Move non-deterministic key generation out of catalog

.gitignore

@@ -1,2 +1,3 @@
 /target
-/bbuilder
+/bbuilder
+/composer

Cargo.toml

@@ -46,4 +46,3 @@ reqwest = { version = "0.12", default-features = false }
 jsonrpsee = { version = "0.24", features = ["server", "ws-client", "http-client", "macros"] }
 tracing = "0.1"
 tracing-subscriber = "0.3"
-getrandom = { version = "0.2", features = ["js"] }

catalog/berachain/Cargo.toml

@@ -10,7 +10,6 @@ eyre.workspace = true
 tinytemplate.workspace = true
 serde_json.workspace = true
 template.workspace = true
-getrandom.workspace = true
 
 [lib]
 path = "lib.rs"

catalog/berachain/lib.rs

@@ -117,26 +117,26 @@ impl ComputeResource for BeaconKit {
                     port: "http".to_string(),
                 },
             ))
-            .artifact(Artifacts::File(spec::File {
-                name: "genesis".to_string(),
-                target_path: "/data/genesis.json".to_string(),
-                content: bera_chain_file(chain_id, "genesis.json"),
-            }))
-            .artifact(Artifacts::File(spec::File {
-                name: "kzg-trusted-setup".to_string(),
-                target_path: "/data/kzg-trusted-setup.json".to_string(),
-                content: bera_chain_file(chain_id, "kzg-trusted-setup.json"),
-            }))
-            .artifact(Artifacts::File(spec::File {
-                name: "config".to_string(),
-                target_path: "/data/config.toml".to_string(),
-                content: config_file.render().to_string(),
-            }))
-            .artifact(Artifacts::File(spec::File {
-                name: "app".to_string(),
-                target_path: "/data/app.toml".to_string(),
-                content: app_file.render().to_string(),
-            }));
+            .artifact(Artifacts::File(spec::File::remote(
+                "genesis",
+                "/data/genesis.json",
+                bera_chain_file(chain_id, "genesis.json"),
+            )))
+            .artifact(Artifacts::File(spec::File::remote(
+                "kzg-trusted-setup",
+                "/data/kzg-trusted-setup.json",
+                bera_chain_file(chain_id, "kzg-trusted-setup.json"),
+            )))
+            .artifact(Artifacts::File(spec::File::inline(
+                "config",
+                "/data/config.toml",
+                config_file.render(),
+            )))
+            .artifact(Artifacts::File(spec::File::inline(
+                "app",
+                "/data/app.toml",
+                app_file.render(),
+            )));
 
         Ok(Pod::default().with_spec("node", node))
     }
@@ -175,11 +175,11 @@ impl ComputeResource for BeraReth {
                     port: "http".to_string(),
                 },
             ))
-            .artifact(Artifacts::File(spec::File {
-                name: "eth-genesis".to_string(),
-                target_path: "/data/eth-genesis.json".to_string(),
-                content: bera_chain_file(chain_id, "eth-genesis.json"),
-            }));
+            .artifact(Artifacts::File(spec::File::remote(
+                "eth-genesis",
+                "/data/eth-genesis.json",
+                bera_chain_file(chain_id, "eth-genesis.json"),
+            )));
 
         Ok(Pod::default().with_spec("reth", node))
     }

catalog/ethereum/Cargo.toml

@@ -10,7 +10,6 @@ eyre.workspace = true
 tinytemplate.workspace = true
 serde_json.workspace = true
 template.workspace = true
-getrandom.workspace = true
 
 [lib]
 path = "lib.rs"

catalog/ethereum/lib.rs

@@ -1,7 +1,7 @@
 use serde::Deserialize;
 use spec::{
-    Arg, Artifacts, Babel, ComputeResource, DEFAULT_JWT_TOKEN, Deployment, DeploymentExtension,
-    Manifest, Pod, Port, Spec, Volume,
+    Arg, Artifacts, Babel, ComputeResource, Deployment, DeploymentExtension, Manifest, Pod, Port,
+    Spec, Volume,
 };
 
 #[derive(Default, Clone)]
@@ -104,11 +104,7 @@ impl ComputeResource for Reth {
                     port: "http".to_string(),
                 },
             ))
-            .artifact(Artifacts::File(spec::File {
-                name: "jwt".to_string(),
-                target_path: "/data/jwt_secret".to_string(),
-                content: DEFAULT_JWT_TOKEN.to_string(),
-            }));
+            .artifact(Artifacts::File(spec::File::jwt("jwt", "/data/jwt_secret")));
 
         Ok(Pod::default().with_spec("node", node))
     }
@@ -168,11 +164,7 @@ impl ComputeResource for Lighthouse {
                     port: "http".to_string(),
                 },
             ))
-            .artifact(Artifacts::File(spec::File {
-                name: "jwt".to_string(),
-                target_path: "/data/jwt_secret".to_string(),
-                content: DEFAULT_JWT_TOKEN.to_string(),
-            }));
+            .artifact(Artifacts::File(spec::File::jwt("jwt", "/data/jwt_secret")));
 
         Ok(Pod::default().with_spec("node", node))
     }
@@ -233,11 +225,7 @@ impl ComputeResource for Prysm {
                     port: "http".to_string(),
                 },
             ))
-            .artifact(Artifacts::File(spec::File {
-                name: "jwt".to_string(),
-                target_path: "/data/jwt_secret".to_string(),
-                content: DEFAULT_JWT_TOKEN.to_string(),
-            }));
+            .artifact(Artifacts::File(spec::File::jwt("jwt", "/data/jwt_secret")));
 
         Ok(Pod::default().with_spec("node", node))
     }

catalog/polygon/Cargo.toml

@@ -10,8 +10,6 @@ eyre.workspace = true
 tinytemplate.workspace = true
 serde_json.workspace = true
 template.workspace = true
-cosmos-keys.workspace = true
-getrandom.workspace = true
 
 [lib]
 path = "lib.rs"

catalog/polygon/lib.rs

@@ -1,8 +1,7 @@
-use cosmos_keys::{generate_cometbft_key, generate_tendermint_key};
 use serde::{Deserialize, Serialize};
 use spec::{
-    Arg, Artifacts, Babel, ComputeResource, Deployment, DeploymentExtension, Manifest, Pod, Spec,
-    Volume,
+    Arg, Artifacts, Babel, ComputeResource, Deployment, DeploymentExtension, Generated, Manifest,
+    Pod, Spec, Volume,
 };
 use template::Template;
 
@@ -48,9 +47,6 @@ impl ComputeResource for Heimdall {
             chain: chain.cosmos_chain_id().to_string(),
         };
 
-        let keys = generate_tendermint_key().serialize()?;
-        let val_keys = generate_cometbft_key().serialize()?;
-
         let val_keys_state = "{
   \"height\": \"0\",
   \"round\": 0,
@@ -81,41 +77,41 @@ impl ComputeResource for Heimdall {
                     port: "http".to_string(),
                 },
             ))
-            .artifact(Artifacts::File(spec::File{
-                name: "genesis".to_string(),
-                target_path: "/data/heimdall/config/genesis.json".to_string(),
-                content: "https://storage.googleapis.com/amoy-heimdallv2-genesis/migrated_dump-genesis.json".to_string(),
-            }))
-            .artifact(Artifacts::File(spec::File{
-                name: "client.toml".to_string(),
-                target_path: "/data/heimdall/config/client.toml".to_string(),
-                content: client_config.render().to_string(),
-            }))
-            .artifact(Artifacts::File(spec::File{
-                name: "app.toml".to_string(),
-                target_path: "/data/heimdall/config/app.toml".to_string(),
-                content: app_config.to_string(),
-            }))
-            .artifact(Artifacts::File(spec::File{
-                name: "config.toml".to_string(),
-                target_path: "/data/heimdall/config/config.toml".to_string(),
-                content: config_config.to_string(),
-            }))
-            .artifact(Artifacts::File(spec::File{
-                name: "node_key.json".to_string(),
-                target_path: "/data/heimdall/config/node_key.json".to_string(),
-                content: keys,
-            }))
-            .artifact(Artifacts::File(spec::File{
-                name: "priv_validator_key.json".to_string(),
-                target_path: "/data/heimdall/config/priv_validator_key.json".to_string(),
-                content: val_keys,
-            }))
-            .artifact(Artifacts::File(spec::File{
-                name: "priv_validator_state.json".to_string(),
-                target_path: "/data/heimdall/data/priv_validator_state.json".to_string(),
-                content: val_keys_state.to_string(),
-            }));
+            .artifact(Artifacts::File(spec::File::remote(
+                "genesis",
+                "/data/heimdall/config/genesis.json",
+                "https://storage.googleapis.com/amoy-heimdallv2-genesis/migrated_dump-genesis.json",
+            )))
+            .artifact(Artifacts::File(spec::File::inline(
+                "client.toml",
+                "/data/heimdall/config/client.toml",
+                client_config.render(),
+            )))
+            .artifact(Artifacts::File(spec::File::inline(
+                "app.toml",
+                "/data/heimdall/config/app.toml",
+                app_config,
+            )))
+            .artifact(Artifacts::File(spec::File::inline(
+                "config.toml",
+                "/data/heimdall/config/config.toml",
+                config_config,
+            )))
+            .artifact(Artifacts::File(spec::File::generated(
+                "node_key.json",
+                "/data/heimdall/config/node_key.json",
+                Generated::Ed25519TendermintNodeKey,
+            )))
+            .artifact(Artifacts::File(spec::File::generated(
+                "priv_validator_key.json",
+                "/data/heimdall/config/priv_validator_key.json",
+                Generated::Secp256k1CometBftValidatorKey,
+            )))
+            .artifact(Artifacts::File(spec::File::inline(
+                "priv_validator_state.json",
+                "/data/heimdall/data/priv_validator_state.json",
+                val_keys_state,
+            )));
 
         Ok(Pod::default().with_spec("node", node))
     }
@@ -161,16 +157,16 @@ impl ComputeResource for Bor {
             })
             .arg("server")
             .arg2("--config", "/data/config.toml")
-            .artifact(Artifacts::File(spec::File {
-                name: "config".to_string(),
-                target_path: "/data/config.toml".to_string(),
-                content: config.render(),
-            }))
-            .artifact(Artifacts::File(spec::File {
-                name: "genesis.json".to_string(),
-                target_path: "/data/genesis.json".to_string(),
-                content: bor_genesis(chain),
-            }));
+            .artifact(Artifacts::File(spec::File::inline(
+                "config",
+                "/data/config.toml",
+                config.render(),
+            )))
+            .artifact(Artifacts::File(spec::File::remote(
+                "genesis.json",
+                "/data/genesis.json",
+                bor_genesis(chain),
+            )));
 
         Ok(Pod::default().with_spec("bor", node))
     }

catalog/tempo/Cargo.toml

@@ -7,7 +7,6 @@ edition = "2024"
 serde.workspace = true
 spec.workspace = true
 eyre.workspace = true
-getrandom.workspace = true
 
 [lib]
 path = "lib.rs"

crates/bbuilder/Cargo.toml

@@ -11,6 +11,7 @@ eyre.workspace = true
 serde_json.workspace = true
 serde.workspace = true
 catalog.workspace = true
+cosmos-keys.workspace = true
 clap.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true

crates/bbuilder/bin/main.rs

@@ -73,6 +73,10 @@ async fn run_command(
     let manifest_path = manifest_dir.join("manifest.json");
     fs::write(&manifest_path, serde_json::to_string_pretty(&manifest)?)?;
 
+    // Mint secrets and inline them, so runtimes only ever see content or a URL
+    let secrets_dir = std::path::Path::new(&config_folder).join("secrets");
+    let manifest = bbuilder::generator::generate(manifest, &secrets_dir)?;
+
     // Pass ./bbuilder/docker-runtime to DockerRuntime
     let docker_runtime_path = std::path::Path::new(&config_folder)
         .join("docker-runtime")