chore: update passphrase to file rather than string in cli (#146)

* chore: write password file

* chore: also fix evm-single

Author: chatton

framework/docker/evstack/evmsingle/node.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"path/filepath"
 	"sync"
 	"time"
 
@@ -60,6 +61,11 @@ func (n *Node) Name() string {
 // HostName returns a condensed hostname
 func (n *Node) HostName() string { return internal.CondenseHostName(n.Name()) }
 
+// passphraseFilePath returns the path to the passphrase file
+func (n *Node) passphraseFilePath() string {
+	return filepath.Join(n.HomeDir(), "config", "passphrase.txt")
+}
+
 // GetNetworkInfo returns internal/external addressing
 func (n *Node) GetNetworkInfo(ctx context.Context) (types.NetworkInfo, error) {
 	internalIP, err := internal.GetContainerInternalIP(ctx, n.DockerClient, n.ContainerLifecycle.ContainerID())
@@ -115,9 +121,13 @@ func (n *Node) initContainer(ctx context.Context) error {
 	// Always run init to ensure config exists and is up to date
 	initCmd := []string{n.cfg.Bin, "init", "--home", n.HomeDir()}
 	if n.nodeCfg.EVMSignerPassphrase != "" {
+		if err := n.WriteFile(ctx, filepath.Join("config", "passphrase.txt"), []byte(n.nodeCfg.EVMSignerPassphrase)); err != nil {
+			return fmt.Errorf("failed to write passphrase file: %w", err)
+		}
+
 		initCmd = append(initCmd,
 			"--rollkit.node.aggregator=true",
-			"--rollkit.signer.passphrase", n.nodeCfg.EVMSignerPassphrase,
+			"--rollkit.signer.passphrase_file", n.passphraseFilePath(),
 		)
 	}
 
@@ -156,7 +166,7 @@ func (n *Node) createNodeContainer(ctx context.Context) error {
 		cmd = append(cmd, "--evnode.node.block_time", n.nodeCfg.EVMBlockTime)
 	}
 	if n.nodeCfg.EVMSignerPassphrase != "" {
-		cmd = append(cmd, "--evnode.node.aggregator=true", "--evnode.signer.passphrase", n.nodeCfg.EVMSignerPassphrase)
+		cmd = append(cmd, "--evnode.node.aggregator=true", "--evnode.signer.passphrase_file", n.passphraseFilePath())
 	}
 
 	if n.nodeCfg.DAAddress != "" {

framework/docker/evstack/node.go

@@ -93,17 +93,26 @@ func (n *Node) isAggregator() bool {
 	return n.isAggregatorFlag
 }
 
+// passphraseFilePath returns the path to the passphrase file
+func (n *Node) passphraseFilePath() string {
+	return filepath.Join(n.HomeDir(), "config", "passphrase.txt")
+}
+
 // Init initializes the Node.
 func (n *Node) Init(ctx context.Context, initArguments ...string) error {
 	n.mu.Lock()
 	defer n.mu.Unlock()
 
 	cmd := []string{n.cfg.Bin, "--home", n.HomeDir(), "--chain_id", n.cfg.ChainID, "init"}
 	if n.isAggregator() {
+		if err := n.WriteFile(ctx, filepath.Join("config", "passphrase.txt"), []byte(n.cfg.AggregatorPassphrase)); err != nil {
+			return fmt.Errorf("failed to write passphrase file: %w", err)
+		}
+
 		signerPath := filepath.Join(n.HomeDir(), "config")
 		cmd = append(cmd,
 			"--evnode.node.aggregator",
-			"--evnode.signer.passphrase="+n.cfg.AggregatorPassphrase, //nolint:gosec // used for testing only
+			"--evnode.signer.passphrase_file="+n.passphraseFilePath(), //nolint:gosec // used for testing only
 			"--evnode.signer.signer_path="+signerPath)
 	}
 
@@ -147,7 +156,7 @@ func (n *Node) createEvstackContainer(ctx context.Context, additionalStartArgs .
 		signerPath := filepath.Join(n.HomeDir(), "config")
 		startCmd = append(startCmd,
 			"--evnode.node.aggregator",
-			"--evnode.signer.passphrase="+n.cfg.AggregatorPassphrase, //nolint:gosec // used for testing only
+			"--evnode.signer.passphrase_file="+n.passphraseFilePath(), //nolint:gosec // used for testing only
 			"--evnode.signer.signer_path="+signerPath)
 	}