RASL — Retrieval of Arbitrary Structures & Links

The rasl URL Scheme

RASL URLs look like this: rasl://bafkreifn5yxi7nkftsn46b6x26grda57ict7md2xuvfbsgkiahe2e7vnq4/?hint=berjon.com&hint=bsky.app. This breaks down into the following components:

• The rasl scheme. This is simply used as an entry point into RASL semantics.
• An authority, which is simply a DASL CID ([cid]), here bafkreifn5yxi7nkftsn46b6x26grda57ict7md2xuvfbsgkiahe2e7vnq4.
• A path (here just /) that is empty or / and that is expected to be ignored since RASL is only used for raw data retrieval.
• A query string part, that is parsed according to CGI rules and that contains zero or more hint entries, each of which is a host from which that CID can be obtained.

Use the following steps to parse a RASL URL:

1. Accept a string url and parse it according to the URL Standard ([url]).
2. If that's a failure, return the failure.
3. Read the host part of the parsed URL and store that in cid.
4. If cid is not a valid CID ([cid]), return failure.
5. Select all the tuples in the query object associated with the URL ([url]) whose name is exaclty hint. Each value MUST match the syntax of a valid host for the https scheme and values which do not match this syntax MUST be ignored and removed from this list. Store the remaining values in hints. If there were none then hints is an empty array.
6. Return the URL's parts as well as cid and hints.

Fetching RASL

A user agent may retrieve a CID in whichever way it prefers. This section provides a simple standard for HTTP-based CID retrieval, to make it easy for authors to publish content to their own sites and have it retrieved, without having to worry about operating any infrastructure beyond the web server they already have.

Use the following steps to fetch a RASL URL:

1. Accept a string url and parse it according to the steps to parse a RASL URL.
2. Construct a request using cid from the url as well as hints that may be from the URL or from elsewhere (this is entirely up to you):
   1. For each hint, construct a request URL that is the concatenation of https://, the hint as host, /.well-known/rasl/, and the cid.
   2. Prepare the request such that it has a method of either GET or HEAD, that it is stateless (no cookies, no credentials of any kind), and that it uses no content negotiation.
3. Fetch the requests. How these get prioritised is entirely up to the implementation. It is common to run them all in parallel and abort them with the first success response. Note that the .well-known path may redirect, so be ready to handle that. This makes it possible to create sites that are published the usual way and to have a RASL that is simply a redirect to the resource. So for instance, you may have an existing https://berjon.com/kitten.jpg the CID for which is bafkreifn5yxi7nkftsn46b6x26grda57ict7md2xuvfbsgkiahe2e7vnq4. This can be published as this RASL URL: rasl://bafkreifn5yxi7nkftsn46b6x26grda57ict7md2xuvfbsgkiahe2e7vnq4/?hint=berjon.com. A client can retrieve it by constructing the a request to this URL: https://berjon.com/.well-known/rasl/bafkreifn5yxi7nkftsn46b6x26grda57ict7md2xuvfbsgkiahe2e7vnq4. In turn, the latter may simply return a 307 redirect back to https://berjon.com/kitten.jpg. (Yes, this is HTTP with extra steps, but the extra steps get you self-certifying content.)
4. If the response is a redirect but not a 307, the client SHOULD treat it as if it had been a 307 anyway.
5. If none of the responses are successful, return failure.
6. Set the response's media type to application/octet-stream. (The server should have done that already, but may not have done so, notably if it relied on a redirect.) The purpose of RASL is to retrieve data in ways that are independent of the server — any media type processing must therefore take place at another layer. Without this, we lose the self-certifying nature of the system. (Note that servers are encouraged to enforce that so as not to have their RASL endpoints used for general-purpose web serving, which can be a security vector depending on where the data being served came from.)
7. Produce a CID for the retrieved data. If that CID does not match the requested cid, return failure.
8. Return the data.