davideandClaude Sonnet 5.5
55d852fe08
The lifespan decrypts the key and compares a fixed sample (reserve/round pool addresses, the 10 lowest and highest user addresses, unrevealed round secrets) with the database, and refuses to serve on any mismatch without printing key material. The key scripts refuse a new or imported key that would not reproduce the stored addresses, and write 0600. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
22 lines
914 B
Python
22 lines
914 B
Python
"""One-time ops bootstrap: generate and encrypt the server's master xprv.
|
|
|
|
Usage:
|
|
python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
# put that value in XPRV_ENCRYPTION_KEY (.env), then:
|
|
python scripts/generate_master_key.py
|
|
"""
|
|
|
|
from app.config import settings
|
|
from app.wallet.hd import generate_master_key
|
|
from app.wallet.verify import load_sample
|
|
|
|
if __name__ == "__main__":
|
|
if not settings.xprv_encryption_key:
|
|
raise SystemExit("XPRV_ENCRYPTION_KEY is not set")
|
|
sample = load_sample()
|
|
if sample.users or sample.rounds or sample.seeds:
|
|
# SEC-50: a new key cannot reproduce the addresses the database already holds.
|
|
raise SystemExit("the database already has users or rounds: a new key would not reproduce their addresses")
|
|
generate_master_key()
|
|
print(f"Master key written (encrypted) to {settings.master_key_path}")
|