{"record":{"id":"c03ff08427a03769","repo":"Pumpkin-MC/Pumpkin","slug":"no-public-key-or-secret-configured-for-vine-proxy","errorCode":null,"errorMessage":"No public key or secret configured for Vine proxy","messagePattern":"No public key or secret configured for Vine proxy","errorType":"error_code","errorClass":"VineError","httpStatus":null,"severity":"error","filePath":"crates/pumpkin/src/net/proxy/vine.rs","lineNumber":30,"sourceCode":"    ser::NetworkReadExt,\n};\nuse sha2::{Digest, Sha256};\nuse thiserror::Error;\nuse tracing::debug;\n\nuse crate::net::{GameProfile, java::pending::PendingConnection};\n\npub const VINE_PLAYER_INFO_CHANNEL: &str = \"vine:player_info\";\npub const VINE_FORWARDING_VERSION: i32 = 1;\npub const MAX_TIMESTAMP_DRIFT_SECS: i64 = 30;\n\n#[derive(Error, Debug)]\npub enum VineError {\n    #[error(\"No response data received\")]\n    NoData,\n    #[error(\"Vine response data too short (minimum 89 bytes)\")]\n    DataTooShort,\n    #[error(\"No public key or secret configured for Vine proxy\")]\n    MissingKeyConfig,\n    #[error(\"Invalid Ed25519 public key\")]\n    InvalidPublicKey,\n    #[error(\"Failed to verify Ed25519 signature\")]\n    InvalidSignature,\n    #[error(\"Failed to read forward version\")]\n    FailedReadForwardVersion,\n    #[error(\"Unsupported forwarding version {0}. Expected {1}\")]\n    UnsupportedForwardVersion(i32, i32),\n    #[error(\"Vine timestamp expired or desynchronized: skew of {0}s exceeds limit of {1}s\")]\n    TimestampExpired(i64, i64),\n    #[error(\"Vine challenge nonce mismatch\")]\n    ChallengeMismatch,\n    #[error(\"Missing expected challenge from pending connection\")]\n    MissingChallenge,\n    #[error(\"Failed to read address\")]\n    FailedReadAddress,\n    #[error(\"Failed to parse address\")]","sourceCodeStart":12,"sourceCodeEnd":48,"githubUrl":"https://github.com/Pumpkin-MC/Pumpkin/blob/8d4639e25a57c15e47448ec327c780d41bbf2356/crates/pumpkin/src/net/proxy/vine.rs#L12-L48","documentation":"VineError::MissingKeyConfig is returned by get_verifying_key (crates/pumpkin/src/net/proxy/vine.rs:83-108) when Vine forwarding is enabled but both the public_key and secret fields in the VineConfig are empty or whitespace-only. The server has no key material to verify the proxy's Ed25519 signature, so it cannot trust the forwarded player data. Configuration is rejected before any signature verification is attempted.","triggerScenarios":"receive_vine_plugin_response processes a valid Vine response and calls get_verifying_key, but config.public_key and config.secret are both empty/blank strings in the server's network proxy configuration.","commonSituations":"The operator enabled Vine forwarding in the config but forgot to copy the proxy's public key or shared secret; the config key was misspelled or left as the default empty placeholder; the config file was reset or regenerated without preserving the key fields.","solutions":["Set either vine public_key (hex-encoded 32-byte Ed25519 public key from the proxy) or vine secret (shared secret) in the server's VineConfig","Copy the public key exactly as printed by the proxy, without extra whitespace","Restart the server after editing the config so the new VineConfig is loaded"],"exampleFix":"// before (config)\n[vine]\nenabled = true\npublic_key = \"\"\nsecret = \"\"\n// after\n[vine]\nenabled = true\npublic_key = \"1fc8f9e2a4b7...\" # hex Ed25519 public key from the proxy","handlingStrategy":"validation","validationCode":"fn validate_vine_config(config: &VineConfig) -> Result<(), String> {\n    if config.public_key.trim().is_empty() && config.secret.trim().is_empty() {\n        return Err(\"Set either vine.public_key or vine.secret when Vine forwarding is enabled\".into());\n    }\n    Ok(())\n}\n// run at startup before accepting connections","typeGuard":"fn has_key_material(config: &VineConfig) -> bool {\n    !config.public_key.trim().is_empty() || !config.secret.trim().is_empty()\n}","tryCatchPattern":"match get_verifying_key(&config) {\n    Err(VineError::MissingKeyConfig) => {\n        eprintln!(\"Vine forwarding enabled but no public_key/secret set; refusing logins\");\n        return;\n    }\n    other => other?,\n}","preventionTips":["Validate key configuration at server startup, not on first login","Document that either public_key OR secret must be set when vine.enabled = true","Keep the proxy's public key recorded in config management alongside the server config","Fail fast at boot if forwarding is enabled without keys instead of failing logins at runtime"],"tags":["configuration","minecraft","proxy-forwarding","missing-key"],"backgroundTag":"missing-required-config-field","analyzedSha":"8d4639e25a57c15e47448ec327c780d41bbf2356","analyzedAt":"2026-09-09T15:32:22.916Z","contentChangedAt":"2026-09-09T15:32:22.916Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}