Seed Phrase Management and Setup Wizard

Files: commands/seed.rs, commands/setup.rs Crate: kinetic-cli | Stage: 14

seed.rs — BIP-39 Identity Bootstrap

seed init — First-time identity generation

#![allow(unused)]
fn main() {
-> See: `kinetic-cli/src/commands/seed.rs` — Lines 30–79
}

1. getrandom::fill(&mut [0u8; 32]) — 256 bits of OS entropy.
2. Mnemonic::from_entropy_in(Language::English, &entropy) — converts to a 24-word BIP-39 mnemonic.
3. Prints the phrase to the terminal with a clear warning (“NEVER be able to view this phrase again”).
4. Backup verification loop: Uses entropy[0] % 24 and entropy[1] % 24 to pick two random word positions from the phrase. Prompts the user to type those two words. If wrong, loops. If correct, confirms and breaks.
5. save_keypair_from_mnemonic(&path, &phrase, NETWORK_ID) — derives the ML-DSA-65 keypair from the mnemonic and writes it to <base_dir>/identity.key.

Important

The word indices are derived from the entropy itself — not random at display time — so they are deterministic from the same entropy but unpredictable to anyone who hasn’t seen the phrase.

seed restore

Prompts the seed phrase via rpassword::prompt_password() (reads without echoing to terminal), then calls save_keypair_from_mnemonic(). If the phrase is invalid, the error is surfaced and the command fails cleanly.

#![allow(unused)]
fn main() {
-> See: `kinetic-cli/src/commands/seed.rs` — Lines 81–99
}

setup.rs — First-Run Wizard

kinetic setup is a thin wrapper that:

1. Prints a welcome banner.
2. Calls handle_seed_command(SeedCommands::Init) — runs the full seed generation flow.
3. Prints “Setup Complete” with suggested next steps.

kinetic setup firefox — Root CA injection

#![allow(unused)]
fn main() {
-> See: `kinetic-cli/src/commands/setup.rs` — Lines 52–end
}

Note

Injects the Kinetic Root CA (generated by the daemon on first boot at <base_dir>/<NETWORK_ID>.cert.pem) into Firefox’s NSS certificate database so that .kin HTTPS sites work without browser warnings.

Process:

1. Reads the cert from <base_dir>/<NETWORK_ID>.cert.pem. If missing, instructs the user to start the daemon first.
2. Finds all Firefox profile directories per platform:
   • Windows: %APPDATA%/Mozilla/Firefox/Profiles/
   • macOS: ~/Library/Application Support/Firefox/Profiles/
   • Linux: ~/.mozilla/firefox/ and ~/.var/app/org.mozilla.firefox/ (Flatpak)
3. For each profile that has a cert9.db (NSS3 format), calls:

   certutil -A -n "Kinetic Root CA" -t "CT,," -i <cert.pem> -d sql:<profile_dir>
   

4. Also checks cert8.db (older NSS2) and calls the same command with the legacy format.
5. Prints success/failure for each profile found.