jochen
a33d334008
mesh/merge-gate fail: builds rofi → g14, shanks; no bus step; a manifest the change touches fails the module check: rofi claims node-launcher and says it s…
mesh/repo-check fail: its merge-check.sh failed: files asking for a setting without saying whether it is trusted: 21
mesh/delivery-group group feat/a-secret-given-at-the-desk rejected: a member's own check failed
mesh/delivery superseded: a newer head of the same pull request
100 lines
3.2 KiB
Go
100 lines
3.2 KiB
Go
package main
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
"time"
|
|
|
|
"golang.org/x/crypto/nacl/box"
|
|
)
|
|
|
|
// node-launcher's verb `secret` (novox/hq ADR 0259 §10): a prompt that does not show what is typed, whose
|
|
// answer is sealed to the key the asker gives before it leaves this process — never in the clear on the
|
|
// bus, in the runtime's log or in any call's record. The controller asks it to take a module's own secret,
|
|
// such as a bot token, from the operator at their desk.
|
|
//
|
|
// **What it does not do**: on an X11 desk any program of the operator's account can read the keys as they
|
|
// are typed, and a program that asks this verb with a key of its own is answered with what the operator
|
|
// typed into a prompt they did not ask for. The prompt says who asks and for what, so the operator types
|
|
// only into one they started (ADR 0234's accepted residual risk).
|
|
|
|
// SecretQuestion is what node-launcher.secret asks.
|
|
type SecretQuestion struct {
|
|
Prompt string
|
|
Message string
|
|
SealTo [32]byte
|
|
Timeout time.Duration
|
|
}
|
|
|
|
// SecretAnswer is what node-launcher.secret answers: the value sealed, or why there is none. Never the value.
|
|
type SecretAnswer struct {
|
|
Sealed string `json:"sealed,omitempty"`
|
|
Cancelled bool `json:"cancelled"`
|
|
TimedOut bool `json:"timed_out,omitempty"`
|
|
}
|
|
|
|
func secretQuestion(args map[string]any) (SecretQuestion, error) {
|
|
var q SecretQuestion
|
|
var err error
|
|
if q.Prompt, err = text(args, "prompt", true); err != nil {
|
|
return q, err
|
|
}
|
|
if q.Message, err = text(args, "message", false); err != nil {
|
|
return q, err
|
|
}
|
|
key, err := text(args, "seal_to", true)
|
|
if err != nil {
|
|
return q, err
|
|
}
|
|
raw, err := base64.StdEncoding.DecodeString(strings.TrimSpace(key))
|
|
if err != nil || len(raw) != 32 {
|
|
return q, errors.New("seal_to is not a sealing key: 32 bytes, base64")
|
|
}
|
|
copy(q.SealTo[:], raw)
|
|
q.Timeout, err = seconds(args, "timeout_seconds", menuMost, menuMost)
|
|
return q, err
|
|
}
|
|
|
|
// Secret asks the operator in a prompt that shows nothing of what is typed, and seals the answer.
|
|
func Secret(q SecretQuestion) (SecretAnswer, error) {
|
|
s, err := findSession()
|
|
if err != nil {
|
|
return SecretAnswer{}, err
|
|
}
|
|
args := []string{"-dmenu", "-password", "-p", q.Prompt, "-theme-str", "listview { enabled: false; }"}
|
|
if q.Message != "" {
|
|
args = append(args, "-mesg", q.Message)
|
|
}
|
|
r, err := s.run(q.Timeout, "", "rofi", args...)
|
|
if errors.Is(err, ErrTimedOut) {
|
|
return SecretAnswer{Cancelled: true, TimedOut: true}, nil
|
|
}
|
|
if err != nil {
|
|
return SecretAnswer{}, err
|
|
}
|
|
switch r.Code {
|
|
case 0:
|
|
case 1:
|
|
return SecretAnswer{Cancelled: true}, nil
|
|
default:
|
|
// rofi's own words, never what was typed: that is on standard output, which is not said.
|
|
return SecretAnswer{}, fmt.Errorf("rofi exited %d: %s", r.Code, strings.TrimSpace(r.Stderr))
|
|
}
|
|
value := []byte(strings.TrimRight(r.Stdout, "\r\n"))
|
|
r.Stdout = ""
|
|
if len(value) == 0 {
|
|
return SecretAnswer{Cancelled: true}, nil
|
|
}
|
|
sealed, err := box.SealAnonymous(nil, value, &q.SealTo, rand.Reader)
|
|
for i := range value {
|
|
value[i] = 0
|
|
}
|
|
if err != nil {
|
|
return SecretAnswer{}, errors.New("what was typed could not be sealed; nothing is answered")
|
|
}
|
|
return SecretAnswer{Sealed: base64.StdEncoding.EncodeToString(sealed)}, nil
|
|
}
|