mirror of
https://github.com/block/buzz.git
synced 2026-10-27 12:40:30 +00:00
ee6ca5fa28
Require `BUZZ_RELAY_PRIVATE_KEY` on every relay startup and remove the shared public fallback key completely. For local development, `just bootstrap` now generates a random key once in the gitignored `.env` file. Re-running bootstrap preserves that key, so relay-authored events retain the same identity across restarts. The local relay recipes reload `.env`, while isolated CI and E2E launchers pass explicit per-run keys. Startup fails immediately when the key is missing or invalid, before connecting to Postgres or Redis. Deployed relays continue to receive their stable key from the existing chart-managed secret. Validated with: - `./scripts/test-ensure-local-relay-key.sh` - `cargo test -p buzz-relay --bin buzz-relay` - `cargo clippy -p buzz-relay --bin buzz-relay -- -D warnings` - `cargo fmt --all -- --check` - `shellcheck scripts/ensure-local-relay-key.sh scripts/test-ensure-local-relay-key.sh` Signed-off-by: Jordan Mecom <jm@squareup.com>
34 lines
1.0 KiB
Bash
Executable File
34 lines
1.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "${SCRIPT_DIR}/.." && pwd)"
|
|
TEST_DIR="$(mktemp -d "${TMPDIR:-/tmp}/buzz-relay-key-test.XXXXXX")"
|
|
trap 'rm -rf "${TEST_DIR}"' EXIT
|
|
|
|
ENV_FILE="${TEST_DIR}/.env"
|
|
cp "${REPO_ROOT}/.env.example" "${ENV_FILE}"
|
|
|
|
"${SCRIPT_DIR}/ensure-local-relay-key.sh" "${ENV_FILE}" >/dev/null
|
|
first_key="$(sed -n 's/^BUZZ_RELAY_PRIVATE_KEY=//p' "${ENV_FILE}")"
|
|
|
|
if [[ ! "${first_key}" =~ ^[0-9a-f]{64}$ ]]; then
|
|
echo "FAIL: bootstrap did not generate a valid 32-byte hex relay key" >&2
|
|
exit 1
|
|
fi
|
|
|
|
"${SCRIPT_DIR}/ensure-local-relay-key.sh" "${ENV_FILE}" >/dev/null
|
|
second_key="$(sed -n 's/^BUZZ_RELAY_PRIVATE_KEY=//p' "${ENV_FILE}")"
|
|
|
|
if [[ "${first_key}" != "${second_key}" ]]; then
|
|
echo "FAIL: bootstrap replaced the existing relay key" >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ "$(grep -c '^BUZZ_RELAY_PRIVATE_KEY=' "${ENV_FILE}")" -ne 1 ]]; then
|
|
echo "FAIL: bootstrap wrote more than one relay key" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "PASS: bootstrap generates one relay key and reuses it"
|