Repository navigation
feat(cli): add keys show --json - #466
Merged
Merged
Conversation
`keys show` prints the keystore's two public keys as labelled lines,
which a script can only scrape. With --json it prints one line instead,
{"node_public_key":"<hex>","consensus_public_key":"<hex>"}, each key in
the same bare lowercase hex the plain output uses. Without the flag the
output is unchanged.
Seismic's TEE image will read a node's public keys this way, so the
field names are an interface, and a test pins them.
Also correct `keys generate`'s help, which said it fails when keys
already exist: it asks before overwriting, and --no-overwrite leaves
existing keys untouched and exits successfully.
samlaf
added a commit
to SeismicSystems/seismic-images
that referenced
this pull request
Oct 6, 2026
…lder retires Fixes SEI-781. summit-key-holder, the enclave daemon that generated summit's keys at boot, served them with a quote on :7879 and wrote the keystore once LUKS opened, is gone. Two things replace it. The attestation service starts at boot and serves the founding harvest on :7879 itself (SeismicSystems/enclave#285), so it is the only process that opens the TPM. The summit user leaves the tpm group: any process that can quote arbitrary report_data can have a peer wrap root_key to a key of its own. summit.target groups three units: - summit-keygen, a oneshot at boot: `summit keys generate --no-overwrite` into /run/seismic/summit/keys, and the public halves from `summit keys show --json` into public-keys.json for the harvest. - summit-persist, a oneshot after persistent-luks-setup: copies the tmpfs keys into /persistent/summit/keys on first boot, or confirms the keystore on a reboot, then republishes the public keys from it. - summit, which now only reads its keystore. attestation.service no longer waits for tdx-init or the custodian. It reads its peers once tdx-init's done marker appears and retries the custodian socket, so it only pulls them in with Wants=. An explicit restart of the custodian therefore no longer restarts it; SEI-777 is where a custodian restart's behaviour gets decided. The enclave pin moves to 0ac3a6a. The summit pin moves to 299d8d7 for `keys show --json` (SeismicSystems/summit#466). Design: https://github.com/SeismicSystems/seismic/blob/main/docs/tee/architecture.md#one-process-opens-the-tpm
samlaf
added a commit
to SeismicSystems/seismic-images
that referenced
this pull request
Oct 7, 2026
… CLI Part of SEI-643 - enclave 0ac3a6a -> 56d2a91 (SeismicSystems/enclave#287): the custodian the previous commit's units expect. It mints at startup, reads founding_tx_io_pk from /run/seismic/conf/network-manifest.json, and takes no --genesis-node flag. - summit 299d8d7 -> 532ad6f, the squash merge of SeismicSystems/summit#466 (`keys show --json`), with the same tree as the PR commit it replaces. seismic_reth stays: the custodian-ipc wire types are unchanged since 0ac3a6a.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
keys showprints the keystore's two public keys as labelled lines, which a script can only scrape. With --json it prints one line instead, {"node_public_key":"","consensus_public_key":""}, each key in the same bare lowercase hex the plain output uses. Without the flag the output is unchanged.Seismic's TEE image will read a node's public keys this way, so the field names are an interface, and a test pins them.
Also corrected
keys generate's help, which said it fails when keys already exist: it asks before overwriting, and --no-overwrite leaves existing keys untouched and exits successfully.