CCI report: 24fe656e-e54b-46b6-af9a-9b4fa5c20744

Request message

{
  "request": "trigger",
  "version": 1,
  "event_type": "patch",
  "repository": {
    "id": "rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5",
    "name": "heartwood",
    "description": "Radicle Heartwood Protocol & Stack",
    "private": false,
    "default_branch": "master",
    "delegates": [
      "did:key:z6MksFqXN3Yhqk8pTJdUGLwATkRfQvwZXPqR2qMEhbS9wzpT",
      "did:key:z6MktaNvN1KVFMkSRAiN4qK5yvX1zuEEaseeX5sffhzPZRZW",
      "did:key:z6MkireRatUThvd3qzfKht1S44wpm4FEWSSa4PRMTSQZ3voM",
      "did:key:z6MkgFq6z5fkF2hioLLSNu1zP2qEL1aHXHZzGH1FLFGAnBGz",
      "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz"
    ]
  },
  "action": "Updated",
  "patch": {
    "id": "cfbc8ab4edd0eddb24e56a7ce56a1a0f6d2d3d39",
    "author": {
      "id": "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz",
      "alias": "lorenz"
    },
    "title": "node: Support systemd credentials for secret key and passphrase",
    "state": {
      "status": "open",
      "conflicts": []
    },
    "before": "5cd016b587a2a90f2321af41122cc12b01b7f391",
    "after": "c188b55b12f907acb4d1e68db893f75c975f2727",
    "commits": [
      "c188b55b12f907acb4d1e68db893f75c975f2727",
      "ce60dfe400e512f9495c8d91e3a00715c2b45a0c",
      "09879dad9b94a5aed048a3311d583119ac292883"
    ],
    "target": "5cd016b587a2a90f2321af41122cc12b01b7f391",
    "labels": [],
    "assignees": [],
    "revisions": [
      {
        "id": "cfbc8ab4edd0eddb24e56a7ce56a1a0f6d2d3d39",
        "author": {
          "id": "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz",
          "alias": "lorenz"
        },
        "description": "## Secret Key\n\nWhile it is possible to use systemd credentials via\n\n    LoadCredential=xyz.radicle.node.secret:\u2026\n    ExecStart=radicle-node \u2026 --secret \"${CREDENTIALS_DIRECOTRY/xyz.radicle.node.credential\"\n\nMake usage more convenient and directly support passing the secret key\nvia a systemd credential. The ID of the credential must be\n\n    xyz.radicle.node.secret\n\nand is not user-configurable.\n\nA systemd service unit file might contain:\n\n    LoadCredential=xyz.radicle.node.secret:\u2026\n    ExecStart=radicle-node \u2026\n\nThis requires just a bit of plumbing in `radicle-node`.\n\nThe preference order for the path of the secret key is:\n 1. The command line argument `--secret`.\n 2. The systemd credential.\n 3. The configuration file.\n 4. The default location to preserve backward compatibility.\n\nThe reason to prefer the systemd credential over the configuration file\nis that it uses a mechanism that is influenced by the environment of the\nprocess, which is deemed \"closer at runtime\" or \"more dynamic\" than a\nconfiguration file. Ad-hoc overrides are still possible via the\ncommandline argument.\n\n## Passphrase\n\nWhile it is possible to pass the passphrase via the environment, e.g.\n`EnvironmentFile=<path to file that contains \"RAD_PASSPHRASE=\u2026\">`\nthis is less secure than passing it via a file, because the environment\nis inherited down the process tree.\n\nThus, allow using a systemd credential. The ID of the credential must be\n\n    xyz.radicle.node.passphrase\n\nand is not user-configurable.\n\nPassing the passphrase via file, it is now possible with\n`LoadCredential=xyz.radicle.node.passphrase:<path to file that contains passphrase>`\n\nThis requires just a bit of plumbing in `radicle-node`.\n\nBecause this mechanism is more secure than using the environment\nvariable `RAD_PASSPHRASE`, it takes priority. That is, if both the\nsystemd credential is available, *and* the environment variable\n`RAD_PASSPHRASE` is set, the former is preferred.\n\n## Plumbing in `radicle-systemd`\n\nAdd `mod credential` with `fn path` which implements a simple lookup of\nsystemd credentials. See <https://systemd.io/CREDENTIALS/>",
        "base": "5cd016b587a2a90f2321af41122cc12b01b7f391",
        "oid": "5144631070e98167289de98efe2850f6600c07d3",
        "timestamp": 1759482013
      },
      {
        "id": "530936aaf90926038c615313c139197ae20b4f51",
        "author": {
          "id": "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz",
          "alias": "lorenz"
        },
        "description": "Fix commit message",
        "base": "5cd016b587a2a90f2321af41122cc12b01b7f391",
        "oid": "c188b55b12f907acb4d1e68db893f75c975f2727",
        "timestamp": 1759482282
      }
    ]
  }
}

Send response

{
  "response": "triggered",
  "run_id": {
    "id": "24fe656e-e54b-46b6-af9a-9b4fa5c20744"
  },
  "info_url": "https://cci.rad.levitte.org//24fe656e-e54b-46b6-af9a-9b4fa5c20744.html"
}

Checkout the source (in /opt/radcis/ci.rad.levitte.org/cci/state/24fe656e-e54b-46b6-af9a-9b4fa5c20744/w)

Started at: 2025-10-03 11:04:46.357837+02:00

Commands:

Read the repo configuration (.radicle/native.yaml in /opt/radcis/ci.rad.levitte.org/cci/state/24fe656e-e54b-46b6-af9a-9b4fa5c20744/w)

shell: 'export RUSTDOCFLAGS=''-D warnings''


  cargo --version

  rustc --version


  cargo fmt --check

  cargo clippy --all-targets --workspace -- --deny warnings

  cargo build --all-targets --workspace

  cargo doc --workspace --no-deps

  cargo test --workspace --no-fail-fast

  '

Run the script

Commands:

Send result

{
  "response": "finished",
  "result": "failure"
}