config: support all sui key formats for operator key#808
Merged
Conversation
|
Collaborator
Style Guide AuditAudited 1 file(s) against the Sui Documentation Style Guide. 3 violation(s) found. All must be fixed before merge.
|
dlukegordon
reviewed
Jul 14, 2026
dlukegordon
left a comment
dlukegordon
left a comment
Contributor
There was a problem hiding this comment.
We also need to update crates/hashi/src/backup.rs:329-357.
The key loader now accepts inline suiprivkey and Base64 values, but backup discovery still recognizes only inline PEM. It treats either new inline format as a path, rejects it as missing, and interpolates the complete value into the error at line 356. Automatic backups log that error at crates/hashi/src/backup.rs:109, exposing the private key.
Pick up sui-crypto suiprivkey (Bech32) decoding (MystenLabs/sui-rust-sdk#254) and the sui-sdk-types 0.3.1 parsing-hardening fixes. The bech32 feature is needed to accept operator keys in the format produced by sui keytool.
Operators fed hashi server keys straight from sui keytool and hit "unable to load Ed25519 private key from ." — the loader only accepted PKCS#8 PEM/DER, and its error both leaked whatever inline value was configured (potentially the private key itself) and named no accepted format. Key loading now lives in a new hashi::keys module built on sui_crypto::simple::SimpleKeypair, so all three simple Sui schemes (Ed25519, secp256k1, and secp256r1) are accepted in every format the tooling produces, as a file path or an inline config value: - PKCS#8 PEM and DER (openssl genpkey) - Bech32 suiprivkey strings (sui keytool generate/export) - legacy Base64 keystore entries (sui.keystore, sui keytool convert) Load errors now name the accepted formats and how to generate a key, call out an empty configured value explicitly, and never echo anything that could plausibly be key material. Loading was verified against real sui keytool 1.69.1 output for each scheme and encoding. The Base64 decoding and address derivation carry local TODOs pointing at the pending sui-crypto additions (SimpleKeypair::from_base64 and SimpleVerifiyingKey::derive_address); both shims disappear on the next dependency bump once those land upstream. Also resolve the long-standing "TODO support more than just Ed25519" on Config::operator_private_key.
Section 2.4 of the node operator runbook now lists every accepted operator-private-key format (PKCS#8 PEM/DER, Bech32 suiprivkey, and Base64 keystore), which tool produces each, and how to generate a key with either sui keytool or openssl. Also note that raw hex keys are not accepted since they carry no scheme flag, and update the config templates that claimed only PEM/DER files were supported.
MystenLabs/sui-rust-sdk#281 landed SimpleKeypair::from_base64 (and friends) plus SimpleVerifiyingKey::derive_address, so the two local shims in hashi::keys — the hand-rolled Base64 keystore decoder and the address derivation that matched on MultisigMemberPublicKey — are deleted in favor of the upstream API. Call sites now derive addresses via keypair.verifying_key().derive_address(). Also replace the e2e sui_network keypair_from_base64 helper, which was the same Base64 keystore decoding hand-rolled a second time, with Ed25519PrivateKey::from_base64.
Backup discovery still recognized only inline PEM: an inline suiprivkey or Base64 keystore operator key was treated as a file path, rejected as missing, and interpolated verbatim into the error — which the automatic backup task writes to the log, exposing the private key. Classification now lives in hashi::keys::referenced_key_file, next to the loader whose semantics it mirrors (PEM, suiprivkey, or Base64 keystore values are inline; existing files are returned as paths; anything else is an error). Its errors redact anything that could plausibly be key material, so a malformed inline key fails the backup without the value reaching the log. Add tests covering inline suiprivkey/Base64 backup runs and the no-echo guarantee.
dlukegordon
approved these changes
Jul 14, 2026
bmwill
enabled auto-merge (rebase)
July 14, 2026 14:44
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.