harden: the test recovery phrase ships inside the release artifacts, and the committed-key guard matches only by filename #351
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Two build/release hygiene gaps disclosed by the review of #347 (#347 (comment)). Neither blocked that PR.
1.
DEBUG_MNEMONICsurvives in release bundlesThe 12-word BIP-39 test phrase in
src/shared/constants.jssurvives as a dead string literal in both release bundles — verified by grepping the unpacked artifacts, present in all fourindex.jsfiles.It is unreachable and harmless today: both bundles verify
autistmask-build-debug=off, so no wallet is ever created from it, and the phrase is publicly committed anyway. It is also pre-existing, untouched by that PR.What changed is that #310 made this the first build that ships a distributable artifact at all. A BIP-39 phrase embedded in a distributed wallet binary is worth removing on its own terms — it is the kind of string that scanners, auditors and users will find and have to reason about.
Not in milestone 1.0.0: it cannot be reached at runtime and the phrase is not secret.
2. The committed-private-key guard matches by filename extension only
tests/extensionId.test.jsguards against committed private key material by checking filename extensions, so key material committed under an unexpected name passes it. Defense-in-depth gap rather than a defect — the review confirmed no key material is in the tree today.Definition of done
__BUILD_DEBUG__define so esbuild folds it away in a release build.script/verify-buildfails if a BIP-39 test phrase appears in any emitted release bundle, so this cannot silently return.make checkand both e2e suites green.