GITHUB_OUTPUT
-
-      - name: Restore vcpkg_installed from cache
-        id: cache-restore
-        uses: actions/cache/restore@v4
+      - name: Restore vcpkg installed packages
+        id: cache-vcpkg-restore
+        uses: actions/cache/restore@v5
         with:
-          path: vcpkg_installed
-          key: ${{ steps.vcpkg-key.outputs.key }}
-
-      - name: Install vcpkg packages if cache miss (with retry)
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        uses: nick-fields/retry@v3
-        with:
-          timeout_minutes: 60
-          max_attempts: 3
-          shell: pwsh
-          command: >-
-            & "$env:VCPKG_ROOT/vcpkg.exe" install
-            --recurse
-            --clean-after-build
-            --triplet=${{ matrix.arch }}-windows
-            --x-feature=test
-            --x-manifest-root=.
+          path: |
+            ${{ env.VCPKG_INSTALLED_DIR }}
+            ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
+          key: ${{ needs.prepare-dependencies.outputs.vcpkg_cache_key }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-shared-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}
+            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-shared-
 
       - name: Configure CMake
         shell: pwsh
         run: |
+          mkdir build -ErrorAction SilentlyContinue
           cmake -B build `
             -S . `
-            -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
+            -DCMAKE_TOOLCHAIN_FILE=${{ env.VCPKG_INSTALLATION_ROOT }}/scripts/buildsystems/vcpkg.cmake `
             -DVCPKG_TARGET_TRIPLET=${{ matrix.arch }}-windows `
-            -DVCPKG_INSTALLED_DIR="${{ github.workspace }}/vcpkg_installed" `
-            -DVCPKG_MANIFEST_INSTALL=OFF `
+            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
             -DVCPKG_MANIFEST_FEATURES=test `
             -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} `
             -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} `
@@ -197,15 +167,21 @@ jobs:
             -A ${{ matrix.arch }}
 
       - name: Build
-        run: cmake --build build --config ${{ matrix.build_type }} --parallel 4
+        run: |
+          cmake --build build --config ${{ matrix.build_type }} --parallel 4
+          # Copy vcpkg installed libraries to the build directory
+          Copy-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}\${{ matrix.arch }}-windows\lib\*.lib" -Destination "build" -Force
+          Copy-Item -Path "${{ env.VCPKG_INSTALLED_DIR }}\${{ matrix.arch }}-windows\bin\*.dll" -Destination "build" -Force
 
       - name: Test
         if: matrix.build_type == 'Release'
-        run: ctest --test-dir build --build-config ${{ matrix.build_type }} --output-on-failure
+        run: |
+          cd build
+          ctest --build-config ${{ matrix.build_type }} --output-on-failure --parallel 4
 
       - name: Upload build artifacts
         if: matrix.build_type == 'Release'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: opendht-windows-${{ matrix.arch }}-cxx${{ matrix.cxx_standard }}-${{ matrix.build_type }}
           path: |
@@ -215,68 +191,43 @@ jobs:
           retention-days: 7
 
   build-windows-static:
-    name: Windows Static MSVC (${{ matrix.arch }}-windows-static-release, ${{ matrix.build_type }}, C++${{ matrix.cxx_standard }})
+    name: Windows Static MSVC Build
     runs-on: windows-latest
-    needs: vcpkg-static
+    needs: prepare-static-dependencies
     strategy:
-      fail-fast: false
       matrix:
         build_type: [Release]
         arch: [x64]
         cxx_standard: [17, 20, 23]
-    env:
-      VCPKG_DEFAULT_TRIPLET: ${{ matrix.arch }}-windows-static-release
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up MSVC
-        uses: microsoft/setup-msbuild@v2
+        uses: microsoft/setup-msbuild@v3
 
-      - name: Setup vcpkg
-        uses: lukka/run-vcpkg@v11
-
-      - name: Compute vcpkg cache key
-        id: vcpkg-key
-        shell: pwsh
-        run: |
-          $combined = (Get-FileHash vcpkg.json -Algorithm SHA256).Hash + (Get-FileHash vcpkg-configuration.json -Algorithm SHA256).Hash
-          $bytes = [System.Text.Encoding]::UTF8.GetBytes($combined)
-          $hash = (([System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes) | ForEach-Object { $_.ToString('x2') }) -join '').Substring(0, 16)
-          echo "key=vcpkg-x64-windows-static-release-$hash-${{ runner.os }}" >> $env:GITHUB_OUTPUT
-
-      - name: Restore vcpkg_installed from cache
-        id: cache-restore
-        uses: actions/cache/restore@v4
+      - name: Restore vcpkg static installed packages
+        id: cache-vcpkg-static-restore
+        uses: actions/cache/restore@v5
         with:
-          path: vcpkg_installed
-          key: ${{ steps.vcpkg-key.outputs.key }}
-
-      - name: Install vcpkg packages if cache miss (with retry)
-        if: steps.cache-restore.outputs.cache-hit != 'true'
-        uses: nick-fields/retry@v3
-        with:
-          timeout_minutes: 60
-          max_attempts: 3
-          shell: pwsh
-          command: >-
-            & "$env:VCPKG_ROOT/vcpkg.exe" install
-            --recurse
-            --clean-after-build
-            --triplet=${{ matrix.arch }}-windows-static-release
-            --x-feature=test
-            --x-manifest-root=.
-
+          path: |
+            ${{ env.VCPKG_INSTALLED_DIR }}
+            ${{ env.VCPKG_DEFAULT_BINARY_CACHE }}
+          key: ${{ needs.prepare-static-dependencies.outputs.vcpkg_static_cache_key }}
+          restore-keys: |
+            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-static-${{ hashFiles('**/vcpkg.json', '**/vcpkg-configuration.json') }}
+            ${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.arch }}-static-
+      
       - name: Configure CMake for Static Build
         shell: pwsh
         run: |
+          mkdir build -ErrorAction SilentlyContinue
           cmake -B build `
             -S . `
-            -DCMAKE_TOOLCHAIN_FILE="$env:VCPKG_ROOT/scripts/buildsystems/vcpkg.cmake" `
+            -DCMAKE_TOOLCHAIN_FILE=${{ env.VCPKG_INSTALLATION_ROOT }}/scripts/buildsystems/vcpkg.cmake `
             -DVCPKG_TARGET_TRIPLET=${{ matrix.arch }}-windows-static-release `
-            -DVCPKG_INSTALLED_DIR="${{ github.workspace }}/vcpkg_installed" `
-            -DVCPKG_MANIFEST_INSTALL=OFF `
+            -DVCPKG_INSTALLED_DIR=${{ env.VCPKG_INSTALLED_DIR }} `
             -DVCPKG_MANIFEST_FEATURES=test `
             -DCMAKE_BUILD_TYPE=${{ matrix.build_type }} `
             -DCMAKE_CXX_STANDARD=${{ matrix.cxx_standard }} `
@@ -294,13 +245,18 @@ jobs:
             -A ${{ matrix.arch }}
 
       - name: Build Static
-        run: cmake --build build --config ${{ matrix.build_type }} --parallel 4
+        shell: pwsh
+        run: |
+          cmake --build build --config ${{ matrix.build_type }} --parallel 4
 
       - name: Test Static Build
-        run: ctest --test-dir build --build-config ${{ matrix.build_type }} --output-on-failure
+        shell: pwsh
+        run: |
+          cd build
+          ctest --build-config ${{ matrix.build_type }} --output-on-failure --parallel 4
 
       - name: Upload static build artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: opendht-windows-static-${{ matrix.arch }}-cxx${{ matrix.cxx_standard }}-${{ matrix.build_type }}
           path: |
@@ -319,7 +275,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Setup MinGW
         uses: msys2/setup-msys2@v2
@@ -419,7 +375,7 @@ jobs:
 
       - name: Upload MinGW artifacts
         if: matrix.build_type == 'Release'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: opendht-windows-mingw-${{ matrix.build_type }}
           path: |

CMakeLists.txt

@@ -9,8 +9,8 @@ if(POLICY CMP0167)
     cmake_policy(SET CMP0167 NEW)
 endif()
 
-set (opendht_VERSION_MAJOR 3)
-set (opendht_VERSION_MINOR 7.9)
+set (opendht_VERSION_MAJOR 4)
+set (opendht_VERSION_MINOR 0.0)
 set (opendht_VERSION ${opendht_VERSION_MAJOR}.${opendht_VERSION_MINOR})
 set (PACKAGE_VERSION ${opendht_VERSION})
 set (VERSION "${opendht_VERSION}")

c/opendht.cpp

@@ -600,7 +600,7 @@ dht_runner_put_signed(
 void
 dht_runner_put_encrypted(dht_runner* r,
                          const dht_infohash* h,
-                         const dht_infohash* to,
+                         const dht_pkid* to,
                          const dht_value* v,
                          dht_done_cb done_cb,
                          void* cb_user_data,
@@ -608,7 +608,7 @@ dht_runner_put_encrypted(dht_runner* r,
 {
     auto runner = reinterpret_cast<dht::DhtRunner*>(r);
     auto hash = reinterpret_cast<const dht::InfoHash*>(h);
-    auto toHash = reinterpret_cast<const dht::InfoHash*>(to);
+    auto toHash = reinterpret_cast<const dht::PkId*>(to);
     auto value = reinterpret_cast<const ValueSp*>(v);
     runner->putEncrypted(
         *hash,

c/opendht_c.h

@@ -195,7 +195,7 @@ OPENDHT_C_PUBLIC void dht_runner_put_signed(dht_runner* runner,
                                             bool permanent);
 OPENDHT_C_PUBLIC void dht_runner_put_encrypted(dht_runner* runner,
                                                const dht_infohash* hash,
-                                               const dht_infohash* to,
+                                               const dht_pkid* to,
                                                const dht_value* value,
                                                dht_done_cb done_cb,
                                                void* cb_user_data,

doc/dhtnode.1

@@ -1,102 +1,193 @@
-.TH DHTNODE 1 2019-06-08
+.TH DHTNODE 1 2026-04-18
 .SH NAME
 .B dhtnode
 - a simple OpenDHT command line node runner.
 .SH SYNOPSIS
 .B dhtnode
 [\fB\-h\fR]
+[\fB\-V\fR]
 [\fB\-v\fR [\fB\-l\fR \fIlogfile\fR] [\fB\-L\fR]]
-[\fB\-i\fR [\fB\-\-save\-identity\fR \fIfile\fR]]
+[\fB\-i\fR [\fB\-I\fR \fIfile\fR]]
+[\fB\-c\fR \fIfile\fR]
+[\fB\-k\fR \fIfile\fR]
+[\fB\-m\fR \fIpassword\fR]
 [\fB\-d\fR] [\fB\-s\fR]
+[\fB\-D\fR] [\fB\-U\fR] [\fB\-P\fR]
 [\fB\-n\fR \fInetwork_id\fR]
 [\fB\-p\fR \fIlocal_port\fR]
 [\fB\-b\fR \fIbootstrap_host\fR[:\fIport\fR]]
-[\fB\-\-certificate\fR \fIfile\fR]
-[\fB\-\-privkey\fR \fIfile\fR]
-[\fB\-\-privkey\-password\fR \fIpassword\fR]
-[\fB\-\-proxyserver\fR \fIport\fR]
-[\fB\-\-proxyclient\fR \fIserver\fR]
+[\fB\-f\fR \fIpath\fR]
+[\fB\-S\fR \fIport\fR]
+[\fB\-e\fR \fIport\fR]
+[\fB\-a\fR \fIaddress\fR]
+[\fB\-w\fR \fIfile\fR]
+[\fB\-K\fR \fIfile\fR]
+[\fB\-M\fR \fIpassword\fR]
+[\fB\-C\fR \fIserver\fR]
+[\fB\-y\fR \fIendpoint\fR]
+[\fB\-z\fR \fIkey\fR]
+[\fB\-u\fR \fIbundleid\fR]
 .SH DESCRIPTION
-Runs an OpenDHT node, with a CLI (default) or as a daemon (with \fB'-d'\fP or \fB'-s'\fP).
+Runs an OpenDHT node, with an interactive CLI (default) or as a daemon (with \fB'-d'\fP or \fB'-s'\fP).
 Commands available in the interactive shell are:
 .EX
     h, help    Print this help message.
-    q, quit    Quit the program.
+    x, quit    Quit the program.
     log        Start/stop printing DHT logs.
 
     Node information:
     ll         Print basic information and stats about the current node.
-    ls         Print basic information about current searches.
-    ld         Print basic information about currenty stored values on this node.
-    lr         Print the full current routing table of this node
+    ls [key]   Print basic information about current search(es).
+    ld [key]   Print basic information about currenty stored values on this
+               node (or for a specific key).
+    lr         Print the full current routing table of this node.
 
     Operations on the DHT:
-    b ip:port             Ping potential node at given IP address/port.
-    g [key]               Get values at [key].
-    l [key]               Listen for value changes at [key].
-    p [key] [str]         Put string value at [key].
-    s [key] [str]         Put string value at [key], signed with our generated
-                          private key.
-    e [key] [dest] [str]  Put string value at [key], encrypted for [dest] with
-                          its public key (if found).
+    b <ip:port>            Ping potential node at given IP address/port.
+    g <key>                Get values at <key>.
+    l <key>                Listen for value changes at <key>.
+    cl <key> <token>       Cancel listen for <token> and <key>.
+    p <key> <str>          Put string value at <key>.
+    pp <key> <str>         Put string value at <key> (persistent version).
+    cpp <key> <id>         Cancel persistent put operation for <key> and
+                           value <id>.
+    s <key> <str>          Put string value at <key>, signed with our
+                           generated private key.
+    e <key> <dest> <str>   Put string value at <key>, encrypted for <dest>
+                           with its public key (if found).
+    cc                     Trigger connectivity changed signal.
+
+    Operations with the proxy (if compiled with proxy server support):
+    pst [port] <pushServer>  Start the proxy interface on port.
+    psx [port]               Start the proxy SSL interface on port.
+    psp [port]               Stop the proxy interface on port.
+
+    Operations with the proxy (if compiled with proxy client support):
+    stt [server_address] <device_key>  Start the proxy client.
+    stp                                Stop the proxy client.
+    rs  [token]                        Resubscribe to opendht.
+    rp  [token]                        Inject a push notification.
 .EE
 .SH OPTIONS
 .TP
-\fB\-h\fP
-Prints some help.
+\fB\-h\fP, \fB\-\-help\fP
+Prints help and exits.
 .TP
-\fB\-v\fP
-Enable the verbose mode (log to stdout/stderr by default)
+\fB\-V\fP, \fB\-\-version\fP
+Prints version information and exits.
 .TP
-\fB\-l\fP \fIlog_file\fP
-Write log to file instead of stdout/stderr
+\fB\-v\fP, \fB\-\-verbose\fP
+Enable verbose mode (log to stdout/stderr by default).
 .TP
-\fB\-L\fP
-Write log to syslog instead of stdout/stderr
+\fB\-l\fP \fIlogfile\fP, \fB\-\-logfile\fP \fIlogfile\fP
+Write log to file instead of stdout/stderr.
 .TP
-\fB\-i\fP
-Generate cryptographic identity for the node.
+\fB\-L\fP, \fB\-\-syslog\fP
+Write log to syslog instead of stdout/stderr (enables verbose mode).
 .TP
-\fB\-\-save\-identity\fP \fIfile\fP
+\fB\-i\fP, \fB\-\-identity\fP
+Generate a cryptographic identity (RSA key pair and self-signed certificate)
+for the node. Required to perform cryptographic operations (encrypt/sign values)
+if no private key file is provided.
+.TP
+\fB\-I\fP \fIfile\fP, \fB\-\-save\-identity\fP \fIfile\fP
 Save generated identity (certificate and private key) to given file prefix.
+Files are saved as \fIfile\fP and \fIfile\fP_ca.
 .TP
-\fB\-\-certificate\fP \fIfile\fP
-Load identity certificate from given file.
+\fB\-c\fP \fIfile\fP, \fB\-\-certificate\fP \fIfile\fP
+Load identity certificate from given file. If specified, the certificate is
+published on the DHT.
 .TP
-\fB\-\-privkey\fP \fIfile\fP
-Load identity private key from given file.
+\fB\-k\fP \fIfile\fP, \fB\-\-privkey\fP \fIfile\fP
+Load identity private key from given file. Required to perform cryptographic
+operations if no identity is generated.
 .TP
-\fB\-\-privkey\-password\fP \fIpassword\fP
+\fB\-m\fP \fIpassword\fP, \fB\-\-privkey\-password\fP \fIpassword\fP
 Password to use for private key encryption or decryption (optional).
 .TP
-\fB\-d\fP
-Run the program in daemon mode (will fork in the background).
+\fB\-d\fP, \fB\-\-daemonize\fP
+Run the program in daemon mode (will fork in the background). When verbose mode
+is enabled, logs to syslog by default.
 .TP
-\fB\-s\fP
+\fB\-s\fP, \fB\-\-service\fP
 Run the program in service mode (non\-forking daemon).
 .TP
-\fB\-D\fP
+\fB\-D\fP, \fB\-\-peer\-discovery\fP
 Enables multicast automatic local peer discovery.
 .TP
-\fB\-f\fP \fIfile\fP
-Specify a file path to persist/load the node state.
+\fB\-U\fP, \fB\-\-no\-rate\-limit\fP
+Disable rate limiting (allows unlimited requests and storage).
 .TP
-\fB\-n\fP \fInetwork_id\fP
-Specify the network id. This let you connect to distinct networks and prevents
-the merge of two different networks (available since OpenDHT v0.6.1).
+\fB\-P\fP, \fB\-\-public\-stable\fP
+Enable public stable mode.
 .TP
-\fB\-p\fP \fIlocal_port\fP
-Use UDP port \fIlocal_port\fP for the program to bind to.
+\fB\-f\fP \fIpath\fP, \fB\-\-persist\fP \fIpath\fP
+Specify a file path to persist/load the node state (routing table and values).
 .TP
-\fB\-b\fP \fIbootstrap_host\fP[:\fIport\fP]
-The program needs to be given a node to connect to the network. You use this
-option to provide the ip address of that node.
+\fB\-n\fP \fInetwork_id\fP, \fB\-\-net\fP \fInetwork_id\fP
+Specify the network id. This lets you connect to distinct networks and prevents
+the merge of two different networks. Defaults to 0 (the main public network).
 .TP
-\fB\-\-proxyserver\fP \fIlocal_port\fP
-Run a proxy server bound to this DHT node on HTTP port \fIlocal_port\fP
+\fB\-p\fP \fIlocal_port\fP, \fB\-\-port\fP \fIlocal_port\fP
+Use UDP port \fIlocal_port\fP for the program to bind to. If not set, will use
+any available port. The default OpenDHT port for public nodes is 4222.
 .TP
-\fB\-\-proxyclient\fP \fIserver\fP
-Run this DHT node in proxy client mode, and connect to \fIserver\fP
+\fB\-b\fP \fIbootstrap_host\fP[:\fIport\fP], \fB\-\-bootstrap\fP \fIbootstrap_host\fP[:\fIport\fP]
+Specify a bootstrap node address to connect to the network.
+.TP
+\fB\-S\fP \fIlocal_port\fP, \fB\-\-proxyserver\fP \fIlocal_port\fP
+Run a REST API proxy server bound to this DHT node on HTTP port \fIlocal_port\fP.
+.TP
+\fB\-e\fP \fIlocal_port\fP, \fB\-\-proxyserverssl\fP \fIlocal_port\fP
+Run a REST API proxy server with SSL bound to this DHT node on HTTPS port \fIlocal_port\fP.
+.TP
+\fB\-a\fP \fIaddress\fP, \fB\-\-proxy\-addr\fP \fIaddress\fP
+Proxy server bind address.
+.TP
+\fB\-w\fP \fIfile\fP, \fB\-\-proxy\-certificate\fP \fIfile\fP
+Load proxy SSL certificate from given file.
+.TP
+\fB\-K\fP \fIfile\fP, \fB\-\-proxy\-privkey\fP \fIfile\fP
+Load proxy SSL private key from given file.
+.TP
+\fB\-M\fP \fIpassword\fP, \fB\-\-proxy\-privkey\-password\fP \fIpassword\fP
+Password for the proxy private key encryption or decryption (optional).
+.TP
+\fB\-C\fP \fIserver\fP, \fB\-\-proxyclient\fP \fIserver\fP
+Run this DHT node in proxy client mode, and connect to \fIserver\fP.
+.TP
+\fB\-y\fP \fIendpoint\fP, \fB\-\-pushserver\fP \fIendpoint\fP
+Push notification server endpoint.
+.TP
+\fB\-z\fP \fIkey\fP, \fB\-\-devicekey\fP \fIkey\fP
+Device key for push notifications.
+.TP
+\fB\-u\fP \fIbundleid\fP, \fB\-\-bundleid\fP \fIbundleid\fP
+Bundle ID for push notifications.
+.SH EXAMPLES
+Run a node using bootstrap.jami.net as a bootstrap:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222
+.EE
+.PP
+Run a node as a non-forking daemon on port 4222:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net -p 4222 -s
+.EE
+.PP
+Run a proxy server on port 8000:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222 --proxyserver 8000
+.EE
+.PP
+Use a proxy client to connect to a proxy server:
+.PP
+.EX
+dhtnode --proxyclient dhtproxy.jami.net:80
+.EE
 .SH AUTHORS
 .TP
 Program written by

include/opendht/callbacks.h

@@ -187,8 +187,6 @@ using ShutdownCallback = std::function<void()>;
 using IdentityAnnouncedCb = std::function<void(bool)>;
 using PublicAddressChangedCb = std::function<void(std::vector<SockAddr>)>;
 
-using CertificateStoreQueryLegacy
-    = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const InfoHash& pk_id)>;
 using CertificateStoreQuery = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const PkId& pk_id)>;
 
 using DoneCallback = std::function<void(bool success, const std::vector<std::shared_ptr<Node>>& nodes)>;

include/opendht/dhtrunner.h

@@ -61,8 +61,7 @@ public:
         std::unique_ptr<net::DatagramSocket> sock;
         std::shared_ptr<PeerDiscovery> peerDiscovery {};
         StatusCallback statusChangedCallback {};
-        CertificateStoreQueryLegacy certificateStore {};
-        CertificateStoreQuery certificateStorePkId {};
+        CertificateStoreQuery certificateStore {};
         IdentityAnnouncedCb identityAnnouncedCb {};
         PublicAddressChangedCb publicAddressChangedCb {};
         std::unique_ptr<std::mt19937_64> rng {};
@@ -286,21 +285,6 @@ public:
     }
     void putSigned(const std::string& key, Value&& value, DoneCallbackSimple cb = {}, bool permanent = false);
 
-    void putEncrypted(
-        InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallback cb = {}, bool permanent = false);
-    void putEncrypted(
-        InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false)
-    {
-        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
-    }
-
-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallback cb = {}, bool permanent = false);
-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallbackSimple cb, bool permanent = false)
-    {
-        putEncrypted(hash, to, std::forward<Value>(value), bindDoneCb(cb), permanent);
-    }
-    void putEncrypted(const std::string& key, InfoHash to, Value&& value, DoneCallback cb = {}, bool permanent = false);
-
     void putEncrypted(InfoHash hash,
                       const std::shared_ptr<crypto::PublicKey>& to,
                       std::shared_ptr<Value> value,
@@ -315,13 +299,11 @@ public:
         putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
     }
 
-    [[deprecated("Use the shared_ptr version instead")]]
     void putEncrypted(InfoHash hash,
                       const std::shared_ptr<crypto::PublicKey>& to,
                       Value&& value,
                       DoneCallback cb = {},
                       bool permanent = false);
-    [[deprecated("Use the shared_ptr version instead")]]
     void putEncrypted(InfoHash hash,
                       const std::shared_ptr<crypto::PublicKey>& to,
                       Value&& value,
@@ -338,6 +320,14 @@ public:
     {
         putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
     }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallback cb = {}, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), std::move(cb), permanent);
+    }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallbackSimple cb, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), bindDoneCb(cb), permanent);
+    }
 
     /**
      * Insert known nodes to the routing table, without necessarly ping them.
@@ -450,13 +440,9 @@ public:
     void getPublicAddress(std::function<void(std::vector<SockAddr>&&)>, sa_family_t af = AF_UNSPEC);
 
     // securedht methods
-
-    [[deprecated("Use PkId version")]] void findCertificate(
-        InfoHash hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)>);
     void findCertificate(PkId hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)>);
 
     void registerCertificate(const std::shared_ptr<crypto::Certificate>& cert);
-    void setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method);
     void setLocalCertificateStore(CertificateStoreQuery&& query_method);
 
     /**

include/opendht/securedht.h

@@ -113,14 +113,6 @@ public:
      * and put it in the DHT.
      * The operation will be immediate if the recipient' public key is known (otherwise it will be retrived first).
      */
-    void putEncrypted(
-        const InfoHash& hash, const InfoHash& to, Sp<Value> val, DoneCallback callback, bool permanent = false);
-
-    [[deprecated("Use the shared_ptr version instead")]]
-    void putEncrypted(const InfoHash& hash, const InfoHash& to, Value&& v, DoneCallback callback, bool permanent = false)
-    {
-        putEncrypted(hash, to, std::make_shared<Value>(std::move(v)), callback, permanent);
-    }
     void putEncrypted(const InfoHash& hash,
                       const crypto::PublicKey& to,
                       Sp<Value> val,
@@ -145,19 +137,11 @@ public:
 
     Value decrypt(const Value& v);
 
-    [[deprecated("Use PkId version")]] void findCertificate(
-        const InfoHash& node, const std::function<void(const Sp<crypto::Certificate>)>& cb);
-    [[deprecated("Use PkId version")]] void findPublicKey(const InfoHash& node,
-                                                          const std::function<void(const Sp<crypto::PublicKey>)>& cb);
-
     void findCertificate(const PkId& id, const std::function<void(const Sp<crypto::Certificate>)>& cb);
     void findPublicKey(const PkId& id, const std::function<void(const Sp<crypto::PublicKey>)>& cb);
 
     void registerCertificate(const Sp<crypto::Certificate>& cert);
 
-    [[deprecated("Use PkId version")]] Sp<crypto::Certificate> getCertificate(const InfoHash& node) const;
-    [[deprecated("Use PkId version")]] Sp<crypto::PublicKey> getPublicKey(const InfoHash& node) const;
-
     Sp<crypto::Certificate> getCertificate(const PkId& node) const;
     Sp<crypto::PublicKey> getPublicKey(const PkId& node) const;
 
@@ -166,10 +150,6 @@ public:
      * The search key used is the public key ID, so there may be multiple certificates retured, signed with
      * the same private key.
      */
-    void setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method)
-    {
-        localQueryMethodLegacy_ = std::move(query_method);
-    }
     void setLocalCertificateStore(CertificateStoreQuery&& query_method) { localQueryMethod_ = std::move(query_method); }
     void setOnPublicAddressChanged(PublicAddressChangedCb cb) override { dht_->setOnPublicAddressChanged(cb); }
 
@@ -347,13 +327,10 @@ private:
 
     // method to query the local certificate store
     CertificateStoreQuery localQueryMethod_ {};
-    CertificateStoreQueryLegacy localQueryMethodLegacy_ {};
 
     // our certificate cache
-    std::map<InfoHash, Sp<crypto::Certificate>> nodesCertificates_ {};
-    std::map<InfoHash, Sp<crypto::PublicKey>> nodesPubKeys_ {};
-    std::map<PkId, Sp<crypto::Certificate>> nodesCertificatesLong_ {};
-    std::map<PkId, Sp<crypto::PublicKey>> nodesPubKeysLong_ {};
+    std::map<PkId, Sp<crypto::Certificate>> nodesCertificates_ {};
+    std::map<PkId, Sp<crypto::PublicKey>> nodesPubKeys_ {};
 
     std::atomic_bool forward_all_ {false};
     bool enableCache_ {false};

include/opendht/thread_pool.h

@@ -55,10 +55,12 @@ public:
 private:
     std::mutex lock_;
     std::condition_variable cv_ {};
+    std::condition_variable stopCv_ {};
     std::queue<std::function<void()>> tasks_ {};
     std::vector<std::unique_ptr<std::thread>> threads_;
     unsigned readyThreads_ {0};
     bool running_ {true};
+    bool stopping_ {false};
 
     unsigned minThreads_;
     const unsigned maxThreads_;

meson.build

@@ -5,7 +5,7 @@ project(
     'cython',
     license: 'MIT',
     license_files: 'LICENSE',
-    version: '3.7.9',
+    version: '4.0.0',
     meson_version: '>=1.1.0',
     default_options: ['cpp_std=c++20', 'warning_level=3'],
 )

ports/shiftmedia-libgnutls/external-libtasn1.patch

@@ -1,118 +0,0 @@
-diff --git a/SMP/libgnutls.vcxproj.filters b/SMP/libgnutls.vcxproj.filters
-index ef202f4ac..a397e1574 100644
---- a/SMP/libgnutls.vcxproj.filters
-+++ b/SMP/libgnutls.vcxproj.filters
-@@ -103,9 +103,6 @@
-     <Filter Include="Header Files\lib\inih">
-       <UniqueIdentifier>{ae0c3eeb-53df-4c72-a85a-6b46de35e7ba}</UniqueIdentifier>
-     </Filter>
--    <Filter Include="Source Files\libtasn1">
--      <UniqueIdentifier>{32be60b7-8c65-486e-9df5-7e529443cf07}</UniqueIdentifier>
--    </Filter>
-     <Filter Include="Source Files\lib\nettle\gost">
-       <UniqueIdentifier>{1f3549a8-3c3d-475f-8fd6-20451d336464}</UniqueIdentifier>
-     </Filter>
-@@ -1535,30 +1532,6 @@
-     <ClCompile Include="..\lib\nettle\sysrng-bcrypt.c">
-       <Filter>Source Files\lib\nettle</Filter>
-     </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\coding.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\decoding.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\element.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\errors.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\gstr.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\parser_aux.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\structure.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\version.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
-     <ClCompile Include="..\lib\nettle\gost\acpkm.c">
-       <Filter>Source Files\lib\nettle\gost</Filter>
-     </ClCompile>
-diff --git a/SMP/libgnutls_files.props b/SMP/libgnutls_files.props
-index 55049b70b..2bb76e3b0 100644
---- a/SMP/libgnutls_files.props
-+++ b/SMP/libgnutls_files.props
-@@ -175,13 +175,6 @@
-   <ItemGroup>
-     <ClCompile Include="lib\gnutls_asn1_tab.c" />
-     <ClCompile Include="lib\pkix_asn1_tab.c" />
--    <ClCompile Include="..\devel\libtasn1\lib\coding.c" />
--    <ClCompile Include="..\devel\libtasn1\lib\decoding.c" />
--    <ClCompile Include="..\devel\libtasn1\lib\element.c" />
--    <ClCompile Include="..\devel\libtasn1\lib\gstr.c" />
--    <ClCompile Include="..\devel\libtasn1\lib\parser_aux.c" />
--    <ClCompile Include="..\devel\libtasn1\lib\structure.c" />
--    <ClCompile Include="..\devel\libtasn1\lib\version.c" />
-     <ClCompile Include="..\gnulib\lib\c-strcasecmp.c" />
-     <ClCompile Include="..\gnulib\lib\c-strncasecmp.c" />
-     <ClCompile Include="..\gnulib\lib\cloexec.c" />
-@@ -545,9 +538,6 @@
-     </ClCompile>	
-     <ClCompile Include="..\gnulib\lib\stdio-write.c">
-       <PreprocessorDefinitions>REPLACE_PRINTF_POSIX=1;REPLACE_FPRINTF_POSIX=1;REPLACE_VPRINTF_POSIX=1;REPLACE_VFPRINTF_POSIX=1;%(PreprocessorDefinitions)</PreprocessorDefinitions>
--    </ClCompile>	
--    <ClCompile Include="..\devel\libtasn1\lib\errors.c">
--      <ObjectFileName>$(IntDir)\tasn1_$(filename).obj</ObjectFileName>
-     </ClCompile>
-     <ClCompile Include="..\lib\algorithms\ecc.c">
-       <ObjectFileName>$(IntDir)\alg_%(Filename).obj</ObjectFileName>
-diff --git a/SMP/libgnutls_winrt.vcxproj.filters b/SMP/libgnutls_winrt.vcxproj.filters
-index f6a355e7e..299749c2a 100644
---- a/SMP/libgnutls_winrt.vcxproj.filters
-+++ b/SMP/libgnutls_winrt.vcxproj.filters
-@@ -103,9 +103,6 @@
-     <Filter Include="Header Files\lib\inih">
-       <UniqueIdentifier>{ae0c3eeb-53df-4c72-a85a-6b46de35e7ba}</UniqueIdentifier>
-     </Filter>
--    <Filter Include="Source Files\libtasn1">
--      <UniqueIdentifier>{32be60b7-8c65-486e-9df5-7e529443cf07}</UniqueIdentifier>
--    </Filter>
-     <Filter Include="Header Files\lib\nettle\gost">
-       <UniqueIdentifier>{4fada990-3138-4089-a6c7-ae722a0e7fe9}</UniqueIdentifier>
-     </Filter>
-@@ -1535,30 +1532,6 @@
-     <ClCompile Include="..\lib\nettle\sysrng-bcrypt.c">
-       <Filter>Source Files\lib\nettle</Filter>
-     </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\coding.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\decoding.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\element.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\errors.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\gstr.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\parser_aux.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\structure.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
--    <ClCompile Include="..\devel\libtasn1\lib\version.c">
--      <Filter>Source Files\libtasn1</Filter>
--    </ClCompile>
-     <ClCompile Include="..\lib\accelerated\afalg.c">
-       <Filter>Source Files\lib\accelerated</Filter>
-     </ClCompile>

ports/shiftmedia-libgnutls/pkgconfig.patch

@@ -1,13 +0,0 @@
-diff --git a/lib/gnutls.pc.in b/lib/gnutls.pc.in
-index 7cdedda5..11785bcd 100644
---- a/lib/gnutls.pc.in
-+++ b/lib/gnutls.pc.in
-@@ -18,7 +18,7 @@ Name: GnuTLS
- Description: Transport Security Layer implementation for the GNU system
- URL: https://www.gnutls.org/
- Version: @VERSION@
--Libs: -L${libdir} -lgnutls
-+Libs: -L${libdir} @GNUTLS_LIBS@
- Libs.private: @LIBZ_PC@ @LIBINTL@ @LIBSOCKET@ @INET_PTON_LIB@ @LIBPTHREAD@ @LIB_SELECT@ @TSS_LIBS@ @GMP_LIBS@ @LIBUNISTRING@ @LIBATOMIC_LIBS@ @GNUTLS_LIBS_PRIVATE@
- @GNUTLS_REQUIRES_PRIVATE@
- Cflags: -I${includedir}

ports/shiftmedia-libgnutls/portfile.cmake

@@ -1,183 +0,0 @@
-set(GNULIB_REF "3639c57")
-
-vcpkg_from_github(
-    OUT_SOURCE_PATH SOURCE_PATH
-    REPO ShiftMediaProject/gnutls
-    REF ${VERSION}
-    SHA512 db318ee923d0810484e98342cc395624efc52b7227020fc14b9fa9ae63e4b8bf254cfd90470e051cd992fb167fb839fff340430a223bcc50d1422f1738a5b599
-    HEAD_REF master
-    PATCHES
-        external-libtasn1.patch
-        pkgconfig.patch
-)
-
-file(REMOVE_RECURSE "${SOURCE_PATH}/devel/perlasm")
-
-# Use GitHub mirror of gnulib instead of git.savannah.gnu.org (unreliable on CI)
-vcpkg_from_github(
-    OUT_SOURCE_PATH GNULIB_SOURCE_PATH
-    REPO coreutils/gnulib
-    REF 3639c57a970191e0bf7a9789bd1341786d0255a1
-    SHA512 663781c7d9adb9a7b18decda4a473509e6377d1553aa953cc4876b19ae99a18488dae9652f92661be02ecdd8dfc9f7facb55e0bf3b8a499a00caf2f7223a2823
-    HEAD_REF master
-)
-
-file(REMOVE_RECURSE "${SOURCE_PATH}/gnulib")
-file(RENAME "${GNULIB_SOURCE_PATH}" "${SOURCE_PATH}/gnulib")
-
-include("${CURRENT_HOST_INSTALLED_DIR}/share/yasm-tool-helper/yasm-tool-helper.cmake")
-yasm_tool_helper(OUT_VAR YASM)
-file(TO_NATIVE_PATH "${YASM}" YASM)
-
-if(VCPKG_LIBRARY_LINKAGE STREQUAL "dynamic")
-    set(CONFIGURATION_RELEASE ReleaseDLL)
-    set(CONFIGURATION_DEBUG DebugDLL)
-else()
-    set(CONFIGURATION_RELEASE Release)
-    set(CONFIGURATION_DEBUG Debug)
-endif()
-
-if(VCPKG_TARGET_IS_UWP)
-    string(APPEND CONFIGURATION_RELEASE WinRT)
-    string(APPEND CONFIGURATION_DEBUG WinRT)
-endif()
-
-set(_gnutlsproject "${SOURCE_PATH}/SMP/libgnutls.vcxproj")
-file(READ "${_gnutlsproject}" _contents)
-string(REPLACE  [[<Import Project="$(VCTargetsPath)\BuildCustomizations\yasm.props" />]]
-                    "<Import Project=\"${CURRENT_HOST_INSTALLED_DIR}/share/vs-yasm/yasm.props\" />"
-                _contents "${_contents}")
-string(REPLACE  [[<Import Project="$(VCTargetsPath)\BuildCustomizations\yasm.targets" />]]
-                    "<Import Project=\"${CURRENT_HOST_INSTALLED_DIR}/share/vs-yasm/yasm.targets\" />"
-                _contents "${_contents}")
-string(REGEX REPLACE "${VCPKG_ROOT_DIR}/installed/[^/]+/share" "${CURRENT_HOST_INSTALLED_DIR}/share" _contents "${_contents}") # Above already
-file(WRITE "${_gnutlsproject}" "${_contents}")
-
-if(VCPKG_CRT_LINKAGE STREQUAL "static")
-    set(RuntimeLibraryExt "")
-else()
-    set(RuntimeLibraryExt "DLL")
-endif()
-
-# patch output library file path and name
-foreach(PROPS IN ITEMS
-"${SOURCE_PATH}/SMP/smp_deps.props"
-"${SOURCE_PATH}/SMP/smp_winrt_deps.props")
-vcpkg_replace_string(
-    "${PROPS}"
-    [=[_winrt</TargetName>]=]
-    [=[</TargetName>]=]
-    IGNORE_UNCHANGED
-)
-vcpkg_replace_string(
-    "${PROPS}"
-    [=[<TargetName>lib$(RootNamespace)]=]
-    [=[<TargetName>$(RootNamespace)]=]
-)
-endforeach()
-
-# patch hogweed, gpm, nettle, zlib libraries file names; inject RuntimeLibrary property to control CRT linkage 
-foreach(VCXPROJ IN ITEMS
-"${SOURCE_PATH}/SMP/libgnutls.vcxproj"
-"${SOURCE_PATH}/SMP/libgnutls_winrt.vcxproj")
-vcpkg_replace_string(
-    "${VCXPROJ}"
-    "_winrt.lib"
-    ".lib"
-    IGNORE_UNCHANGED
-)
-vcpkg_replace_string(
-    "${VCXPROJ}"
-    "libhogweed"
-    "hogweed"
-)
-vcpkg_replace_string(
-    "${VCXPROJ}"
-    "hogweedd"
-    "hogweed"
-)
-vcpkg_replace_string(
-    "${VCXPROJ}"
-    "libgmp"
-    "gmp"
-)
-vcpkg_replace_string(
-    "${VCXPROJ}"
-    "gmpd"
-    "gmp"
-)
-vcpkg_replace_string(
-    "${VCXPROJ}"
-    "libnettle"
-    "nettle"
-)
-vcpkg_replace_string(
-    "${VCXPROJ}"
-    "nettled"
-    "nettle"
-)
-set(zlib_basename "zlib")
-if(EXISTS "${CURRENT_INSTALLED_DIR}/lib/zs.lib")
-    set(zlib_basename "zs")
-elseif(EXISTS "${CURRENT_INSTALLED_DIR}/lib/z.lib")
-    set(zlib_basename "z")
-endif()
-vcpkg_replace_string(
-    "${VCXPROJ}"
-    "libzlib"
-    "${zlib_basename}"
-)
-vcpkg_replace_string(
-    "${VCXPROJ}"
-    "zlib"
-    "${zlib_basename}"
-)
-vcpkg_replace_string(
-    "${VCXPROJ}"
-    [=[</DisableSpecificWarnings>]=]
-    [=[</DisableSpecificWarnings><RuntimeLibrary>$(RuntimeLibrary)</RuntimeLibrary>]=]
-)
-endforeach()
-
-vcpkg_install_msbuild(
-    USE_VCPKG_INTEGRATION
-    SOURCE_PATH "${SOURCE_PATH}"
-    PROJECT_SUBPATH SMP/libgnutls.sln
-    PLATFORM ${TRIPLET_SYSTEM_ARCH}
-    LICENSE_SUBPATH LICENSE
-    RELEASE_CONFIGURATION ${CONFIGURATION_RELEASE}
-    DEBUG_CONFIGURATION ${CONFIGURATION_DEBUG}
-    SKIP_CLEAN
-    OPTIONS /p:YasmPath="${YASM}" /p:OutDir=..\\msvc
-    OPTIONS_DEBUG /p:RuntimeLibrary=MultiThreadedDebug${RuntimeLibraryExt}
-    OPTIONS_RELEASE /p:RuntimeLibrary=MultiThreaded${RuntimeLibraryExt}
-)
-
-get_filename_component(SOURCE_PATH_SUFFIX "${SOURCE_PATH}" NAME)
-if(VCPKG_TARGET_IS_UWP)
-    set(WINRT_SUBFOLDER libgnutls_winrt)
-endif()
-file(INSTALL "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel/${SOURCE_PATH_SUFFIX}/msvc/${WINRT_SUBFOLDER}/include" DESTINATION "${CURRENT_PACKAGES_DIR}")
-
-set(GNUTLS_REQUIRES_PRIVATE "Requires.private: gmp, nettle, hogweed, libtasn1, zlib")
-set(GNUTLS_LIBS_PRIVATE "-lcrypt32 -lws2_32 -lkernel32 -lncrypt")
-
-set(prefix "${CURRENT_INSTALLED_DIR}")
-set(exec_prefix "\${prefix}")
-set(libdir "\${prefix}/lib")
-set(includedir "\${prefix}/include")
-set(GNUTLS_LIBS "-lgnutls")
-configure_file("${SOURCE_PATH}/lib/gnutls.pc.in" "${CURRENT_PACKAGES_DIR}/lib/pkgconfig/gnutls.pc" @ONLY)
-
-if(NOT VCPKG_BUILD_TYPE)
-  set(prefix "${CURRENT_INSTALLED_DIR}/debug")
-  set(exec_prefix "\${prefix}")
-  set(libdir "\${prefix}/lib")
-  set(includedir "\${prefix}/../include")
-  set(GNUTLS_LIBS "-lgnutlsd")
-  configure_file("${SOURCE_PATH}/lib/gnutls.pc.in" "${CURRENT_PACKAGES_DIR}/debug/lib/pkgconfig/gnutls.pc" @ONLY)
-endif()
-
-vcpkg_fixup_pkgconfig()
-vcpkg_copy_pdbs()
-file(COPY "${CURRENT_PORT_DIR}/vcpkg-cmake-wrapper.cmake" DESTINATION "${CURRENT_PACKAGES_DIR}/share/gnutls")

ports/shiftmedia-libgnutls/vcpkg-cmake-wrapper.cmake

@@ -1,2 +0,0 @@
-find_library(GNUTLS_LIBRARY NAMES gnutls gnutlsd NAMES_PER_DIR)
-_find_package(${ARGS})

ports/shiftmedia-libgnutls/vcpkg.json

@@ -1,23 +0,0 @@
-{
-  "name": "shiftmedia-libgnutls",
-  "version": "3.8.7",
-  "port-version": 3,
-  "description": "Unofficial GnuTLS fork with added custom native Visual Studio project build tools. ",
-  "homepage": "https://github.com/ShiftMediaProject/gnutls",
-  "license": "LGPL-2.1-only",
-  "supports": "windows & !arm & !mingw & !xbox",
-  "dependencies": [
-    "gmp",
-    "libtasn1",
-    "nettle",
-    {
-      "name": "vs-yasm",
-      "host": true
-    },
-    {
-      "name": "yasm-tool-helper",
-      "host": true
-    },
-    "zlib"
-  ]
-}

python/CMakeLists.txt

@@ -28,8 +28,18 @@ install(CODE [[
         if(NOT _pip_check EQUAL 0)
             message(WARNING "Skipping Python package install: pip not available for ${Python3_EXECUTABLE}.")
         else()
+            set(_pip_install_args
+                install
+                --no-deps
+                --no-build-isolation
+                --break-system-packages
+                --prefix ${CMAKE_INSTALL_PREFIX})
+            if(DEFINED ENV{DESTDIR} AND NOT "$ENV{DESTDIR}" STREQUAL "")
+                list(APPEND _pip_install_args --root "$ENV{DESTDIR}")
+            endif()
+            list(APPEND _pip_install_args .)
             execute_process(
-                COMMAND ${Python3_EXECUTABLE} -m pip install --no-deps --break-system-packages .
+                COMMAND ${Python3_EXECUTABLE} -m pip ${_pip_install_args}
                 WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/python
                 OUTPUT_VARIABLE _pip_output
                 ERROR_VARIABLE _pip_error

python/opendht.pyx

@@ -820,13 +820,8 @@ cdef class DhtRunner(_WithID):
                         key._infohash, (<PkId>to)._pkid, val._value,
                         cpp.bindDoneCb(done_callback, <void*>cb_obj), permanent
                     )
-                elif isinstance(to, InfoHash):
-                    self.thisptr.get().putEncrypted(
-                        key._infohash, (<InfoHash>to)._infohash, val._value,
-                        cpp.bindDoneCb(done_callback, <void*>cb_obj), permanent
-                    )
                 else:
-                    raise TypeError("'to' must be PublicKey, PkId, or InfoHash")
+                    raise TypeError("'to' must be PublicKey or PkId")
             except:
                 ref.Py_DECREF(cb_obj)
                 raise

python/opendht_cpp.pxd

@@ -282,7 +282,6 @@ cdef extern from "opendht/dhtrunner.h" namespace "dht":
         void get(InfoHash key, GetCallback get_cb, DoneCallback done_cb, nullptr_t f, Where w)
         void put(InfoHash key, shared_ptr[Value] val, DoneCallback done_cb, time_point created, bool permanent)
         void putSigned(InfoHash key, shared_ptr[Value] val, DoneCallback done_cb, bool permanent) 
-        void putEncrypted(InfoHash key, InfoHash to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
         void putEncrypted(InfoHash key, PkId to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
         void putEncrypted(InfoHash key, shared_ptr[PublicKey] to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
         void cancelPut(InfoHash key, shared_ptr[Value] val)

rust/src/dhtrunner.rs

@@ -226,7 +226,7 @@ impl DhtRunner {
     pub fn put_encrypted<'a>(
         &mut self,
         h: &InfoHash,
-        to: &InfoHash,
+        to: &PkId,
         v: Box<Value>,
         done_cb: &'a mut (dyn FnMut(bool)),
         permanent: bool,

rust/src/ffi.rs

@@ -190,7 +190,7 @@ extern {
                                  cb_user_data: *mut c_void,
                                  permanent: bool);
     pub fn dht_runner_put_encrypted(dht: *mut DhtRunner, h: *const InfoHash,
-                                    to: *const InfoHash, v: *const Value,
+                                    to: *const PkId, v: *const Value,
                                     done_cb: extern fn(bool, *mut c_void),
                                     cb_user_data: *mut c_void,
                                     permanent: bool);

src/crypto.cpp

@@ -11,6 +11,7 @@ extern "C" {
 #include <nettle/gcm.h>
 #include <nettle/aes.h>
 #include <nettle/hmac.h>
+#include <nettle/version.h>
 #include <gnutls/crypto.h>
 
 #include <argon2.h>
@@ -98,6 +99,46 @@ private:
 #define GCM_DIGEST_SIZE GCM_BLOCK_SIZE
 #endif
 
+static void
+gcmAes128Digest(gcm_aes128_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes128_digest(ctx, digest);
+#else
+    gcm_aes128_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+gcmAes192Digest(gcm_aes192_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes192_digest(ctx, digest);
+#else
+    gcm_aes192_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+gcmAes256Digest(gcm_aes256_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes256_digest(ctx, digest);
+#else
+    gcm_aes256_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+hmacSha256Digest(hmac_sha256_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    hmac_sha256_digest(ctx, digest);
+#else
+    hmac_sha256_digest(ctx, SHA256_DIGEST_SIZE, digest);
+#endif
+}
+
 Blob
 aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key)
 {
@@ -115,19 +156,19 @@ aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key)
         gcm_aes128_set_key(&aes, key.data());
         gcm_aes128_set_iv(&aes, GCM_IV_SIZE, ret.data());
         gcm_aes128_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes128Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
     } else if (key.size() == AES_LENGTHS[1]) {
         struct gcm_aes192_ctx aes;
         gcm_aes192_set_key(&aes, key.data());
         gcm_aes192_set_iv(&aes, GCM_IV_SIZE, ret.data());
         gcm_aes192_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes192_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes192Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
     } else if (key.size() == AES_LENGTHS[2]) {
         struct gcm_aes256_ctx aes;
         gcm_aes256_set_key(&aes, key.data());
         gcm_aes256_set_iv(&aes, GCM_IV_SIZE, ret.data());
         gcm_aes256_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes256_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes256Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
     }
 
     return ret;
@@ -160,19 +201,19 @@ aesDecrypt(const uint8_t* data, size_t data_length, const Blob& key)
         gcm_aes128_set_key(&aes, key.data());
         gcm_aes128_set_iv(&aes, GCM_IV_SIZE, data);
         gcm_aes128_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes128Digest(&aes, digest.data());
     } else if (key.size() == AES_LENGTHS[1]) {
         struct gcm_aes192_ctx aes;
         gcm_aes192_set_key(&aes, key.data());
         gcm_aes192_set_iv(&aes, GCM_IV_SIZE, data);
         gcm_aes192_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes192_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes192Digest(&aes, digest.data());
     } else if (key.size() == AES_LENGTHS[2]) {
         struct gcm_aes256_ctx aes;
         gcm_aes256_set_key(&aes, key.data());
         gcm_aes256_set_iv(&aes, GCM_IV_SIZE, data);
         gcm_aes256_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes256_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes256Digest(&aes, digest.data());
     }
 
     if (not std::equal(digest.begin(), digest.end(), data + data_length - GCM_DIGEST_SIZE)) {
@@ -2045,7 +2086,7 @@ hkdf_extract(const Blob& salt, const Blob& ikm)
     hmac_sha256_set_key(&ctx, salt.size(), salt.data());
     hmac_sha256_update(&ctx, ikm.size(), ikm.data());
     Blob prk(SHA256_DIGEST_SIZE);
-    hmac_sha256_digest(&ctx, SHA256_DIGEST_SIZE, prk.data());
+    hmacSha256Digest(&ctx, prk.data());
     return prk;
 }
 
@@ -2063,7 +2104,7 @@ hkdf_expand(const Blob& prk, const uint8_t* info, size_t info_len, size_t len)
         hmac_sha256_update(&ctx, info_len, info);
         hmac_sha256_update(&ctx, 1, &i);
         T.resize(SHA256_DIGEST_SIZE);
-        hmac_sha256_digest(&ctx, SHA256_DIGEST_SIZE, T.data());
+        hmacSha256Digest(&ctx, T.data());
         okm.insert(okm.end(), T.begin(), T.end());
         i++;
     }
@@ -2223,7 +2264,7 @@ webPushEncrypt(const Blob& p256dh,
 
     Blob ciphertext(plaintext.size() + GCM_DIGEST_SIZE);
     gcm_aes128_encrypt(&aes, plaintext.size(), ciphertext.data(), plaintext.data());
-    gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, ciphertext.data() + plaintext.size());
+    gcmAes128Digest(&aes, ciphertext.data() + plaintext.size());
 
     // 6. Construct Output
     Blob output;

src/dht.cpp

@@ -1432,6 +1432,8 @@ Dht::storageStore(const InfoHash& id,
     created = std::min(created, now);
     if (expiration == time_point::min())
         expiration = permanent ? time_point::max() : created + getType(value->type).expiration;
+    else if (not permanent)
+        expiration = std::min(expiration, created + getType(value->type).expiration);
     if (expiration < now)
         return false;
 

src/dhtrunner.cpp

@@ -186,9 +186,6 @@ DhtRunner::run(const Config& config, Context&& context)
     if (context.certificateStore) {
         dht_->setLocalCertificateStore(std::move(context.certificateStore));
     }
-    if (context.certificateStorePkId) {
-        dht_->setLocalCertificateStore(std::move(context.certificateStorePkId));
-    }
     if (context.publicAddressChangedCb) {
         dht_->setOnPublicAddressChanged(std::move(context.publicAddressChangedCb));
     }
@@ -667,14 +664,6 @@ DhtRunner::registerCertificate(const std::shared_ptr<crypto::Certificate>& cert)
     dht_->registerCertificate(cert);
 }
 
-void
-DhtRunner::setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method)
-{
-    std::lock_guard lck(dht_mtx);
-    if (dht_)
-        dht_->setLocalCertificateStore(std::forward<CertificateStoreQueryLegacy>(query_method));
-}
-
 void
 DhtRunner::setLocalCertificateStore(CertificateStoreQuery&& query_method)
 {
@@ -955,35 +944,6 @@ DhtRunner::putEncrypted(InfoHash hash, const PkId& to, std::shared_ptr<Value> va
     cv.notify_all();
 }
 
-void
-DhtRunner::putEncrypted(InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
-{
-    std::unique_lock lck(storage_mtx);
-    if (running != State::Running) {
-        lck.unlock();
-        if (cb)
-            cb(false, {});
-        return;
-    }
-    ongoing_ops++;
-    pending_ops.emplace([=, cb = std::move(cb), value = std::move(value)](SecureDht& dht) mutable {
-        dht.putEncrypted(hash, to, value, bindOpDoneCallback(std::move(cb)), permanent);
-    });
-    cv.notify_all();
-}
-
-void
-DhtRunner::putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallback cb, bool permanent)
-{
-    putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), std::move(cb), permanent);
-}
-
-void
-DhtRunner::putEncrypted(const std::string& key, InfoHash to, Value&& value, DoneCallback cb, bool permanent)
-{
-    putEncrypted(InfoHash::get(key), to, std::forward<Value>(value), std::move(cb), permanent);
-}
-
 void
 DhtRunner::putEncrypted(InfoHash hash,
                         const std::shared_ptr<crypto::PublicKey>& to,
@@ -1119,25 +1079,6 @@ DhtRunner::connectivityChanged()
     cv.notify_all();
 }
 
-void
-DhtRunner::findCertificate(InfoHash hash, std::function<void(const Sp<crypto::Certificate>&)> cb)
-{
-    std::unique_lock lck(storage_mtx);
-    if (running != State::Running) {
-        lck.unlock();
-        cb({});
-        return;
-    }
-    ongoing_ops++;
-    pending_ops.emplace([this, hash, cb = std::move(cb)](SecureDht& dht) {
-        dht.findCertificate(hash, [this, cb = std::move(cb)](const Sp<crypto::Certificate>& crt) {
-            cb(crt);
-            opEnded();
-        });
-    });
-    cv.notify_all();
-}
-
 void
 DhtRunner::findCertificate(PkId hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)> cb)
 {

src/securedht.cpp

@@ -96,37 +96,13 @@ SecureDht::secureType(ValueType&& type)
     return type;
 }
 
-Sp<crypto::Certificate>
-SecureDht::getCertificate(const InfoHash& node) const
-{
-    if (node == getId())
-        return certificate_;
-    auto it = nodesCertificates_.find(node);
-    if (it == nodesCertificates_.end())
-        return nullptr;
-    else
-        return it->second;
-}
-
-Sp<crypto::PublicKey>
-SecureDht::getPublicKey(const InfoHash& node) const
-{
-    if (node == getId())
-        return certificate_->getSharedPublicKey();
-    auto it = nodesPubKeys_.find(node);
-    if (it == nodesPubKeys_.end())
-        return nullptr;
-    else
-        return it->second;
-}
-
 Sp<crypto::Certificate>
 SecureDht::getCertificate(const PkId& node) const
 {
     if (node == getLongId())
         return certificate_;
-    auto it = nodesCertificatesLong_.find(node);
-    if (it == nodesCertificatesLong_.end())
+    auto it = nodesCertificates_.find(node);
+    if (it == nodesCertificates_.end())
         return nullptr;
     else
         return it->second;
@@ -137,8 +113,8 @@ SecureDht::getPublicKey(const PkId& node) const
 {
     if (node == getLongId())
         return certificate_->getSharedPublicKey();
-    auto it = nodesPubKeysLong_.find(node);
-    if (it == nodesPubKeysLong_.end())
+    auto it = nodesPubKeys_.find(node);
+    if (it == nodesPubKeys_.end())
         return nullptr;
     else
         return it->second;
@@ -191,85 +167,10 @@ void
 SecureDht::registerCertificate(const Sp<crypto::Certificate>& cert)
 {
     if (cert) {
-        nodesCertificates_[cert->getId()] = cert;
-        nodesCertificatesLong_[cert->getLongId()] = cert;
+        nodesCertificates_[cert->getLongId()] = cert;
     }
 }
 
-void
-SecureDht::findCertificate(const InfoHash& node, const std::function<void(const Sp<crypto::Certificate>)>& cb)
-{
-    Sp<crypto::Certificate> b = getCertificate(node);
-    if (b && *b) {
-        if (logger_)
-            logger_->debug("Using certificate from cache for {}", node.toString());
-        if (cb)
-            cb(b);
-        return;
-    }
-    if (localQueryMethodLegacy_) {
-        auto res = localQueryMethodLegacy_(node);
-        if (not res.empty()) {
-            if (logger_)
-                logger_->debug("Registering certificate from local store for {}", node.toString());
-            nodesCertificates_.emplace(node, res.front());
-            nodesCertificatesLong_.emplace(res.front()->getLongId(), res.front());
-            if (cb)
-                cb(res.front());
-            return;
-        }
-    }
-
-    auto found = std::make_shared<bool>(false);
-    dht_->get(
-        node,
-        [cb, node, found, this](const std::vector<Sp<Value>>& vals) {
-            for (const auto& v : vals) {
-                if (auto cert = registerCertificate(node, v->data)) {
-                    *found = true;
-                    if (logger_)
-                        logger_->debug("Found certificate for {}", node.toString());
-                    if (cb)
-                        cb(cert);
-                    return false;
-                }
-            }
-            return !*found;
-        },
-        [cb, found](bool) {
-            if (!*found and cb)
-                cb(nullptr);
-        },
-        Value::TypeFilter(CERTIFICATE_TYPE));
-}
-
-void
-SecureDht::findPublicKey(const InfoHash& node, const std::function<void(const Sp<crypto::PublicKey>)>& cb)
-{
-    auto pk = getPublicKey(node);
-    if (pk && *pk) {
-        if (logger_)
-            logger_->debug("Found public key from cache for {}", node.toString());
-        if (cb)
-            cb(pk);
-        return;
-    }
-    findCertificate(node, [=](const Sp<crypto::Certificate>& crt) {
-        if (crt && *crt) {
-            auto pk = crt->getSharedPublicKey();
-            if (*pk) {
-                nodesPubKeys_[pk->getId()] = pk;
-                nodesPubKeysLong_[pk->getLongId()] = pk;
-                if (cb)
-                    cb(pk);
-                return;
-            }
-        }
-        if (cb)
-            cb(nullptr);
-    });
-}
-
 void
 SecureDht::findCertificate(const PkId& node, const std::function<void(const Sp<crypto::Certificate>)>& cb)
 {
@@ -287,8 +188,7 @@ SecureDht::findCertificate(const PkId& node, const std::function<void(const Sp<c
         if (not res.empty()) {
             if (logger_)
                 logger_->debug("Registering certificate from local store for {}", node.to_c_str());
-            nodesCertificates_.emplace(res.front()->getId(), res.front());
-            nodesCertificatesLong_.emplace(node, res.front());
+            nodesCertificates_.emplace(node, res.front());
             if (cb)
                 cb(res.front());
             return;
@@ -333,8 +233,7 @@ SecureDht::findPublicKey(const PkId& node, const std::function<void(const Sp<cry
         if (crt && *crt) {
             auto pk = crt->getSharedPublicKey();
             if (*pk) {
-                nodesPubKeys_[pk->getId()] = pk;
-                nodesPubKeysLong_[pk->getLongId()] = pk;
+                nodesPubKeys_[pk->getLongId()] = pk;
                 if (cb)
                     cb(pk);
                 return;
@@ -362,8 +261,7 @@ SecureDht::checkValue(const Sp<Value>& v)
             if (auto decrypted_val = v->decrypt(*key_)) {
                 auto cacheValue = not isDecrypted and decrypted_val->owner;
                 if (cacheValue) {
-                    nodesPubKeys_[decrypted_val->owner->getId()] = decrypted_val->owner;
-                    nodesPubKeysLong_[decrypted_val->owner->getLongId()] = decrypted_val->owner;
+                    nodesPubKeys_[decrypted_val->owner->getLongId()] = decrypted_val->owner;
                 }
                 return decrypted_val;
             }
@@ -377,8 +275,7 @@ SecureDht::checkValue(const Sp<Value>& v)
         auto cacheValue = not v->isSignatureChecked() and enableCache_ and v->owner;
         if (v->checkSignature()) {
             if (cacheValue) {
-                nodesPubKeys_[v->owner->getId()] = v->owner;
-                nodesPubKeysLong_[v->owner->getLongId()] = v->owner;
+                nodesPubKeys_[v->owner->getLongId()] = v->owner;
             }
             return v;
         } else if (logger_)
@@ -492,35 +389,6 @@ SecureDht::putSigned(const InfoHash& hash, Sp<Value> val, DoneCallback callback,
         Where().id(val->id));
 }
 
-void
-SecureDht::putEncrypted(const InfoHash& hash, const InfoHash& to, Sp<Value> val, DoneCallback callback, bool permanent)
-{
-    if (not key_) {
-        if (callback)
-            callback(false, {});
-        return;
-    }
-    findPublicKey(to,
-                  [this, hash, val = std::move(val), callback = std::move(callback), permanent](
-                      const Sp<crypto::PublicKey>& pk) {
-                      if (!pk || !*pk) {
-                          if (callback)
-                              callback(false, {});
-                          return;
-                      }
-                      if (logger_)
-                          logger_->warn("Encrypting data for PK: {}", pk->getId().toString());
-                      try {
-                          dht_->put(hash, encrypt(*val, *pk), callback, time_point::max(), permanent);
-                      } catch (const std::exception& e) {
-                          if (logger_)
-                              logger_->error("Error putting encrypted data: {}", e.what());
-                          if (callback)
-                              callback(false, {});
-                      }
-                  });
-}
-
 void
 SecureDht::putEncrypted(const InfoHash& hash, const PkId& to, Sp<Value> val, DoneCallback callback, bool permanent)
 {

src/thread_pool.cpp

@@ -78,6 +78,8 @@ ThreadPool::run(std::function<void()>&& cb)
                             break;
                         task = std::move(tasks_.front());
                         tasks_.pop();
+                        if (tasks_.empty() && stopping_)
+                            stopCv_.notify_one();
                     }
 
                     // run task
@@ -135,7 +137,9 @@ ThreadPool::stop(bool wait)
 {
     std::unique_lock l(lock_);
     if (wait) {
-        cv_.wait(l, [&]() { return tasks_.empty(); });
+        stopping_ = true;
+        stopCv_.wait(l, [&]() { return tasks_.empty(); });
+        stopping_ = false;
     }
     running_ = false;
     tasks_ = {};

tests/test_dhtrunner.cpp

@@ -262,6 +262,83 @@ DhtRunnerTester::testImportValuesPreservesStoredExpiration()
     restored.join();
 }
 
+void
+DhtRunnerTester::testImportPermanentValueExpires()
+{
+    // Simulate importing a value that was originally stored as permanent
+    // (expiration = time_point::max()). After import the permanent flag is lost,
+    // so the value must expire within the type's normal expiration window.
+    static const dht::ValueType SHORT_TYPE {201, "Short perm", 2s};
+
+    auto key = dht::InfoHash::get("import-permanent-expiration");
+    auto now = dht::clock::now();
+
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+    pk.pack_array(1);
+    pk.pack_array(4);
+    pk.pack(now.time_since_epoch().count());
+    dht::Value {SHORT_TYPE.id, std::string("was-permanent")}.msgpack_pack(pk);
+    pk.pack_bin(0);
+    // Permanent values are exported with time_point::max() expiration
+    pk.pack(dht::clock::time_point::max().time_since_epoch().count());
+
+    dht::DhtRunner restored;
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+    restored.run(0, config);
+
+    restored.importValues({
+        dht::ValuesExport {key, {buffer.data(), buffer.data() + buffer.size()}}
+    });
+
+    // Value should be present right after import
+    auto exportedBefore = restored.exportValues();
+    CPPUNIT_ASSERT(!exportedBefore.empty());
+
+    // Wait longer than the default USER_DATA expiration (10 min) is not
+    // practical, but the type is unregistered so the default 10 min expiration
+    // applies.  Instead, register the short type so the cap uses 2 s.
+    // Re-import into a fresh node that knows the short type.
+    dht::DhtRunner restored2;
+    restored2.run(0, config);
+    restored2.registerInsecureType(SHORT_TYPE);
+    restored2.importValues({
+        dht::ValuesExport {key, {buffer.data(), buffer.data() + buffer.size()}}
+    });
+
+    CPPUNIT_ASSERT(!restored2.exportValues().empty());
+
+    // Wait for the short expiration to pass
+    std::this_thread::sleep_for(3s);
+
+    auto restoredValues = restored2.exportValues();
+    bool found = false;
+    for (const auto& ve : restoredValues) {
+        if (ve.first == key) {
+            msgpack::unpacked msg;
+            msgpack::unpack(msg, (const char*) ve.second.data(), ve.second.size());
+            auto valarr = msg.get();
+            CPPUNIT_ASSERT(valarr.type == msgpack::type::ARRAY);
+            // The value should have expired
+            CPPUNIT_ASSERT_EQUAL(uint32_t(0), valarr.via.array.size);
+            found = true;
+        }
+    }
+    // Either the key was cleaned up entirely or it was found with 0 values
+    CPPUNIT_ASSERT(found || restoredValues.empty()
+                   || std::none_of(restoredValues.begin(), restoredValues.end(),
+                                   [&](const auto& ve) { return ve.first == key; }));
+
+    restored.shutdown();
+    restored.join();
+    restored2.shutdown();
+    restored2.join();
+}
+
 void
 DhtRunnerTester::testBootstrapSetsConnectingState()
 {

tests/test_dhtrunner.h

@@ -22,6 +22,7 @@ class DhtRunnerTester : public CppUnit::TestFixture
     CPPUNIT_TEST(testIdOps);
     CPPUNIT_TEST(testImportValuesPreservesRemoteQuota);
     CPPUNIT_TEST(testImportValuesPreservesStoredExpiration);
+    CPPUNIT_TEST(testImportPermanentValueExpires);
     CPPUNIT_TEST(testBootstrapSetsConnectingState);
     CPPUNIT_TEST(testBootstrapThenPutNoRace);
     CPPUNIT_TEST(testBootstrapMissingNodeThenPutFails);
@@ -66,6 +67,7 @@ public:
     void testIdOps();
     void testImportValuesPreservesRemoteQuota();
     void testImportValuesPreservesStoredExpiration();
+    void testImportPermanentValueExpires();
     void testBootstrapSetsConnectingState();
     void testBootstrapThenPutNoRace();
     void testBootstrapMissingNodeThenPutFails();

tests/test_threadpool.cpp

@@ -80,6 +80,46 @@ ThreadPoolTester::testContext()
     CPPUNIT_ASSERT_EQUAL(N, count.load());
 }
 
+void
+ThreadPoolTester::testJoinNonEmptyTaskQueue()
+{
+    dht::ThreadPool pool(2);
+
+    constexpr unsigned N = 128;
+    std::atomic_uint count {0};
+
+    // Schedule enough work so that the task queue is non-empty when calling
+    // pool.join() below.
+    for (unsigned i = 0; i < N; i++)
+        pool.run([&] {
+            std::this_thread::sleep_for(std::chrono::milliseconds(1));
+            count++;
+        });
+
+    std::atomic_bool joined {false};
+    std::condition_variable cv;
+    std::thread joinThread([&] {
+        CPPUNIT_ASSERT(count.load() < N);
+        pool.join();
+        joined = true;
+        cv.notify_one();
+    });
+
+    // After calling join(), all pending tasks should complete, and then all
+    // threads in the pool should join.
+    std::mutex mtx;
+    std::unique_lock lock(mtx);
+    bool poolJoined = cv.wait_for(lock, std::chrono::seconds(10), [&] { return joined.load(); });
+    if (!poolJoined) {
+        // Detach joinThread if we timed out, otherwise the test can crash.
+        joinThread.detach();
+    } else {
+        joinThread.join();
+    }
+    CPPUNIT_ASSERT_EQUAL_MESSAGE("Some tasks were not completed", N, count.load());
+    CPPUNIT_ASSERT_MESSAGE("Thread pool failed to join before timeout", poolJoined);
+}
+
 void
 ThreadPoolTester::tearDown()
 {}

tests/test_threadpool.h

@@ -14,6 +14,7 @@ class ThreadPoolTester : public CppUnit::TestFixture
     CPPUNIT_TEST(testThreadPool);
     CPPUNIT_TEST(testExecutor);
     CPPUNIT_TEST(testContext);
+    CPPUNIT_TEST(testJoinNonEmptyTaskQueue);
     CPPUNIT_TEST_SUITE_END();
 
 public:
@@ -29,6 +30,7 @@ public:
     void testThreadPool();
     void testExecutor();
     void testContext();
+    void testJoinNonEmptyTaskQueue();
 };
 
 } // namespace test

tools/dhtchat.cpp

@@ -123,7 +123,7 @@ main(int argc, char** argv)
                     iss >> idstr;
                     std::getline(iss, line);
                     dht.putEncrypted(room,
-                                     InfoHash(idstr),
+                                     PkId(idstr),
                                      dht::ImMessage(IdDist()(tools::rd), std::move(line), now),
                                      [](bool ok) {
                                          // dht.cancelPut(room, id);

tools/dhtnode.cpp

@@ -481,7 +481,7 @@ cmd_loop(std::shared_ptr<DhtRunner>& node,
             auto value = std::make_shared<dht::Value>(dht::ValueType::USER_DATA.id,
                                                       std::vector<uint8_t> {v.begin(), v.end()});
             value->user_type = "text/plain";
-            node->putEncrypted(id, InfoHash(tostr), std::move(value), [start](bool ok) {
+            node->putEncrypted(id, PkId(tostr), std::move(value), [start](bool ok) {
                 auto end = std::chrono::high_resolution_clock::now();
                 std::cout << "Put encrypted: " << (ok ? "success" : "failure") << " (took "
                           << print_duration(end - start) << ')' << std::endl;

vcpkg-configuration.json

@@ -1,7 +1,7 @@
 {
   "default-registry": {
     "kind": "git",
-    "baseline": "56bb2411609227288b70117ead2c47585ba07713",
+    "baseline": "66c0373dc7fca549e5803087b9487edfe3aca0a1",
     "repository": "https://github.com/microsoft/vcpkg"
   },
   "registries": [
@@ -10,8 +10,5 @@
       "location": "https://github.com/microsoft/vcpkg-ce-catalog/archive/refs/heads/main.zip",
       "name": "microsoft"
     }
-  ],
-  "overlay-ports": [
-    "ports"
   ]
 }

vcpkg.json

@@ -1,6 +1,6 @@
 {
   "name": "opendht",
-  "version-string": "3.7.9",
+  "version-string": "4.0.0",
   "port-version": 1,
   "description": "OpenDHT: A lightweight C++17 Distributed Hash Table library.",
   "homepage": "https://opendht.net",