feat(cdh-helper): emit app_private_key via __EIGENX_APP_PRIVATE_KEY__ sentinel

A reserved Key value makes the helper return the threshold-recovered
app_private_key (hex of compressed G1 bytes) instead of a release env var,
after the same eigenx-snp attested RetrieveSecretsWithOptions call. Bypasses
the IBE-decrypt and the tmpfs env cache (the root is not part of the release
env and must never be persisted). Lets a co-located signing daemon seed its
KMS-derived root over the existing attested unseal path.

Author: crypt0fairy

cmd/kmsCDHHelper/env_cache_test.go

@@ -68,6 +68,15 @@ func TestEmitKey_MissingKeyFailsLoud(t *testing.T) {
 	assert.Contains(t, err.Error(), "not present in app env")
 }
 
+func TestEmitKey_AppPrivateKeySentinel(t *testing.T) {
+	// The root-key request path returns a one-entry map keyed by the sentinel
+	// (see retrieveAndDecrypt); emitKey must serve it like any other key so the
+	// app_private_key hex reaches stdout unchanged.
+	rootHex := "852555c344147396974349e16f65c08dbf11b0d109e9df97afe2cfd41a84c5f34572a80bcb3053ac0ebec1693e539274"
+	err := emitKey(map[string]string{appPrivateKeyKey: rootHex}, appPrivateKeyKey)
+	require.NoError(t, err)
+}
+
 func TestCacheRoundTrip(t *testing.T) {
 	// Point the cache at a temp dir so the test doesn't touch /run/eigenx.
 	orig := envCacheDir

cmd/kmsCDHHelper/main.go

@@ -161,6 +161,16 @@ const (
 	initDataPath     = "/run/peerpod/initdata"
 )
 
+// appPrivateKeyKey is a reserved Key value that makes the helper emit the
+// threshold-recovered app_private_key itself (hex of its compressed G1 bytes)
+// rather than an environment variable. This is the KMS-derived root a
+// signing daemon seeds from (app_private_key = S·H(appID)); it travels the
+// exact same eigenx-snp attestation path as a sealed env var, so it is only
+// ever recoverable inside an attested TEE. Because it is not part of the
+// release env, it bypasses the merged-env assembly, the IBE-decrypt, and the
+// tmpfs env cache entirely (the root must never be written to disk).
+const appPrivateKeyKey = "__EIGENX_APP_PRIVATE_KEY__"
+
 func main() {
 	if err := run(); err != nil {
 		log.Printf("kmsCDHHelper: %v", err)
@@ -180,10 +190,15 @@ func run() error {
 	// is held across the read so we don't race a concurrent first-call writer
 	// (kata-agent unseals sequentially today, but a multi-container pod shares
 	// the podVM). See env_cache.go.
-	if env, ok, cerr := loadCachedEnv(req.AppID); cerr != nil {
-		return fmt.Errorf("read env cache: %w", cerr)
-	} else if ok {
-		return emitKey(env, req.Key)
+	//
+	// The app_private_key root is never cached (it is not part of the env map),
+	// so its request always attests fresh and never consults the cache.
+	if req.Key != appPrivateKeyKey {
+		if env, ok, cerr := loadCachedEnv(req.AppID); cerr != nil {
+			return fmt.Errorf("read env cache: %w", cerr)
+		} else if ok {
+			return emitKey(env, req.Key)
+		}
 	}
 
 	rsaPriv, rsaPubPEM, err := generateRSAKeypair()
@@ -251,8 +266,14 @@ func run() error {
 	// Cache the whole merged env so sibling sealed vars for this app this pod
 	// boot hit the fast path above. Best-effort: a cache write failure must not
 	// fail the unseal — we already have the value in hand.
-	if cerr := storeCachedEnv(req.AppID, env); cerr != nil {
-		log.Printf("warning: cache merged env for app %q: %v", req.AppID, cerr)
+	//
+	// Never cache the app_private_key root: it is not part of the release env,
+	// and it must not be persisted to the tmpfs cache. Its request always
+	// re-attests (see the fast-path guard above).
+	if req.Key != appPrivateKeyKey {
+		if cerr := storeCachedEnv(req.AppID, env); cerr != nil {
+			log.Printf("warning: cache merged env for app %q: %v", req.AppID, cerr)
+		}
 	}
 
 	return emitKey(env, req.Key)
@@ -653,6 +674,21 @@ func retrieveAndDecrypt(
 		return nil, fmt.Errorf("RetrieveSecretsWithOptions: %w", err)
 	}
 
+	// Root-key request: emit the threshold-recovered app_private_key itself
+	// (hex of its compressed G1 bytes) and stop. This is the KMS-derived root a
+	// signing daemon seeds from; it does not depend on the release's
+	// encrypted_env, so we return before the IBE-decrypt below. The key was
+	// already validated against the master public key by RetrieveSecretsWithOptions
+	// (VerifyAppPrivateKey), so a poisoned KMS fails there, not here.
+	if req.Key == appPrivateKeyKey {
+		if len(result.AppPrivateKey.CompressedBytes) == 0 {
+			return nil, fmt.Errorf("KMS returned empty app_private_key for app %q", req.AppID)
+		}
+		return map[string]string{
+			appPrivateKeyKey: hex.EncodeToString(result.AppPrivateKey.CompressedBytes),
+		}, nil
+	}
+
 	// Per the KMS design (docs/references/new_kms.md, "Application Decryption"):
 	// the secret is the on-chain release's encrypted_env, returned in the
 	// /secrets response and IBE-decrypted here with the threshold-recovered