From 75e54bbb90447974eb89517bcee5a8684e014571 Mon Sep 17 00:00:00 2001 From: Jonas Nick Date: Mon, 29 May 2023 18:49:57 +0000 Subject: [PATCH] spark-wallet: remove package and module --- README.md | 1 - SECURITY.md | 2 +- dev/dev-features.sh | 16 - docs/services.md | 43 - examples/configuration.nix | 6 - modules/modules.nix | 1 - modules/netns-isolation.nix | 9 - modules/nodeinfo.nix | 1 - modules/obsolete-options.nix | 15 +- modules/onion-services.nix | 9 - modules/presets/enable-tor.nix | 2 - modules/spark-wallet.nix | 98 - pkgs/default.nix | 1 - pkgs/spark-wallet/composition.nix | 17 - pkgs/spark-wallet/default.nix | 16 - pkgs/spark-wallet/generate.sh | 58 - pkgs/spark-wallet/node-packages.nix | 2606 --------------------------- pkgs/spark-wallet/supplement.nix | 8 - test/tests.nix | 4 - test/tests.py | 9 +- 20 files changed, 13 insertions(+), 2909 deletions(-) delete mode 100644 modules/spark-wallet.nix delete mode 100644 pkgs/spark-wallet/composition.nix delete mode 100644 pkgs/spark-wallet/default.nix delete mode 100755 pkgs/spark-wallet/generate.sh delete mode 100644 pkgs/spark-wallet/node-packages.nix delete mode 100644 pkgs/spark-wallet/supplement.nix diff --git a/README.md b/README.md index ba24157..2669a40 100644 --- a/README.md +++ b/README.md @@ -90,7 +90,6 @@ NixOS modules ([src](modules/modules.nix)) clightning [via WireGuard](./docs/services.md#use-zeus-mobile-lightning-wallet-via-wireguard) or [Tor](./docs/services.md#use-zeus-mobile-lightning-wallet-via-tor) * [Ride The Lightning](https://github.com/Ride-The-Lightning/RTL): web interface for `lnd` and `clightning` - * [spark-wallet](https://github.com/shesek/spark-wallet) * [electrs](https://github.com/romanz/electrs): Electrum server * [fulcrum](https://github.com/cculianu/Fulcrum): Electrum server (see [the module](modules/fulcrum.nix) for a comparison with electrs) * [btcpayserver](https://github.com/btcpayserver/btcpayserver) diff --git a/SECURITY.md b/SECURITY.md index e6faf95..b15f153 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -45,7 +45,7 @@ all other security vulnerabilities. | Type | Description | Examples | | :-: | :-: | :-: | | Outright Vulnerabilities | Vulnerabilities in nix-bitcoin specific tooling (except CI tooling) | privilege escalation in SUID binary `netns-exec`, improper release signature verification through `fetch-release` | -| Violations of [PoLP](https://en.wikipedia.org/wiki/Principle_of_least_privilege) | nix-bitcoin services are given too much privilege over the system or unnecessary access to other nix-bitcoin services, or one of the nix-bitcoin isolation measures is incorrectly implemented | `netns-isolation` doesn't work, spark-wallet has access to bitcoin RPC interface or files | +| Violations of [PoLP](https://en.wikipedia.org/wiki/Principle_of_least_privilege) | nix-bitcoin services are given too much privilege over the system or unnecessary access to other nix-bitcoin services, or one of the nix-bitcoin isolation measures is incorrectly implemented | `netns-isolation` doesn't work, RTL has access to bitcoin RPC interface or files | | Vulnerabilities in Dependencies | A vulnerability in any dependency of a nix-bitcoin installation with a configuration consisting of any combination of the following services: bitcoind, clightning, lnd, electrs, joinmarket, btcpayserver, liquidd.
**Note:** The vulnerability must first be reported to and handled by the maintainers of the dependency before it qualifies for a reward| Compromised NixOS expression pulls in malicious package, JoinMarket pulls in a python dependency with a known severe vulnerability | | Bad Documentation | Our documentation suggests blatantly insecure things | `install.md` tells you to add our SSH keys to your root user | | Compromise of Signing Key | Compromise of the nix-bitcoin signing key, i.e., `0xB1A70E4F8DCD0366` | Leaking the key, managing to sign something with it | diff --git a/dev/dev-features.sh b/dev/dev-features.sh index 76b3f6e..bf08636 100644 --- a/dev/dev-features.sh +++ b/dev/dev-features.sh @@ -127,22 +127,6 @@ c systemctl status clightning-rest c journalctl -u clightning-rest c systemctl status clightning-rest-migrate-datadir -#――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――― -# spark-wallet - -run-tests.sh -s "{ - services.spark-wallet.enable = true; - test.container.exposeLocalhost = true; -}" container - -c systemctl status spark-wallet -c journalctl -u spark-wallet - -sparkAuth=$(c cat /secrets/spark-wallet-login | grep -ohP '(?<=login=).*') -curl -v http://$sparkAuth@$ip:9737 -# Open in browser -runuser -u "$(logname)" -- xdg-open http://$sparkAuth@$ip:9737 - #――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――――― # electrs diff --git a/docs/services.md b/docs/services.md index af692df..8676834 100644 --- a/docs/services.md +++ b/docs/services.md @@ -291,49 +291,6 @@ Create a plain text URL: lndconnect-wg --url `````` -# Connect to spark-wallet -### Requirements -* Android phone -* [Orbot](https://guardianproject.info/apps/orbot/) installed from [F-Droid](https://guardianproject.info/fdroid) (recommended) or [Google Play](https://play.google.com/store/apps/details?id=org.torproject.android&hl=en) -* [Spark-wallet](https://github.com/shesek/spark-wallet) installed from [direct download](https://github.com/shesek/spark-wallet/releases) or [Google Play](https://play.google.com/store/apps/details?id=com.spark.wallet) - -1. Enable spark-wallet in `configuration.nix` - - Change - ``` - # services.spark-wallet.enable = true; - ``` - to - ``` - services.spark-wallet.enable = true; - ``` - -2. Deploy new `configuration.nix` - -3. Enable Orbot VPN for spark-wallet - - ``` - Open Orbot app - Turn on "VPN Mode" - Select Gear icon under "Tor-Enabled Apps" - Toggle checkbox under Spark icon - ``` - -4. Get the onion address, access key and QR access code for the spark wallet android app - - ``` - journalctl -eu spark-wallet - ``` - Note: The qr code might have issues scanning if you have a light terminal theme. Try setting it to dark or highlighting the entire output to invert the colors. - -5. Connect to spark-wallet android app - - ``` - Server Settings - Scan QR - Done - ``` - # Connect to electrs ### Requirements Android * Android phone diff --git a/examples/configuration.nix b/examples/configuration.nix index 1cc8122..1f9651d 100644 --- a/examples/configuration.nix +++ b/examples/configuration.nix @@ -126,12 +126,6 @@ # Automatically enables lightning-loop. # services.rtl.nodes.lnd.loop = true; - ### SPARK WALLET - # Set this to enable spark-wallet, a minimalistic wallet GUI for - # c-lightning, accessible over the web or through mobile and desktop apps. - # Automatically enables clightning. - # services.spark-wallet.enable = true; - ### ELECTRS # Set this to enable electrs, an Electrum server implemented in Rust. # services.electrs.enable = true; diff --git a/modules/modules.nix b/modules/modules.nix index 71d4b88..1c4d288 100644 --- a/modules/modules.nix +++ b/modules/modules.nix @@ -14,7 +14,6 @@ ./clightning-plugins ./clightning-rest.nix ./clightning-replication.nix - ./spark-wallet.nix ./lnd.nix ./lightning-loop.nix ./lightning-pool.nix diff --git a/modules/netns-isolation.nix b/modules/netns-isolation.nix index 862af1e..fcd7c99 100644 --- a/modules/netns-isolation.nix +++ b/modules/netns-isolation.nix @@ -244,10 +244,6 @@ in { id = 16; connections = [ "bitcoind" ]; }; - spark-wallet = { - id = 17; - # communicates with clightning over lightning-rpc socket - }; nginx = { id = 21; }; @@ -332,11 +328,6 @@ in { services.fulcrum.address = netns.fulcrum.address; - services.spark-wallet = { - address = netns.spark-wallet.address; - extraArgs = "--no-tls"; - }; - services.lightning-loop.rpcAddress = netns.lightning-loop.address; services.nbxplorer.address = netns.nbxplorer.address; diff --git a/modules/nodeinfo.nix b/modules/nodeinfo.nix index 3f906b8..d01eaed 100644 --- a/modules/nodeinfo.nix +++ b/modules/nodeinfo.nix @@ -145,7 +145,6 @@ in { clightning-rest = mkInfo ""; electrs = mkInfo ""; fulcrum = mkInfo ""; - spark-wallet = mkInfo ""; btcpayserver = mkInfo ""; liquidd = mkInfo ""; joinmarket-ob-watcher = mkInfo ""; diff --git a/modules/obsolete-options.nix b/modules/obsolete-options.nix index 8c536ea..f6dcfd3 100644 --- a/modules/obsolete-options.nix +++ b/modules/obsolete-options.nix @@ -24,7 +24,6 @@ in { (mkRenamedOptionModule [ "services" "bitcoind" "rpcthreads" ] [ "services" "bitcoind" "rpc" "threads" ]) (mkRenamedOptionModule [ "services" "clightning" "bind-addr" ] [ "services" "clightning" "address" ]) (mkRenamedOptionModule [ "services" "clightning" "bindport" ] [ "services" "clightning" "port" ]) - (mkRenamedOptionModule [ "services" "spark-wallet" "host" ] [ "services" "spark-wallet" "address" ]) (mkRenamedOptionModule [ "services" "lnd" "rpclisten" ] [ "services" "lnd" "rpcAddress" ]) (mkRenamedOptionModule [ "services" "lnd" "listen" ] [ "services" "lnd" "address" ]) (mkRenamedOptionModule [ "services" "lnd" "listenPort" ] [ "services" "lnd" "port" ]) @@ -75,7 +74,6 @@ in { "lightning-pool" "liquid" "lnd" - "spark-wallet" "bitcoind" ]) ++ (map mkRenamedEnforceTorOption [ @@ -97,8 +95,17 @@ in { '') (mkRemovedOptionModule (optionName ++ [ "readers" ]) "") (mkRemovedOptionModule (optionName ++ [ "writers" ]) "") - ]); - + ]) ++ + # 0.0.92 + [ + (mkRemovedOptionModule [ "services" "spark-wallet" ] '' + Spark Lightning Wallet is unmaintained and incompatible with clightning + 23.05. Therefore, the spark-wallet module has been removed from + nix-bitcoin. For a replacement, consider using the rtl (Ride The + Lightning) module or the clightning-rest module in combination with the + Zeus mobile wallet. + '') + ]; config = { # Migrate old clightning-rest datadir from nix-bitcoin versions < 0.0.70 systemd.services.clightning-rest-migrate-datadir = let diff --git a/modules/onion-services.nix b/modules/onion-services.nix index 8126b9c..a98b2c0 100644 --- a/modules/onion-services.nix +++ b/modules/onion-services.nix @@ -104,15 +104,6 @@ in { # Set sensible defaults for some services { nix-bitcoin.onionServices = { - spark-wallet = { - externalPort = 80; - # Enable 'public' by default, but don't auto-enable the onion service. - # When the onion service is enabled, 'public' lets spark-wallet generate - # a QR code for accessing the web interface. - public = true; - # Low priority so we can override this with mkDefault in ./presets/enable-tor.nix - enable = mkOverride 1400 false; - }; btcpayserver = { externalPort = 80; }; diff --git a/modules/presets/enable-tor.nix b/modules/presets/enable-tor.nix index 709c01e..084494b 100644 --- a/modules/presets/enable-tor.nix +++ b/modules/presets/enable-tor.nix @@ -26,7 +26,6 @@ in { # TODO-EXTERNAL: # disable Tor enforcement until btcpayserver can fetch rates over Tor # btcpayserver = defaultEnableTorProxy; - spark-wallet = defaultEnableTorProxy; lightning-pool = defaultEnableTorProxy; # These services don't make outgoing connections @@ -48,7 +47,6 @@ in { liquidd.enable = defaultTrue; electrs.enable = defaultTrue; fulcrum.enable = defaultTrue; - spark-wallet.enable = defaultTrue; joinmarket-ob-watcher.enable = defaultTrue; rtl.enable = defaultTrue; }; diff --git a/modules/spark-wallet.nix b/modules/spark-wallet.nix deleted file mode 100644 index 47292ca..0000000 --- a/modules/spark-wallet.nix +++ /dev/null @@ -1,98 +0,0 @@ -{ config, lib, pkgs, ... }: - -with lib; -let - options.services.spark-wallet = { - enable = mkEnableOption "spark-wallet"; - address = mkOption { - type = types.str; - default = "localhost"; - description = mdDoc "http(s) server address."; - }; - port = mkOption { - type = types.port; - default = 9737; - description = mdDoc "http(s) server port."; - }; - extraArgs = mkOption { - type = types.separatedString " "; - default = ""; - description = mdDoc "Extra command line arguments passed to spark-wallet."; - }; - getPublicAddressCmd = mkOption { - type = types.str; - default = ""; - description = mdDoc '' - Bash expression which outputs the public service address. - If set, spark-wallet prints a QR code to the systemd journal which - encodes an URL for accessing the web interface. - ''; - }; - user = mkOption { - type = types.str; - default = "spark-wallet"; - description = mdDoc "The user as which to run spark-wallet."; - }; - group = mkOption { - type = types.str; - default = cfg.user; - description = mdDoc "The group as which to run spark-wallet."; - }; - tor = nbLib.tor; - }; - - cfg = config.services.spark-wallet; - nbLib = config.nix-bitcoin.lib; - - clightning = config.services.clightning; - - # Use wasabi rate provider because the default (bitstamp) doesn't accept - # connections through Tor - torRateProvider = "--rate-provider wasabi --proxy socks5h://${config.nix-bitcoin.torClientAddressWithPort}"; - startScript = '' - ${optionalString (cfg.getPublicAddressCmd != "") '' - publicURL=(--public-url "http://$(${cfg.getPublicAddressCmd})") - ''} - exec ${config.nix-bitcoin.pkgs.spark-wallet}/bin/spark-wallet \ - --ln-path '${clightning.networkDir}' \ - --host ${cfg.address} --port ${toString cfg.port} \ - --config '${config.nix-bitcoin.secretsDir}/spark-wallet-login' \ - ${optionalString cfg.tor.proxy torRateProvider} \ - ${optionalString (cfg.getPublicAddressCmd != "") ''"''${publicURL[@]}"''} \ - --pairing-qr --print-key ${cfg.extraArgs} - ''; -in { - inherit options; - - config = mkIf cfg.enable { - services.clightning.enable = true; - - systemd.services.spark-wallet = { - wantedBy = [ "multi-user.target" ]; - requires = [ "clightning.service" ]; - after = [ "clightning.service" ]; - script = startScript; - serviceConfig = nbLib.defaultHardening // { - User = cfg.user; - Restart = "on-failure"; - RestartSec = "10s"; - } // nbLib.allowedIPAddresses cfg.tor.enforce - // nbLib.nodejs; - }; - - users.users.${cfg.user} = { - isSystemUser = true; - group = cfg.group; - extraGroups = [ clightning.group ]; - }; - users.groups.${cfg.group} = {}; - - nix-bitcoin.secrets.spark-wallet-login.user = cfg.user; - nix-bitcoin.generateSecretsCmds.spark-wallet = '' - makePasswordSecret spark-wallet-password - if [[ spark-wallet-password -nt spark-wallet-login ]]; then - echo "login=spark-wallet:$(cat spark-wallet-password)" > spark-wallet-login - fi - ''; - }; -} diff --git a/pkgs/default.nix b/pkgs/default.nix index f131f9f..8075dc5 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -19,7 +19,6 @@ let self = { rtl = pkgs.callPackage ./rtl { inherit (self) fetchNodeModules; }; # The secp256k1 version used by joinmarket secp256k1 = pkgs.callPackage ./secp256k1 { }; - spark-wallet = pkgs.callPackage ./spark-wallet { }; trustedcoin = pkgs.callPackage ./trustedcoin { }; # TODO-EXTERNAL: diff --git a/pkgs/spark-wallet/composition.nix b/pkgs/spark-wallet/composition.nix deleted file mode 100644 index 7eb0a0d..0000000 --- a/pkgs/spark-wallet/composition.nix +++ /dev/null @@ -1,17 +0,0 @@ -# This file has been generated by node2nix 1.9.0. Do not edit! - -{pkgs ? import { - inherit system; - }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-14_x"}: - -let - nodeEnv = import (pkgs.path + "/pkgs/development/node-packages/node-env.nix") { - inherit (pkgs) stdenv lib python2 runCommand writeTextFile writeShellScript; - inherit pkgs nodejs; - libtool = if pkgs.stdenv.isDarwin then pkgs.darwin.cctools else null; - }; -in -import ./node-packages.nix { - inherit (pkgs) fetchurl nix-gitignore stdenv lib fetchgit; - inherit nodeEnv; -} diff --git a/pkgs/spark-wallet/default.nix b/pkgs/spark-wallet/default.nix deleted file mode 100644 index 4fbd3cd..0000000 --- a/pkgs/spark-wallet/default.nix +++ /dev/null @@ -1,16 +0,0 @@ -{ pkgs, lib }: -let - nodePackages = import ./composition.nix { inherit pkgs; }; -in -nodePackages.package.override { - # Required because spark-wallet uses `npm-shrinkwrap.json` as the lock file - reconstructLock = true; - - meta = with lib; { - description = "A minimalistic wallet GUI for c-lightning"; - homepage = "https://github.com/shesek/spark-wallet"; - license = licenses.mit; - maintainers = with maintainers; [ nixbitcoin erikarvstedt ]; - platforms = platforms.unix; - }; -} diff --git a/pkgs/spark-wallet/generate.sh b/pkgs/spark-wallet/generate.sh deleted file mode 100755 index ecbbd65..0000000 --- a/pkgs/spark-wallet/generate.sh +++ /dev/null @@ -1,58 +0,0 @@ -#!/usr/bin/env bash -set -euo pipefail -. "${BASH_SOURCE[0]%/*}/../../helper/run-in-nix-env" "nodePackages.node2nix gnupg wget jq moreutils gnused" "$@" - -TMPDIR=$(mktemp -d -p /tmp) -trap 'rm -rf $TMPDIR' EXIT - -version="0.3.1" -repo=https://github.com/shesek/spark-wallet - -# Fetch and verify source tarball -file=spark-wallet-${version}-npm.tgz -url=$repo/releases/download/v${version}/$file -export GNUPGHOME=$TMPDIR -gpg --keyserver hkps://keyserver.ubuntu.com --recv-key FCF19B67866562F08A43AAD681F6104CD0F150FC -wget -P "$TMPDIR" "$url" -wget -P "$TMPDIR" "$repo/releases/download/v${version}/SHA256SUMS.asc" -gpg --verify "$TMPDIR/SHA256SUMS.asc" -(cd "$TMPDIR"; sha256sum --check --ignore-missing SHA256SUMS.asc) -hash=$(nix hash file "$TMPDIR/$file") - -# Extract source -src=$TMPDIR/src -mkdir "$src" -tar xvf "$TMPDIR/$file" -C "$src" --strip-components 1 >/dev/null - -# Make qrcode-terminal a strict dependency so that node2nix includes it in the package derivation. -jq '.dependencies["qrcode-terminal"] = .optionalDependencies["qrcode-terminal"]' "$src/package.json" | sponge "$src/package.json" - -node2nix \ - --nodejs-14 \ - --input "$src/package.json" \ - --lock "$src/npm-shrinkwrap.json" \ - --composition composition.nix \ - --no-copy-node-env - -# Use node-env.nix from nixpkgs -# shellcheck disable=SC2016 -nodeEnvImport='import "${toString pkgs.path}/pkgs/development/node-packages/node-env.nix"' -sed -i "s|import ./node-env.nix|$nodeEnvImport|" composition.nix - -# Use the verified package src -read -rd '' fetchurl < rtl-password ''); - tests.spark-wallet = cfg.spark-wallet.enable; - tests.lnd = cfg.lnd.enable; services.lnd = { port = 9736; @@ -186,7 +184,6 @@ let }; test.features.clightningPlugins = true; services.rtl.enable = true; - services.spark-wallet.enable = true; services.clightning-rest.enable = true; services.clightning-rest.lndconnect = { enable = true; onion = true; }; services.lnd.enable = true; @@ -236,7 +233,6 @@ let services.clightning-rest.enable = true; services.liquidd.enable = true; services.rtl.enable = true; - services.spark-wallet.enable = true; services.lnd.enable = true; services.lightning-loop.enable = true; services.lightning-pool.enable = true; diff --git a/test/tests.py b/test/tests.py index bba2dd0..8be260d 100644 --- a/test/tests.py +++ b/test/tests.py @@ -251,13 +251,6 @@ def _(): log_has_string("clightning-rest", "cl-rest api server is ready and listening") ) -@test("spark-wallet") -def _(): - assert_running("spark-wallet") - wait_for_open_port(ip("spark-wallet"), 9737) - spark_auth = re.search("login=(.*)", succeed("cat /secrets/spark-wallet-login"))[1] - assert_matches(f"curl -fsS {spark_auth}@{ip('spark-wallet')}:9737", "Spark") - @test("joinmarket") def _(): assert_running("joinmarket") @@ -315,7 +308,7 @@ def _(): # These reachability tests are non-exhaustive assert_reachable("bitcoind", ["clightning", "lnd", "liquidd"]) - assert_unreachable("bitcoind", ["btcpayserver", "spark-wallet", "lightning-loop"]) + assert_unreachable("bitcoind", ["btcpayserver", "rtl", "lightning-loop"]) assert_unreachable("btcpayserver", ["bitcoind", "lightning-loop"]) # netns addresses can not be bound to in the main netns.