DinoX XMPP Provider Data Mirror

This repository contains the validated provider-directory artifacts mirrored for DinoX account onboarding.

The upstream data authority is the XMPP Providers project. This repository does not define provider policy, alter provider ratings, or maintain an independent provider list.

Artifact contract

The version 2 category-B mirror consists of:

• providers/v2/providers-B.json: unchanged upstream provider-list payload;
• providers/v2/providers-B.json.sha256: SHA-256 checksum for the payload;
• providers/v2/source.json: source URL, retrieval time, provider count, API version, and payload checksum.

The intended public deployment URL is:

https://dinox.im/data/providers/v2/providers-B.json

The desktop client must keep a bundled last-known-good list. Failure to update this mirror must never make DinoX account creation unavailable.

Publication policy

Only a completely downloaded and validated payload may replace the previous artifact. An empty, malformed, oversized, truncated, or structurally invalid response must leave the last-known-good mirror unchanged.

Automated validation and publication are added in separate, reviewable slices. Until those slices are complete, updates are maintainer-controlled.

Validation and updates

Use the mirror updater from the repository root:

python3 scripts/update_provider_mirror.py --self-test
python3 scripts/update_provider_mirror.py --check
python3 scripts/update_provider_mirror.py --freshness-check --max-age-hours 72
python3 scripts/update_provider_mirror.py --update

The updater uses only the Python standard library. It validates the v2 category-B payload before publishing local artifacts, rejects unsafe structural changes, and updates the SHA-256 and source metadata only after validation.

Scheduled refresh and static deployment

Forgejo Actions refresh the mirror daily and can also be started manually. The workflow runs validator self-tests before fetching upstream data and commits only when the validated provider artifact changes. Every non-validation run then deploys the complete validated artifact set to the dedicated static-web deployment account. The deployment uses per-file atomic renames and downloads the public files again with a cache-busting query before the job can succeed.

If the default Forgejo Actions checkout token cannot push to this repository, configure a repository secret named DINOX_PROVIDER_DATA_TOKEN with write access to this repository.

Static deployment requires these repository secrets:

• DINOX_PROVIDER_DEPLOY_PRIVATE_KEY: private key for the restricted website deployment account;
• DINOX_PROVIDER_DEPLOY_KNOWN_HOSTS: pinned SSH host-key entry for the deployment endpoint.

The private key must be dedicated to this workflow. Do not reuse an operator's interactive SSH key.

When an upstream fetch fails, the workflow keeps the last-good artifacts and checks their freshness. If the last published source metadata is older than 72 hours, the workflow fails so the stale mirror becomes visible.

Rollback is a normal Git rollback: revert the data repository to the previous known-good data commit, validate it with python3 scripts/update_provider_mirror.py --check, and start the workflow manually. The same deployment and public read-back gates apply to rollback.

Licensing

The mirrored provider data is published under CC0-1.0 by the XMPP Providers contributors. Repository metadata created by the DinoX Team is also dedicated under CC0-1.0. License texts and per-file SPDX metadata are included in this repository.