gitignore: cover the key files the node actually writes - #43
Open
ericscalibur wants to merge 1 commit into
Open
Conversation
.gitignore ignores *.dat and wallet.dat, but the node also writes three files in its data directory that are not .dat and are just as sensitive: btf_enc.key this node's .btf service key -- its network identity nostr.key the Nostr key its descriptors are signed with walletrpc.token bearer token authorising spends over the wallet API A node run with its data directory inside a working tree -- which is the obvious thing to do while developing -- leaves all three untracked but committable, and `git add -A` takes them. Losing btf_enc.key means losing your address; publishing walletrpc.token hands over the wallet to anyone who can reach the port. Also ignore key backup archives and stray .patch/.rej/.orig files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
ericscalibur
force-pushed
the
chore/gitignore-keys
branch
from
July 30, 2026 05:01
d99928f to
c3b7842
Compare
Vic-Nas
added a commit
to Vic-Nas/bitflash-mod
that referenced
this pull request
Jul 30, 2026
…RM64 build (port of Bitflash-sh#41); gitignore: cover key files (port of Bitflash-sh#43) ## Bootstrap seeds (Bitflash-sh#36) A node with an empty cache has only the Nostr relays for discovery -- if those are down, blocked, or just slow, a first run has no way into the network at all, which is exactly the moment a user has the least patience. Seeds are the floor under that: a compiled-in list of long-lived peers, tried automatically only when the peer cache is empty. A seed entry is deliberately just an address and an encryption key, no meeting node -- the rendezvous relay pairs on the service's public key, and a .btf address is that key, so a seed is findable by walking the known relays. Recording which relay a seed was on would rot the moment it failed over, which is the exact "advertising a rendezvous nobody is registered at" failure this project has chased before. Seeds carry no special authority: they hand out the same signed, self-certifying descriptors any peer does, so a hostile seed can stall a bootstrap but can't forge a peer or feed a false chain. The compiled list here is empty, deliberately -- upstream shipped their own dedicated bootstrap node's address in their version of this commit, but that's their infrastructure, not something this fork has any relationship to or authority to point users at. /btfseed= ADDRESS:ENCHEX (repeatable, CLI-only) covers testing and private networks without needing a compiled entry. Adapted the hex-decode call to our own BtfPeerCacheHexToBytes rather than a generic HexToBytes upstream doesn't have under that name. ## ARM64 build failure (Bitflash-sh#41) ByteReverse(word32) in sha.h used the x86 bswap instruction via inline asm, guarded only by #if defined(__GNUC__) -- true on every architecture GCC/Clang target, so on aarch64 the assembler rejected the instruction outright. The 64-bit ByteReverse right below it already had the correct guard (&& defined(__x86_64__)); the 32-bit one just never got it. Fails the build on Apple Silicon, ARM servers, or a Raspberry Pi -- all plausible headless-node hosts. ## .gitignore gaps (Bitflash-sh#43) *.dat/wallet.dat were covered, but btf_enc.key (this node's .btf identity) and nostr.key (its Nostr signing key) are not .dat files and are exactly as sensitive -- already listed explicitly in our .gitignore from an earlier session, but walletrpc.token (bearer authority to spend from the wallet over the wallet API) was missing entirely, along with a general *.key catch-all and patterns for key backup archives, mempool dumps, and stray .patch/.rej/.orig files. A node run with its data directory inside a working tree -- the obvious thing to do while developing -- would otherwise leave all of this untracked but committable.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.gitignore ignores *.dat and wallet.dat, but the node also writes three files in its data directory that are not .dat and are just as sensitive:
btf_enc.key this node's .btf service key -- its network identity
nostr.key the Nostr key its descriptors are signed with
walletrpc.token bearer token authorising spends over the wallet API
A node run with its data directory inside a working tree -- which is the obvious thing to do while developing -- leaves all three untracked but committable, and
git add -Atakes them. Losing btf_enc.key means losing your address; publishing walletrpc.token hands over the wallet to anyone who can reach the port.Also ignore key backup archives and stray .patch/.rej/.orig files.