security: fix secret leakage hardcoded tokens and credentials (Punto 3)

- .gitignore: Add protection for .env, *.pem, *.key, private_key.pem, privkey.pem, ec.key, chiave_privata.key, and shell scripts bal-*.sh
- make_release.sh: Remove hardcoded token 5cfa8c33e337ebaadb355c0ffa2d053d521ee43b
  Add loading from .env file with GITEA_API_TOKEN variable
  Add error handling if token is not set (prevents script from running without proper authentication)
- .env.example: Add template file for Gitea API token setup (not committed to git, .gitignored)
- generate_keys.sh: Add chmod 600 to protect private_key.pem permissions
- contrib/download_and_install_bal.sh: Remove hardcoded xpub and fixed_fee.
  Make all settings required as arguments or environment variables (xpub, fixed_fee, willexecutor_url, email, info)
  Add proper error handling and usage instructions if required arguments are not provided
- tests/secret_leakage_tests.rs: Add regression tests that:
  * Verify .gitignore protects .env, .pem, .key files
  * Verify no private key files are tracked in git (only public_key.pem is allowed)
  * Scan shell scripts for potential hardcoded tokens
- All tests pass: cargo test (8 tests: 3 SQL injection + 2 panic regression + 3 secret leakage)
- Build verified: cargo check (0 errors)

make_release.sh

@@ -0,0 +1,154 @@
+#!/bin/bash
+#author:Svātantrya
+
+source lib.sh
+usage() {
+  echo_w "./make_release <version> <message>"
+}
+
+if [ -n "$1" ]; then release=$1; else usage; exit; fi
+
+if [ -n "$2" ]; then message=$2; else
+  # Create temporary file using mktemp
+  TEMPFILE=$(mktemp)
+  vi $TEMPFILE
+  message=$(cat $TEMPFILE)
+  rm $TEMPFILE
+fi
+
+echo_i $message
+
+# Load secrets from .env file (not committed to git)
+if [ -f .env ]; then
+  export $(grep -v '^#' .env | xargs)
+fi
+
+TOKEN="${GITEA_API_TOKEN}"
+if [ -z "$TOKEN" ]; then
+  echo_e "Error: GITEA_API_TOKEN is not set in .env file."
+  echo_e "Please create a .env file with: GITEA_API_TOKEN=your_token_here"
+  exit 1
+fi
+OWNER="bitcoinafterlife"
+basename=$(basename $(pwd))
+REPO=$basename
+TAG="v$release"
+binpath="target/release/$basename"
+release_name="$basename-$release"
+dest="releases/$release"
+arch=$(uname -m)
+platform="linux-gnu"
+destbin="$dest/$arch"
+destsrc="$dest/src"
+assetname="$release_name""_$arch""_$platform"
+
+asset_tar_gz="$assetname.tar.gz"
+ASSET_PATH="$destbin/$assetname.tar.gz"
+
+giteahost="https://bitcoin-after.life/gitea"
+url_releases="$giteahost/api/v1/repos/$OWNER/$REPO/releases"
+
+echo_i() {
+    echo -e "\033[1m==> $1\033[0m"
+}
+
+echo_e() {
+    echo -e "\033[31;1m$1\033[0m"
+}
+
+echo_s() {
+    echo -e "\033[32;1m$1\033[0m"
+}
+echo_w() {
+    echo -e "\033[33;1m$1\033[0m"
+}
+
+ 
+prepare_release(){
+  mkdir -p "$destbin/$assetname"
+  if ! cargo build --release; then
+    echo_w "error building release"
+    exit 1
+  fi
+  ls -l $binpath
+  cp target/release/bal-server \
+    target/release/bal-pusher \
+    README.md \
+    "$destbin/$assetname"
+  (
+    cd "$destbin"
+    echo_w $ASSET_PATH
+    echo "ls $(pwd)"
+    ls
+    echo "ls $(pwd)/$assetname"
+    ls "$(pwd)/$assetname"
+    ls $assetname
+    tar -czf "$asset_tar_gz" "$assetname"
+  )
+}
+
+push_tag() {
+  git commit -am"release: $release_name"
+  git push
+  #git tag -a "$TAG" -m"release: $release_name"
+  #git push origin --tags
+}
+
+# Configurazioni
+post_release() {
+  if [ -z "$1" ]; then
+    echo_e "no data to release"
+    exit 1
+  else
+    echo "data: $1"
+  fi
+  echo "token:$TOKEN"
+  echo url_releases: $url_releases
+  RELEASE="$(curl -s -X POST \
+    -H "accept: application/json" \
+    -H "Authorization: token $TOKEN" \
+    -H "Content-Type: application/json" \
+    -d "$1" \
+    $url_releases
+  )"
+  echo $RELEASE
+}
+
+add_asset_release() {
+  if [ -z "$1" ]; then
+    echo_e "error add_asset_release"
+    exit 1
+  fi
+  echo $ASSET_PATH
+  ls -l $ASSET_PATH
+  pwd
+  curl -X POST \
+    -H "accept: application/json" \
+    -H "Authorization: token $TOKEN" \
+    -H "Content-Type: multipart/form-data" \
+    -F "attachment=@$ASSET_PATH" \
+    "$url_releases/$1/assets"
+}
+
+  # Estrae l'ID della release
+release_data=$(cat <<EOF
+{
+  "tag_name":"$TAG",
+  "name":"$release_name",
+  "body":"Release: $release_name enjoy\n$message"
+}
+
+EOF
+)
+
+prepare_release
+echo_s "prepare release done"
+push_tag
+echo_s "push tag done"
+echo "$release_data"
+post_release "$release_data"
+echo_s "prepare release done"
+echo $RELEASE
+id_release=
+add_asset_release $(echo $RELEASE | jq .id)
+echo_s "done"