Only decode server trust root once

Author: tulir

go.mod

@@ -14,7 +14,7 @@ require (
 	github.com/skip2/go-qrcode v0.0.0-20200617195104-da1b6568686e
 	github.com/stretchr/testify v1.8.4
 	github.com/tidwall/gjson v1.17.0
-	go.mau.fi/util v0.2.2-0.20231229201527-e01ca03301e9
+	go.mau.fi/util v0.2.2-0.20240107131103-852f29430a02
 	golang.org/x/crypto v0.17.0
 	golang.org/x/exp v0.0.0-20231226003508-02704c960a9b
 	golang.org/x/net v0.19.0

go.sum

@@ -65,8 +65,8 @@ github.com/tidwall/sjson v1.2.5 h1:kLy8mja+1c9jlljvWTlSazM7cKDRfJuR/bOJhcY5NcY=
 github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28=
 github.com/yuin/goldmark v1.6.0 h1:boZcn2GTjpsynOsC0iJHnBWa4Bi0qzfJjthwauItG68=
 github.com/yuin/goldmark v1.6.0/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-go.mau.fi/util v0.2.2-0.20231229201527-e01ca03301e9 h1:sYi2qn5XYnWyHjzBj04/ZeyqMMK31qPM1l2v7aWeiA0=
-go.mau.fi/util v0.2.2-0.20231229201527-e01ca03301e9/go.mod h1:9dGsBCCbZJstx16YgnVMVi3O2bOizELoKpugLD4FoGs=
+go.mau.fi/util v0.2.2-0.20240107131103-852f29430a02 h1:jREUBe6TF4a2HCGowTLzcvOFg44QDZ0xgoo+YJK3ugc=
+go.mau.fi/util v0.2.2-0.20240107131103-852f29430a02/go.mod h1:9dGsBCCbZJstx16YgnVMVi3O2bOizELoKpugLD4FoGs=
 go.mau.fi/zeroconfig v0.1.2 h1:DKOydWnhPMn65GbXZOafgkPm11BvFashZWLct0dGFto=
 go.mau.fi/zeroconfig v0.1.2/go.mod h1:NcSJkf180JT+1IId76PcMuLTNa1CzsFFZ0nBygIQM70=
 golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k=

pkg/signalmeow/receiving.go

@@ -26,6 +26,7 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/rs/zerolog"
+	"go.mau.fi/util/exerrors"
 	"google.golang.org/protobuf/proto"
 	"google.golang.org/protobuf/reflect/protoreflect"
 
@@ -860,18 +861,14 @@ type DecryptionResult struct {
 	SealedSender  bool
 }
 
-func serverTrustRootKey() *libsignalgo.PublicKey {
-	// TODO: put this server's trust root in the config or DB or something
-	serverTrustRoot := "BXu6QIKVz5MA8gstzfOgRQGqyLqOwNKHL6INkv3IHWMF"
-	serverTrustRootBytes, err := base64.StdEncoding.DecodeString(serverTrustRoot)
-	if err != nil {
-		panic(fmt.Errorf("DecodeString error: %w", err))
-	}
-	serverTrustRootKey, err := libsignalgo.DeserializePublicKey(serverTrustRootBytes)
-	if err != nil {
-		panic(fmt.Errorf("DeserializePublicKey error: %w", err))
-	}
-	return serverTrustRootKey
+const prodServerTrustRootStr = "BXu6QIKVz5MA8gstzfOgRQGqyLqOwNKHL6INkv3IHWMF"
+
+var prodServerTrustRootBytes = exerrors.Must(base64.StdEncoding.DecodeString(prodServerTrustRootStr))
+var prodServerTrustRootKey = exerrors.Must(libsignalgo.DeserializePublicKey(prodServerTrustRootBytes))
+
+func init() {
+	// It's never going to be freed anyway
+	prodServerTrustRootKey.CancelFinalizer()
 }
 
 func (cli *Client) sealedSenderDecrypt(ctx context.Context, envelope *signalpb.Envelope) (*DecryptionResult, error) {
@@ -885,7 +882,7 @@ func (cli *Client) sealedSenderDecrypt(ctx context.Context, envelope *signalpb.E
 		ctx,
 		envelope.Content,
 		localAddress,
-		serverTrustRootKey(),
+		prodServerTrustRootKey,
 		timestamp,
 		cli.Store.SessionStore,
 		cli.Store.IdentityStore,