From b7ef6e724028f5dbcf0dd4513c2bc8ff19a6e918 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 31 Mar 2026 03:53:29 +0000
Subject: [PATCH] =?UTF-8?q?refactor:=20=E4=BB=A3=E7=A0=81=E5=AE=A1?=
 =?UTF-8?q?=E6=9F=A5=E5=8F=8D=E9=A6=88=20-=20UUID=E7=94=9F=E6=88=90?=
 =?UTF-8?q?=E7=AE=80=E5=8C=96=20+=20base64url=E6=8F=90=E5=8F=96=E4=B8=BA?=
 =?UTF-8?q?=E5=87=BD=E6=95=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/30c8f4ac-a9ab-450c-85ce-ac2c40ffc705

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
---
 server/proxy/setup/generate-keys.sh | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/server/proxy/setup/generate-keys.sh b/server/proxy/setup/generate-keys.sh
index c5ef1676..4e659e25 100644
--- a/server/proxy/setup/generate-keys.sh
+++ b/server/proxy/setup/generate-keys.sh
@@ -18,6 +18,11 @@
 set -uo pipefail
 # 注意: 不使用 set -e，手动处理错误以确保密钥生成的健壮性
 
+# 工具函数: 将二进制数据转为base64url编码
+to_base64url() {
+    base64 | tr '+/' '-_' | tr -d '='
+}
+
 echo "════════════════════════════════════════"
 echo "🔑 铸渊专线 · 密钥生成"
 echo "════════════════════════════════════════"
@@ -26,10 +31,7 @@ echo ""
 HAS_ERROR=0
 
 # ── 生成UUID ─────────────────────────────────
-UUID=$(xray uuid 2>/dev/null || cat /proc/sys/kernel/random/uuid || true)
-if [ -z "$UUID" ]; then
-    UUID=$(cat /proc/sys/kernel/random/uuid 2>/dev/null || openssl rand -hex 16 | sed 's/\(.\{8\}\)\(.\{4\}\)\(.\{4\}\)\(.\{4\}\)\(.\{12\}\)/\1-\2-\3-\4-\5/')
-fi
+UUID=$(xray uuid 2>/dev/null || cat /proc/sys/kernel/random/uuid 2>/dev/null || openssl rand -hex 16 | sed 's/\(.\{8\}\)\(.\{4\}\)\(.\{4\}\)\(.\{4\}\)\(.\{12\}\)/\1-\2-\3-\4-\5/')
 echo "ZY_PROXY_UUID=$UUID"
 
 # ── 生成Reality X25519密钥对 ──────────────────
@@ -95,9 +97,9 @@ if [ -z "$PRIVATE_KEY" ] && command -v openssl &>/dev/null; then
     if openssl genpkey -algorithm X25519 -out "$TMPKEY" 2>/dev/null; then
         # 从DER格式提取原始32字节密钥，转为base64url (43字符)
         PRIVATE_KEY=$(openssl pkey -in "$TMPKEY" -outform DER 2>/dev/null \
-            | tail -c 32 | base64 | tr '+/' '-_' | tr -d '=') || true
+            | tail -c 32 | to_base64url) || true
         PUBLIC_KEY=$(openssl pkey -in "$TMPKEY" -pubout -outform DER 2>/dev/null \
-            | tail -c 32 | base64 | tr '+/' '-_' | tr -d '=') || true
+            | tail -c 32 | to_base64url) || true
     fi
     rm -f "$TMPKEY"
 
@@ -115,7 +117,7 @@ fi
 if [ -z "$PRIVATE_KEY" ]; then
     echo "  ⚠️ 所有X25519生成方法均失败，使用随机占位密钥"
     echo "  ⚠️ 请在服务器上手动运行: xray x25519"
-    PRIVATE_KEY=$(openssl rand -base64 32 | tr '+/' '-_' | tr -d '=' | head -c 43)
+    PRIVATE_KEY=$(openssl rand 32 | to_base64url | head -c 43)
     PUBLIC_KEY="PLACEHOLDER_REGENERATE_WITH_XRAY_X25519"
     HAS_ERROR=1
 fi