Allow Spectrum Library DNS endpoints

docs/HANDOFF.md

@@ -71,9 +71,9 @@ kadinho <[email protected]>
 The same Compose project also runs `ps5-guide-gateway`, bound specifically to
 `192.168.20.30` on DNS UDP/TCP 53 and HTTP/HTTPS TCP 80/443. It resolves
 `manuals.playstation.net` locally and forwards only `homebrew.page`,
-`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com` to the
-configured upstream resolver (`1.1.1.1` by default). Every other name receives
-NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to
+`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
+and `release-assets.githubusercontent.com` to the configured upstream resolver
+(`1.1.1.1` by default). Every other name receives NXDOMAIN. The HTTP/HTTPS gateway redirects the User Guide to
 `http://192.168.20.30:8000/`.
 
 Port `8080` on the host is already used by `unifi-network-application`; do not move
@@ -179,12 +179,13 @@ primary DNS `192.168.20.30` and secondary DNS `0.0.0.0`, then restart the consol
 accept the self-signed certificate warning in the User Guide.
 
 The gateway provides allowlisted recursive DNS forwarding only for `homebrew.page`,
-`itsplk.github.io`, `github.com` and `release-assets.githubusercontent.com`. Only
-those names and `manuals.playstation.net` resolve; all other names receive NXDOMAIN.
-This permits the homebrew store and the official PS5 Payload Manager catalog and
-HTTPS release downloads while continuing to block PSN and update resolution. The
-PS5 sends DNS only to `net-utils01`; that host must be allowed to reach the
-configured upstream resolver on UDP/TCP 53.
+`itsplk.github.io`, `store.spectrumlibrary.online`, `api.github.com`, `github.com`
+and `release-assets.githubusercontent.com`. Only those names and
+`manuals.playstation.net` resolve; all other names receive NXDOMAIN. This permits
+the reviewed fixed endpoints of the homebrew store, PS5 Payload Manager and Spectrum
+Library while continuing to block PSN and update resolution. The PS5 sends DNS only
+to `net-utils01`; that host must be allowed to reach the configured upstream
+resolver on UDP/TCP 53.
 
 The Payload Manager review used upstream commit
 `e4e72dc9d831dd09ee8fabc222ad1e7f5139050e` and the official catalog current on
@@ -192,6 +193,16 @@ The Payload Manager review used upstream commit
 URLs used `github.com`, with observed redirects only to
 `release-assets.githubusercontent.com`. Custom repositories are intentionally not
 covered because their catalog and payload URLs are user-controlled.
+
+The Spectrum Library review used repository commit
+`fe4935f5a21da1e080b941ddd1ec44483b7b60f7`. That repository contains only a README,
+not source code. Static analysis of the published 1.4.8 ELF (SHA-256
+`5d1372d48f76167e3f9e24b335cf571ea6e4b3960e6b7202d2802b0f78c3a519`)
+identified `store.spectrumlibrary.online` for API/catalog access and
+`api.github.com` for update checks. Its API may return additional dynamic download
+and cover hosts, which are not allowlisted without review. The Spectrum API returned
+HTTP 502 during the 2026-10-07 review. Release 1.4.9 contained only a 4-byte
+`Void.pkg`, so 1.4.8 was the last usable artifact available for static analysis.
 The PS5 was previously identified as `192.168.10.26`; requests from
 `192.168.10.6` seen at that time were from a different client. Those addresses
 are historical and must not be used as the current payload destination.

docs/PS5_SETUP.md

@@ -137,10 +137,10 @@ O Compose inclui um DNS controlado no `net-utils01` que:
 
 - bloqueie domínios PlayStation/PSN e servidores de atualização;
 - responda `manuals.playstation.net` com `192.168.20.30`;
-- encaminhe apenas `homebrew.page`, `itsplk.github.io`, `github.com` e
+- encaminhe apenas `homebrew.page`, `itsplk.github.io`,
+  `store.spectrumlibrary.online`, `api.github.com`, `github.com` e
   `release-assets.githubusercontent.com` para o resolvedor configurado, permitindo
-  o catálogo, ícones e downloads HTTPS do homebrew store e o catálogo oficial do
-  PS5 Payload Manager;
+  os destinos fixos do homebrew store, PS5 Payload Manager e Spectrum Library;
 - devolva `NXDOMAIN` para todos os restantes nomes, mantendo PSN, updates e
   telemetria bloqueados por DNS;
 - registe as consultas nos logs do container;
@@ -170,7 +170,7 @@ não um hostname. A firewall deve permitir UDP e TCP `53` de `net-utils01` para
 resolvedor. A consola continua a precisar apenas de UDP/TCP `53` para
 `192.168.20.30`; não deve consultar diretamente um DNS público.
 
-O acesso WAN da consola pode ficar limitado a TCP `443` para os quatro domínios
+O acesso WAN da consola pode ficar limitado a TCP `443` para os seis domínios
 permitidos. Não são necessárias regras WAN de entrada. Se faltarem ícones, consultar
 os logs da firewall: um URL de ícone apontado pelo catálogo para outro domínio será
 bloqueado até esse destino ser revisto e acrescentado explicitamente.
@@ -182,6 +182,14 @@ O catálogo oficial do PS5 Payload Manager está em
 para qualquer host e permanecem bloqueados até os seus JSON, payloads, hashes e
 redirects serem revistos e o hostname exato ser acrescentado conscientemente.
 
+O repositório do Spectrum Library não publica código-fonte. A análise estática do
+ELF 1.4.8 identificou `store.spectrumlibrary.online` para catálogo/API e
+`api.github.com` para atualizações; os downloads de releases GitHub usam os dois
+hosts GitHub já permitidos. A API pode devolver URLs dinâmicos de capas, manifests e
+pacotes, que permanecem bloqueados se usarem outros hosts. Durante a revisão de
+2026-10-07, o servidor Spectrum devolvia HTTP 502, uma falha upstream que o DNS
+local não consegue corrigir.
+
 ## Abrir pelo Guia do Utilizador
 
 Com um DNS que redirecione o manual: