From 401165d0d658c3dca13807603d487e4c37414be7 Mon Sep 17 00:00:00 2001
From: Chris Eager <chris@signal.org>
Date: Tue, 27 May 2025 14:08:12 -0500
Subject: [PATCH] Convert unidentifiedDelivery.certificate configuration to
 byte[]

---
 service/config/sample-secrets-bundle.yml                       | 1 -
 service/config/sample.yml                                      | 2 +-
 .../org/whispersystems/textsecuregcm/WhisperServerService.java | 2 +-
 .../configuration/UnidentifiedDeliveryConfiguration.java       | 3 ++-
 service/src/test/resources/config/test.yml                     | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/service/config/sample-secrets-bundle.yml b/service/config/sample-secrets-bundle.yml
index 81dd83749..a7e608d9c 100644
--- a/service/config/sample-secrets-bundle.yml
+++ b/service/config/sample-secrets-bundle.yml
@@ -66,7 +66,6 @@ cdn.accessSecret: test # AWS Access Secret
 
 cdn3StorageManager.clientSecret: test
 
-unidentifiedDelivery.certificate: ABCD1234
 unidentifiedDelivery.privateKey: ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789AAAAAAA
 
 keyTransparencyService.clientPrivateKey: |
diff --git a/service/config/sample.yml b/service/config/sample.yml
index e45c7cfd8..b5fef6136 100644
--- a/service/config/sample.yml
+++ b/service/config/sample.yml
@@ -265,7 +265,7 @@ dogstatsd:
   host: 127.0.0.1
 
 unidentifiedDelivery:
-  certificate: secret://unidentifiedDelivery.certificate
+  certificate: CgIIAQ==
   privateKey: secret://unidentifiedDelivery.privateKey
   expiresDays: 7
 
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
index f721131d7..a342f23a8 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
@@ -1080,7 +1080,7 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
         new ArchiveController(backupAuthManager, backupManager, backupMetrics),
         new CallRoutingControllerV2(rateLimiters, cloudflareTurnCredentialsManager),
         new CallLinkController(rateLimiters, callingGenericZkSecretParams),
-        new CertificateController(new CertificateGenerator(config.getDeliveryCertificate().certificate().value(),
+        new CertificateController(new CertificateGenerator(config.getDeliveryCertificate().certificate(),
             config.getDeliveryCertificate().ecPrivateKey(), config.getDeliveryCertificate().expiresDays()),
             zkAuthOperations, callingGenericZkSecretParams, clock),
         new ChallengeController(rateLimitChallengeManager, challengeConstraintChecker),
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/configuration/UnidentifiedDeliveryConfiguration.java b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/UnidentifiedDeliveryConfiguration.java
index 50eb96709..2a45b1e3e 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/configuration/UnidentifiedDeliveryConfiguration.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/UnidentifiedDeliveryConfiguration.java
@@ -5,6 +5,7 @@
 
 package org.whispersystems.textsecuregcm.configuration;
 
+import jakarta.validation.constraints.NotEmpty;
 import jakarta.validation.constraints.NotNull;
 import org.signal.libsignal.protocol.InvalidKeyException;
 import org.signal.libsignal.protocol.ecc.Curve;
@@ -12,7 +13,7 @@ import org.signal.libsignal.protocol.ecc.ECPrivateKey;
 import org.whispersystems.textsecuregcm.configuration.secrets.SecretBytes;
 import org.whispersystems.textsecuregcm.util.ExactlySize;
 
-public record UnidentifiedDeliveryConfiguration(@NotNull SecretBytes certificate,
+public record UnidentifiedDeliveryConfiguration(@NotNull @NotEmpty  byte[] certificate,
                                                 @ExactlySize(32) SecretBytes privateKey,
                                                 int expiresDays) {
   public ECPrivateKey ecPrivateKey() throws InvalidKeyException {
diff --git a/service/src/test/resources/config/test.yml b/service/src/test/resources/config/test.yml
index 021cf1f5b..827f4fb35 100644
--- a/service/src/test/resources/config/test.yml
+++ b/service/src/test/resources/config/test.yml
@@ -264,7 +264,7 @@ dogstatsd:
   host: 127.0.0.1
 
 unidentifiedDelivery:
-  certificate: secret://unidentifiedDelivery.certificate
+  certificate: CgIIAQ==
   privateKey: secret://unidentifiedDelivery.privateKey
   expiresDays: 7