script to add your own rotation key on bluesky so you're "billionaire takeover safe" or something

getrotatedidiot.py

# usage: BSKY_USERNAME=whatever.example BSKY_PASSWORD=passwordgoeshere BSKY_SUFFIX=lol python3 getrotatedidiot.py
# written whilst "intoxicated" (pretty intense covid) so may have bugs

# pip install secp256k1 atproto==0.0.55 base58

import os

import secp256k1
import base58
from atproto import Client, models

SECP256K1_DID_PREFIX = bytes([0xE7, 0x01])
BASE58_MULTIBASE_PREFIX = "z"
DID_KEY_PREFIX = "did:key:"


def recommended_did_credentials_to_dict(
    recommended_did_credentials: models.com.atproto.identity.get_recommended_did_credentials.Response,
):
    return {
        "alsoKnownAs": recommended_did_credentials.also_known_as,
        "rotationKeys": (
            recommended_did_credentials.rotation_keys
            if recommended_did_credentials.rotation_keys
            else []
        ),
        "services": recommended_did_credentials.services,
        "verificationMethods": recommended_did_credentials.verification_methods,
    }


def gen_key(
    privkey_in: str | None = None, prefix: str | None = None, suffix: str | None = None
) -> str:
    while True:
        # Generate the key: It's a secp256k1 keypair
        privkey_in = bytes.fromhex(privkey_in) if privkey_in else None
        privkey_obj = secp256k1.PrivateKey(privkey_in)
        privkey_hex = privkey_obj.private_key.hex()
        pubkey_hex = privkey_obj.pubkey.serialize().hex()

        # And the pubkey in DID format is base58, it has two prefixes, one encoded, one not.
        # That gives it the "zQ3" prefix overall.
        compressed_pubkey = privkey_obj.pubkey.serialize(compressed=True)
        pubkey_did_format = DID_KEY_PREFIX + (
            BASE58_MULTIBASE_PREFIX
            + base58.b58encode(SECP256K1_DID_PREFIX + compressed_pubkey).decode()
        )

        # bruteforcing checks
        if (
            privkey_in is None
            and prefix is not None
            and not pubkey_did_format.startswith("did:key:zQ3sh" + prefix)
        ):
            continue

        if (
            privkey_in is None
            and suffix is not None
            and not pubkey_did_format.endswith(suffix)
        ):
            continue

        print(f"New privkey: {privkey_hex}")
        print(f"New pubkey: {pubkey_hex}")
        print(f"New pubkey as DID: {pubkey_did_format}")
        print("Save these somewhere very safe!\n\n")
        return pubkey_did_format


def main() -> None:
    client = Client()
    client.login(os.environ["BSKY_USERNAME"], os.environ["BSKY_PASSWORD"])

    pubkey_did_format = gen_key(
        privkey_in=os.environ.get("BSKY_PRIVKEY"),
        prefix=os.environ.get("BSKY_PREFIX"),
        suffix=os.environ.get("BSKY_SUFFIX"),
    )

    recommended_did_credentials = (
        client.com.atproto.identity.get_recommended_did_credentials()
    )
    recommended_did_credentials_dict = recommended_did_credentials_to_dict(
        recommended_did_credentials
    )
    signature_request = recommended_did_credentials_dict.copy()
    signature_request["rotationKeys"] = [
        pubkey_did_format,
        *signature_request["rotationKeys"],
    ]
    print(f"Recommended DID Credentials are: {recommended_did_credentials_dict}")
    print(f"We'll be changing that to: {signature_request}")

    client.com.atproto.identity.request_plc_operation_signature()
    email_code = input(
        "Requested token for PLC Update, check your email and input it here: "
    ).strip()
    signature_request["token"] = email_code

    signed_operation = client.com.atproto.identity.sign_plc_operation(signature_request)
    print(f"Signed operation: {signed_operation.operation}")
    submission_result = client.com.atproto.identity.submit_plc_operation(
        models.com.atproto.identity.submit_plc_operation.Data(
            operation=signed_operation.operation
        )
    )
    print(f"Result is: {submission_result}")


if __name__ == "__main__":
    main()