CCI report: ca625fa1-57ec-43f7-ab0b-df88209c079b

Request message

{
  "request": "trigger",
  "version": 1,
  "event_type": "patch",
  "repository": {
    "id": "rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5",
    "name": "heartwood",
    "description": "Radicle Heartwood Protocol & Stack",
    "private": false,
    "default_branch": "master",
    "delegates": [
      "did:key:z6MksFqXN3Yhqk8pTJdUGLwATkRfQvwZXPqR2qMEhbS9wzpT",
      "did:key:z6MktaNvN1KVFMkSRAiN4qK5yvX1zuEEaseeX5sffhzPZRZW",
      "did:key:z6MkireRatUThvd3qzfKht1S44wpm4FEWSSa4PRMTSQZ3voM",
      "did:key:z6MkgFq6z5fkF2hioLLSNu1zP2qEL1aHXHZzGH1FLFGAnBGz",
      "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz"
    ]
  },
  "action": "Updated",
  "patch": {
    "id": "cfbc8ab4edd0eddb24e56a7ce56a1a0f6d2d3d39",
    "author": {
      "id": "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz",
      "alias": "lorenz"
    },
    "title": "node: Support systemd credentials for secret key and passphrase",
    "state": {
      "status": "open",
      "conflicts": []
    },
    "before": "7b8da0e72f6a6e86271358173c7603d2b2891eba",
    "after": "9fb3e1e7f36b3c9bcf021462cd01804c7c746f5e",
    "commits": [
      "9fb3e1e7f36b3c9bcf021462cd01804c7c746f5e",
      "7aec84bf004c7853232e848196e2001a96e25491",
      "6e9fc6d36dd108faf15ef7e5ed22e1975c167309"
    ],
    "target": "8c1073b9c951edf01f12d3fd194ffb18484be2bd",
    "labels": [],
    "assignees": [],
    "revisions": [
      {
        "id": "cfbc8ab4edd0eddb24e56a7ce56a1a0f6d2d3d39",
        "author": {
          "id": "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz",
          "alias": "lorenz"
        },
        "description": "## Secret Key\n\nWhile it is possible to use systemd credentials via\n\n    LoadCredential=xyz.radicle.node.secret:\u2026\n    ExecStart=radicle-node \u2026 --secret \"${CREDENTIALS_DIRECTORY}/xyz.radicle.node.secret\"\n\nMake usage more convenient and directly support passing the secret key\nvia a systemd credential. The ID of the credential must be\n\n    xyz.radicle.node.secret\n\nand is not user-configurable.\n\nA systemd service unit file might contain:\n\n    LoadCredential=xyz.radicle.node.secret:\u2026\n    ExecStart=radicle-node \u2026\n\nThis requires just a bit of plumbing in `radicle-node`.\n\nThe preference order for the path of the secret key is:\n 1. The command line argument `--secret`.\n 2. The systemd credential.\n 3. The configuration file.\n 4. The default location to preserve backward compatibility.\n\nThe reason to prefer the systemd credential over the configuration file\nis that it uses a mechanism that is influenced by the environment of the\nprocess, which is deemed \"closer at runtime\" or \"more dynamic\" than a\nconfiguration file. Ad-hoc overrides are still possible via the\ncommandline argument.\n\n## Passphrase\n\nWhile it is possible to pass the passphrase via the environment, e.g.\n`EnvironmentFile=<path to file that contains \"RAD_PASSPHRASE=\u2026\">`\nthis is less secure than passing it via a file, because the environment\nis inherited down the process tree.\n\nThus, allow using a systemd credential. The ID of the credential must be\n\n    xyz.radicle.node.passphrase\n\nand is not user-configurable.\n\nPassing the passphrase via file is now possible with\n`LoadCredential=xyz.radicle.node.passphrase:<path to file that contains passphrase>`\n\nThis requires just a bit of plumbing in `radicle-node`.\n\nBecause this mechanism is more secure than using the environment\nvariable `RAD_PASSPHRASE`, it takes priority. That is, if both the\nsystemd credential is available, *and* the environment variable\n`RAD_PASSPHRASE` is set, the former is preferred.\n\nHeads-up:\n 1. The contents of the file must be valid UTF-8 (see documentation of\n    `std::fs::read_to_string`). Assuming that the passphrase is at some\n    point chosen by the user and typed on a keyboard, this does not\n    seem like a severe restriction.\n 2. The contents of the file are not processed otherwise, i.e. line\n    breaks (notably at the end of the file) are not stripped.\n\nThe related `issue/8bd040e9de05e7fc27e373ebc1649ff4ad930e7a` asked for a\nvery similar feature: Passing the passphrase via a file named by the\nvalue of the of the environment variable `RAD_PASSPHRASE_FILE`.\nIt was also briefly discussed at\n<https://radicle.zulipchat.com/#narrow/channel/369277-heartwood/topic/.60RAD_PASSPHRASE_FILE.60/with/529104447>.\n\n## Plumbing in `radicle-systemd`\n\nAdd `mod credential` with `fn path` which implements a simple lookup of\nsystemd credentials. See <https://systemd.io/CREDENTIALS/>",
        "base": "5cd016b587a2a90f2321af41122cc12b01b7f391",
        "oid": "5144631070e98167289de98efe2850f6600c07d3",
        "timestamp": 1759482013
      },
      {
        "id": "530936aaf90926038c615313c139197ae20b4f51",
        "author": {
          "id": "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz",
          "alias": "lorenz"
        },
        "description": "Fix commit message",
        "base": "5cd016b587a2a90f2321af41122cc12b01b7f391",
        "oid": "c188b55b12f907acb4d1e68db893f75c975f2727",
        "timestamp": 1759482282
      },
      {
        "id": "c786c3ba0c23d89e2c2bd633b19d1e215e04be2e",
        "author": {
          "id": "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz",
          "alias": "lorenz"
        },
        "description": "Improve commit messages",
        "base": "5cd016b587a2a90f2321af41122cc12b01b7f391",
        "oid": "082cc00a383ed52c28df3683cf778f3b8dc7fd4c",
        "timestamp": 1759483102
      },
      {
        "id": "c39659c58e6dd7eee9c8d54dc4f54cc5840ae272",
        "author": {
          "id": "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz",
          "alias": "lorenz"
        },
        "description": "Fix a small clippy.",
        "base": "7b8da0e72f6a6e86271358173c7603d2b2891eba",
        "oid": "e48b260000639d2f5d3eddd14fdd3f9af8310fe0",
        "timestamp": 1759989743
      },
      {
        "id": "a26f07007b557f285f0cc001abd0aef6409740e6",
        "author": {
          "id": "did:key:z6MkkPvBfjP4bQmco5Dm7UGsX2ruDBieEHi8n9DVJWX5sTEz",
          "alias": "lorenz"
        },
        "description": "Add changelog entries.",
        "base": "7b8da0e72f6a6e86271358173c7603d2b2891eba",
        "oid": "9fb3e1e7f36b3c9bcf021462cd01804c7c746f5e",
        "timestamp": 1760000112
      }
    ]
  }
}

Send response

{
  "response": "triggered",
  "run_id": {
    "id": "ca625fa1-57ec-43f7-ab0b-df88209c079b"
  },
  "info_url": "https://cci.rad.levitte.org//ca625fa1-57ec-43f7-ab0b-df88209c079b.html"
}

Checkout the source (in /opt/radcis/ci.rad.levitte.org/cci/state/ca625fa1-57ec-43f7-ab0b-df88209c079b/w)

Started at: 2025-10-09 11:02:22.238795+02:00

Commands:

Read the repo configuration (.radicle/native.yaml in /opt/radcis/ci.rad.levitte.org/cci/state/ca625fa1-57ec-43f7-ab0b-df88209c079b/w)

shell: 'export RUSTDOCFLAGS=''-D warnings''


  cargo --version

  rustc --version


  cargo fmt --check

  cargo clippy --all-targets --workspace -- --deny warnings

  cargo build --all-targets --workspace

  cargo doc --workspace --no-deps

  cargo test --workspace --no-fail-fast

  '

Run the script

Commands:

Send result

{
  "response": "finished",
  "result": "failure"
}