eleven / messenger Public

docs: release key fetch — the Bitwarden item's seed is a hidden custom field, not a password (#1143)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Paul Campbell 3 months ago 83607756e93f8ca85651f0d7760b1ffe8b0bcc39 parent e7777dd

2 files changed, +11 −4

diff --git a/deploy/release-server.sh b/deploy/release-server.sh

index e6008e3..8158e95 100755

--- a/deploy/release-server.sh

+++ b/deploy/release-server.sh

@@ -26,8 +26,12 @@

# secret manager -> shell -> the signing tool's memory and never touches disk

# (one fetch covers a whole publish && promote chain):

-# LCHAT_RELEASE_KEY="$(bw get password "Eleven Messenger server release signing key")" \

-# ./deploy/release-server.sh publish "notes"

+# export LCHAT_RELEASE_KEY="$(bw get item "Eleven Messenger server release signing key" \

+# | jq -r '.fields[]? | select((.value|length)>40).value' | head -1)"

+# ./deploy/release-server.sh publish "notes"

+# (The Bitwarden item has no password field — the seed rides a hidden custom

+# field, which that jq picks out by being the only long value.)

# Fallbacks: $LCHAT_RELEASE_KEY_FILE as a file path, or `-` to read the key

# from stdin (parked in this run's tmpdir, wiped on exit).

diff --git a/docs/server-releases.md b/docs/server-releases.md

index 7af316a..a8e2b05 100644

--- a/docs/server-releases.md

+++ b/docs/server-releases.md

@@ -307,8 +307,11 @@ mirror can only cause a refusal, not an install.

```sh

# per session: fetch the seed from Bitwarden into the environment — it never

-# touches disk, and one fetch covers a whole publish && promote chain

-export LCHAT_RELEASE_KEY="$(bw get password "Eleven Messenger server release signing key")"

+# touches disk, and one fetch covers a whole publish && promote chain. The

+# item has no password field; the seed is its hidden custom field (the only

+# long value, which is what the jq picks out).

+export LCHAT_RELEASE_KEY="$(bw get item "Eleven Messenger server release signing key" \

+ | jq -r '.fields[]? | select((.value|length)>40).value' | head -1)"

# cut a release from clean main and point edge at it

./deploy/release-server.sh publish "what changed, one line"