Merge main: OpsLog's own Club Log API key

internal/extsvc/clublog.go

@@ -40,12 +40,26 @@ func looksLikeHTML(s string) bool {
 // anything in the operator's log, which is what a test button must never do.
 const clublogDownloadURL = "https://clublog.org/getadif.php"
 
-// clublogAppAPIKey is OpsLog's Club Log *application* API key. Club Log
-// requires an api parameter that identifies the client software (not the
-// user) — the same way Log4OM embeds its own key — so we ship it baked in
-// rather than asking each user for one. It's an application identifier, not
-// a user secret, but note it is visible in the source and the binary.
-const clublogAppAPIKey = "5767f19333363a9ef432ee9cd4141fe76b8adf38"
+// clublogAppAPIKey is OpsLog's own Club Log *application* API key, issued to
+// "OpsLog" by G7VJR on 2026-08-18.
+//
+// Club Log requires an api parameter identifying the client SOFTWARE, not the
+// user — the same way Log4OM embeds its own — so it ships baked in rather than
+// asking every operator to request one.
+//
+// It replaces a key that was registered to XV9Q, not to OpsLog. That was not a
+// cosmetic detail: every OpsLog upload in the world was attributed to that
+// callsign, its owner received the abuse warnings OpsLog earned, and a
+// revocation aimed at them would have cut Club Log uploads for every user of
+// this program at once.
+//
+// Club Log asks that the key not be published in source code. The source lives
+// on a private remote and only the built exe is released — but the key is still
+// recoverable from that binary by anyone who looks, as it is for every logger
+// that embeds one. Treat it as an identifier that can be attributed, never as a
+// secret: it authorises nothing on its own, since every request also carries the
+// operator's own e-mail and password.
+const clublogAppAPIKey = "8df47807a412c586787c9401c96c10c135d6e580"
 
 // UploadClublog pushes one ADIF record to Club Log in real time. The user
 // supplies the account email + password and the logbook callsign; the