diff --git a/core/archipelago/src/api/rpc/lnd/macaroons.rs b/core/archipelago/src/api/rpc/lnd/macaroons.rs index 1cf6657a..5c293575 100644 --- a/core/archipelago/src/api/rpc/lnd/macaroons.rs +++ b/core/archipelago/src/api/rpc/lnd/macaroons.rs @@ -616,10 +616,11 @@ async fn run_rotation( .await .with_context(|| format!("unlocking the wallet — old material is in {backup}"))?; - let deadline = std::time::Instant::now() + std::time::Duration::from_secs(MACAROON_WAIT_SECS); + let mint_deadline = + std::time::Instant::now() + std::time::Duration::from_secs(MACAROON_WAIT_SECS); let admin_path = format!("{LND_MAINNET_DIR}/admin.macaroon"); let mut new_digest = None; - while std::time::Instant::now() < deadline { + while std::time::Instant::now() < mint_deadline { if let Some(d) = digest_as_root(&admin_path).await { new_digest = Some(d); break; @@ -644,10 +645,19 @@ async fn run_rotation( }); // 6. Verify the things that must NOT have changed. + // + // Its own budget, deliberately not the mint deadline. Sharing one would mean + // a rotation that legitimately spent 14 of its 15 minutes waiting for LND to + // mint gets 1 minute to prove the channels came back, and then reports + // FAILURE on a node that is perfectly healthy — the most alarming possible + // way to be wrong about someone's Lightning wallet. with_progress(|p| p.set("verify", StepState::Running, None)); - let (pubkey_after, census_after) = wait_for_serving(deadline).await.with_context(|| { - format!("verifying the node after rotation — old material is in {backup}") - })?; + let verify_deadline = + std::time::Instant::now() + std::time::Duration::from_secs(MACAROON_WAIT_SECS); + let (pubkey_after, census_after) = + wait_for_serving(verify_deadline).await.with_context(|| { + format!("verifying the node after rotation — old material is in {backup}") + })?; with_progress(|p| p.channels_after = Some(census_after.channels_open)); if pubkey_after != pubkey_before { with_progress(|p| p.set("verify", StepState::Failed, None));