In `@crates/chain/src/chain.rs`:
- Around line 2195-2231: Run rustfmt (cargo fmt) to fix formatting issues in the
get_or_create_peer_id function; specifically reformat the block handling
key_path, the creation branch that defines signing_key, and the final peer_id
return so that spacing/line breaks around key_path.display(), signing_key, and
peer_id match project formatting. Ensure you run `cargo fmt` on the crate
(crates/chain) and recommit the changed formatting for the get_or_create_peer_id
function (references: get_or_create_peer_id, key_path, signing_key, peer_id).
- Around line 2216-2224: The private key is being created with std::fs::write
which may produce world-readable permissions; change the write to explicitly
create the file with owner-only permissions on Unix: open the key_path using
std::fs::OpenOptions (or OpenOptionsExt on Unix) and set mode to 0o600 when
creating, write key.to_bytes().as_slice() into that handle, and fallback to the
existing std::fs::write behavior on non-Unix via cfg(unix) so Windows semantics
are unchanged; update the block around peer_info_dir, key_path, and the key
write to use this secure create-and-write approach.
- Line 2205: The TOCTOU arises because the code checks key_path.exists() before
reading; change to a read-first pattern by attempting std::fs::read(&key_path)
and matching the result: on Ok(data) parse/deserialize to produce signing_key,
on Err(e) if e.kind() == std::io::ErrorKind::NotFound then handle the "missing
key" path (generate a new signing key, create parent dirs if needed, and write
it out), and for other errors return or log the I/O error. Update the logic
surrounding the signing_key variable and key_path usage (the block that
currently starts with let signing_key = if key_path.exists()) to use this
read-first approach.
- Around line 2205-2231: The code derives peer_id three times from the same
private key (inside both branches and again after the if/else); refactor to
derive peer_id once after obtaining signing_key: keep the existing logic that
reads or generates the SigningKey in the if/else (functions/values: key_path,
peer_info_dir, k256::ecdsa::SigningKey, signing_key), remove the duplicate
IrysPeerId::from(irys_types::IrysAddress::from_private_key(...)) calls inside
each branch, and compute let peer_id =
irys_types::IrysPeerId::from(irys_types::IrysAddress::from_private_key(&signing_key))
once after the if/else so you can use peer_id for logging and for the returned
Ok(peer_id).