mirror of
https://github.com/block/buzz.git
synced 2026-10-27 12:40:30 +00:00
ee6ca5fa28
Require `BUZZ_RELAY_PRIVATE_KEY` on every relay startup and remove the shared public fallback key completely. For local development, `just bootstrap` now generates a random key once in the gitignored `.env` file. Re-running bootstrap preserves that key, so relay-authored events retain the same identity across restarts. The local relay recipes reload `.env`, while isolated CI and E2E launchers pass explicit per-run keys. Startup fails immediately when the key is missing or invalid, before connecting to Postgres or Redis. Deployed relays continue to receive their stable key from the existing chart-managed secret. Validated with: - `./scripts/test-ensure-local-relay-key.sh` - `cargo test -p buzz-relay --bin buzz-relay` - `cargo clippy -p buzz-relay --bin buzz-relay -- -D warnings` - `cargo fmt --all -- --check` - `shellcheck scripts/ensure-local-relay-key.sh scripts/test-ensure-local-relay-key.sh` Signed-off-by: Jordan Mecom <jm@squareup.com>
67 lines
1.3 KiB
Bash
Executable File
67 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ENV_FILE="${1:-.env}"
|
|
|
|
if [[ ! -f "${ENV_FILE}" ]]; then
|
|
echo "error: ${ENV_FILE} does not exist" >&2
|
|
exit 1
|
|
fi
|
|
|
|
existing_key="$({
|
|
unset BUZZ_RELAY_PRIVATE_KEY
|
|
set +u
|
|
# shellcheck disable=SC1090
|
|
source "${ENV_FILE}" || exit 1
|
|
printf '%s' "${BUZZ_RELAY_PRIVATE_KEY:-}"
|
|
})"
|
|
|
|
if [[ -n "${existing_key}" ]]; then
|
|
chmod 600 "${ENV_FILE}"
|
|
exit 0
|
|
fi
|
|
|
|
relay_key="$(node <<'NODE'
|
|
const { randomBytes } = require("node:crypto");
|
|
const curveOrder = BigInt(
|
|
"0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141",
|
|
);
|
|
|
|
let bytes;
|
|
let scalar;
|
|
do {
|
|
bytes = randomBytes(32);
|
|
scalar = BigInt(`0x${bytes.toString("hex")}`);
|
|
} while (scalar === 0n || scalar >= curveOrder);
|
|
|
|
process.stdout.write(bytes.toString("hex"));
|
|
NODE
|
|
)"
|
|
|
|
temp_file="$(mktemp "${ENV_FILE}.tmp.XXXXXX")"
|
|
trap 'rm -f "${temp_file}"' EXIT
|
|
|
|
awk -v key="${relay_key}" '
|
|
BEGIN { replaced = 0 }
|
|
/^[[:space:]]*(export[[:space:]]+)?BUZZ_RELAY_PRIVATE_KEY=/ {
|
|
if (!replaced) {
|
|
print "BUZZ_RELAY_PRIVATE_KEY=" key
|
|
replaced = 1
|
|
}
|
|
next
|
|
}
|
|
{ print }
|
|
END {
|
|
if (!replaced) {
|
|
if (NR > 0) print ""
|
|
print "BUZZ_RELAY_PRIVATE_KEY=" key
|
|
}
|
|
}
|
|
' "${ENV_FILE}" > "${temp_file}"
|
|
|
|
chmod 600 "${temp_file}"
|
|
mv "${temp_file}" "${ENV_FILE}"
|
|
trap - EXIT
|
|
|
|
echo "Generated BUZZ_RELAY_PRIVATE_KEY in ${ENV_FILE}."
|