From 8abab89ba56b2249ffe4e7d3de467770daf6e8a8 Mon Sep 17 00:00:00 2001 From: eth0net Date: Wed, 23 Sep 2026 02:10:06 +0100 Subject: [PATCH] fix: flush a signing key before anything depends on it The account row is committed durably and the key beside it was not, so a crash in between leaves an account whose document names a key this server cannot sign with. Nothing recovers that. Signed-off-by: eth0net --- src/store/keys.rs | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/src/store/keys.rs b/src/store/keys.rs index 3be06c5..791fb3b 100644 --- a/src/store/keys.rs +++ b/src/store/keys.rs @@ -42,6 +42,14 @@ pub fn write(path: &Path, keypair: &Keypair) -> Result<(), Error> { use std::os::unix::fs::OpenOptionsExt; options.mode(0o600); } - options.open(path)?.write_all(&keypair.to_bytes())?; + let mut file = options.open(path)?; + file.write_all(&keypair.to_bytes())?; + // Flushed before the account that needs it is committed. A key that is + // still in the page cache when the power goes is an account whose document + // names a public key nothing here can sign for, and there is no second copy. + file.sync_all()?; + if let Some(parent) = path.parent() { + std::fs::File::open(parent)?.sync_all()?; + } Ok(()) } -- 2.51.2