netrunner: drop bootstrapIdentity from genkeys + testkeys

LoadMnemonic no longer takes *ServiceIdentity (luxfi/keys v1.2.0).

cmd/genkeys/main.go

@@ -35,18 +35,10 @@ type ValidatorBackup struct {
 func main() {
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
-	identity, err := bootstrapIdentity("netrunner/genkeys")
-	if err != nil {
-		fmt.Printf("ERROR: derive KMS dial identity: %v\n", err)
-		fmt.Println("Set MNEMONIC or KMS_BOOTSTRAP_MNEMONIC for consensus-auth dial.")
-		os.Exit(1)
-	}
-	defer identity.Wipe()
 	mnemonic, err := keys.LoadMnemonic(ctx,
 		os.Getenv("KMS_ADDR"),
 		os.Getenv("KMS_ENV"),
-		envOr("KMS_MNEMONIC_PATH", "/mnemonic"),
-		identity)
+		envOr("KMS_MNEMONIC_PATH", "/mnemonic"))
 	if err != nil {
 		fmt.Printf("ERROR: load mnemonic: %v\n", err)
 		fmt.Println("Set MNEMONIC env var, or KMS_ADDR + KMS_ENV + KMS_MNEMONIC_PATH for native ZAP.")
@@ -160,20 +152,3 @@ func envOr(name, def string) string {
 	return def
 }
 
-// bootstrapIdentity derives the *keys.ServiceIdentity used to sign the
-// KMS dial envelope. Bootstrap mnemonic source order:
-//   1. KMS_BOOTSTRAP_MNEMONIC env var — explicit operator override.
-//   2. MNEMONIC env var — local dev + CI test seam.
-//
-// At least one MUST be set so the dial carries identity. Without an
-// identity the consensus-auth gate rejects the secret-opcode envelope.
-func bootstrapIdentity(servicePath string) (*keys.ServiceIdentity, error) {
-	m := strings.TrimSpace(os.Getenv("KMS_BOOTSTRAP_MNEMONIC"))
-	if m == "" {
-		m = strings.TrimSpace(os.Getenv("MNEMONIC"))
-	}
-	if m == "" {
-		return nil, fmt.Errorf("KMS_BOOTSTRAP_MNEMONIC (or MNEMONIC) must be set to dial KMS")
-	}
-	return keys.NewServiceIdentity(m, servicePath)
-}

cmd/testkeys/main.go

@@ -14,18 +14,10 @@ import (
 func main() {
 	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
 	defer cancel()
-	identity, err := bootstrapIdentity("netrunner/testkeys")
-	if err != nil {
-		fmt.Printf("ERROR: derive KMS dial identity: %v\n", err)
-		fmt.Println("Set MNEMONIC or KMS_BOOTSTRAP_MNEMONIC for consensus-auth dial.")
-		os.Exit(1)
-	}
-	defer identity.Wipe()
 	mnemonic, err := keys.LoadMnemonic(ctx,
 		os.Getenv("KMS_ADDR"),
 		os.Getenv("KMS_ENV"),
-		envOr("KMS_MNEMONIC_PATH", "/mnemonic"),
-		identity)
+		envOr("KMS_MNEMONIC_PATH", "/mnemonic"))
 	if err != nil {
 		fmt.Printf("ERROR: load mnemonic: %v\n", err)
 		fmt.Println("Set MNEMONIC env var, or KMS_ADDR + KMS_ENV + KMS_MNEMONIC_PATH for native ZAP.")
@@ -100,20 +92,3 @@ func envOr(name, def string) string {
 	return def
 }
 
-// bootstrapIdentity derives the *keys.ServiceIdentity used to sign the
-// KMS dial envelope. Bootstrap mnemonic source order:
-//   1. KMS_BOOTSTRAP_MNEMONIC env var — explicit operator override.
-//   2. MNEMONIC env var — local dev + CI test seam.
-//
-// At least one MUST be set so the dial carries identity. Without an
-// identity the consensus-auth gate rejects the secret-opcode envelope.
-func bootstrapIdentity(servicePath string) (*keys.ServiceIdentity, error) {
-	m := strings.TrimSpace(os.Getenv("KMS_BOOTSTRAP_MNEMONIC"))
-	if m == "" {
-		m = strings.TrimSpace(os.Getenv("MNEMONIC"))
-	}
-	if m == "" {
-		return nil, fmt.Errorf("KMS_BOOTSTRAP_MNEMONIC (or MNEMONIC) must be set to dial KMS")
-	}
-	return keys.NewServiceIdentity(m, servicePath)
-}

go.mod

@@ -18,8 +18,8 @@ require (
 	github.com/luxfi/genesis v1.13.9
 	github.com/luxfi/geth v1.16.98
 	github.com/luxfi/go-bip39 v1.1.2
-	github.com/luxfi/ids v1.2.10
-	github.com/luxfi/keys v1.0.9
+	github.com/luxfi/ids v1.2.13
+	github.com/luxfi/keys v1.2.0
 	github.com/luxfi/log v1.4.3
 	github.com/luxfi/math v1.4.1
 	github.com/luxfi/metric v1.5.8
@@ -90,7 +90,7 @@ require (
 	github.com/luxfi/crypto/ipa v1.2.4 // indirect
 	github.com/luxfi/filesystem v0.0.1 // indirect
 	github.com/luxfi/formatting v1.0.1 // indirect
-	github.com/luxfi/kms v1.9.13 // indirect
+	github.com/luxfi/kms v1.11.3 // indirect
 	github.com/luxfi/mdns v0.1.1 // indirect
 	github.com/luxfi/net v0.0.4 // indirect
 	github.com/luxfi/pq v1.0.3 // indirect

go.sum

@@ -296,14 +296,14 @@ github.com/luxfi/go-bip32 v1.0.2 h1:7vFbb+Wr4Z499q2tuCLdd7wWjtn8sH+HWBlx76mhH9Y=
 github.com/luxfi/go-bip32 v1.0.2/go.mod h1:bc7/LXDKAJQZ/F0Xjf5yXaTZxY9/ssLb4FC+Hxn/cDk=
 github.com/luxfi/go-bip39 v1.1.2 h1:p+wLMPGs6MLQh7q0YIsmy2EhHL7LHiELEGTJko6t/Jg=
 github.com/luxfi/go-bip39 v1.1.2/go.mod h1:96de9VkR2kY/ASAnhMtvt3TSh+PZkAFAngNj0GjRGDo=
-github.com/luxfi/ids v1.2.10 h1:f1WILZE199ayMuqnEyB2WP1qfMZkmozOQXSVYtB3e5k=
-github.com/luxfi/ids v1.2.10/go.mod h1:QBIwy3OHvrtskbUqKh1+OYRa6PsyR7f7oNX33sOfK7w=
+github.com/luxfi/ids v1.2.13 h1:lEotq0WUpMLcc/5X5MbE3n73jdfNo8IlFvTDfUXg+9A=
+github.com/luxfi/ids v1.2.13/go.mod h1:QWjJvggX/nRkmrz1AGSaF2Y6mnOvz3g7lFOzs3Zd+JM=
 github.com/luxfi/keychain v1.0.2 h1:uQgmjs37/VBIALEiYrrszTpxvtqr07/YvS9TnmxGafs=
 github.com/luxfi/keychain v1.0.2/go.mod h1:q/4ULgZBlstKkwzOzG/0T6y73BDPgnkrcibbJyTvmbU=
-github.com/luxfi/keys v1.0.9 h1:RlwhWZA+OwK54jCmV6qz36I7/DX+GJrWrQ717uNqZiA=
-github.com/luxfi/keys v1.0.9/go.mod h1:U3tZNDmv3nXkPoZwLtq9RNjwyN0XyoN29worigfT+c0=
-github.com/luxfi/kms v1.9.13 h1:b3kRaKcorBS508VUf3B/TMOr1nnHO0jOatwvci1uZWU=
-github.com/luxfi/kms v1.9.13/go.mod h1:qGuK95av+MRUFsCr44FUuico4bX5lvO8pAq/lULeSas=
+github.com/luxfi/keys v1.2.0 h1:+AriQNM7FOylAEls1XvFdlSOXDfoyc6X3ZfJRWQ2I9g=
+github.com/luxfi/keys v1.2.0/go.mod h1:SjsAaxo6sGmSp9OaHXUiVCqsknO8iPspN6jMOoEAMb8=
+github.com/luxfi/kms v1.11.3 h1:ru/vHNneYiWeO9nPDXMAaUrkVj5zBwtg0VUj4PLy0tQ=
+github.com/luxfi/kms v1.11.3/go.mod h1:k91I3fULpJHicaWa2YESthHtHv3XwGlJauW/dcvB6WM=
 github.com/luxfi/lattice/v7 v7.1.4 h1:hQR02M6cHTAV5+joOPi9gb9Gm+z/hKJnhJF4IlciIJs=
 github.com/luxfi/lattice/v7 v7.1.4/go.mod h1:DmIQFi3mJiehVsR235l1NKYEU0JhU649OX5p7gMEW2c=
 github.com/luxfi/log v1.4.3 h1:xkUKRWvQ4ZwvlUC2e0/RTtHYZOYSMvSQ9W9lbjwBmiI=