Add option to self-sign bridge bot device

Author: tulir

mautrix/bridge/config.py

@@ -144,6 +144,7 @@ def do_update(self, helper: ConfigUpdateHelper) -> None:
         copy("bridge.encryption.require")
         copy("bridge.encryption.appservice")
         copy("bridge.encryption.msc4190")
+        copy("bridge.encryption.self_sign")
         copy("bridge.encryption.delete_keys.delete_outbound_on_ack")
         copy("bridge.encryption.delete_keys.dont_store_outbound")
         copy("bridge.encryption.delete_keys.ratchet_on_decrypt")

mautrix/bridge/e2ee.py

@@ -58,6 +58,7 @@ class EncryptionManager:
     periodically_delete_expired_keys: bool
     delete_outdated_inbound: bool
     msc4190: bool
+    self_sign: bool
 
     bridge: br.Bridge
     az: AppService
@@ -110,6 +111,7 @@ def __init__(
         self.key_sharing_enabled = bridge.config["bridge.encryption.allow_key_sharing"]
         self.appservice_mode = bridge.config["bridge.encryption.appservice"]
         self.msc4190 = bridge.config["bridge.encryption.msc4190"]
+        self.self_sign = bridge.config["bridge.encryption.self_sign"]
         if self.appservice_mode:
             self.az.otk_handler = self.crypto.handle_as_otk_counts
             self.az.device_list_handler = self.crypto.handle_as_device_lists
@@ -288,8 +290,18 @@ async def start(self) -> None:
         if not device_id:
             await self.crypto_store.put_device_id(self.client.device_id)
             self.log.debug(f"Logged in with new device ID {self.client.device_id}")
+            await self.crypto.share_keys()
         elif self.crypto.account.shared:
             await self._verify_keys_are_on_server()
+        else:
+            await self.crypto.share_keys()
+        if self.self_sign:
+            trust_state = await self.crypto.resolve_trust(self.crypto.own_identity)
+            if trust_state < TrustState.CROSS_SIGNED_UNTRUSTED:
+                recovery_key = await self.crypto.generate_recovery_key()
+                self.log.info(f"Generated recovery key and signed own device: {recovery_key}")
+            else:
+                self.log.debug(f"Own device is already verified ({trust_state})")
         if self.appservice_mode:
             self.log.info("End-to-bridge encryption support is enabled (appservice mode)")
         else: