changeKeystorePassphrase silently drops blspublickey from validator keystores
还没有人认领这个 Issue。
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 78/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- typescript
- 领域
- security
调研方向
从 packages/sdk/keystores/src/keystore-base.ts 中的 changeKeystorePassphrase 开始，检查新的 V3 对象是如何构建的。使用 packages/sdk/keystores/src/test-constants.ts 中的 GETH_GEN_KEYSTORE1 重现 passphrase 更改，然后添加一个回归测试，证明重新加密后 blspublickey 仍然存在。
由索引模型根据 Issue 内容生成。
描述
Summary
KeystoreBase.changeKeystorePassphrase destroys any non-standard top-level field in a V3 keystore. Celo validator keystores generated by geth carry a blspublickey field, so changing such a keystore's passphrase silently loses it.
Cause
packages/sdk/keystores/src/keystore-base.ts re-encrypts by decrypting the private key and building a fresh V3 object. That object only ever contains version, id, address and crypto, so everything else in the original file is dropped:
in : {address, blspublickey, crypto, id, version}
out: {address, crypto, id, version}
^^^^^^^^^^^^ silently lost
There is no error and no warning — the write succeeds and the field is simply gone.
Reproduce
GETH_GEN_KEYSTORE1 in packages/sdk/keystores/src/test-constants.ts is a real geth-generated fixture containing a blspublickey. Persist it, call changeKeystorePassphrase, then re-read the raw entry: the field is absent.
Not a regression
This predates the removal of ethereumjs-wallet (#792). That library's toV3 had exactly the same behaviour, so the migration neither introduced nor worsened it. It was left alone there deliberately to keep that PR strictly behaviour-neutral and easy to review.
Suggested fix
Preserve unknown top-level fields across re-encryption — spread the parsed original and overwrite only crypto (and id), rather than constructing the object from scratch. Add a regression test using the GETH_GEN_KEYSTORE1 fixture asserting blspublickey survives a passphrase change.
Worth deciding at the same time whether importPrivateKey should be able to write such fields, or whether preservation on re-encryption is the whole scope.
Impact
Limited. @celo/keystores has no consumers inside this monorepo — celocli never reads or writes keystore files — so this only affects external npm consumers of the package who manage geth-generated validator keystores.
- 主要语言
- TypeScript
- 星标
- 43
- 派生
- 36
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
celo-org/developer-tooling 的其他 Issue
-
难度 2/5 1-3 小时 新手友好度 76/100
celo-org/developer-tooling#786 ·
-
难度 3/5 1-2 天 新手友好度 55/100
celo-org/developer-tooling#800 · 1 条评论 ·
-
Bridge commands duplicate signer construction and miss new signer types可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 4/5 3-5 天 新手友好度 68/100
celo-org/developer-tooling#794 ·
-
bug celocli
难度 4/5 3-5 天 新手友好度 50/100
celo-org/developer-tooling#790 ·
-
--ledgerLiveMode iterates the BIP-44 change index instead of the hardened account index可能已有人在做 @Steve0x2a 于 49 天前认领。 未关闭bug celocli
难度 3/5 1-2 天 新手友好度 78/100
celo-org/developer-tooling#789 ·
查看 celo-org/developer-tooling 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 77/100
Clouditera/VulnHunter#57 ·
-
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
bug bug:behavior clawsweeper:bulk-filed clawsweeper:fix-shape-clear clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:auth-provider issue-rating: 🦞 diamond lobster P2
难度 2/5 1-3 小时 新手友好度 76/100
openclaw/openclaw#185297 · 1 条评论 · 1 个 reaction ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 62/100
-
bug needs-triage
难度 2/5 1-3 小时 新手友好度 76/100
apex-dev-tools/apex-log-parser#199 ·
维护者通常 1 天内回复