From b5d0ebbbab70ae29b3e12047263ae36f7710bc33 Mon Sep 17 00:00:00 2001
From: morning-verlu <258725120+morning-verlu@users.noreply.github.com>
Date: Sun, 31 May 2026 21:31:28 +0800
Subject: [PATCH] commands: derive peer ID on config replace

Signed-off-by: morning-verlu <258725120+morning-verlu@users.noreply.github.com>
---
 core/commands/config.go         | 10 ++++++++++
 docs/changelogs/v0.43.md        |  2 ++
 test/cli/config_secrets_test.go | 21 +++++++++++++++++++++
 3 files changed, 33 insertions(+)

diff --git a/core/commands/config.go b/core/commands/config.go
index bec2127dcd0..33740544f06 100644
--- a/core/commands/config.go
+++ b/core/commands/config.go
@@ -18,6 +18,7 @@ import (
 	"github.com/ipfs/kubo/core/commands/cmdenv"
 	"github.com/ipfs/kubo/repo"
 	"github.com/ipfs/kubo/repo/fsrepo"
+	"github.com/libp2p/go-libp2p/core/peer"
 )
 
 // ConfigUpdateOutput is config profile apply command's output
@@ -607,6 +608,15 @@ func replaceConfig(r repo.Repo, file io.Reader) error {
 	}
 
 	newCfg.Identity.PrivKey = pkstr
+	pk, err := newCfg.Identity.DecodePrivateKey("")
+	if err != nil {
+		return errors.New("failed to decode PrivKey")
+	}
+	id, err := peer.IDFromPrivateKey(pk)
+	if err != nil {
+		return errors.New("failed to derive PeerID from PrivKey")
+	}
+	newCfg.Identity.PeerID = id.String()
 
 	// Handle Pinning.RemoteServices (API.Key of each service is a secret)
 
diff --git a/docs/changelogs/v0.43.md b/docs/changelogs/v0.43.md
index e3c1d984ec7..91385b688cf 100644
--- a/docs/changelogs/v0.43.md
+++ b/docs/changelogs/v0.43.md
@@ -24,4 +24,6 @@ This release was brought to you by the [Shipyard](https://ipshipyard.com/) team.
 
 ### 📝 Changelog
 
+- Fixed `ipfs config replace` to keep `Identity.PeerID` consistent with the preserved private key.
+
 ### 👨‍👩‍👧‍👦 Contributors
diff --git a/test/cli/config_secrets_test.go b/test/cli/config_secrets_test.go
index 8dc48657f53..ff59e5e1197 100644
--- a/test/cli/config_secrets_test.go
+++ b/test/cli/config_secrets_test.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/ipfs/kubo/test/cli/harness"
 	"github.com/stretchr/testify/assert"
+	"github.com/tidwall/gjson"
 	"github.com/tidwall/sjson"
 )
 
@@ -106,6 +107,26 @@ func TestConfigSecrets(t *testing.T) {
 			}
 			assert.Equal(t, origPrivKey, newPrivKey, "PrivKey should be preserved")
 		})
+
+		t.Run("Identity.PeerID is derived from preserved PrivKey during config replace", func(t *testing.T) {
+			t.Parallel()
+			node := harness.NewT(t).NewNode().Init()
+
+			originalPeerID := node.PeerID().String()
+			foreignPeerID := "QmTFauExutTsy4XP6JbMFcw2Wa9645HJt2bTqL6qYDCKfe"
+			assert.NotEqual(t, originalPeerID, foreignPeerID)
+
+			configShow := node.RunIPFS("config", "show").Stdout.String()
+			configJSON := MustVal(sjson.Set(configShow, "Identity.PeerID", foreignPeerID))
+			node.WriteBytes("foreign-peerid-config", []byte(configJSON))
+
+			node.IPFS("config", "replace", "foreign-peerid-config")
+
+			newConfig := node.ReadFile(node.ConfigFile())
+			newPeerID := gjson.Get(newConfig, "Identity.PeerID").String()
+			assert.Equal(t, originalPeerID, newPeerID)
+			assert.NotEqual(t, foreignPeerID, newPeerID)
+		})
 	})
 
 	t.Run("TLS security validation", func(t *testing.T) {