From 968a396779ee779da585b68ca643de4c1a2ad065 Mon Sep 17 00:00:00 2001 From: m Date: Sun, 17 May 2026 17:09:42 +1000 Subject: [PATCH] feat(electrumx): add electrum.nmc.ethicnology.com to default server set Adds a third public Namecoin ElectrumX server to the default and Tor-preferred lists in DEFAULT_ELECTRUMX_SERVERS / TOR_ELECTRUMX_SERVERS: electrum.nmc.ethicnology.com:50002 (IPv4 142.44.246.181, OVH Canada) Operated by @ethicnology, who ships the namecoind + ElectrumX + mempool podman stack at github.com/ethicnology/namecoin-compose. Probed live: - server.version -> ElectrumX 1.19.0, protocol 1.4 - server.features -> Namecoin mainnet genesis 000000000062b72c...c770 - scripthash.get_history for d/testls -> full history (heights up to 822885), and blockchain.transaction.get decodes the OP_NAME_UPDATE output correctly. Same code path used by ElectrumXClient against all other public servers, no client changes required. TLS uses a publicly-trusted Let's Encrypt cert, so usePinnedTrustStore is left at the default (false). This makes it the first entry in the list whose TLS does NOT depend on PINNED_ELECTRUMX_CERTS, and adds useful diversity: - electrumx.testls.space (self-signed, pinned, often ECONNRESETs) - nmc2.bitcoins.sk / 46.229.238.187 (self-signed, pinned) - relay.testls.bit / 23.158.233.10 (self-signed, pinned) - electrum.nmc.ethicnology.com (LE cert, system trust store) If every self-signed peer is unreachable (e.g. corporate networks that strip unknown CAs but allow LE chains), resolution can still succeed. No bare-IP companion entry is added for 142.44.246.181: unlike the 46.229.238.187 / 23.158.233.10 pinned peers (which use DER-SHA256 pinning that ignores hostname verification), an IP-literal endpoint against the LE cert would fail standard hostname verification under the system trust manager (SAN covers only the hostname). The IP is captured in this commit message and the source comment for reference. Verification on this branch: - :quartz:spotlessCheck OK - :quartz:jvmTest OK (BitRelayResolverTest etc. unchanged) --- .../namecoin/ElectrumXServer.kt | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip05DnsIdentifiers/namecoin/ElectrumXServer.kt b/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip05DnsIdentifiers/namecoin/ElectrumXServer.kt index d98c77ac76..992b55328d 100644 --- a/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip05DnsIdentifiers/namecoin/ElectrumXServer.kt +++ b/quartz/src/commonMain/kotlin/com/vitorpamplona/quartz/nip05DnsIdentifiers/namecoin/ElectrumXServer.kt @@ -110,6 +110,26 @@ val DEFAULT_ELECTRUMX_SERVERS = // nmc2.bitcoins.sk) so resolvers that have an unhealthy DNS path can // still reach the server. Cert pin works by SHA-256 of DER, no SNI required. ElectrumxServer("23.158.233.10", 50002, useSsl = true, usePinnedTrustStore = true), + // electrum.nmc.ethicnology.com — third public Namecoin ElectrumX deployment, + // operated by @ethicnology (github.com/ethicnology/namecoin-compose, a + // namecoind + ElectrumX + mempool podman stack). ElectrumX 1.19.0, + // Namecoin mainnet genesis (000000000062b72c…c770). + // + // Uses a publicly-trusted Let's Encrypt certificate, so usePinnedTrustStore + // is left at the default (false) — the system trust store is sufficient. + // This makes it the first entry in the list whose TLS does NOT rely on + // PINNED_ELECTRUMX_CERTS, and provides graceful fallback if every + // self-signed peer above is unreachable (e.g. corporate networks that + // strip unknown CAs but allow LE). + ElectrumxServer("electrum.nmc.ethicnology.com", 50002, useSsl = true, usePinnedTrustStore = false), + // Note: no bare-IP companion entry for electrum.nmc.ethicnology.com. + // Unlike the 46.229.238.187 / 23.158.233.10 peers above (which use + // usePinnedTrustStore=true and DER-SHA256 pinning that doesn't care + // about hostname verification), this server's TLS chains to a publicly- + // trusted Let's Encrypt cert whose SAN covers only electrum.nmc.ethicnology.com. + // Connecting by the bare IP 142.44.246.181 would fail standard hostname + // verification under the system trust manager, so the entry would never + // succeed in practice. The hostname entry above is the only useful form. ) /** Tor-preferred server list: onion primary, clearnet fallback. */ @@ -135,4 +155,6 @@ val TOR_ELECTRUMX_SERVERS = ElectrumxServer("relay.testls.bit", 50002, useSsl = true, usePinnedTrustStore = true), // Bare IP peer (same operator/cert/box). See clearnet list above. ElectrumxServer("23.158.233.10", 50002, useSsl = true, usePinnedTrustStore = true), + // electrum.nmc.ethicnology.com — public LE-cert ElectrumX. See clearnet list above. + ElectrumxServer("electrum.nmc.ethicnology.com", 50002, useSsl = true, usePinnedTrustStore = false), )