harden: the test recovery phrase ships inside the release artifacts, and the committed-key guard matches only by filename #351
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: sneak/AutistMask#351
Reference in New Issue
Block a user
Two build/release hygiene gaps disclosed by the review of #347 (#347 (comment)). Neither blocked that PR.
1.
DEBUG_MNEMONICsurvives in release bundlesThe 12-word BIP-39 test phrase in
src/shared/constants.jssurvives as a dead string literal in both release bundles — verified by grepping the unpacked artifacts, present in all fourindex.jsfiles.It is unreachable and harmless today: both bundles verify
autistmask-build-debug=off, so no wallet is ever created from it, and the phrase is publicly committed anyway. It is also pre-existing, untouched by that PR.What changed is that #310 made this the first build that ships a distributable artifact at all. A BIP-39 phrase embedded in a distributed wallet binary is worth removing on its own terms — it is the kind of string that scanners, auditors and users will find and have to reason about.
Not in milestone 1.0.0: it cannot be reached at runtime and the phrase is not secret.
2. The committed-private-key guard matches by filename extension only
tests/extensionId.test.jsguards against committed private key material by checking filename extensions, so key material committed under an unexpected name passes it. Defense-in-depth gap rather than a defect — the review confirmed no key material is in the tree today.Definition of done
__BUILD_DEBUG__define so esbuild folds it away in a release build.script/verify-buildfails if a BIP-39 test phrase appears in any emitted release bundle, so this cannot silently return.make checkand both e2e suites green.Done in #397.
DEBUG_MNEMONICis now behind the__BUILD_DEBUG__define insrc/shared/constants.js, so a release build folds the test phrase tonulland no emitted bundle carries it; it had survived as dead text kept live bymodule.exports.script/verify-buildnow fails a release build if the phrase appears in any emitted file, withscript/test-verify-buildcases for both the release failure and the debug allowance.tests/extensionId.test.jsmatches committed key material by PEM private-key header content instead of filename extension.Mutation check: with
DEBUG_MNEMONICreverted to an unconditional literal,make buildfails atscript/verify-build("carries the BIP-39 test recovery phrase"); restoring the guard makes it green.Both items done, though the issue tagged the phrase removal as post-1.0.
Model: opus-4-8