fix(dappnode): retry incomplete wallet provisioning

Author: hmzakhalid

dappnode/entrypoint.sh

@@ -13,6 +13,7 @@ CURRENT_STATE_DIR="${CURRENT_STATE_DIR:-$CONFIG_DIR/.interfold}"
 # Current Interfold releases resolve a relative `key_file: key` beside a discovered
 # /data/config.yaml to this path for the default node profile.
 PASSWORD_FILE="${PASSWORD_FILE:-$CURRENT_STATE_DIR/config/_default/key}"
+CREDENTIALS_READY_FILE="${CREDENTIALS_READY_FILE:-$(dirname "$PASSWORD_FILE")/credentials.provisioned}"
 
 log() { printf '[%s] %s\n' "$(date '+%H:%M:%S')" "$1"; }
 fail() {
@@ -130,6 +131,43 @@ validate_persisted_password_file() {
     [ -r "$PASSWORD_FILE" ] || fail "persisted password file is not readable: $PASSWORD_FILE"
 }
 
+validate_credentials_ready_file() {
+    [ -f "$CREDENTIALS_READY_FILE" ] || fail "credential readiness marker is not a regular file: $CREDENTIALS_READY_FILE"
+    [ ! -L "$CREDENTIALS_READY_FILE" ] || fail "credential readiness marker must not be a symbolic link: $CREDENTIALS_READY_FILE"
+    chmod 400 "$CREDENTIALS_READY_FILE" || fail "could not restrict credential readiness marker permissions"
+}
+
+mark_credentials_ready() {
+    mkdir -p "$(dirname "$CREDENTIALS_READY_FILE")"
+    : > "$CREDENTIALS_READY_FILE"
+    chmod 400 "$CREDENTIALS_READY_FILE"
+}
+
+wallet_identity_available() {
+    interfold wallet get --config "$CONFIG_FILE" >/dev/null 2>&1
+}
+
+credentials_are_ready() {
+    if [ -e "$CREDENTIALS_READY_FILE" ]; then
+        validate_credentials_ready_file
+        return 0
+    fi
+
+    if wallet_identity_available; then
+        mark_credentials_ready
+        return 0
+    fi
+
+    return 1
+}
+
+provision_wallet() {
+    jq -jr '.private_key, "\n"' "$SECRETS_FILE" \
+        | interfold wallet set --private-key-stdin --config "$CONFIG_FILE" \
+        || fail "wallet command failed"
+    mark_credentials_ready
+}
+
 configure_credentials() {
     validate_secret_file
 
@@ -138,6 +176,10 @@ configure_credentials() {
         jq -er '.password' "$SECRETS_FILE" | tr -d '\n' | cmp -s - "$PASSWORD_FILE" \
             || fail "uploaded password does not match the persisted credential key"
         log "Using the matching persisted encryption password."
+        if ! credentials_are_ready; then
+            log "Encrypted wallet identity is incomplete; retrying wallet provisioning."
+            provision_wallet
+        fi
         rm -f "$SECRETS_FILE"
         log "Existing encrypted wallet/network identity was preserved."
         return
@@ -147,9 +189,7 @@ configure_credentials() {
     jq -jr '.password, "\n"' "$SECRETS_FILE" \
         | interfold password set --password-stdin --config "$CONFIG_FILE" \
         || fail "password command failed"
-    jq -jr '.private_key, "\n"' "$SECRETS_FILE" \
-        | interfold wallet set --private-key-stdin --config "$CONFIG_FILE" \
-        || fail "wallet command failed"
+    provision_wallet
 
     # DAppNode copies fileUpload content into this container before startup.
     # Wallet command derives both Ethereum and libp2p identities. Remove the
@@ -163,8 +203,10 @@ if [ -e "$SECRETS_FILE" ]; then
 elif [ -s "$PASSWORD_FILE" ]; then
     # Backward-compatible restart/upgrade path: DAppNode file uploads are copied
     # when configuring a container, while encrypted credentials persist in
-    # /data. Interfold itself will fail startup if wallet/network state is absent.
+    # /data. If an older complete install predates the readiness marker, stamp it
+    # after the wallet decrypts successfully.
     validate_persisted_password_file
+    credentials_are_ready || fail "credential upload is required to complete wallet provisioning: $SECRETS_FILE"
     log "No credential upload present; using persisted credential state."
 else
     fail "credentials file is required for first startup: $SECRETS_FILE"

dappnode/tests/test-hardening.sh

@@ -34,6 +34,7 @@ make_mock_interfold() {
         'case "${1:-} ${2:-} ${3:-}" in' \
         '  "password set --password-stdin"*) operation=password ;;' \
         '  "wallet set --private-key-stdin"*) operation=wallet ;;' \
+        '  "wallet get --config"*) operation=wallet-get ;;' \
         '  "start "*) operation=start ;;' \
         '  *) operation=unexpected ;;' \
         'esac' \
@@ -51,6 +52,13 @@ make_mock_interfold() {
         '    ;;' \
         '  wallet)' \
         '    IFS= read -r secret' \
+        '    printf "%s" "$secret" > "$WALLET_FILE"' \
+        '    chmod 400 "$WALLET_FILE"' \
+        '    ;;' \
+        '  wallet-get)' \
+        '    [ "${WALLET_GET_FAIL:-}" != "1" ] || exit 43' \
+        '    [ -s "$WALLET_FILE" ] || exit 44' \
+        '    printf "0x3333333333333333333333333333333333333333\n"' \
         '    ;;' \
         '  start)' \
         '    : ;;' \
@@ -93,6 +101,8 @@ run_entrypoint() {
         TEMPLATE_FILE="$ROOT_DIR/config.template.yaml" \
         SECRETS_FILE="$case_dir/secrets/secrets.json" \
         PASSWORD_FILE="$case_dir/data/password" \
+        CREDENTIALS_READY_FILE="$case_dir/data/credentials.provisioned" \
+        WALLET_FILE="$case_dir/data/wallet" \
         CALL_LOG="$case_dir/calls" \
         ARGV_LOG="$case_dir/argv" \
         RPC_URL="ws://127.0.0.1:8545" \
@@ -141,6 +151,12 @@ fi
 assert_contains "$failure_dir/calls" 'wallet'
 assert_not_contains "$failure_dir/calls" 'start'
 [ -e "$failure_dir/secrets/secrets.json" ] || fail "failed setup removed recovery input"
+[ ! -e "$failure_dir/data/credentials.provisioned" ] || fail "failed setup created readiness marker"
+run_entrypoint "$failure_dir"
+[ "$(tr '\n' ' ' < "$failure_dir/calls")" = "wallet-get wallet start " ] \
+    || fail "wallet retry did not resume incomplete provisioning"
+[ ! -e "$failure_dir/secrets/secrets.json" ] || fail "retried setup did not remove plaintext credentials"
+[ -e "$failure_dir/data/credentials.provisioned" ] || fail "retried setup did not create readiness marker"
 
 # Existing state may only be reused with the password that encrypted it.
 mismatch_dir="$TEST_ROOT/password-mismatch"
@@ -156,6 +172,7 @@ fi
 matching_dir="$TEST_ROOT/password-match"
 mkdir -p "$matching_dir/data" "$matching_dir/secrets"
 printf '%s' 'correct horse battery staple' > "$matching_dir/data/password"
+printf '%s' 'ready' > "$matching_dir/data/credentials.provisioned"
 write_secrets "$matching_dir/secrets/secrets.json"
 run_entrypoint "$matching_dir"
 [ "$(tr '\n' ' ' < "$matching_dir/calls")" = "start " ] || fail "matching persisted state was re-provisioned"
@@ -191,21 +208,41 @@ restart_dir="$TEST_ROOT/restart"
 mkdir -p "$restart_dir/data"
 printf '%s' 'persisted-password' > "$restart_dir/data/password"
 chmod 400 "$restart_dir/data/password"
+printf '%s' 'ready' > "$restart_dir/data/credentials.provisioned"
 run_entrypoint "$restart_dir"
 [ "$(tr '\n' ' ' < "$restart_dir/calls")" = "start " ] || fail "persisted restart unexpectedly re-provisioned credentials"
 
+old_restart_dir="$TEST_ROOT/old-restart"
+mkdir -p "$old_restart_dir/data"
+printf '%s' 'persisted-password' > "$old_restart_dir/data/password"
+printf '%s' 'wallet' > "$old_restart_dir/data/wallet"
+run_entrypoint "$old_restart_dir"
+[ "$(tr '\n' ' ' < "$old_restart_dir/calls")" = "wallet-get start " ] \
+    || fail "old complete state was not marked and started"
+[ -e "$old_restart_dir/data/credentials.provisioned" ] || fail "old complete state was not marked ready"
+
+incomplete_restart_dir="$TEST_ROOT/incomplete-restart"
+mkdir -p "$incomplete_restart_dir/data"
+printf '%s' 'persisted-password' > "$incomplete_restart_dir/data/password"
+if run_entrypoint "$incomplete_restart_dir"; then
+    fail "password-only state without upload was accepted"
+fi
+assert_contains "$incomplete_restart_dir/calls" 'wallet-get'
+assert_not_contains "$incomplete_restart_dir/calls" 'start'
+
 # The 0.1.8 state bridge moves the complete custom-config namespace in one
 # rename, preserving the unversioned DB/event log for current releases.
 upgrade_dir="$TEST_ROOT/legacy-upgrade"
 mkdir -p "$upgrade_dir/data/.enclave/config/_default" "$upgrade_dir/data/.enclave/data/_default/db" \
     "$upgrade_dir/data/.enclave/data/_default/log.0"
 printf '%s' 'persisted-password' > "$upgrade_dir/data/.enclave/config/_default/key"
 printf '%s' 'legacy-state' > "$upgrade_dir/data/.enclave/data/_default/db/sentinel"
+printf '%s' 'wallet' > "$upgrade_dir/data/wallet"
 run_entrypoint "$upgrade_dir" \
     PASSWORD_FILE="$upgrade_dir/data/.interfold/config/_default/key"
 [ ! -e "$upgrade_dir/data/.enclave" ] || fail "legacy state namespace remained after upgrade"
 assert_contains "$upgrade_dir/data/.interfold/data/_default/db/sentinel" 'legacy-state'
-[ "$(tr '\n' ' ' < "$upgrade_dir/calls")" = "start " ] || fail "legacy state upgrade did not start"
+[ "$(tr '\n' ' ' < "$upgrade_dir/calls")" = "wallet-get start " ] || fail "legacy state upgrade did not start"
 
 ambiguous_dir="$TEST_ROOT/ambiguous-upgrade"
 mkdir -p "$ambiguous_dir/data/.enclave" "$ambiguous_dir/data/.interfold"