Strip every check that wasn't a hard correctness requirement of the
package itself:
- No path-template validation. {ord}/trailing-slash/{env}-rejection
are gone. If your template is malformed, lqd's config layer will
reject the resulting flag downstream — that's where validation
belongs, not in a fetch shim.
- No partial-env check. If KMS_ADDR is set, kmsboot runs. KMS_ENV
and STAKING_KMS_PATH_TEMPLATE are passed through as-is (empty if
unset).
- No empty-blob check. KMS returns what KMS returns. lqd will
complain about empty PEM bytes if the chain config needs them.
- Config struct is gone. ConfigFromEnv is gone. Validate is gone.
InjectWith is gone. There's nothing left to configure.
Public surface is now four entry points:
Inject(ctx, argv) (argv, error)
InjectWithFetcher(ctx, fetcher, argv) (argv, error)
DefaultFetcher(ctx, addr, env) (Fetcher, error)
PodOrdinal(podName) (int, error)
Triggers: KMS_ADDR alone gates the whole thing. Unset = no-op.
Why: Lux nodes activate all curves and crypto precompiles by default;
chain config decides which keys apply. kmsboot is a transport, not a
policy engine. The previous correctness checks were duplicating
work that lqd's config layer does better.
Tests:
- 6 cases (down from 12): pass-through-when-no-addr, round-trip,
path-substitution (3 pod-naming schemes), empty-bytes-pass-through
(positive: kmsboot does NOT fail on empty), fetch-error-propagates,
PodOrdinal (8 sub-cases).
API break vs v1.3.0: yes — Config / ConfigFromEnv / InjectWith
removed. Direct consumers update to plain Inject(). Tag this as
v1.4.0 (minor bump — kmsboot is < 1 month old and only luxfi/
node imports it).
Lux nodes activate all curves and crypto precompiles by default —
secp256k1, ed25519, sr25519, secp256r1, BLS, FROST, CGGMP21, ML-DSA,
SLH-DSA, ML-KEM, Corona, Pulsar. A validator binary can legitimately
hold both classical and post-quantum staking material at the same
time; which one a given chain consumes is decided by the chain's
genesis `SecurityProfile`, not by the staking-load layer.
kmsboot was wrong-layer enforcing a strict-PQ policy. Strip it:
- Drop `Config.StrictPQ`. There is only one mode now.
- Drop the classical-compat env coexistence refusal
(`STAKING_TLS_KEY` / `STAKING_TLS_CERT` / `STAKING_SIGNER_KEY`
can be set alongside KMS-fetched PQ material).
- Drop the argv-override refusal. Caller-supplied
`--staking-*-file-content` later in argv wins under standard
last-flag-wins viper/pflag semantics — kmsboot's prepend is
deliberate so the operator's override takes precedence.
- Drop the exported `ClassicalStakingEnvs` package var.
What stays — these are correctness, not policy:
- All three trigger envs must be set together (no guessing).
- `{env}` in path template is rejected (env is a separate KMS
dimension carried at the GetAt boundary, not a path substring).
- Path template must contain `{ord}` and end with `/`.
- Empty blob from KMS = hard fail (no silent partial registration).
Tests:
- Removed: `RefusesClassicalCompat`, `RefusesOverrideFlag`,
`StrictPQOff`.
- Added: `AllowsClassicalCoexistence` (positive: classical envs +
PQ kmsboot succeeds), `PrependsBeforeUserOverride` (positive:
operator-supplied flag survives at tail of argv).
- 12 cases now pass; same coverage of correctness invariants.
Closes the gap between kmsboot's behavior and Lux's design: the
package fetches and injects; chain-config decides which keys apply.
Hanzo AI