From b80bd841c80525c39ee5912ead2ec557833610bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9Cramfox=E2=80=9D?= <“kasey@n0.computer”>
Date: Mon, 13 Oct 2025 22:59:28 -0400
Subject: [PATCH 1/7] add logging and loop

---
 iroh/tests/integration.rs | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/iroh/tests/integration.rs b/iroh/tests/integration.rs
index 3d588296e2a..454ddba553d 100644
--- a/iroh/tests/integration.rs
+++ b/iroh/tests/integration.rs
@@ -32,7 +32,14 @@ use wasm_bindgen_test::wasm_bindgen_test as test;
 const ECHO_ALPN: &[u8] = b"echo";
 
 #[test]
-async fn simple_endpoint_id_based_connection_transfer() -> Result {
+async fn simple_node_id_based_connection_transfer_loop() -> Result {
+    for _ in 0..10 {
+        simple_node_id_based_connection_transfer().await?;
+    }
+    Ok(())
+}
+
+async fn simple_node_id_based_connection_transfer() -> Result {
     std::panic::set_hook(Box::new(console_error_panic_hook::hook));
     setup_logging();
 
@@ -40,17 +47,21 @@ async fn simple_endpoint_id_based_connection_transfer() -> Result {
         .relay_mode(RelayMode::Staging)
         .bind()
         .await?;
+    tracing::info!("started client, id {}", client.id().fmt_short());
     let server = Endpoint::builder()
         .relay_mode(RelayMode::Staging)
         .alpns(vec![ECHO_ALPN.to_vec()])
         .bind()
         .await?;
+    tracing::info!("started server, id {}", server.id().fmt_short());
 
     // Make the server respond to requests with an echo
     task::spawn({
+        tracing::info!("waiting for incoming connections on the server");
         let server = server.clone();
         async move {
             while let Some(incoming) = server.accept().await {
+                tracing::info!("accepting connection");
                 let conn = incoming.await.e()?;
                 let endpoint_id = conn.remote_id()?;
                 tracing::info!(endpoint_id = %endpoint_id.fmt_short(), "Accepted connection");
@@ -76,6 +87,9 @@ async fn simple_endpoint_id_based_connection_transfer() -> Result {
     // Wait for pkarr records to be published
     time::timeout(Duration::from_secs(10), {
         let endpoint_id = server.id();
+        tracing::info!(
+            "start timeout waiting for records to be published, waiting for {endpoint_id} resolution"
+        );
         async move {
             let resolver = PkarrResolver::n0_dns().build();
             loop {
@@ -83,12 +97,15 @@ async fn simple_endpoint_id_based_connection_transfer() -> Result {
                 time::sleep(Duration::from_secs(1)).await;
 
                 let Some(mut stream) = resolver.resolve(endpoint_id) else {
+                    tracing::info!("unable to get resolver stream, looping");
                     continue;
                 };
                 let Ok(Some(item)) = stream.try_next().await else {
+                    tracing::info!("no items on stream when resolving, looping");
                     continue;
                 };
                 if item.relay_url().is_some() {
+                    tracing::info!("home relay found");
                     break;
                 }
             }

From 3db2456ad679ac894b8739e2aa7f36a919248ecd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9Cramfox=E2=80=9D?= <“kasey@n0.computer”>
Date: Tue, 14 Oct 2025 10:40:57 -0400
Subject: [PATCH 2/7] fix? maybe? Add `online` wait to ensure we have a relay
 url before proceeding with the test

---
 iroh/tests/integration.rs | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/iroh/tests/integration.rs b/iroh/tests/integration.rs
index 454ddba553d..6aaf909dcdf 100644
--- a/iroh/tests/integration.rs
+++ b/iroh/tests/integration.rs
@@ -32,17 +32,9 @@ use wasm_bindgen_test::wasm_bindgen_test as test;
 const ECHO_ALPN: &[u8] = b"echo";
 
 #[test]
-async fn simple_node_id_based_connection_transfer_loop() -> Result {
-    for _ in 0..10 {
-        simple_node_id_based_connection_transfer().await?;
-    }
-    Ok(())
-}
-
 async fn simple_node_id_based_connection_transfer() -> Result {
     std::panic::set_hook(Box::new(console_error_panic_hook::hook));
     setup_logging();
-
     let client = Endpoint::builder()
         .relay_mode(RelayMode::Staging)
         .bind()
@@ -55,6 +47,12 @@ async fn simple_node_id_based_connection_transfer() -> Result {
         .await?;
     tracing::info!("started server, id {}", server.id().fmt_short());
 
+    // ensure the server has connected to a relay
+    // and therefore has enough information to publish
+    time::timeout(Duration::from_secs(6), server.online())
+        .await
+        .e()?;
+
     // Make the server respond to requests with an echo
     task::spawn({
         tracing::info!("waiting for incoming connections on the server");

From 6d7bc0eb7d7c5314ef3fe0f7524e0b393c233292 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9Cramfox=E2=80=9D?= <“kasey@n0.computer”>
Date: Tue, 14 Oct 2025 11:12:33 -0400
Subject: [PATCH 3/7] some logging changes for clarity

---
 iroh/tests/integration.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/iroh/tests/integration.rs b/iroh/tests/integration.rs
index 6aaf909dcdf..d59992bf634 100644
--- a/iroh/tests/integration.rs
+++ b/iroh/tests/integration.rs
@@ -49,9 +49,10 @@ async fn simple_node_id_based_connection_transfer() -> Result {
 
     // ensure the server has connected to a relay
     // and therefore has enough information to publish
+    tracing::info!("waiting for server to go online");
     time::timeout(Duration::from_secs(6), server.online())
         .await
-        .e()?;
+        .context("server endpoint took too long to get online")?;
 
     // Make the server respond to requests with an echo
     task::spawn({

From abadbbb2622a2d8ea2dad2acb957999165515d93 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9Cramfox=E2=80=9D?= <“kasey@n0.computer”>
Date: Fri, 17 Oct 2025 14:21:13 -0400
Subject: [PATCH 4/7] tests: expand timeouts

---
 iroh/tests/integration.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/iroh/tests/integration.rs b/iroh/tests/integration.rs
index d59992bf634..2966ddbaccd 100644
--- a/iroh/tests/integration.rs
+++ b/iroh/tests/integration.rs
@@ -50,7 +50,7 @@ async fn simple_node_id_based_connection_transfer() -> Result {
     // ensure the server has connected to a relay
     // and therefore has enough information to publish
     tracing::info!("waiting for server to go online");
-    time::timeout(Duration::from_secs(6), server.online())
+    time::timeout(Duration::from_secs(12), server.online())
         .await
         .context("server endpoint took too long to get online")?;
 
@@ -84,7 +84,7 @@ async fn simple_node_id_based_connection_transfer() -> Result {
     });
 
     // Wait for pkarr records to be published
-    time::timeout(Duration::from_secs(10), {
+    time::timeout(Duration::from_secs(20), {
         let endpoint_id = server.id();
         tracing::info!(
             "start timeout waiting for records to be published, waiting for {endpoint_id} resolution"

From 9b84cd2a011e73dac9d97bba4864df43e2431143 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9Cramfox=E2=80=9D?= <“kasey@n0.computer”>
Date: Mon, 20 Oct 2025 13:56:00 -0400
Subject: [PATCH 5/7] chore: upgrade rustls and webpki for minimal crates CI

---
 Cargo.lock                | 4 ++--
 iroh/Cargo.toml           | 4 ++--
 iroh/tests/integration.rs | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 95eac58de86..3568651304d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3945,9 +3945,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.32"
+version = "0.23.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd3c25631629d034ce7cd9940adc9d45762d46de2b0f57193c4443b92c6d4d40"
+checksum = "751e04a496ca00bb97a5e043158d23d66b5aabf2e1d5aa2a0aaebb1aafe6f82c"
 dependencies = [
  "log",
  "once_cell",
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index b380224c14c..b67049c7187 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -55,7 +55,7 @@ reqwest = { version = "0.12", default-features = false, features = [
     "stream",
 ] }
 ring = "0.17"
-rustls = { version = "0.23", default-features = false, features = ["ring"] }
+rustls = { version = "0.23.33", default-features = false, features = ["ring"] }
 serde = { version = "1.0.219", features = ["derive", "rc"] }
 smallvec = "1.11.1"
 snafu = { version = "0.8.5", features = ["rust_1_81"] }
@@ -70,7 +70,7 @@ tokio-stream = { version = "0.1.15", features = ["sync"] }
 tokio-util = { version = "0.7", features = ["io-util", "io", "rt"] }
 tracing = "0.1"
 url = { version = "2.5", features = ["serde"] }
-webpki = { package = "rustls-webpki", version = "0.103", features = ["ring"] }
+webpki = { package = "rustls-webpki", version = "0.103.7", features = ["ring"] }
 webpki_types = { package = "rustls-pki-types", version = "1.12" }
 webpki-roots = "1.0"
 z32 = "1.0.3"
diff --git a/iroh/tests/integration.rs b/iroh/tests/integration.rs
index 2966ddbaccd..99121088ebb 100644
--- a/iroh/tests/integration.rs
+++ b/iroh/tests/integration.rs
@@ -32,7 +32,7 @@ use wasm_bindgen_test::wasm_bindgen_test as test;
 const ECHO_ALPN: &[u8] = b"echo";
 
 #[test]
-async fn simple_node_id_based_connection_transfer() -> Result {
+async fn simple_endpoint_id_based_connection_transfer() -> Result {
     std::panic::set_hook(Box::new(console_error_panic_hook::hook));
     setup_logging();
     let client = Endpoint::builder()

From 8c855b5a86980909a534a4c47345396dbf60c743 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9Cramfox=E2=80=9D?= <“kasey@n0.computer”>
Date: Mon, 20 Oct 2025 15:32:28 -0400
Subject: [PATCH 6/7] chore: pin to specific `webpki`, `webpki-roots`, and
 `rustls` versions

---
 Cargo.lock                 | 14 +++++++-------
 iroh-dns-server/Cargo.toml |  2 +-
 iroh-relay/Cargo.toml      |  6 +++---
 iroh/Cargo.toml            |  2 +-
 iroh/bench/Cargo.toml      |  2 +-
 5 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 3568651304d..8914c5657dc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1931,7 +1931,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots 1.0.2",
+ "webpki-roots 1.0.3",
 ]
 
 [[package]]
@@ -2278,7 +2278,7 @@ dependencies = [
  "url",
  "wasm-bindgen-futures",
  "wasm-bindgen-test",
- "webpki-roots 1.0.2",
+ "webpki-roots 1.0.3",
  "z32",
 ]
 
@@ -2530,7 +2530,7 @@ dependencies = [
  "tracing-subscriber",
  "tracing-test",
  "url",
- "webpki-roots 1.0.2",
+ "webpki-roots 1.0.3",
  "ws_stream_wasm",
  "z32",
 ]
@@ -3877,7 +3877,7 @@ dependencies = [
  "wasm-bindgen-futures",
  "wasm-streams",
  "web-sys",
- "webpki-roots 1.0.2",
+ "webpki-roots 1.0.3",
 ]
 
 [[package]]
@@ -5456,14 +5456,14 @@ version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
 dependencies = [
- "webpki-roots 1.0.2",
+ "webpki-roots 1.0.3",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e8983c3ab33d6fb807cfcdad2491c4ea8cbc8ed839181c7dfd9c67c83e261b2"
+checksum = "32b130c0d2d49f8b6889abc456e795e82525204f27c42cf767cf0d7734e089b8"
 dependencies = [
  "rustls-pki-types",
 ]
diff --git a/iroh-dns-server/Cargo.toml b/iroh-dns-server/Cargo.toml
index e2566d6b1b5..4b8e7eab6f2 100644
--- a/iroh-dns-server/Cargo.toml
+++ b/iroh-dns-server/Cargo.toml
@@ -36,7 +36,7 @@ pkarr = { version = "5", features = ["relays", "dht"], default-features = false
 rcgen = "0.14"
 redb = "2.6.3"
 regex = "1.10.3"
-rustls = { version = "0.23", default-features = false, features = ["ring"] }
+rustls = { version = "0.23.33", default-features = false, features = ["ring"] }
 rustls-pemfile = { version = "2.1" }
 serde = { version = "1", features = ["derive"] }
 struct_iterable = "0.1.1"
diff --git a/iroh-relay/Cargo.toml b/iroh-relay/Cargo.toml
index 50d0eff2053..d5db894efe9 100644
--- a/iroh-relay/Cargo.toml
+++ b/iroh-relay/Cargo.toml
@@ -48,7 +48,7 @@ rand = "0.9.2"
 reqwest = { version = "0.12", default-features = false, features = [
     "rustls-tls",
 ] }
-rustls = { version = "0.23", default-features = false, features = ["ring"] }
+rustls = { version = "0.23.33", default-features = false, features = ["ring"] }
 serde = { version = "1", features = ["derive", "rc"] }
 strum = { version = "0.27", features = ["derive"] }
 tokio = { version = "1", features = [
@@ -65,8 +65,8 @@ sha1 = "0.11.0-rc.2"
 tokio-util = { version = "0.7", features = ["io-util", "io", "codec", "rt"] }
 tracing = "0.1"
 url = { version = "2.5.3", features = ["serde"] }
-webpki = { package = "rustls-webpki", version = "0.103" }
-webpki-roots = "1.0"
+webpki = { package = "rustls-webpki", version = "0.103.7" }
+webpki-roots = "1.0.3"
 webpki_types = { package = "rustls-pki-types", version = "1.12" }
 data-encoding = "2.6.0"
 lru = "0.16"
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index b67049c7187..0f34e2fea81 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -72,7 +72,7 @@ tracing = "0.1"
 url = { version = "2.5", features = ["serde"] }
 webpki = { package = "rustls-webpki", version = "0.103.7", features = ["ring"] }
 webpki_types = { package = "rustls-pki-types", version = "1.12" }
-webpki-roots = "1.0"
+webpki-roots = "1.0.3"
 z32 = "1.0.3"
 
 # fix minimal versions
diff --git a/iroh/bench/Cargo.toml b/iroh/bench/Cargo.toml
index 3eb45a863d8..5137c8c01ba 100644
--- a/iroh/bench/Cargo.toml
+++ b/iroh/bench/Cargo.toml
@@ -15,7 +15,7 @@ n0-snafu = "0.2.0"
 quinn = { package = "iroh-quinn", version = "0.14" }
 rand = "0.9.2"
 rcgen = "0.14"
-rustls = { version = "0.23", default-features = false, features = ["ring"] }
+rustls = { version = "0.23.33", default-features = false, features = ["ring"] }
 clap = { version = "4", features = ["derive"] }
 tokio = { version = "1", features = ["rt", "sync"] }
 tracing = "0.1"

From 8a6feafbc3394a9d94dbb62ff106652a4b945b84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E2=80=9Cramfox=E2=80=9D?= <“kasey@n0.computer”>
Date: Mon, 20 Oct 2025 15:41:06 -0400
Subject: [PATCH 7/7] chore: use rustls-platform-verifier specific version for
 minimum crates test

---
 Cargo.lock      | 1 +
 iroh/Cargo.toml | 1 +
 2 files changed, 2 insertions(+)

diff --git a/Cargo.lock b/Cargo.lock
index 8914c5657dc..be73a3b5552 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2259,6 +2259,7 @@ dependencies = [
  "ring",
  "rustls",
  "rustls-pki-types",
+ "rustls-platform-verifier",
  "rustls-webpki",
  "serde",
  "serde_json",
diff --git a/iroh/Cargo.toml b/iroh/Cargo.toml
index 0f34e2fea81..cd74e8bf79d 100644
--- a/iroh/Cargo.toml
+++ b/iroh/Cargo.toml
@@ -79,6 +79,7 @@ z32 = "1.0.3"
 # for n0-futures
 futures-buffered = "0.2.11"
 pkcs8 = "0.11.0-rc.7"
+rustls-platform-verifier = "0.5.3"
 
 # metrics
 iroh-metrics = { version = "0.36", default-features = false }