Prompt the user to enter a password, from which will be derived the key used * for `hsm_secret` encryption. * The algorithm used to derive the key is Argon2(id), to which libsodium * defaults. However argon2id-specific constants are used in case someone runs it * with a libsodium version which default constants differs (typically <1.0.9). * * DEPRECATED: Use --hsm-passphrase instead. */
| 601 | * DEPRECATED: Use --hsm-passphrase instead. |
| 602 | */ |
| 603 | static char *opt_set_hsm_password(struct lightningd *ld) |
| 604 | { |
| 605 | int is_encrypted; |
| 606 | |
| 607 | /* Show deprecation warning */ |
| 608 | if (!opt_deprecated_ok(ld, "encrypted_hsm", |
| 609 | "Use --hsm-passphrase instead", |
| 610 | "v25.12", "v26.12")) |
| 611 | return "--encrypted-hsm was removed, use --hsm-passphrase instead"; |
| 612 | |
| 613 | is_encrypted = is_legacy_hsm_secret_encrypted("hsm_secret"); |
| 614 | /* While lightningd is performing the first initialization |
| 615 | * this check is always true because the file does not exist. |
| 616 | * |
| 617 | * Maybe the is_hsm_secret_encrypted is performing a not useful |
| 618 | * check at this stage, but the hsm is a delicate part, |
| 619 | * so it is a good information to have inside the log. */ |
| 620 | if (is_encrypted == -1) |
| 621 | log_info(ld->log, "'hsm_secret' does not exist (%s)", |
| 622 | strerror(errno)); |
| 623 | |
| 624 | return read_hsm_passphrase(ld); |
| 625 | } |
| 626 | |
| 627 | /* Set flag to indicate hsm_secret needs a passphrase. |
| 628 | * This replaces the old --encrypted-hsm option which was for legacy encrypted secrets. |
nothing calls this directly
no test coverage detected