aurora
Aurora

{"kind":1618,"id":"0b42b7d99cd8cb16e476c830d90e1f28acd978932db4eec4b753af12d027f684","pubkey":"43185edecb675892824b1a37a57f3e407fbde2eda7201a3829b8cf4ba7c5b4f0","created_at":1787438486,"tags":[["a","30617:460c25e682fda7832b52d1f22d3d22b3176d972f60dcdc3212ed8c92ef85065c:amethyst","wss://https://relay.ngit.dev"],["p","460c25e682fda7832b52d1f22d3d22b3176d972f60dcdc3212ed8c92ef85065c"],["r","6c3ff33351e7c7a1ae4fa2ac3651df4310ca9ed1"],["c","6c3ff33351e7c7a1ae4fa2ac3651df4310ca9ed1"],["clone","https://relay.ngit.dev/@npub1gvv…xchs/amethyst.git"],["merge-base","10149d7150bc4ee93d3da5e3708802a99e9e1ff9"],["branch-name","fix/desktop-keychain-vault-v2"],["subject","fix(desktop): consolidate keychain items so cold-boot prompts once"],["alt","git Pull Request: fix(desktop): consolidate keychain items so cold-boot prompts once"]],"content":"Rebased re-submission of the vault-consolidation PR from 2026-07-29\n(event `67ab268e…`, branch `fix/desktop-keychain-single-item-batch`),\nwhich never merged. The double-prompt it fixes is still present in\nv1.14.0: on a cold boot macOS still surfaces one Keychain Access\nprompt per item unless the user clicked \"Always Allow\" on every\nsingle one.\n\n## Problem\n\n`ae3218249a` cached the `Keyring` handle, which stopped the\n`Keyring.create()` re-open storm. But macOS Keychain gates access\n**per item**, not per session. Amethyst's cold-boot path touches at\nminimum two distinct items:\n\n- `account-metadata-key` (DesktopAccountStorage's AES-256-GCM master key)\n- the active account's nsec, or one/two bunker-ephemeral aliases\n (`bunker-ephemeral-<npub>`, legacy shared bunker alias)\n\nEach item carries its own ACL. A user who clicks \"Allow\" (the default,\nsafer-looking button) instead of \"Always Allow\" gets re-prompted for\nevery subsequent item — the \"asks for my password twice at startup\"\nbug. Caching the session handle cannot help; the ACL check is per\nitem.\n\n## Fix\n\nTwo-layered, both wired into `AccountManager.loadSavedAccount()`:\n\n1. **Consolidated vault (durable fix).**\n `SecureKeyStorage.enableConsolidatedVault(candidateAliases)` packs\n every Amethyst-managed alias into a single keychain item,\n `amethyst-desktop/vault-v1`. macOS then sees exactly ONE item to\n gate regardless of how many accounts or bunker sessions exist —\n one prompt on cold boot, and one \"Always Allow\" click covers\n everything forever.\n\n Migration: on cold boot, if `vault-v1` exists, load it (zero\n legacy reads). If absent and any legacy alias exists, batch-read\n the legacies (the pre-migration prompts fire one last time), pack\n into the vault, delete the originals. Idempotent; safe to call\n every startup. Post-migration writes go into the vault, not into\n new per-alias items.\n\n Vault contents are hand-rolled JSON-with-base64-values (no Jackson\n dependency in `commons/keystorage`). The decoder is deliberately\n strict: any malformed input returns `emptyMap()` and falls back to\n legacy per-alias reads — better to prompt than to risk key\n corruption.\n\n2. **Warm cache (fallback for unmigrated users).**\n `SecureKeyStorage.warmCacheFromKeyring(aliases)` batch-reads all\n candidate aliases back-to-back holding one `Keyring` handle and\n caches the results in memory, so downstream `getPrivateKey` calls\n never touch the keychain again this process. Even on the old\n per-item ACL, macOS's within-session heuristic collapses adjacent\n prompts when the user picks \"Always Allow\" for one.\n\nCandidate aliases are computed from the persisted account list:\nmetadata key + every npub + every bunker-ephemeral alias + the legacy\nshared bunker alias.\n\n## Test coverage\n\n`SecureKeyStorageVaultTest` (326 lines, hermetic — stub `KeyringHandle`\ninjected via the package-private `keyringFactory`):\n\n- vault round-trip encode/decode, including quotes/backslashes/\n newlines/non-ASCII in secrets\n- migration packs multiple legacy aliases into one item and deletes\n the originals\n- post-migration `savePrivateKey` writes through the vault, not new\n per-alias items\n- malformed vault payloads fall back to legacy reads instead of\n corrupting state\n- warm-cache short-circuits subsequent keychain touches\n- delete-from-vault rewrites the item, and deletes the vault item\n itself when the last alias is removed\n\n## Verification\n\n`:commons:compileKotlinJvm :commons:jvmTest :desktopApp:compileKotlin\n:desktopApp:test :commons:spotlessCheck :desktopApp:spotlessCheck`\nall green on this branch (rebased onto current main, `10149d7150`).","sig":"f47ea0140fce261b663c9c92aecca7e45f2928f2688b7ce672d5bc9cb7422484712d2700dc09cd3a01966da168408f4f06de858bfa73fdf9bf5e584490220077"}

2026-08-22 00:18:44 CEST

https://npub1r0rs5q2gk0e3dk3nlc7gnu378ec6cnlenqp8a3cjhyzu6f8k5sgs4sq9ac.blossom.band/de3abaad261f53aafbc527830510d50e4fa079987cad300107ba5464f8a851bf.mp4

2026-08-21 04:10:01 CEST

- reply

Halo Simulator reply visibility check 1787278188

2026-08-21 04:06:53 CEST

- reply

Halo Simulator reply visibility check 1787278000

2026-08-20 21:17:03 CEST

hello

2026-08-20 20:34:15 CEST

hello

2026-08-18 17:55:08 CEST

Note: the Nix flake, package, and NixOS module in this PR are untested beyond `nix build .#default` and `nix eval .#packages.x86_64-linux.vm.drvPath`. The runNixOSTest was dropped (it boots two QEMU VMs and hung the terminal); `nix build .#vm` + `curl 127.0.0.1:3000/healthz` is the manual test path. The module's dataDir/user/StateDirectory fix is also untested on a real NixOS host.

2026-08-18 00:11:50 CEST

Hello Nostr! :)

2026-08-17 20:44:44 CEST

hello

2026-08-17 20:38:09 CEST

hello

2026-08-17 19:18:49 CEST

hello

2026-08-17 19:13:40 CEST

hello

2026-08-17 19:05:27 CEST

hello

2026-08-16 17:42:24 CEST

hello

2026-08-15 03:36:54 CEST

mapa vivo que une la oferta de donantes (comida, herramientas, servicios, etc) con la demanda en los puntos de toda la ciudad (necesidades)
www.conectacolombia.org
#SOSColombia #cali #terremoto

2026-08-12 01:47:52 CEST

hello

2026-08-07 17:12:22 CEST

escape

2026-08-03 18:45:18 CEST

Do you think Pluto should be a planet?

2026-08-03 09:20:36 CEST

hello from nostr-package example at 2026-08-03T07:20:36.379Z

2026-08-03 09:19:56 CEST

hello from nostr-package example at 2026-08-03T07:19:56.812Z

2026-08-03 09:18:39 CEST

hello from nostr-package example at 2026-08-03T07:18:39.459Z

2026-08-03 09:17:06 CEST

hello from nostr-package example at 2026-08-03T07:17:06.589Z

2026-08-03 09:17:00 CEST

hello from nostr-package example at 2026-08-03T07:17:00.394Z

2026-08-03 09:15:57 CEST

hello from nostr-package example at 2026-08-03T07:15:57.383Z

2026-08-03 09:13:56 CEST

hello from nostr-package example at 2026-08-03T07:13:56.009Z

2026-08-03 09:13:09 CEST

hello from nostr-package example at 2026-08-03T07:13:09.075Z

2026-08-03 09:12:28 CEST

hello from nostr-package example at 2026-08-03T07:12:28.963Z

2026-08-03 06:00:32 CEST

hello from the nostr army knife

2026-08-03 03:00:44 CEST

hello from the nostr army knife

2026-08-03 02:05:35 CEST

hello from the nostr army knife

2026-08-03 00:00:36 CEST

hello from the nostr army knife

2026-08-02 22:00:13 CEST

hello from the nostr army knife

2026-08-02 19:00:48 CEST

hello from the nostr army knife

2026-08-02 16:00:37 CEST

hello from the nostr army knife

2026-08-02 15:00:30 CEST

hello from the nostr army knife

2026-08-02 14:01:09 CEST

hello from the nostr army knife

2026-08-02 12:07:13 CEST

hello from the nostr army knife

2026-08-02 12:07:11 CEST

hello from the nostr army knife

2026-08-02 12:07:09 CEST

hello from the nostr army knife

2026-08-02 12:07:07 CEST

hello from the nostr army knife

2026-08-02 12:00:18 CEST

hello from the nostr army knife

2026-08-02 09:00:28 CEST

hello from the nostr army knife

2026-08-02 08:00:48 CEST

hello from the nostr army knife

2026-08-02 06:00:23 CEST

hello from the nostr army knife

2026-08-02 01:00:53 CEST

hello from the nostr army knife

2026-08-02 00:00:47 CEST

hello from the nostr army knife

2026-08-01 23:00:47 CEST

hello from the nostr army knife

2026-08-01 22:00:46 CEST

hello from the nostr army knife

2026-08-01 21:00:22 CEST

hello from the nostr army knife

2026-08-01 19:00:31 CEST

hello from the nostr army knife

2026-08-01 13:00:18 CEST

hello from the nostr army knife

2026-08-01 12:00:17 CEST

hello from the nostr army knife

2026-08-01 11:00:18 CEST

hello from the nostr army knife

2026-08-01 10:00:18 CEST

hello from the nostr army knife

2026-08-01 09:00:18 CEST

hello from the nostr army knife

2026-08-01 08:00:18 CEST

hello from the nostr army knife

2026-08-01 06:00:17 CEST

hello from the nostr army knife

2026-08-01 05:00:18 CEST

hello from the nostr army knife

2026-08-01 04:47:08 CEST

hello

2026-08-01 04:00:22 CEST

hello from the nostr army knife

2026-08-01 03:00:17 CEST

hello from the nostr army knife

2026-08-01 02:00:24 CEST

hello from the nostr army knife

2026-07-31 20:00:18 CEST

hello from the nostr army knife

2026-07-31 17:00:25 CEST

hello from the nostr army knife

2026-07-31 16:00:22 CEST

hello from the nostr army knife

2026-07-31 05:00:18 CEST

hello from the nostr army knife

2026-07-31 04:00:24 CEST

hello from the nostr army knife

2026-07-31 03:00:18 CEST

hello from the nostr army knife

2026-07-31 02:00:18 CEST

hello from the nostr army knife

2026-07-31 01:00:15 CEST

hello from the nostr army knife

2026-07-31 00:00:18 CEST

hello from the nostr army knife

2026-07-30 23:47:22 CEST

Do you think Pluto should be a planet?

2026-07-30 23:47:08 CEST

Do you think Pluto should be a planet?

2026-07-30 23:47:02 CEST

Do you think Pluto should be a planet?

2026-07-30 23:00:18 CEST

hello from the nostr army knife

2026-07-30 22:00:18 CEST

hello from the nostr army knife

2026-07-30 21:00:18 CEST

hello from the nostr army knife

2026-07-30 20:00:18 CEST

hello from the nostr army knife

2026-07-30 19:00:17 CEST

hello from the nostr army knife

2026-07-30 18:00:17 CEST

hello from the nostr army knife

2026-07-30 17:00:15 CEST

hello from the nostr army knife

2026-07-30 16:00:17 CEST

hello from the nostr army knife

2026-07-30 15:00:18 CEST

hello from the nostr army knife

2026-07-30 14:00:18 CEST

hello from the nostr army knife