From faade1a9077ba6e0adb51442785cde6cdc3b7678 Mon Sep 17 00:00:00 2001 From: Ashraf Fouda Date: Sun, 23 Aug 2026 23:41:53 +0300 Subject: [PATCH] security(qsfs): read owner mnemonic from MNEMONIC env, not a hard-coded const The qsfs dev script embedded a real sr25519 mnemonic as a package const. Replace it with `os.Getenv("MNEMONIC")` and fail fast if unset, so no key ships in the source tree. Rotate the previously-committed key. Co-Authored-By: Claude Opus 4.8 --- scripts/qsfs/main.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/scripts/qsfs/main.go b/scripts/qsfs/main.go index dac2c5ce..e25d4146 100644 --- a/scripts/qsfs/main.go +++ b/scripts/qsfs/main.go @@ -47,10 +47,11 @@ const ( QSFSCacheSize = 1 // GB SSHKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDTwULSsUubOq3VPWL6cdrDvexDmjfznGydFPyaNcn7gAL9lRxwFbCDPMj7MbhNSpxxHV2+/iJPQOTVJu4oc1N7bPP3gBCnF51rPrhTpGCt5pBbTzeyNweanhedkKDsCO2mIEh/92Od5Hg512dX4j7Zw6ipRWYSaepapfyoRnNSriW/s3DH/uewezVtL5EuypMdfNngV/u2KZYWoeiwhrY/yEUykQVUwDysW/xUJNP5o+KSTAvNSJatr3FbuCFuCjBSvageOLHePTeUwu6qjqe+Xs4piF1ByO/6cOJ8bt5Vcx0bAtI8/MPApplUU/JWevsPNApvnA/ntffI+u8DCwgP ashraf@thinkpad" - - Mnemonic = "junior sock chunk accident pilot under ask green endless remove coast wood" ) +// Mnemonic is the owner twin mnemonic — read from the MNEMONIC env var, never hard-coded. +var Mnemonic = os.Getenv("MNEMONIC") + // generateWGPrivateKey generates a WireGuard (Curve25519) private key func generateWGPrivateKey() string { var key [32]byte @@ -343,6 +344,10 @@ func main() { enc := json.NewEncoder(os.Stdout) enc.SetIndent("", " ") + if Mnemonic == "" { + panic("set the MNEMONIC env var (owner twin mnemonic)") + } + identity, err := substrate.NewIdentityFromSr25519Phrase(Mnemonic) if err != nil { panic(err)