luxfi/netrunner
1
0
Fork 0
mirror of https://github.com/luxfi/netrunner.git synced 2026-07-27 00:04:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

genkeys/testkeys: thread *keys.ServiceIdentity into LoadMnemonic dial

Browse Source 
The KMS consensus-auth gate now requires every secret-opcode envelope
to carry a signed identity. Derive a bootstrap ServiceIdentity from
KMS_BOOTSTRAP_MNEMONIC (or MNEMONIC) under the well-known servicePaths
"netrunner/genkeys" / "netrunner/testkeys" and thread it into the
LoadMnemonic call so the dial envelope is signed.
This commit is contained in:
Hanzo AI
2026-06-01 16:15:47 -07:00
parent c8ed115875
commit 9b8e6fc7de
2 changed files with 54 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/genkeys/main.go
+27 -1
View File
@@ -35,10 +35,18 @@ type ValidatorBackup struct {
func main() {
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
identity, err := bootstrapIdentity("netrunner/genkeys")
if err != nil {
fmt.Printf("ERROR: derive KMS dial identity: %v\n", err)
fmt.Println("Set MNEMONIC or KMS_BOOTSTRAP_MNEMONIC for consensus-auth dial.")
os.Exit(1)
}
defer identity.Wipe()
mnemonic, err := keys.LoadMnemonic(ctx,
os.Getenv("KMS_ADDR"),
os.Getenv("KMS_ENV"),
envOr("KMS_MNEMONIC_PATH", "/mnemonic"))
envOr("KMS_MNEMONIC_PATH", "/mnemonic"),
identity)
if err != nil {
fmt.Printf("ERROR: load mnemonic: %v\n", err)
fmt.Println("Set MNEMONIC env var, or KMS_ADDR + KMS_ENV + KMS_MNEMONIC_PATH for native ZAP.")
@@ -151,3 +159,21 @@ func envOr(name, def string) string {
}
return def
}
// bootstrapIdentity derives the *keys.ServiceIdentity used to sign the
// KMS dial envelope. Bootstrap mnemonic source order:
// 1. KMS_BOOTSTRAP_MNEMONIC env var — explicit operator override.
// 2. MNEMONIC env var — local dev + CI test seam.
//
// At least one MUST be set so the dial carries identity. Without an
// identity the consensus-auth gate rejects the secret-opcode envelope.
func bootstrapIdentity(servicePath string) (*keys.ServiceIdentity, error) {
m := strings.TrimSpace(os.Getenv("KMS_BOOTSTRAP_MNEMONIC"))
if m == "" {
m = strings.TrimSpace(os.Getenv("MNEMONIC"))
}
if m == "" {
return nil, fmt.Errorf("KMS_BOOTSTRAP_MNEMONIC (or MNEMONIC) must be set to dial KMS")
}
return keys.NewServiceIdentity(m, servicePath)
}
cmd/testkeys/main.go
+27 -1
View File
@@ -14,10 +14,18 @@ import (
func main() {
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
defer cancel()
identity, err := bootstrapIdentity("netrunner/testkeys")
if err != nil {
fmt.Printf("ERROR: derive KMS dial identity: %v\n", err)
fmt.Println("Set MNEMONIC or KMS_BOOTSTRAP_MNEMONIC for consensus-auth dial.")
os.Exit(1)
}
defer identity.Wipe()
mnemonic, err := keys.LoadMnemonic(ctx,
os.Getenv("KMS_ADDR"),
os.Getenv("KMS_ENV"),
envOr("KMS_MNEMONIC_PATH", "/mnemonic"))
envOr("KMS_MNEMONIC_PATH", "/mnemonic"),
identity)
if err != nil {
fmt.Printf("ERROR: load mnemonic: %v\n", err)
fmt.Println("Set MNEMONIC env var, or KMS_ADDR + KMS_ENV + KMS_MNEMONIC_PATH for native ZAP.")
@@ -91,3 +99,21 @@ func envOr(name, def string) string {
}
return def
}
// bootstrapIdentity derives the *keys.ServiceIdentity used to sign the
// KMS dial envelope. Bootstrap mnemonic source order:
// 1. KMS_BOOTSTRAP_MNEMONIC env var — explicit operator override.
// 2. MNEMONIC env var — local dev + CI test seam.
//
// At least one MUST be set so the dial carries identity. Without an
// identity the consensus-auth gate rejects the secret-opcode envelope.
func bootstrapIdentity(servicePath string) (*keys.ServiceIdentity, error) {
m := strings.TrimSpace(os.Getenv("KMS_BOOTSTRAP_MNEMONIC"))
if m == "" {
m = strings.TrimSpace(os.Getenv("MNEMONIC"))
}
if m == "" {
return nil, fmt.Errorf("KMS_BOOTSTRAP_MNEMONIC (or MNEMONIC) must be set to dial KMS")
}
return keys.NewServiceIdentity(m, servicePath)
}