python: support DESTDIR in pip install step

Use --root $DESTDIR when the environment variable is set so that staged installs (e.g. 'make DESTDIR=/tmp/pkg install') place the Python package under the staging root. Also pass --no-build-isolation and --prefix to avoid rebuilding in an isolated venv and to honour CMAKE_INSTALL_PREFIX.
thread_pool: notify when task queue becomes empty
2026-11-08 12:28:42 +00:00 · 2026-05-25 13:40:55 -04:00 · 2026-05-21 10:17:08 -04:00 · 2026-05-21 10:17:08 -04:00 · 2026-05-18 10:50:23 -04:00 · 2026-05-18 10:36:48 -04:00
26 changed files with 368 additions and 333 deletions
@@ -9,8 +9,8 @@ if(POLICY CMP0167)
    cmake_policy(SET CMP0167 NEW)
 endif()

-set (opendht_VERSION_MAJOR 3)
-set (opendht_VERSION_MINOR 7.9)
+set (opendht_VERSION_MAJOR 4)
+set (opendht_VERSION_MINOR 0.0)
 set (opendht_VERSION ${opendht_VERSION_MAJOR}.${opendht_VERSION_MINOR})
 set (PACKAGE_VERSION ${opendht_VERSION})
 set (VERSION "${opendht_VERSION}")
@@ -600,7 +600,7 @@ dht_runner_put_signed(
 void
 dht_runner_put_encrypted(dht_runner* r,
                         const dht_infohash* h,
-                         const dht_infohash* to,
+                         const dht_pkid* to,
                         const dht_value* v,
                         dht_done_cb done_cb,
                         void* cb_user_data,
@@ -608,7 +608,7 @@ dht_runner_put_encrypted(dht_runner* r,
 {
    auto runner = reinterpret_cast<dht::DhtRunner*>(r);
    auto hash = reinterpret_cast<const dht::InfoHash*>(h);
-    auto toHash = reinterpret_cast<const dht::InfoHash*>(to);
+    auto toHash = reinterpret_cast<const dht::PkId*>(to);
    auto value = reinterpret_cast<const ValueSp*>(v);
    runner->putEncrypted(
        *hash,
@@ -195,7 +195,7 @@ OPENDHT_C_PUBLIC void dht_runner_put_signed(dht_runner* runner,
                                            bool permanent);
 OPENDHT_C_PUBLIC void dht_runner_put_encrypted(dht_runner* runner,
                                               const dht_infohash* hash,
-                                               const dht_infohash* to,
+                                               const dht_pkid* to,
                                               const dht_value* value,
                                               dht_done_cb done_cb,
                                               void* cb_user_data,
@@ -1,102 +1,193 @@
-.TH DHTNODE 1 2019-06-08
+.TH DHTNODE 1 2026-04-18
 .SH NAME
 .B dhtnode
 - a simple OpenDHT command line node runner.
 .SH SYNOPSIS
 .B dhtnode
 [\fB\-h\fR]
+[\fB\-V\fR]
 [\fB\-v\fR [\fB\-l\fR \fIlogfile\fR] [\fB\-L\fR]]
-[\fB\-i\fR [\fB\-\-save\-identity\fR \fIfile\fR]]
+[\fB\-i\fR [\fB\-I\fR \fIfile\fR]]
+[\fB\-c\fR \fIfile\fR]
+[\fB\-k\fR \fIfile\fR]
+[\fB\-m\fR \fIpassword\fR]
 [\fB\-d\fR] [\fB\-s\fR]
+[\fB\-D\fR] [\fB\-U\fR] [\fB\-P\fR]
 [\fB\-n\fR \fInetwork_id\fR]
 [\fB\-p\fR \fIlocal_port\fR]
 [\fB\-b\fR \fIbootstrap_host\fR[:\fIport\fR]]
-[\fB\-\-certificate\fR \fIfile\fR]
-[\fB\-\-privkey\fR \fIfile\fR]
-[\fB\-\-privkey\-password\fR \fIpassword\fR]
-[\fB\-\-proxyserver\fR \fIport\fR]
-[\fB\-\-proxyclient\fR \fIserver\fR]
+[\fB\-f\fR \fIpath\fR]
+[\fB\-S\fR \fIport\fR]
+[\fB\-e\fR \fIport\fR]
+[\fB\-a\fR \fIaddress\fR]
+[\fB\-w\fR \fIfile\fR]
+[\fB\-K\fR \fIfile\fR]
+[\fB\-M\fR \fIpassword\fR]
+[\fB\-C\fR \fIserver\fR]
+[\fB\-y\fR \fIendpoint\fR]
+[\fB\-z\fR \fIkey\fR]
+[\fB\-u\fR \fIbundleid\fR]
 .SH DESCRIPTION
-Runs an OpenDHT node, with a CLI (default) or as a daemon (with \fB'-d'\fP or \fB'-s'\fP).
+Runs an OpenDHT node, with an interactive CLI (default) or as a daemon (with \fB'-d'\fP or \fB'-s'\fP).
 Commands available in the interactive shell are:
 .EX
    h, help    Print this help message.
-    q, quit    Quit the program.
+    x, quit    Quit the program.
    log        Start/stop printing DHT logs.

    Node information:
    ll         Print basic information and stats about the current node.
-    ls         Print basic information about current searches.
-    ld         Print basic information about currenty stored values on this node.
-    lr         Print the full current routing table of this node
+    ls [key]   Print basic information about current search(es).
+    ld [key]   Print basic information about currenty stored values on this
+               node (or for a specific key).
+    lr         Print the full current routing table of this node.

    Operations on the DHT:
-    b ip:port             Ping potential node at given IP address/port.
-    g [key]               Get values at [key].
-    l [key]               Listen for value changes at [key].
-    p [key] [str]         Put string value at [key].
-    s [key] [str]         Put string value at [key], signed with our generated
-                          private key.
-    e [key] [dest] [str]  Put string value at [key], encrypted for [dest] with
-                          its public key (if found).
+    b <ip:port>            Ping potential node at given IP address/port.
+    g <key>                Get values at <key>.
+    l <key>                Listen for value changes at <key>.
+    cl <key> <token>       Cancel listen for <token> and <key>.
+    p <key> <str>          Put string value at <key>.
+    pp <key> <str>         Put string value at <key> (persistent version).
+    cpp <key> <id>         Cancel persistent put operation for <key> and
+                           value <id>.
+    s <key> <str>          Put string value at <key>, signed with our
+                           generated private key.
+    e <key> <dest> <str>   Put string value at <key>, encrypted for <dest>
+                           with its public key (if found).
+    cc                     Trigger connectivity changed signal.
+
+    Operations with the proxy (if compiled with proxy server support):
+    pst [port] <pushServer>  Start the proxy interface on port.
+    psx [port]               Start the proxy SSL interface on port.
+    psp [port]               Stop the proxy interface on port.
+
+    Operations with the proxy (if compiled with proxy client support):
+    stt [server_address] <device_key>  Start the proxy client.
+    stp                                Stop the proxy client.
+    rs  [token]                        Resubscribe to opendht.
+    rp  [token]                        Inject a push notification.
 .EE
 .SH OPTIONS
 .TP
-\fB\-h\fP
-Prints some help.
+\fB\-h\fP, \fB\-\-help\fP
+Prints help and exits.
 .TP
-\fB\-v\fP
-Enable the verbose mode (log to stdout/stderr by default)
+\fB\-V\fP, \fB\-\-version\fP
+Prints version information and exits.
 .TP
-\fB\-l\fP \fIlog_file\fP
-Write log to file instead of stdout/stderr
+\fB\-v\fP, \fB\-\-verbose\fP
+Enable verbose mode (log to stdout/stderr by default).
 .TP
-\fB\-L\fP
-Write log to syslog instead of stdout/stderr
+\fB\-l\fP \fIlogfile\fP, \fB\-\-logfile\fP \fIlogfile\fP
+Write log to file instead of stdout/stderr.
 .TP
-\fB\-i\fP
-Generate cryptographic identity for the node.
+\fB\-L\fP, \fB\-\-syslog\fP
+Write log to syslog instead of stdout/stderr (enables verbose mode).
 .TP
-\fB\-\-save\-identity\fP \fIfile\fP
+\fB\-i\fP, \fB\-\-identity\fP
+Generate a cryptographic identity (RSA key pair and self-signed certificate)
+for the node. Required to perform cryptographic operations (encrypt/sign values)
+if no private key file is provided.
+.TP
+\fB\-I\fP \fIfile\fP, \fB\-\-save\-identity\fP \fIfile\fP
 Save generated identity (certificate and private key) to given file prefix.
+Files are saved as \fIfile\fP and \fIfile\fP_ca.
 .TP
-\fB\-\-certificate\fP \fIfile\fP
-Load identity certificate from given file.
+\fB\-c\fP \fIfile\fP, \fB\-\-certificate\fP \fIfile\fP
+Load identity certificate from given file. If specified, the certificate is
+published on the DHT.
 .TP
-\fB\-\-privkey\fP \fIfile\fP
-Load identity private key from given file.
+\fB\-k\fP \fIfile\fP, \fB\-\-privkey\fP \fIfile\fP
+Load identity private key from given file. Required to perform cryptographic
+operations if no identity is generated.
 .TP
-\fB\-\-privkey\-password\fP \fIpassword\fP
+\fB\-m\fP \fIpassword\fP, \fB\-\-privkey\-password\fP \fIpassword\fP
 Password to use for private key encryption or decryption (optional).
 .TP
-\fB\-d\fP
-Run the program in daemon mode (will fork in the background).
+\fB\-d\fP, \fB\-\-daemonize\fP
+Run the program in daemon mode (will fork in the background). When verbose mode
+is enabled, logs to syslog by default.
 .TP
-\fB\-s\fP
+\fB\-s\fP, \fB\-\-service\fP
 Run the program in service mode (non\-forking daemon).
 .TP
-\fB\-D\fP
+\fB\-D\fP, \fB\-\-peer\-discovery\fP
 Enables multicast automatic local peer discovery.
 .TP
-\fB\-f\fP \fIfile\fP
-Specify a file path to persist/load the node state.
+\fB\-U\fP, \fB\-\-no\-rate\-limit\fP
+Disable rate limiting (allows unlimited requests and storage).
 .TP
-\fB\-n\fP \fInetwork_id\fP
-Specify the network id. This let you connect to distinct networks and prevents
-the merge of two different networks (available since OpenDHT v0.6.1).
+\fB\-P\fP, \fB\-\-public\-stable\fP
+Enable public stable mode.
 .TP
-\fB\-p\fP \fIlocal_port\fP
-Use UDP port \fIlocal_port\fP for the program to bind to.
+\fB\-f\fP \fIpath\fP, \fB\-\-persist\fP \fIpath\fP
+Specify a file path to persist/load the node state (routing table and values).
 .TP
-\fB\-b\fP \fIbootstrap_host\fP[:\fIport\fP]
-The program needs to be given a node to connect to the network. You use this
-option to provide the ip address of that node.
+\fB\-n\fP \fInetwork_id\fP, \fB\-\-net\fP \fInetwork_id\fP
+Specify the network id. This lets you connect to distinct networks and prevents
+the merge of two different networks. Defaults to 0 (the main public network).
 .TP
-\fB\-\-proxyserver\fP \fIlocal_port\fP
-Run a proxy server bound to this DHT node on HTTP port \fIlocal_port\fP
+\fB\-p\fP \fIlocal_port\fP, \fB\-\-port\fP \fIlocal_port\fP
+Use UDP port \fIlocal_port\fP for the program to bind to. If not set, will use
+any available port. The default OpenDHT port for public nodes is 4222.
 .TP
-\fB\-\-proxyclient\fP \fIserver\fP
-Run this DHT node in proxy client mode, and connect to \fIserver\fP
+\fB\-b\fP \fIbootstrap_host\fP[:\fIport\fP], \fB\-\-bootstrap\fP \fIbootstrap_host\fP[:\fIport\fP]
+Specify a bootstrap node address to connect to the network.
+.TP
+\fB\-S\fP \fIlocal_port\fP, \fB\-\-proxyserver\fP \fIlocal_port\fP
+Run a REST API proxy server bound to this DHT node on HTTP port \fIlocal_port\fP.
+.TP
+\fB\-e\fP \fIlocal_port\fP, \fB\-\-proxyserverssl\fP \fIlocal_port\fP
+Run a REST API proxy server with SSL bound to this DHT node on HTTPS port \fIlocal_port\fP.
+.TP
+\fB\-a\fP \fIaddress\fP, \fB\-\-proxy\-addr\fP \fIaddress\fP
+Proxy server bind address.
+.TP
+\fB\-w\fP \fIfile\fP, \fB\-\-proxy\-certificate\fP \fIfile\fP
+Load proxy SSL certificate from given file.
+.TP
+\fB\-K\fP \fIfile\fP, \fB\-\-proxy\-privkey\fP \fIfile\fP
+Load proxy SSL private key from given file.
+.TP
+\fB\-M\fP \fIpassword\fP, \fB\-\-proxy\-privkey\-password\fP \fIpassword\fP
+Password for the proxy private key encryption or decryption (optional).
+.TP
+\fB\-C\fP \fIserver\fP, \fB\-\-proxyclient\fP \fIserver\fP
+Run this DHT node in proxy client mode, and connect to \fIserver\fP.
+.TP
+\fB\-y\fP \fIendpoint\fP, \fB\-\-pushserver\fP \fIendpoint\fP
+Push notification server endpoint.
+.TP
+\fB\-z\fP \fIkey\fP, \fB\-\-devicekey\fP \fIkey\fP
+Device key for push notifications.
+.TP
+\fB\-u\fP \fIbundleid\fP, \fB\-\-bundleid\fP \fIbundleid\fP
+Bundle ID for push notifications.
+.SH EXAMPLES
+Run a node using bootstrap.jami.net as a bootstrap:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222
+.EE
+.PP
+Run a node as a non-forking daemon on port 4222:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net -p 4222 -s
+.EE
+.PP
+Run a proxy server on port 8000:
+.PP
+.EX
+dhtnode -b bootstrap.jami.net:4222 --proxyserver 8000
+.EE
+.PP
+Use a proxy client to connect to a proxy server:
+.PP
+.EX
+dhtnode --proxyclient dhtproxy.jami.net:80
+.EE
 .SH AUTHORS
 .TP
 Program written by
@@ -187,8 +187,6 @@ using ShutdownCallback = std::function<void()>;
 using IdentityAnnouncedCb = std::function<void(bool)>;
 using PublicAddressChangedCb = std::function<void(std::vector<SockAddr>)>;

-using CertificateStoreQueryLegacy
-    = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const InfoHash& pk_id)>;
 using CertificateStoreQuery = std::function<std::vector<std::shared_ptr<crypto::Certificate>>(const PkId& pk_id)>;

 using DoneCallback = std::function<void(bool success, const std::vector<std::shared_ptr<Node>>& nodes)>;
@@ -61,8 +61,7 @@ public:
        std::unique_ptr<net::DatagramSocket> sock;
        std::shared_ptr<PeerDiscovery> peerDiscovery {};
        StatusCallback statusChangedCallback {};
-        CertificateStoreQueryLegacy certificateStore {};
-        CertificateStoreQuery certificateStorePkId {};
+        CertificateStoreQuery certificateStore {};
        IdentityAnnouncedCb identityAnnouncedCb {};
        PublicAddressChangedCb publicAddressChangedCb {};
        std::unique_ptr<std::mt19937_64> rng {};
@@ -286,21 +285,6 @@ public:
    }
    void putSigned(const std::string& key, Value&& value, DoneCallbackSimple cb = {}, bool permanent = false);

-    void putEncrypted(
-        InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallback cb = {}, bool permanent = false);
-    void putEncrypted(
-        InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallbackSimple cb, bool permanent = false)
-    {
-        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
-    }
-
-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallback cb = {}, bool permanent = false);
-    void putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallbackSimple cb, bool permanent = false)
-    {
-        putEncrypted(hash, to, std::forward<Value>(value), bindDoneCb(cb), permanent);
-    }
-    void putEncrypted(const std::string& key, InfoHash to, Value&& value, DoneCallback cb = {}, bool permanent = false);
-
    void putEncrypted(InfoHash hash,
                      const std::shared_ptr<crypto::PublicKey>& to,
                      std::shared_ptr<Value> value,
@@ -315,13 +299,11 @@ public:
        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
    }

-    [[deprecated("Use the shared_ptr version instead")]]
    void putEncrypted(InfoHash hash,
                      const std::shared_ptr<crypto::PublicKey>& to,
                      Value&& value,
                      DoneCallback cb = {},
                      bool permanent = false);
-    [[deprecated("Use the shared_ptr version instead")]]
    void putEncrypted(InfoHash hash,
                      const std::shared_ptr<crypto::PublicKey>& to,
                      Value&& value,
@@ -338,6 +320,14 @@ public:
    {
        putEncrypted(hash, to, value, bindDoneCb(cb), permanent);
    }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallback cb = {}, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), std::move(cb), permanent);
+    }
+    void putEncrypted(InfoHash hash, const PkId& to, Value&& value, DoneCallbackSimple cb, bool permanent = false)
+    {
+        putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), bindDoneCb(cb), permanent);
+    }

    /**
     * Insert known nodes to the routing table, without necessarly ping them.
@@ -450,13 +440,9 @@ public:
    void getPublicAddress(std::function<void(std::vector<SockAddr>&&)>, sa_family_t af = AF_UNSPEC);

    // securedht methods
-
-    [[deprecated("Use PkId version")]] void findCertificate(
-        InfoHash hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)>);
    void findCertificate(PkId hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)>);

    void registerCertificate(const std::shared_ptr<crypto::Certificate>& cert);
-    void setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method);
    void setLocalCertificateStore(CertificateStoreQuery&& query_method);

    /**
@@ -113,14 +113,6 @@ public:
     * and put it in the DHT.
     * The operation will be immediate if the recipient' public key is known (otherwise it will be retrived first).
     */
-    void putEncrypted(
-        const InfoHash& hash, const InfoHash& to, Sp<Value> val, DoneCallback callback, bool permanent = false);
-
-    [[deprecated("Use the shared_ptr version instead")]]
-    void putEncrypted(const InfoHash& hash, const InfoHash& to, Value&& v, DoneCallback callback, bool permanent = false)
-    {
-        putEncrypted(hash, to, std::make_shared<Value>(std::move(v)), callback, permanent);
-    }
    void putEncrypted(const InfoHash& hash,
                      const crypto::PublicKey& to,
                      Sp<Value> val,
@@ -145,19 +137,11 @@ public:

    Value decrypt(const Value& v);

-    [[deprecated("Use PkId version")]] void findCertificate(
-        const InfoHash& node, const std::function<void(const Sp<crypto::Certificate>)>& cb);
-    [[deprecated("Use PkId version")]] void findPublicKey(const InfoHash& node,
-                                                          const std::function<void(const Sp<crypto::PublicKey>)>& cb);
-
    void findCertificate(const PkId& id, const std::function<void(const Sp<crypto::Certificate>)>& cb);
    void findPublicKey(const PkId& id, const std::function<void(const Sp<crypto::PublicKey>)>& cb);

    void registerCertificate(const Sp<crypto::Certificate>& cert);

-    [[deprecated("Use PkId version")]] Sp<crypto::Certificate> getCertificate(const InfoHash& node) const;
-    [[deprecated("Use PkId version")]] Sp<crypto::PublicKey> getPublicKey(const InfoHash& node) const;
-
    Sp<crypto::Certificate> getCertificate(const PkId& node) const;
    Sp<crypto::PublicKey> getPublicKey(const PkId& node) const;

@@ -166,10 +150,6 @@ public:
     * The search key used is the public key ID, so there may be multiple certificates retured, signed with
     * the same private key.
     */
-    void setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method)
-    {
-        localQueryMethodLegacy_ = std::move(query_method);
-    }
    void setLocalCertificateStore(CertificateStoreQuery&& query_method) { localQueryMethod_ = std::move(query_method); }
    void setOnPublicAddressChanged(PublicAddressChangedCb cb) override { dht_->setOnPublicAddressChanged(cb); }

@@ -347,13 +327,10 @@ private:

    // method to query the local certificate store
    CertificateStoreQuery localQueryMethod_ {};
-    CertificateStoreQueryLegacy localQueryMethodLegacy_ {};

    // our certificate cache
-    std::map<InfoHash, Sp<crypto::Certificate>> nodesCertificates_ {};
-    std::map<InfoHash, Sp<crypto::PublicKey>> nodesPubKeys_ {};
-    std::map<PkId, Sp<crypto::Certificate>> nodesCertificatesLong_ {};
-    std::map<PkId, Sp<crypto::PublicKey>> nodesPubKeysLong_ {};
+    std::map<PkId, Sp<crypto::Certificate>> nodesCertificates_ {};
+    std::map<PkId, Sp<crypto::PublicKey>> nodesPubKeys_ {};

    std::atomic_bool forward_all_ {false};
    bool enableCache_ {false};
@@ -55,10 +55,12 @@ public:
 private:
    std::mutex lock_;
    std::condition_variable cv_ {};
+    std::condition_variable stopCv_ {};
    std::queue<std::function<void()>> tasks_ {};
    std::vector<std::unique_ptr<std::thread>> threads_;
    unsigned readyThreads_ {0};
    bool running_ {true};
+    bool stopping_ {false};

    unsigned minThreads_;
    const unsigned maxThreads_;
@@ -5,7 +5,7 @@ project(
    'cython',
    license: 'MIT',
    license_files: 'LICENSE',
-    version: '3.7.9',
+    version: '4.0.0',
    meson_version: '>=1.1.0',
    default_options: ['cpp_std=c++20', 'warning_level=3'],
 )
@@ -28,8 +28,18 @@ install(CODE [[
        if(NOT _pip_check EQUAL 0)
            message(WARNING "Skipping Python package install: pip not available for ${Python3_EXECUTABLE}.")
        else()
+            set(_pip_install_args
+                install
+                --no-deps
+                --no-build-isolation
+                --break-system-packages
+                --prefix ${CMAKE_INSTALL_PREFIX})
+            if(DEFINED ENV{DESTDIR} AND NOT "$ENV{DESTDIR}" STREQUAL "")
+                list(APPEND _pip_install_args --root "$ENV{DESTDIR}")
+            endif()
+            list(APPEND _pip_install_args .)
            execute_process(
-                COMMAND ${Python3_EXECUTABLE} -m pip install --no-deps --break-system-packages .
+                COMMAND ${Python3_EXECUTABLE} -m pip ${_pip_install_args}
                WORKING_DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/python
                OUTPUT_VARIABLE _pip_output
                ERROR_VARIABLE _pip_error
@@ -820,13 +820,8 @@ cdef class DhtRunner(_WithID):
                        key._infohash, (<PkId>to)._pkid, val._value,
                        cpp.bindDoneCb(done_callback, <void*>cb_obj), permanent
                    )
-                elif isinstance(to, InfoHash):
-                    self.thisptr.get().putEncrypted(
-                        key._infohash, (<InfoHash>to)._infohash, val._value,
-                        cpp.bindDoneCb(done_callback, <void*>cb_obj), permanent
-                    )
                else:
-                    raise TypeError("'to' must be PublicKey, PkId, or InfoHash")
+                    raise TypeError("'to' must be PublicKey or PkId")
            except:
                ref.Py_DECREF(cb_obj)
                raise
@@ -282,7 +282,6 @@ cdef extern from "opendht/dhtrunner.h" namespace "dht":
        void get(InfoHash key, GetCallback get_cb, DoneCallback done_cb, nullptr_t f, Where w)
        void put(InfoHash key, shared_ptr[Value] val, DoneCallback done_cb, time_point created, bool permanent)
        void putSigned(InfoHash key, shared_ptr[Value] val, DoneCallback done_cb, bool permanent) 
-        void putEncrypted(InfoHash key, InfoHash to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
        void putEncrypted(InfoHash key, PkId to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
        void putEncrypted(InfoHash key, shared_ptr[PublicKey] to, shared_ptr[Value] val, DoneCallback done_cb, bool permanent)
        void cancelPut(InfoHash key, shared_ptr[Value] val)
@@ -226,7 +226,7 @@ impl DhtRunner {
    pub fn put_encrypted<'a>(
        &mut self,
        h: &InfoHash,
-        to: &InfoHash,
+        to: &PkId,
        v: Box<Value>,
        done_cb: &'a mut (dyn FnMut(bool)),
        permanent: bool,
@@ -190,7 +190,7 @@ extern {
                                 cb_user_data: *mut c_void,
                                 permanent: bool);
    pub fn dht_runner_put_encrypted(dht: *mut DhtRunner, h: *const InfoHash,
-                                    to: *const InfoHash, v: *const Value,
+                                    to: *const PkId, v: *const Value,
                                    done_cb: extern fn(bool, *mut c_void),
                                    cb_user_data: *mut c_void,
                                    permanent: bool);
@@ -11,6 +11,7 @@ extern "C" {
 #include <nettle/gcm.h>
 #include <nettle/aes.h>
 #include <nettle/hmac.h>
+#include <nettle/version.h>
 #include <gnutls/crypto.h>

 #include <argon2.h>
@@ -98,6 +99,46 @@ private:
 #define GCM_DIGEST_SIZE GCM_BLOCK_SIZE
 #endif

+static void
+gcmAes128Digest(gcm_aes128_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes128_digest(ctx, digest);
+#else
+    gcm_aes128_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+gcmAes192Digest(gcm_aes192_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes192_digest(ctx, digest);
+#else
+    gcm_aes192_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+gcmAes256Digest(gcm_aes256_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    gcm_aes256_digest(ctx, digest);
+#else
+    gcm_aes256_digest(ctx, GCM_DIGEST_SIZE, digest);
+#endif
+}
+
+static void
+hmacSha256Digest(hmac_sha256_ctx* ctx, uint8_t* digest)
+{
+#if NETTLE_VERSION_MAJOR >= 4
+    hmac_sha256_digest(ctx, digest);
+#else
+    hmac_sha256_digest(ctx, SHA256_DIGEST_SIZE, digest);
+#endif
+}
+
 Blob
 aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key)
 {
@@ -115,19 +156,19 @@ aesEncrypt(const uint8_t* data, size_t data_length, const Blob& key)
        gcm_aes128_set_key(&aes, key.data());
        gcm_aes128_set_iv(&aes, GCM_IV_SIZE, ret.data());
        gcm_aes128_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes128Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
    } else if (key.size() == AES_LENGTHS[1]) {
        struct gcm_aes192_ctx aes;
        gcm_aes192_set_key(&aes, key.data());
        gcm_aes192_set_iv(&aes, GCM_IV_SIZE, ret.data());
        gcm_aes192_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes192_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes192Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
    } else if (key.size() == AES_LENGTHS[2]) {
        struct gcm_aes256_ctx aes;
        gcm_aes256_set_key(&aes, key.data());
        gcm_aes256_set_iv(&aes, GCM_IV_SIZE, ret.data());
        gcm_aes256_encrypt(&aes, data_length, ret.data() + GCM_IV_SIZE, data);
-        gcm_aes256_digest(&aes, GCM_DIGEST_SIZE, ret.data() + GCM_IV_SIZE + data_length);
+        gcmAes256Digest(&aes, ret.data() + GCM_IV_SIZE + data_length);
    }

    return ret;
@@ -160,19 +201,19 @@ aesDecrypt(const uint8_t* data, size_t data_length, const Blob& key)
        gcm_aes128_set_key(&aes, key.data());
        gcm_aes128_set_iv(&aes, GCM_IV_SIZE, data);
        gcm_aes128_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes128Digest(&aes, digest.data());
    } else if (key.size() == AES_LENGTHS[1]) {
        struct gcm_aes192_ctx aes;
        gcm_aes192_set_key(&aes, key.data());
        gcm_aes192_set_iv(&aes, GCM_IV_SIZE, data);
        gcm_aes192_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes192_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes192Digest(&aes, digest.data());
    } else if (key.size() == AES_LENGTHS[2]) {
        struct gcm_aes256_ctx aes;
        gcm_aes256_set_key(&aes, key.data());
        gcm_aes256_set_iv(&aes, GCM_IV_SIZE, data);
        gcm_aes256_decrypt(&aes, data_sz, ret.data(), data + GCM_IV_SIZE);
-        gcm_aes256_digest(&aes, GCM_DIGEST_SIZE, digest.data());
+        gcmAes256Digest(&aes, digest.data());
    }

    if (not std::equal(digest.begin(), digest.end(), data + data_length - GCM_DIGEST_SIZE)) {
@@ -2045,7 +2086,7 @@ hkdf_extract(const Blob& salt, const Blob& ikm)
    hmac_sha256_set_key(&ctx, salt.size(), salt.data());
    hmac_sha256_update(&ctx, ikm.size(), ikm.data());
    Blob prk(SHA256_DIGEST_SIZE);
-    hmac_sha256_digest(&ctx, SHA256_DIGEST_SIZE, prk.data());
+    hmacSha256Digest(&ctx, prk.data());
    return prk;
 }

@@ -2063,7 +2104,7 @@ hkdf_expand(const Blob& prk, const uint8_t* info, size_t info_len, size_t len)
        hmac_sha256_update(&ctx, info_len, info);
        hmac_sha256_update(&ctx, 1, &i);
        T.resize(SHA256_DIGEST_SIZE);
-        hmac_sha256_digest(&ctx, SHA256_DIGEST_SIZE, T.data());
+        hmacSha256Digest(&ctx, T.data());
        okm.insert(okm.end(), T.begin(), T.end());
        i++;
    }
@@ -2223,7 +2264,7 @@ webPushEncrypt(const Blob& p256dh,

    Blob ciphertext(plaintext.size() + GCM_DIGEST_SIZE);
    gcm_aes128_encrypt(&aes, plaintext.size(), ciphertext.data(), plaintext.data());
-    gcm_aes128_digest(&aes, GCM_DIGEST_SIZE, ciphertext.data() + plaintext.size());
+    gcmAes128Digest(&aes, ciphertext.data() + plaintext.size());

    // 6. Construct Output
    Blob output;
@@ -1432,6 +1432,8 @@ Dht::storageStore(const InfoHash& id,
    created = std::min(created, now);
    if (expiration == time_point::min())
        expiration = permanent ? time_point::max() : created + getType(value->type).expiration;
+    else if (not permanent)
+        expiration = std::min(expiration, created + getType(value->type).expiration);
    if (expiration < now)
        return false;

@@ -186,9 +186,6 @@ DhtRunner::run(const Config& config, Context&& context)
    if (context.certificateStore) {
        dht_->setLocalCertificateStore(std::move(context.certificateStore));
    }
-    if (context.certificateStorePkId) {
-        dht_->setLocalCertificateStore(std::move(context.certificateStorePkId));
-    }
    if (context.publicAddressChangedCb) {
        dht_->setOnPublicAddressChanged(std::move(context.publicAddressChangedCb));
    }
@@ -667,14 +664,6 @@ DhtRunner::registerCertificate(const std::shared_ptr<crypto::Certificate>& cert)
    dht_->registerCertificate(cert);
 }

-void
-DhtRunner::setLocalCertificateStore(CertificateStoreQueryLegacy&& query_method)
-{
-    std::lock_guard lck(dht_mtx);
-    if (dht_)
-        dht_->setLocalCertificateStore(std::forward<CertificateStoreQueryLegacy>(query_method));
-}
-
 void
 DhtRunner::setLocalCertificateStore(CertificateStoreQuery&& query_method)
 {
@@ -955,35 +944,6 @@ DhtRunner::putEncrypted(InfoHash hash, const PkId& to, std::shared_ptr<Value> va
    cv.notify_all();
 }

-void
-DhtRunner::putEncrypted(InfoHash hash, InfoHash to, std::shared_ptr<Value> value, DoneCallback cb, bool permanent)
-{
-    std::unique_lock lck(storage_mtx);
-    if (running != State::Running) {
-        lck.unlock();
-        if (cb)
-            cb(false, {});
-        return;
-    }
-    ongoing_ops++;
-    pending_ops.emplace([=, cb = std::move(cb), value = std::move(value)](SecureDht& dht) mutable {
-        dht.putEncrypted(hash, to, value, bindOpDoneCallback(std::move(cb)), permanent);
-    });
-    cv.notify_all();
-}
-
-void
-DhtRunner::putEncrypted(InfoHash hash, InfoHash to, Value&& value, DoneCallback cb, bool permanent)
-{
-    putEncrypted(hash, to, std::make_shared<Value>(std::move(value)), std::move(cb), permanent);
-}
-
-void
-DhtRunner::putEncrypted(const std::string& key, InfoHash to, Value&& value, DoneCallback cb, bool permanent)
-{
-    putEncrypted(InfoHash::get(key), to, std::forward<Value>(value), std::move(cb), permanent);
-}
-
 void
 DhtRunner::putEncrypted(InfoHash hash,
                        const std::shared_ptr<crypto::PublicKey>& to,
@@ -1119,25 +1079,6 @@ DhtRunner::connectivityChanged()
    cv.notify_all();
 }

-void
-DhtRunner::findCertificate(InfoHash hash, std::function<void(const Sp<crypto::Certificate>&)> cb)
-{
-    std::unique_lock lck(storage_mtx);
-    if (running != State::Running) {
-        lck.unlock();
-        cb({});
-        return;
-    }
-    ongoing_ops++;
-    pending_ops.emplace([this, hash, cb = std::move(cb)](SecureDht& dht) {
-        dht.findCertificate(hash, [this, cb = std::move(cb)](const Sp<crypto::Certificate>& crt) {
-            cb(crt);
-            opEnded();
-        });
-    });
-    cv.notify_all();
-}
-
 void
 DhtRunner::findCertificate(PkId hash, std::function<void(const std::shared_ptr<crypto::Certificate>&)> cb)
 {
@@ -96,37 +96,13 @@ SecureDht::secureType(ValueType&& type)
    return type;
 }

-Sp<crypto::Certificate>
-SecureDht::getCertificate(const InfoHash& node) const
-{
-    if (node == getId())
-        return certificate_;
-    auto it = nodesCertificates_.find(node);
-    if (it == nodesCertificates_.end())
-        return nullptr;
-    else
-        return it->second;
-}
-
-Sp<crypto::PublicKey>
-SecureDht::getPublicKey(const InfoHash& node) const
-{
-    if (node == getId())
-        return certificate_->getSharedPublicKey();
-    auto it = nodesPubKeys_.find(node);
-    if (it == nodesPubKeys_.end())
-        return nullptr;
-    else
-        return it->second;
-}
-
 Sp<crypto::Certificate>
 SecureDht::getCertificate(const PkId& node) const
 {
    if (node == getLongId())
        return certificate_;
-    auto it = nodesCertificatesLong_.find(node);
-    if (it == nodesCertificatesLong_.end())
+    auto it = nodesCertificates_.find(node);
+    if (it == nodesCertificates_.end())
        return nullptr;
    else
        return it->second;
@@ -137,8 +113,8 @@ SecureDht::getPublicKey(const PkId& node) const
 {
    if (node == getLongId())
        return certificate_->getSharedPublicKey();
-    auto it = nodesPubKeysLong_.find(node);
-    if (it == nodesPubKeysLong_.end())
+    auto it = nodesPubKeys_.find(node);
+    if (it == nodesPubKeys_.end())
        return nullptr;
    else
        return it->second;
@@ -191,85 +167,10 @@ void
 SecureDht::registerCertificate(const Sp<crypto::Certificate>& cert)
 {
    if (cert) {
-        nodesCertificates_[cert->getId()] = cert;
-        nodesCertificatesLong_[cert->getLongId()] = cert;
+        nodesCertificates_[cert->getLongId()] = cert;
    }
 }

-void
-SecureDht::findCertificate(const InfoHash& node, const std::function<void(const Sp<crypto::Certificate>)>& cb)
-{
-    Sp<crypto::Certificate> b = getCertificate(node);
-    if (b && *b) {
-        if (logger_)
-            logger_->debug("Using certificate from cache for {}", node.toString());
-        if (cb)
-            cb(b);
-        return;
-    }
-    if (localQueryMethodLegacy_) {
-        auto res = localQueryMethodLegacy_(node);
-        if (not res.empty()) {
-            if (logger_)
-                logger_->debug("Registering certificate from local store for {}", node.toString());
-            nodesCertificates_.emplace(node, res.front());
-            nodesCertificatesLong_.emplace(res.front()->getLongId(), res.front());
-            if (cb)
-                cb(res.front());
-            return;
-        }
-    }
-
-    auto found = std::make_shared<bool>(false);
-    dht_->get(
-        node,
-        [cb, node, found, this](const std::vector<Sp<Value>>& vals) {
-            for (const auto& v : vals) {
-                if (auto cert = registerCertificate(node, v->data)) {
-                    *found = true;
-                    if (logger_)
-                        logger_->debug("Found certificate for {}", node.toString());
-                    if (cb)
-                        cb(cert);
-                    return false;
-                }
-            }
-            return !*found;
-        },
-        [cb, found](bool) {
-            if (!*found and cb)
-                cb(nullptr);
-        },
-        Value::TypeFilter(CERTIFICATE_TYPE));
-}
-
-void
-SecureDht::findPublicKey(const InfoHash& node, const std::function<void(const Sp<crypto::PublicKey>)>& cb)
-{
-    auto pk = getPublicKey(node);
-    if (pk && *pk) {
-        if (logger_)
-            logger_->debug("Found public key from cache for {}", node.toString());
-        if (cb)
-            cb(pk);
-        return;
-    }
-    findCertificate(node, [=](const Sp<crypto::Certificate>& crt) {
-        if (crt && *crt) {
-            auto pk = crt->getSharedPublicKey();
-            if (*pk) {
-                nodesPubKeys_[pk->getId()] = pk;
-                nodesPubKeysLong_[pk->getLongId()] = pk;
-                if (cb)
-                    cb(pk);
-                return;
-            }
-        }
-        if (cb)
-            cb(nullptr);
-    });
-}
-
 void
 SecureDht::findCertificate(const PkId& node, const std::function<void(const Sp<crypto::Certificate>)>& cb)
 {
@@ -287,8 +188,7 @@ SecureDht::findCertificate(const PkId& node, const std::function<void(const Sp<c
        if (not res.empty()) {
            if (logger_)
                logger_->debug("Registering certificate from local store for {}", node.to_c_str());
-            nodesCertificates_.emplace(res.front()->getId(), res.front());
-            nodesCertificatesLong_.emplace(node, res.front());
+            nodesCertificates_.emplace(node, res.front());
            if (cb)
                cb(res.front());
            return;
@@ -333,8 +233,7 @@ SecureDht::findPublicKey(const PkId& node, const std::function<void(const Sp<cry
        if (crt && *crt) {
            auto pk = crt->getSharedPublicKey();
            if (*pk) {
-                nodesPubKeys_[pk->getId()] = pk;
-                nodesPubKeysLong_[pk->getLongId()] = pk;
+                nodesPubKeys_[pk->getLongId()] = pk;
                if (cb)
                    cb(pk);
                return;
@@ -362,8 +261,7 @@ SecureDht::checkValue(const Sp<Value>& v)
            if (auto decrypted_val = v->decrypt(*key_)) {
                auto cacheValue = not isDecrypted and decrypted_val->owner;
                if (cacheValue) {
-                    nodesPubKeys_[decrypted_val->owner->getId()] = decrypted_val->owner;
-                    nodesPubKeysLong_[decrypted_val->owner->getLongId()] = decrypted_val->owner;
+                    nodesPubKeys_[decrypted_val->owner->getLongId()] = decrypted_val->owner;
                }
                return decrypted_val;
            }
@@ -377,8 +275,7 @@ SecureDht::checkValue(const Sp<Value>& v)
        auto cacheValue = not v->isSignatureChecked() and enableCache_ and v->owner;
        if (v->checkSignature()) {
            if (cacheValue) {
-                nodesPubKeys_[v->owner->getId()] = v->owner;
-                nodesPubKeysLong_[v->owner->getLongId()] = v->owner;
+                nodesPubKeys_[v->owner->getLongId()] = v->owner;
            }
            return v;
        } else if (logger_)
@@ -492,35 +389,6 @@ SecureDht::putSigned(const InfoHash& hash, Sp<Value> val, DoneCallback callback,
        Where().id(val->id));
 }

-void
-SecureDht::putEncrypted(const InfoHash& hash, const InfoHash& to, Sp<Value> val, DoneCallback callback, bool permanent)
-{
-    if (not key_) {
-        if (callback)
-            callback(false, {});
-        return;
-    }
-    findPublicKey(to,
-                  [this, hash, val = std::move(val), callback = std::move(callback), permanent](
-                      const Sp<crypto::PublicKey>& pk) {
-                      if (!pk || !*pk) {
-                          if (callback)
-                              callback(false, {});
-                          return;
-                      }
-                      if (logger_)
-                          logger_->warn("Encrypting data for PK: {}", pk->getId().toString());
-                      try {
-                          dht_->put(hash, encrypt(*val, *pk), callback, time_point::max(), permanent);
-                      } catch (const std::exception& e) {
-                          if (logger_)
-                              logger_->error("Error putting encrypted data: {}", e.what());
-                          if (callback)
-                              callback(false, {});
-                      }
-                  });
-}
-
 void
 SecureDht::putEncrypted(const InfoHash& hash, const PkId& to, Sp<Value> val, DoneCallback callback, bool permanent)
 {
@@ -78,6 +78,8 @@ ThreadPool::run(std::function<void()>&& cb)
                            break;
                        task = std::move(tasks_.front());
                        tasks_.pop();
+                        if (tasks_.empty() && stopping_)
+                            stopCv_.notify_one();
                    }

                    // run task
@@ -135,7 +137,9 @@ ThreadPool::stop(bool wait)
 {
    std::unique_lock l(lock_);
    if (wait) {
-        cv_.wait(l, [&]() { return tasks_.empty(); });
+        stopping_ = true;
+        stopCv_.wait(l, [&]() { return tasks_.empty(); });
+        stopping_ = false;
    }
    running_ = false;
    tasks_ = {};
@@ -262,6 +262,83 @@ DhtRunnerTester::testImportValuesPreservesStoredExpiration()
    restored.join();
 }

+void
+DhtRunnerTester::testImportPermanentValueExpires()
+{
+    // Simulate importing a value that was originally stored as permanent
+    // (expiration = time_point::max()). After import the permanent flag is lost,
+    // so the value must expire within the type's normal expiration window.
+    static const dht::ValueType SHORT_TYPE {201, "Short perm", 2s};
+
+    auto key = dht::InfoHash::get("import-permanent-expiration");
+    auto now = dht::clock::now();
+
+    msgpack::sbuffer buffer;
+    msgpack::packer<msgpack::sbuffer> pk(&buffer);
+    pk.pack_array(1);
+    pk.pack_array(4);
+    pk.pack(now.time_since_epoch().count());
+    dht::Value {SHORT_TYPE.id, std::string("was-permanent")}.msgpack_pack(pk);
+    pk.pack_bin(0);
+    // Permanent values are exported with time_point::max() expiration
+    pk.pack(dht::clock::time_point::max().time_since_epoch().count());
+
+    dht::DhtRunner restored;
+    dht::DhtRunner::Config config;
+    config.dht_config.node_config.max_peer_req_per_sec = -1;
+    config.dht_config.node_config.max_req_per_sec = -1;
+    config.dht_config.node_config.max_store_size = -1;
+    config.dht_config.node_config.max_store_keys = -1;
+    restored.run(0, config);
+
+    restored.importValues({
+        dht::ValuesExport {key, {buffer.data(), buffer.data() + buffer.size()}}
+    });
+
+    // Value should be present right after import
+    auto exportedBefore = restored.exportValues();
+    CPPUNIT_ASSERT(!exportedBefore.empty());
+
+    // Wait longer than the default USER_DATA expiration (10 min) is not
+    // practical, but the type is unregistered so the default 10 min expiration
+    // applies.  Instead, register the short type so the cap uses 2 s.
+    // Re-import into a fresh node that knows the short type.
+    dht::DhtRunner restored2;
+    restored2.run(0, config);
+    restored2.registerInsecureType(SHORT_TYPE);
+    restored2.importValues({
+        dht::ValuesExport {key, {buffer.data(), buffer.data() + buffer.size()}}
+    });
+
+    CPPUNIT_ASSERT(!restored2.exportValues().empty());
+
+    // Wait for the short expiration to pass
+    std::this_thread::sleep_for(3s);
+
+    auto restoredValues = restored2.exportValues();
+    bool found = false;
+    for (const auto& ve : restoredValues) {
+        if (ve.first == key) {
+            msgpack::unpacked msg;
+            msgpack::unpack(msg, (const char*) ve.second.data(), ve.second.size());
+            auto valarr = msg.get();
+            CPPUNIT_ASSERT(valarr.type == msgpack::type::ARRAY);
+            // The value should have expired
+            CPPUNIT_ASSERT_EQUAL(uint32_t(0), valarr.via.array.size);
+            found = true;
+        }
+    }
+    // Either the key was cleaned up entirely or it was found with 0 values
+    CPPUNIT_ASSERT(found || restoredValues.empty()
+                   || std::none_of(restoredValues.begin(), restoredValues.end(),
+                                   [&](const auto& ve) { return ve.first == key; }));
+
+    restored.shutdown();
+    restored.join();
+    restored2.shutdown();
+    restored2.join();
+}
+
 void
 DhtRunnerTester::testBootstrapSetsConnectingState()
 {
@@ -22,6 +22,7 @@ class DhtRunnerTester : public CppUnit::TestFixture
    CPPUNIT_TEST(testIdOps);
    CPPUNIT_TEST(testImportValuesPreservesRemoteQuota);
    CPPUNIT_TEST(testImportValuesPreservesStoredExpiration);
+    CPPUNIT_TEST(testImportPermanentValueExpires);
    CPPUNIT_TEST(testBootstrapSetsConnectingState);
    CPPUNIT_TEST(testBootstrapThenPutNoRace);
    CPPUNIT_TEST(testBootstrapMissingNodeThenPutFails);
@@ -66,6 +67,7 @@ public:
    void testIdOps();
    void testImportValuesPreservesRemoteQuota();
    void testImportValuesPreservesStoredExpiration();
+    void testImportPermanentValueExpires();
    void testBootstrapSetsConnectingState();
    void testBootstrapThenPutNoRace();
    void testBootstrapMissingNodeThenPutFails();
@@ -80,6 +80,46 @@ ThreadPoolTester::testContext()
    CPPUNIT_ASSERT_EQUAL(N, count.load());
 }

+void
+ThreadPoolTester::testJoinNonEmptyTaskQueue()
+{
+    dht::ThreadPool pool(2);
+
+    constexpr unsigned N = 128;
+    std::atomic_uint count {0};
+
+    // Schedule enough work so that the task queue is non-empty when calling
+    // pool.join() below.
+    for (unsigned i = 0; i < N; i++)
+        pool.run([&] {
+            std::this_thread::sleep_for(std::chrono::milliseconds(1));
+            count++;
+        });
+
+    std::atomic_bool joined {false};
+    std::condition_variable cv;
+    std::thread joinThread([&] {
+        CPPUNIT_ASSERT(count.load() < N);
+        pool.join();
+        joined = true;
+        cv.notify_one();
+    });
+
+    // After calling join(), all pending tasks should complete, and then all
+    // threads in the pool should join.
+    std::mutex mtx;
+    std::unique_lock lock(mtx);
+    bool poolJoined = cv.wait_for(lock, std::chrono::seconds(10), [&] { return joined.load(); });
+    if (!poolJoined) {
+        // Detach joinThread if we timed out, otherwise the test can crash.
+        joinThread.detach();
+    } else {
+        joinThread.join();
+    }
+    CPPUNIT_ASSERT_EQUAL_MESSAGE("Some tasks were not completed", N, count.load());
+    CPPUNIT_ASSERT_MESSAGE("Thread pool failed to join before timeout", poolJoined);
+}
+
 void
 ThreadPoolTester::tearDown()
 {}
@@ -14,6 +14,7 @@ class ThreadPoolTester : public CppUnit::TestFixture
    CPPUNIT_TEST(testThreadPool);
    CPPUNIT_TEST(testExecutor);
    CPPUNIT_TEST(testContext);
+    CPPUNIT_TEST(testJoinNonEmptyTaskQueue);
    CPPUNIT_TEST_SUITE_END();

 public:
@@ -29,6 +30,7 @@ public:
    void testThreadPool();
    void testExecutor();
    void testContext();
+    void testJoinNonEmptyTaskQueue();
 };

 } // namespace test
@@ -123,7 +123,7 @@ main(int argc, char** argv)
                    iss >> idstr;
                    std::getline(iss, line);
                    dht.putEncrypted(room,
-                                     InfoHash(idstr),
+                                     PkId(idstr),
                                     dht::ImMessage(IdDist()(tools::rd), std::move(line), now),
                                     [](bool ok) {
                                         // dht.cancelPut(room, id);
@@ -481,7 +481,7 @@ cmd_loop(std::shared_ptr<DhtRunner>& node,
            auto value = std::make_shared<dht::Value>(dht::ValueType::USER_DATA.id,
                                                      std::vector<uint8_t> {v.begin(), v.end()});
            value->user_type = "text/plain";
-            node->putEncrypted(id, InfoHash(tostr), std::move(value), [start](bool ok) {
+            node->putEncrypted(id, PkId(tostr), std::move(value), [start](bool ok) {
                auto end = std::chrono::high_resolution_clock::now();
                std::cout << "Put encrypted: " << (ok ? "success" : "failure") << " (took "
                          << print_duration(end - start) << ')' << std::endl;
@@ -1,6 +1,6 @@
 {
  "name": "opendht",
-  "version-string": "3.7.9",
+  "version-string": "4.0.0",
  "port-version": 1,
  "description": "OpenDHT: A lightweight C++17 Distributed Hash Table library.",
  "homepage": "https://opendht.net",
Author	SHA1	Message	Date
Adrien Beraud	370f619ac4	python: support DESTDIR in pip install step Use --root $DESTDIR when the environment variable is set so that staged installs (e.g. 'make DESTDIR=/tmp/pkg install') place the Python package under the staging root. Also pass --no-build-isolation and --prefix to avoid rebuilding in an isolated venv and to honour CMAKE_INSTALL_PREFIX.	2026-05-25 13:40:55 -04:00
François-Simon Fauteux-Chapleau	7cf3e8b738	thread_pool: notify when task queue becomes empty This prevents ThreadPool::stop from hanging if it is called with `wait` set to true (which is notably the case in ThreadPool::join) and the pool's task queue is non-empty.	2026-05-21 10:17:08 -04:00
François-Simon Fauteux-Chapleau	e924ef5620	tests: add regression test for hang in thread pool The worker threads in a ThreadPool don't signal the pool's condition variable when completing the last task in the queue. As a consequence, ThreadPool::join() hangs if called while the task queue is non-empty.	2026-05-21 10:17:08 -04:00
Adrien Béraud	d96115b445	docs: update manpage for dhtnode	2026-05-18 10:50:23 -04:00
Adrien Béraud	bb96d2d80e	dhtchat: adapt for new API	2026-05-18 10:36:48 -04:00
Adrien Béraud	8b96652b32	dhtrunner: add signatures for putEncrypted(InfoHash, PkId to, Value&&)	2026-05-18 10:36:48 -04:00
Adrien Béraud	d1235660d5	crypto: add support to build with Nettle 4.0	2026-05-13 14:36:13 -04:00
Adrien Béraud	23c6b5547b	python: update for API changes in 4.0	2026-05-13 14:18:08 -04:00
Adrien Béraud	61c4a3880f	update version to 4.0.0	2026-05-11 09:28:57 -04:00
Adrien Béraud	44f2aaa876	remove deprecated APIs	2026-05-11 09:27:56 -04:00
Adrien Béraud	a363d573e3	dht: fix persisted permanent values never expiring When values are exported and re-imported, permanent values retain their time_point::max() expiration but lose their permanent flag. This caused them to be stored as non-permanent with an effectively infinite expiration, so they would never expire. Cap the expiration of non-permanent values to created + type.expiration, ensuring that imported permanent values get a finite expiration matching their value type.	2026-05-09 00:39:49 -04:00
Adrien Béraud	3ff9338980	tests: add test for permanent value import expiration Add testImportPermanentValueExpires to verify that values originally stored as permanent (with time_point::max() expiration) properly expire after being exported and re-imported, since the permanent flag is lost during the import process.	2026-05-09 00:39:49 -04:00