Allow BlackBox catalog DNS endpoints

docs/HANDOFF.md

@@ -72,8 +72,10 @@ The same Compose project also runs `ps5-guide-gateway`, bound specifically to
 `192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves
 `manuals.playstation.net` locally and forwards only `homebrew.page`,
 `itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
-and `release-assets.githubusercontent.com` to the configured upstream resolver
-(`1.1.1.1` by default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to
+`raw.githubusercontent.com`, `release-assets.githubusercontent.com`,
+`prosperopatches.com`, `cdn.prosperopatches.com`, `image.api.playstation.com` and
+`gmedia.playstation.com` to the configured upstream resolver (`1.1.1.1` by
+default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to
 `http://192.168.20.30:8000/`.
 
 Port `8080` on the host is already used by `unifi-network-application`; do not move
@@ -180,12 +182,14 @@ accept the self-signed certificate warning in the User Guide.
 
 The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`,
 `itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
-and `release-assets.githubusercontent.com`. Only those names and
+`raw.githubusercontent.com`, `release-assets.githubusercontent.com`,
+`prosperopatches.com`, `cdn.prosperopatches.com`, `image.api.playstation.com` and
+`gmedia.playstation.com`. Only those names and
 `manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits
-the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager and Spectrum
-Library while continuing to block PSN and update resolution. The PS5 sends DNS only
-to `net-utils01`; that host must be allowed to reach the configured upstream
-resolver on UDP/TCP 53.
+the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager, Spectrum
+Library and BlackBox while continuing to block PSN and update resolution. The PS5
+sends DNS only to `net-utils01`; that host must be allowed to reach the configured
+upstream resolver on UDP/TCP 53.
 
 The Payload Manager review used upstream commit
 `e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
@@ -203,6 +207,16 @@ identified `store.spectrumlibrary.online` for API/catalog access and
 and cover hosts, which are not allowlisted without review. The Spectrum API returned
 HTTP 502 during the 2026-10-07 review. Release 1.4.9 contained only a 4-byte
 `Void.pkg`, so 1.4.8 was the last usable artifact available for static analysis.
+
+The BlackBox review used repository commit
+`80fa07c9cb5319b3ca4b906b9381e1cca2a91295` and the published v1.0.5 ELF. Its
+SHA-256, `152dda87ec64899270db61c61676b62e5d29a46a67523299b2719a81d4486235`,
+matched the release sidecar. Static analysis identified `raw.githubusercontent.com`
+for catalog/update manifests, the existing GitHub hosts for application releases,
+and Prosperopatches plus PlayStation media hosts for artwork. Archive.org,
+Vikingfile and their download infrastructure are intentionally excluded: they serve
+third-party game files, many catalog entries have no SHA-256, and those hosts are
+not required for catalog browsing or BlackBox updates.
 The PS5 was previously identified as `192.168.10.26`; requests from
 `192.168.10.6` seen at that time were from a different client. Those addresses
 are historical and must not be used as the current payload destination.

docs/PS5_SETUP.md

@@ -139,8 +139,11 @@ O Compose inclui um DNS controlado no `net-utils01` que:
 - responda `manuals.playstation.net` com `192.168.20.30`;
 - encaminhe apenas `homebrew.page`, `itsplk.github.io`,
   `store.spectrumlibrary.online`, `api.github.com`, `github.com` e
-  `release-assets.githubusercontent.com` para o resolvedor configurado, permitindo
-  os destinos fixos do homebrew store, PS5 Payload Manager e Spectrum Library;
+  `raw.githubusercontent.com`, `release-assets.githubusercontent.com`,
+  `prosperopatches.com`, `cdn.prosperopatches.com`,
+  `image.api.playstation.com` e `gmedia.playstation.com` para o resolvedor
+  configurado, permitindo os destinos revistos do homebrew store, PS5 Payload
+  Manager, Spectrum Library e BlackBox;
 - devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e
   telemetria bloqueados por DNS;
 - registe as consultas nos logs do container;
@@ -170,7 +173,7 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para
 resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para
 `192.168.20.30`; não deve consultar diretamente um DNS público.
 
-O acesso WAN da consola pode ficar limitado a TCP `443` para os seis domínios
+O acesso WAN da consola pode ficar limitado a TCP `443` para os domínios
 permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar
 os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será
 bloqueado até esse destino ser revisto e acrescentado explicitamente.
@@ -190,6 +193,13 @@ pacotes, que permanecem bloqueados se usarem outros hosts. Durante a revisão de
 2026-10-07, o servidor Spectrum devolvia HTTP 502, uma falha upstream que o DNS
 local não consegue corrigir.
 
+O BlackBox v1.0.5 obtém o catálogo e manifests de atualização em
+`raw.githubusercontent.com`, descarrega as suas próprias releases através dos hosts
+GitHub já permitidos e usa Prosperopatches e os dois hosts de media PlayStation para
+capas. Embora o catálogo contenha links para Archive.org e Vikingfile, esses hosts
+não são permitidos: não são necessários para navegar no catálogo ou atualizar o
+BlackBox e dão acesso a ficheiros de jogos terceiros, frequentemente sem SHA-256.
+
 ## Abrir pelo Guia do Utilizador
 
 Com um DNS que redirecione o manual: