Redact traces and lock down trace files

ober

cff15c1b1f6e7f4249fe1da4d4702f6b3541c17f

diff --git a/signal/trace.ss b/signal/trace.ss
index effe931..606a672 100644
--- a/signal/trace.ss
+++ b/signal/trace.ss
@@ -27,8 +27,9 @@
   ;;   1/true/yes            write to /tmp/jerboa-signal-trace.log
   ;;   any other value       treated as a trace file path
   ;;
-  ;; Trace lines are intentionally raw: they include recipient ids and message
-  ;; bodies so we can debug exact signal-cli RPC frames.
+  ;; Trace details are redacted by default. Set
+  ;; JERBOA_SIGNAL_TRACE_SENSITIVE=1 only on a trusted local machine when raw
+  ;; Signal RPC frames are needed for debugging.
   (def (trace-enabled?)
     (and (trace-port) #t))
 
@@ -37,12 +38,12 @@
       (when port
         (with-trace-lock
           (lambda ()
-            (guard (_ [#t (void)])
-              (display (number->string (real-time)) port)
-              (display " " port)
+	            (guard (_ [#t (void)])
+	              (display (number->string (real-time)) port)
+	              (display " " port)
               (display tag port)
               (display " " port)
-              (display (one-line (safe-display detail)) port)
+              (display (one-line (trace-detail tag detail)) port)
               (newline port)
               (flush-output-port port))))))
     (void))
@@ -104,7 +105,8 @@
              (when (file-exists? path)
                (delete-file path))
              (let ([port (open-output-file path)])
-               (display "# jerboa-signal trace: raw Signal RPC, local sensitive data\n" port)
+               (chmod path #o600)
+               (display "# jerboa-signal trace\n" port)
                (flush-output-port port)
                port)))])))
 
@@ -129,6 +131,15 @@
              (string-ci=? s "true")
              (string-ci=? s "yes"))))
 
+  (def (sensitive-trace-enabled?)
+    (enabled-env? (getenv "JERBOA_SIGNAL_TRACE_SENSITIVE")))
+
+  (def (trace-detail tag detail)
+    (let ([s (safe-display detail)])
+      (if (sensitive-trace-enabled?)
+          s
+          (format "[redacted tag=~a chars=~a]" tag (string-length s)))))
+
   (def (one-line s)
     (let ([out (open-output-string)]
           [n (string-length s)])