Auto-download over Tor

[kiminuo]

Depends on #12121
Fixes #8800
Follow-up to #8741

This PR adds auto-download feature over Tor. Currently, it works over the clearnet. To make the feature work, it was necessary to implement HTTP redirection support for Tor.

[turbolay]

The PR is quite hard to review because it bundles many changes but is really good.
I tested and could download through Tor without any issue.

What do you consider is missing for this feature? It seems to me that there is not much else to do other than remove debug code

I see no difficulty nor controversies in this PR, it's simply good. I guess you can remove debug code, and I will provide a more complete review

[kiminuo]

The PR is quite hard to review because it bundles many changes but is really good.

I extracted some minor changes to #12121 to make this PR smaller.

[kiminuo]

What do you consider is missing for this feature? It seems to me that there is not much else to do other than remove debug code

I removed the debug code. I'm not really aware of anything missing.

[adamPetho]

An easy way to test this is to use this PR to download the new release, right?

[kiminuo]

Yes, that's right.

[adamPetho]

Hmm, for me updating WW fails with:

2023-12-22 18:05:24.496 [10] ERROR      UpdateManager.UpdateChecker_UpdateStatusChangedAsync (91)       Getting new update failed with error. Exception: System.InvalidOperationException: Invalid wasabi signature.
   at WalletWasabi.Helpers.WasabiSignerHelpers.VerifySha256Sum(Byte[] sha256Hash, Byte[] signatureBytes) in WalletWasabi\Helpers\WasabiSignerHelpers.cs:line 46
   at WalletWasabi.Helpers.WasabiSignerHelpers.VerifySha256SumsFileAsync(String sha256SumsAscFilePath) in WalletWasabi\Helpers\WasabiSignerHelpers.cs:line 35
   at WalletWasabi.Services.UpdateManager.DownloadAndValidateWasabiSignatureAsync(String sha256SumsFilePath, String sha256SumsUrl, String wasabiSigUrl) in WalletWasabi\Services\UpdateManager.cs:line 242
   at WalletWasabi.Services.UpdateManager.GetInstallerAsync(Version targetVersion) in WalletWasabi\Services\UpdateManager.cs:line 115
   at WalletWasabi.Services.UpdateManager.UpdateChecker_UpdateStatusChangedAsync(Object sender, UpdateStatus updateStatus) in WalletWasabi\Services\UpdateManager.cs:line 77

On master, verifying the signature passes and the download starts.

[kiminuo]

Hmm, for me updating WW fails with:

2023-12-22 18:05:24.496 [10] ERROR      UpdateManager.UpdateChecker_UpdateStatusChangedAsync (91)       Getting new update failed with error. Exception: System.InvalidOperationException: Invalid wasabi signature.
   at WalletWasabi.Helpers.WasabiSignerHelpers.VerifySha256Sum(Byte[] sha256Hash, Byte[] signatureBytes) in WalletWasabi\Helpers\WasabiSignerHelpers.cs:line 46
   at WalletWasabi.Helpers.WasabiSignerHelpers.VerifySha256SumsFileAsync(String sha256SumsAscFilePath) in WalletWasabi\Helpers\WasabiSignerHelpers.cs:line 35
   at WalletWasabi.Services.UpdateManager.DownloadAndValidateWasabiSignatureAsync(String sha256SumsFilePath, String sha256SumsUrl, String wasabiSigUrl) in WalletWasabi\Services\UpdateManager.cs:line 242
   at WalletWasabi.Services.UpdateManager.GetInstallerAsync(Version targetVersion) in WalletWasabi\Services\UpdateManager.cs:line 115
   at WalletWasabi.Services.UpdateManager.UpdateChecker_UpdateStatusChangedAsync(Object sender, UpdateStatus updateStatus) in WalletWasabi\Services\UpdateManager.cs:line 77

On master, verifying the signature passes and the download starts.

Right, there was extra BOM character in WalletWasabi\Client\Installer\SHA256SUMS.asc which changed the hash. Fixed by fafbcc3.

[adamPetho]

tACK, I was able to download v2.0.5 over Tor with this PR.

For the code changes, I can only give a trustACK.

[kiminuo]

@Kukks Friendly ping. I believe you were interested in "HTTP redirect support for Tor".

[yahiheb]

tACK

[MaxHillebrand]

tACK 322284b

[turbolay]

The code is hard to review for me, but I went through it for quite some time and do not find clear mistakes.
I also tested and it works without any issue.

Should redirection also be tested? Or is the implementation common knowledge?

[kiminuo]

Should redirection also be tested?

It is tested by downloading the file. But it can be tested also in other situations.

Or is the implementation common knowledge?

It's not "common knowledge". It's more like "HTTP protocol is not actually easy to implement" because RFCs are not totally complete regarding behavior (in edge/corner cases).

It's hard to test redirecting fully. So I did my best to implement it and I just hope it's OK. And then on the other hand, if we discover there is a bug, we will simply add a new unit test and fix it. We need redirecting only for this particular auto-download feature. @Kukks has other use cases, so maybe we'll colaboratively find out other needs.