fix: Rename all EigenInference references to Darkbloom#98
Conversation
|
Deployment failed with the following error: View Documentation: https://vercel.com/docs/accounts/team-members-and-roles |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
| // X25519 encryption key from any other key derived from the same mnemonic. | ||
| // Bumping the version here rotates the coordinator key for all senders. | ||
| const CoordinatorKeyHKDFInfo = "eigeninference-coordinator-e2e-v1" | ||
| const CoordinatorKeyHKDFInfo = "darkbloom-coordinator-e2e-v1" |
There was a problem hiding this comment.
could break backwards compat
| API_KEY="$(fetch_secret darkbloom-dd-api-key || true)" | ||
| fi | ||
|
|
||
| if [[ -z "$APP_KEY" ]]; then | ||
| APP_KEY="$(fetch_secret eigeninference-dd-app-key || true)" | ||
| APP_KEY="$(fetch_secret darkbloom-dd-app-key || true)" | ||
| fi | ||
|
|
||
| if [[ -z "$SITE" ]]; then | ||
| SITE="$(fetch_secret eigeninference-dd-site || true)" | ||
| SITE="$(fetch_secret darkbloom-dd-site || true)" |
There was a problem hiding this comment.
breaks backwards compat
|
Deployment failed with the following error: View Documentation: https://vercel.com/docs/accounts/team-members-and-roles |
PR #98 Review: EigenInference → Darkbloom RenameReviewed the full diff (167 files, ~870 additions / ~857 deletions). The bulk of the rename is correct and consistent, but there are several incorrect renames that break migration paths, one build-breaking issue, and a couple of wire-protocol changes that need attention. Critical — Broken Migration Paths (data loss for existing users)
Critical — Build-Breaking
Wire-Protocol Changes (provider↔coordinator compatibility)
Incorrect Over-Rename
Minor
Inline comments follow for the file-specific issues. |
|
|
||
| let newPath = appSupport.appendingPathComponent("darkbloom").appendingPathComponent("provider.toml") | ||
| let legacyPath = appSupport.appendingPathComponent("eigeninference").appendingPathComponent("provider.toml") | ||
| let legacyPath = appSupport.appendingPathComponent("darkbloom").appendingPathComponent("provider.toml") |
| # Analytics | ||
|
|
||
| Standalone read-only analytics service for Darkbloom / EigenInference. | ||
| Standalone read-only analytics service for Darkbloom / Darkbloom. |
GCP secrets: fetch darkbloom-* then fall back to eigeninference-* on 404.
Config path: auto-migrate ~/.config/eigeninference/ → ~/.config/darkbloom/;
load_auth_token falls back to legacy path.
Install.sh: fix broken migration chain in coordinator copy — restore
~/.eigeninference step (was ~/.darkbloom→~/.darkbloom, a no-op).
ACME: add eigeninference-acme as alias provisioner alongside darkbloom-acme
so enrolled devices can still renew certs.
Sealed Content-Type: accept application/eigeninference-sealed+json
alongside the new name during transition.
hankbobtheresearchoor
left a comment
hankbobtheresearchoor
left a comment
There was a problem hiding this comment.
Backwards Compatibility Review — EigenInference → Darkbloom Rename
✅ Well-Handled (backwards compat present)
- GCP Secret Manager:
fetch/fetch_secrettrydarkbloom-*first, fall back toeigeninference-*— good - ACME provisioner: Adds
eigeninference-acmeas alias alongsidedarkbloom-acme— good - Rust config dir: Checks
~/.config/darkbloom/first, falls back to~/.config/eigeninference/, auto-copies — good - Install.sh auth_token: Checks both paths — good
- Sealed Content-Type: Coordinator accepts both
application/darkbloom-sealed+jsonand legacyapplication/eigeninference-sealed+json— good - ENV vars:
EIGENINFERENCE_*env vars intentionally preserved — good - Console UI localStorage:
eigeninference_* → darkbloom_*migration map preserved — good - Legacy key cleanup:
LEGACY_KEY_FILESandlegacy_secret_pathsstill include.eigeninferencepaths — good
🔴 Still Breaking — Must Fix Before Merge
- PKCS#12 push cert password — Hardcoded
pass:eigeninference→pass:darkbloom. Existing push certs encrypted with old password can't be decrypted. Must try old password first. - MDM API key default — Fallback changed from
eigeninference-micromdm-api→darkbloom-micromdm-api. Existing MicroMDM deployments using old API key break if env var not set. - Step-CA password file —
eigeninference-step-ca→darkbloom-step-ca. Existing CA with old password can't be unlocked on restart. - Step-CA provisioner name —
eigeninference-admin→darkbloom-admin. Existing client cert signing requests using old provisioner name will fail. - Swift ConfigManager legacy path removed — Migration bridge from
eigeninference/todarkbloom/path deleted. Upgrading macOS app users lose existing config.
🟠 Should Fix — Will Break Some Deployments
- R2 release artifact paths —
eigeninloom-bundle-*→darkbloom-bundle-*. Self-update will 404 on previously published releases. Needs fallback URL or version-aware path construction. - Enclave binary name —
eigeninference-enclave→darkbloom-enclave. Existing installations witheigeninference-enclavein~/.darkbloom/bin/have a stale binary. Should check both names. - Go module path —
github.com/eigeninference/coordinator→github.com/darkbloom/coordinator. All downstream Go imports break. Acceptable for internal monorepo, but any external consumers will need a major version bump.
🟡 Low Risk / Acceptable
- Python SDK import —
from eigeninference import EigenInference→from darkbloom import Darkbloom. Internal test file only, no published PyPI package to break. - Install.sh RC cleanup — Removes
.eigeninference/binfrom PATH cleanup patterns. Existing providers witheigeninferencein PATH won't get cleaned up on reinstall.
Verdict: Changes Requested — 5 items in the 🔴 category will brick existing deployments and must be addressed.
| echo "Decoding MDM push certificate from PKCS#12..." | ||
| printf '%s' "$MDM_PUSH_P12_B64" | tr '_-' '/+' | base64 -d > /tmp/push.p12 | ||
| openssl pkcs12 -in /tmp/push.p12 -clcerts -nokeys -passin pass:eigeninference \ | ||
| openssl pkcs12 -in /tmp/push.p12 -clcerts -nokeys -passin pass:darkbloom \ |
There was a problem hiding this comment.
🔴 PKCS#12 password regression: This changes the push cert decryption password from eigeninference to darkbloom. If the existing push cert in GCP Secret Manager was encrypted with the old password, this will fail to decrypt it.
Fix: Try the new password first, then fall back to the old one:
openssl pkcs12 -in /tmp/push.p12 -clcerts -nokeys -passin pass:darkbloom \
-out /data/micromdm/push.crt 2>/dev/null || \
openssl pkcs12 -in /tmp/push.p12 -clcerts -nokeys -passin pass:eigeninference \
-out /data/micromdm/push.crt 2>/dev/null| mdmKey := os.Getenv("EIGENINFERENCE_MDM_API_KEY") | ||
| if mdmKey == "" { | ||
| mdmKey = "eigeninference-micromdm-api" // default | ||
| mdmKey = "darkbloom-micromdm-api" // default |
There was a problem hiding this comment.
🔴 MDM API key default regression: Fallback changed from eigeninference-micromdm-api to darkbloom-micromdm-api. If EIGENINFERENCE_MDM_API_KEY env var is not set, the coordinator will send the wrong API key to an existing MicroMDM instance.
Fix: Check the old default as fallback, similar to how GCP secrets work:
mdmKey = "darkbloom-micromdm-api" // default
// Legacy: if new default fails, try old default| echo "Initializing step-ca (first boot)..." | ||
| mkdir -p /data/step-ca/secrets | ||
| echo "eigeninference-step-ca" > /data/step-ca/secrets/password | ||
| echo "darkbloom-step-ca" > /data/step-ca/secrets/password |
There was a problem hiding this comment.
🔴 Step-CA password regression: Password file changed from eigeninference-step-ca to darkbloom-step-ca. On an existing coordinator VM with persistent /data/step-ca/, if the CA was initialized with the old password, step-ca will fail to unlock.
Note: The first-boot guard (if [ ! -d "/data/step-ca/config" ]) prevents this on existing VMs — but on a fresh deploy or re-initialization, the new password is used and any manually-copied CA data would be inaccessible.
Consider: Try new password first, fall back to old password on unlock failure.
| --dns "${DOMAIN:-localhost}" \ | ||
| --address ":9000" \ | ||
| --provisioner "eigeninference-admin" \ | ||
| --provisioner "darkbloom-admin" \ |
There was a problem hiding this comment.
🔴 Step-CA provisioner name regression: Provisioner changed from eigeninference-admin to darkbloom-admin. Existing client cert signing requests that reference eigeninference-admin as the provisioner will fail.
The ACME provisioner correctly has an alias (eigeninference-acme is preserved), but the JWK provisioner (eigeninference-admin → darkbloom-admin) has no such alias.
Fix: Add eigeninference-admin as a second JWK provisioner in the step-CA config, similar to the ACME alias pattern already used.
| return legacyPath | ||
| } | ||
| return newPath | ||
| return appSupport.appendingPathComponent("darkbloom").appendingPathComponent("provider.toml") |
There was a problem hiding this comment.
🔴 Legacy config path migration removed: The old code checked both darkbloom/ and eigeninference/ paths and returned whichever existed. The new code only checks darkbloom/. Users upgrading from EigenInference.app who have config at ~/Library/Application Support/eigeninference/provider.toml will lose their existing config.
Fix: Restore the fallback:
let newPath = appSupport.appendingPathComponent("darkbloom").appendingPathComponent("provider.toml")
let legacyPath = appSupport.appendingPathComponent("eigeninference").appendingPathComponent("provider.toml")
if FileManager.default.fileExists(atPath: newPath.path) {
return newPath
}
if FileManager.default.fileExists(atPath: legacyPath.path) {
return legacyPath
}
return newPath| let _ = std::fs::rename( | ||
| eigeninference_dir.join("eigeninference-enclave"), | ||
| bin_dir.join("eigeninference-enclave"), | ||
| darkbloom_dir.join("darkbloom-enclave"), |
There was a problem hiding this comment.
🟠 Enclave binary name: darkbloom-enclave is now the expected binary name, but existing installations have eigeninference-enclave in ~/.darkbloom/bin/. Consider checking both names during cmd_doctor and cmd_update, similar to how default_config_path() falls back to the legacy path.
| url.replace( | ||
| "eigeninference-bundle-macos-arm64.tar.gz", | ||
| "eigeninference-python-macos-arm64.tar.gz", | ||
| "darkbloom-bundle-macos-arm64.tar.gz", |
There was a problem hiding this comment.
🟠 R2 artifact path: darkbloom-bundle-macos-arm64.tar.gz won't exist for previously published releases (which use eigeninference-bundle-*). Self-update on an older provider version will 404.
Consider: If the download URL returns 404, fall back to the eigeninference-bundle-* path. Or version-gate the URL construction.
…tep-CA password/provisioner, Swift ConfigManager PKCS#12 push cert: try darkbloom password first, fall back to eigeninference. MDM API key: revert default to eigeninference-micromdm-api (legacy). Step-CA password: migrate eigeninference-step-ca → darkbloom-step-ca on existing VMs. Step-CA JWK provisioner: add eigeninference-admin alias sharing darkbloom-admin key. Swift ConfigManager: restore eigeninference/ legacy path fallback for provider.toml.
hankbobtheresearchoor
left a comment
hankbobtheresearchoor
left a comment
There was a problem hiding this comment.
Re-Review After Fixes — EigenInference → Darkbloom Rename
✅ All 5 Critical Items Resolved
- PKCS#12 push cert password — ✅ Now tries
pass:darkbloomfirst, falls back topass:eigeninferencevia||. Both cert and key extraction covered. - MDM API key default — ✅ Kept as
eigeninference-micromdm-api(legacy default) inmain.go. Deploy scripts use${MICROMDM_API_KEY:-${MICROMDM_API_KEY_FALLBACK:-darkbloom-micromdm-api}}for new installs. - Step-CA password — ✅ Adds migration block that detects
eigeninference-step-cain password file and rewrites todarkbloom-step-ca. New installs getdarkbloom-step-cadirectly. - Step-CA JWK provisioner alias — ✅ Adds
eigeninference-adminas a JWK provisioner alias sharing the same key asdarkbloom-admin. Matches the ACME alias pattern. - Swift ConfigManager legacy path — ✅ Restored the
eigeninference/fallback check. Checksdarkbloom/first, theneigeninference/, returns new path if neither exists.
Great fixes — all follow the established pattern of new-name-first, old-name-fallback.
🟠 Remaining Items (non-blocking but should be tracked)
- R2 artifact path — Still
darkbloom-bundle-*only. Self-update will 404 on previously published releases usingeigeninference-bundle-*. Low urgency since old releases can be re-uploaded or redirected at the CDN level. - Enclave binary name —
cmd_doctoronly checksdarkbloom-enclave, doesn't fall back toeigeninference-enclave. If a user has the old binary but not the new one, doctor reports it missing. Low risk sincecmd_updateinstalls the new binary. - Go module path —
github.com/darkbloom/coordinatoris the new path. Acceptable for internal monorepo; just needs awareness that any external consumers break.
These are minor and can be addressed in follow-up PRs.
Verdict: Approve — All critical backwards compatibility regressions are resolved.
| # as darkbloom-admin, so existing clients using the old provisioner name | ||
| # can still sign certificate requests. | ||
| echo "Adding eigeninference-admin JWK provisioner alias..." | ||
| ADMIN_KEY=$(jq -r '.authority.provisioners[] | select(.type=="JWK" and .name=="darkbloom-admin") | .key' "$CA_JSON") |
There was a problem hiding this comment.
💡 Nit: The JWK alias provisioner is only added during first-boot initialization (if [ ! -d "/data/step-ca/config" ]). For existing VMs that already have step-ca initialized, the eigeninference-admin alias won't be added. Consider adding a migration step (similar to the password migration above) that appends the alias to an existing ca.json on subsequent boots.
Non-blocking — existing VMs with the old provisioner will continue to work since the old provisioner name is already in their ca.json. This only matters if step-ca is re-initialized.
| mdmKey := os.Getenv("EIGENINFERENCE_MDM_API_KEY") | ||
| if mdmKey == "" { | ||
| mdmKey = "eigeninference-micromdm-api" // default | ||
| mdmKey = "eigeninference-micromdm-api" // legacy default |
There was a problem hiding this comment.
💡 Note: Keeping eigeninference-micromdm-api as the Go-side default is a pragmatic choice — it means existing deployments keep working without env var changes. The new darkbloom-micromdm-api default only kicks in via the deploy script's nested fallback. This works but means the two codepaths have different defaults. Consider a code comment explaining this split for future maintainers.
2 participants
Summary
Agentic workflows will need to carve meaning in this codebase. simple things like conflicting class names can cause them to draw incorrect relationships when forming higher order knowledge.
Any variables to
EigenInferenceused for persistent resource definitions (e.g, postgres keys, table names) or env have been kept in-tact to not break existing usability.Linked issue
Closes #
Test plan
Components touched
Protocol / interface changes
Notes for reviewers