Use DKG package in vault reporting plugin

.changeset/real-falcons-like.md

@@ -0,0 +1,5 @@
+---
+"chainlink": minor
+---
+
+#changed vault plugin to use dkg result database

core/capabilities/integration_tests/framework/don.go

@@ -477,6 +477,7 @@ func startNewNode(ctx context.Context,
 		c.Feature.FeedsManager = ptr(false)
 		c.Feature.LogPoller = ptr(true)
 		c.CRE.UseLocalTimeProvider = ptr(true)
+		c.CRE.EnableDKGRecipient = ptr(true)
 
 		if setupCfg != nil {
 			setupCfg(c)

core/cmd/shell_local.go

@@ -519,6 +519,13 @@ func (s *Shell) runNode(c *cli.Context) error {
 		}
 	}
 
+	if s.Config.CRE().EnableDKGRecipient() {
+		err2 := app.GetKeyStore().DKGRecipient().EnsureKey(rootCtx)
+		if err2 != nil {
+			return errors.Wrap(err2, "failed to ensure dkg recipient key")
+		}
+	}
+
 	err2 := app.GetKeyStore().Workflow().EnsureKey(rootCtx)
 	if err2 != nil {
 		return errors.Wrap(err2, "failed to ensure workflow key")

core/config/cre_config.go

@@ -7,6 +7,7 @@ type CRE interface {
 	StreamsAPISecret() string
 	WorkflowFetcher() WorkflowFetcher
 	UseLocalTimeProvider() bool
+	EnableDKGRecipient() bool
 	Linking() CRELinking
 }
 

core/config/docs/core.toml

@@ -891,3 +891,5 @@ IgnoreJoblessBridges = false # Default
 [CRE]
 # UseLocalTimeProvider should be set true if the DON Time OCR Plugin is not running
 UseLocalTimeProvider = true # Default
+# EnableDKGRecipient should be set to true if the DON runs a capability that uses a DKG result package.
+EnableDKGRecipient = false # Default

core/config/toml/types.go

@@ -1826,6 +1826,7 @@ type CreConfig struct {
 	Streams              *StreamsConfig         `toml:",omitempty"`
 	WorkflowFetcher      *WorkflowFetcherConfig `toml:",omitempty"`
 	UseLocalTimeProvider *bool                  `toml:",omitempty"`
+	EnableDKGRecipient   *bool                  `toml:",omitempty"`
 	Linking              *LinkingConfig         `toml:",omitempty"`
 }
 
@@ -1868,6 +1869,10 @@ func (c *CreConfig) setFrom(f *CreConfig) {
 		}
 	}
 
+	if f.EnableDKGRecipient != nil {
+		c.EnableDKGRecipient = f.EnableDKGRecipient
+	}
+
 	if f.Linking != nil {
 		if c.Linking == nil {
 			c.Linking = &LinkingConfig{}

core/scripts/cre/environment/configs/workflow-don.toml

@@ -78,6 +78,9 @@
       TraceSampleRatio = 1
       HeartbeatInterval = '30s'
 
+      [CRE]
+      EnableDKGRecipient = true
+
       # Remove this bit to allow downloading workflows from remote sources
       [CRE.WorkflowFetcher]
       URL = "file:///home/chainlink/workflows"
@@ -102,6 +105,9 @@
       TraceSampleRatio = 1
       HeartbeatInterval = '30s'
 
+      [CRE]
+      EnableDKGRecipient = true
+
       # Remove this bit to allow downloading workflows from remote sources
       [CRE.WorkflowFetcher]
       URL = "file:///home/chainlink/workflows"
@@ -126,6 +132,9 @@
       TraceSampleRatio = 1
       HeartbeatInterval = '30s'
 
+      [CRE]
+      EnableDKGRecipient = true
+
       # Remove this bit to allow downloading workflows from remote sources
       [CRE.WorkflowFetcher]
       URL = "file:///home/chainlink/workflows"
@@ -150,6 +159,9 @@
       TraceSampleRatio = 1
       HeartbeatInterval = '30s'
 
+      [CRE]
+      EnableDKGRecipient = true
+
       # Remove this bit to allow downloading workflows from remote sources
       [CRE.WorkflowFetcher]
       URL = "file:///home/chainlink/workflows"
@@ -174,6 +186,9 @@
       TraceSampleRatio = 1
       HeartbeatInterval = '30s'
 
+      [CRE]
+      EnableDKGRecipient = true
+
       # Remove this bit to allow downloading workflows from remote sources
       [CRE.WorkflowFetcher]
       URL = "file:///home/chainlink/workflows"

core/scripts/cre/environment/configs/workflow-gateway-capabilities-don.toml

@@ -78,6 +78,9 @@
       TraceSampleRatio = 1
       HeartbeatInterval = '30s'
 
+      [CRE]
+      EnableDKGRecipient = true
+
       # Remove this bit to allow downloading workflows from remote sources
       [CRE.WorkflowFetcher]
       URL = "file:///home/chainlink/workflows"
@@ -125,6 +128,9 @@
       TraceSampleRatio = 1
       HeartbeatInterval = '30s'
 
+      [CRE]
+      EnableDKGRecipient = true
+
       # Remove this bit to allow downloading workflows from remote sources
       [CRE.WorkflowFetcher]
       URL = "file:///home/chainlink/workflows"
@@ -169,6 +175,9 @@
       TraceSampleRatio = 1
       HeartbeatInterval = '30s'
 
+      [CRE]
+      EnableDKGRecipient = true
+
       # Remove this bit to allow downloading workflows from remote sources
       [CRE.WorkflowFetcher]
       URL = "file:///home/chainlink/workflows"

core/scripts/cre/environment/configs/workflow-gateway-don.toml

@@ -77,6 +77,9 @@
       TraceSampleRatio = 1
       HeartbeatInterval = '30s'
 
+      [CRE]
+      EnableDKGRecipient = true
+
       # Remove this bit to allow downloading workflows from remote sources
       [CRE.WorkflowFetcher]
       URL = "file:///home/chainlink/workflows"
@@ -121,6 +124,9 @@
       TraceSampleRatio = 1
       HeartbeatInterval = '30s'
 
+      [CRE]
+      EnableDKGRecipient = true
+
       # Remove this bit to allow downloading workflows from remote sources
       [CRE.WorkflowFetcher]
       URL = "file:///home/chainlink/workflows"

core/scripts/go.mod

@@ -62,7 +62,7 @@ require (
 	github.com/smartcontractkit/chainlink/core/scripts/cre/environment/examples/workflows/v1/proof-of-reserve/web-trigger-based v0.0.0-20250826151008-ae5ec0ee6f2c
 	github.com/smartcontractkit/chainlink/system-tests/lib v0.0.0-00010101000000-000000000000
 	github.com/smartcontractkit/cre-sdk-go/capabilities/scheduler/cron v0.5.1-0.20250818141131-0b979c98bab0
-	github.com/smartcontractkit/libocr v0.0.0-20250707144819-babe0ec4e358
+	github.com/smartcontractkit/libocr v0.0.0-20250905115425-2785a5cee79d
 	github.com/spf13/cobra v1.9.1
 	github.com/spf13/viper v1.20.1
 	github.com/stretchr/testify v1.10.0
@@ -496,7 +496,7 @@ require (
 	github.com/smartcontractkit/freeport v0.1.3-0.20250716200817-cb5dfd0e369e // indirect
 	github.com/smartcontractkit/grpc-proxy v0.0.0-20240830132753-a7e17fec5ab7 // indirect
 	github.com/smartcontractkit/mcms v0.21.1 // indirect
-	github.com/smartcontractkit/smdkg v0.0.0-20250903155928-e3aafa244d2c // indirect
+	github.com/smartcontractkit/smdkg v0.0.0-20250905122113-4057e4fe4b25 // indirect
 	github.com/smartcontractkit/tdh2/go/ocr2/decryptionplugin v0.0.0-20241009055228-33d0c0bf38de // indirect
 	github.com/smartcontractkit/tdh2/go/tdh2 v0.0.0-20250624150019-e49f7e125e6b // indirect
 	github.com/smartcontractkit/wsrpc v0.8.5-0.20250502134807-c57d3d995945 // indirect

core/scripts/go.sum

@@ -1606,12 +1606,12 @@ github.com/smartcontractkit/freeport v0.1.3-0.20250716200817-cb5dfd0e369e h1:Hv9
 github.com/smartcontractkit/freeport v0.1.3-0.20250716200817-cb5dfd0e369e/go.mod h1:T4zH9R8R8lVWKfU7tUvYz2o2jMv1OpGCdpY2j2QZXzU=
 github.com/smartcontractkit/grpc-proxy v0.0.0-20240830132753-a7e17fec5ab7 h1:12ijqMM9tvYVEm+nR826WsrNi6zCKpwBhuApq127wHs=
 github.com/smartcontractkit/grpc-proxy v0.0.0-20240830132753-a7e17fec5ab7/go.mod h1:FX7/bVdoep147QQhsOPkYsPEXhGZjeYx6lBSaSXtZOA=
-github.com/smartcontractkit/libocr v0.0.0-20250707144819-babe0ec4e358 h1:+NVzR5LZVazRUunzVn34u+lwnpmn6NTVPCeZOVyQHLo=
-github.com/smartcontractkit/libocr v0.0.0-20250707144819-babe0ec4e358/go.mod h1:Acy3BTBxou83ooMESLO90s8PKSu7RvLCzwSTbxxfOK0=
+github.com/smartcontractkit/libocr v0.0.0-20250905115425-2785a5cee79d h1:/0/80Ic6wpKH5F1nwDoRj9+70IxXunvCyNcCkA+9ik0=
+github.com/smartcontractkit/libocr v0.0.0-20250905115425-2785a5cee79d/go.mod h1:Acy3BTBxou83ooMESLO90s8PKSu7RvLCzwSTbxxfOK0=
 github.com/smartcontractkit/mcms v0.21.1 h1:vbM1c45Hd526XTKdXy2G1YKlMyzyc+ybdPTK79UlkKg=
 github.com/smartcontractkit/mcms v0.21.1/go.mod h1:7bg4JECK7UHvXAJ7/kzvCNLzUu8JxKvvti3ko9y3FpI=
-github.com/smartcontractkit/smdkg v0.0.0-20250903155928-e3aafa244d2c h1:JDHhQI9dEjNPHunm3e/jkSSucmjys6DAIbPdqh4YqUQ=
-github.com/smartcontractkit/smdkg v0.0.0-20250903155928-e3aafa244d2c/go.mod h1:+Qyxna/keiBLLgfsU787llNiGRyz9rijuEmlCXeZj60=
+github.com/smartcontractkit/smdkg v0.0.0-20250905122113-4057e4fe4b25 h1:zxZHMnCEjSfQYq9vzWUZncikyAy971yU7GsviXVGmLM=
+github.com/smartcontractkit/smdkg v0.0.0-20250905122113-4057e4fe4b25/go.mod h1:Cxtf6GUlIhyQRT6BSl39VhPOySGgsB85nmYGiICDnAs=
 github.com/smartcontractkit/tdh2/go/ocr2/decryptionplugin v0.0.0-20241009055228-33d0c0bf38de h1:n0w0rKF+SVM+S3WNlup6uabXj2zFlFNfrlsKCMMb/co=
 github.com/smartcontractkit/tdh2/go/ocr2/decryptionplugin v0.0.0-20241009055228-33d0c0bf38de/go.mod h1:Sl2MF/Fp3fgJIVzhdGhmZZX2BlnM0oUUyBP4s4xYb6o=
 github.com/smartcontractkit/tdh2/go/tdh2 v0.0.0-20250624150019-e49f7e125e6b h1:hN0Aqc20PTMGkYzqJGKIZCZMR4RoFlI85WpbK9fKIns=

core/services/chainlink/application.go

@@ -668,6 +668,7 @@ func NewApplication(ctx context.Context, opts ApplicationOpts) (Application, err
 				Ks:                             keyStore.OCR2(),
 				EthKs:                          keyStore.Eth(),
 				WorkflowKs:                     keyStore.Workflow(),
+				DKGRecipientKs:                 keyStore.DKGRecipient(),
 				Relayers:                       relayChainInterops,
 				MailMon:                        mailMon,
 				CapabilitiesRegistry:           opts.CapabilitiesRegistry,

core/services/chainlink/config_cre.go

@@ -60,6 +60,13 @@ func (c *creConfig) UseLocalTimeProvider() bool {
 	return *c.c.UseLocalTimeProvider
 }
 
+func (c *creConfig) EnableDKGRecipient() bool {
+	if c.c.EnableDKGRecipient == nil {
+		return false
+	}
+	return *c.c.EnableDKGRecipient
+}
+
 type linkingConfig struct {
 	url        string
 	tlsEnabled bool

core/services/chainlink/config_cre_test.go

@@ -20,6 +20,9 @@ APISecret = "streams-api-secret"
 RestURL = "streams.url"
 WsURL = "streams.url"
 
+[CRE]
+EnableDKGRecipient = true
+
 [CRE.WorkflowFetcher]
 URL = "http://workflow-server.example.com/workflows"
 `
@@ -43,6 +46,7 @@ func TestCREConfig(t *testing.T) {
 	assert.Equal(t, "streams-api-secret", c.StreamsAPISecret())
 	assert.Equal(t, "streams.url", c.WsURL())
 	assert.Equal(t, "streams.url", c.RestURL())
+	assert.True(t, c.EnableDKGRecipient())
 
 	// Test the new WorkflowFetcher URL
 	fetcher := c.WorkflowFetcher()

core/services/chainlink/config_test.go

@@ -614,6 +614,7 @@ func TestConfig_Marshal(t *testing.T) {
 	}
 	full.CRE = toml.CreConfig{
 		UseLocalTimeProvider: ptr(true),
+		EnableDKGRecipient:   ptr(false),
 		Streams: &toml.StreamsConfig{
 			WsURL:   ptr("streams.url"),
 			RestURL: ptr("streams.url"),

core/services/chainlink/testdata/config-empty-effective.toml

@@ -360,6 +360,7 @@ PerOwner = 200
 
 [CRE]
 UseLocalTimeProvider = true
+EnableDKGRecipient = false
 
 [CRE.Streams]
 WsURL = ''

core/services/chainlink/testdata/config-full.toml

@@ -374,6 +374,7 @@ PerOwner = 200
 
 [CRE]
 UseLocalTimeProvider = true
+EnableDKGRecipient = false
 
 [CRE.Streams]
 WsURL = 'streams.url'

core/services/chainlink/testdata/config-multi-chain-effective.toml

@@ -360,6 +360,7 @@ PerOwner = 200
 
 [CRE]
 UseLocalTimeProvider = true
+EnableDKGRecipient = false
 
 [CRE.Streams]
 WsURL = ''

core/services/keystore/keystoretest.go

@@ -63,19 +63,20 @@ func NewInMemory(ds sqlutil.DataSource, scryptParams utils.ScryptParams, logf Lo
 	}
 
 	return &master{
-		keyManager: km,
-		cosmos:     newCosmosKeyStore(km),
-		csa:        newCSAKeyStore(km),
-		eth:        newEthKeyStore(km, dbORM, ds),
-		ocr:        newOCRKeyStore(km),
-		ocr2:       newOCR2KeyStore(km),
-		p2p:        newP2PKeyStore(km),
-		solana:     newSolanaKeyStore(km),
-		starknet:   newStarkNetKeyStore(km),
-		aptos:      newAptosKeyStore(km),
-		tron:       newTronKeyStore(km),
-		ton:        newTONKeyStore(km),
-		vrf:        newVRFKeyStore(km),
-		workflow:   newWorkflowKeyStore(km),
+		keyManager:   km,
+		cosmos:       newCosmosKeyStore(km),
+		csa:          newCSAKeyStore(km),
+		eth:          newEthKeyStore(km, dbORM, ds),
+		ocr:          newOCRKeyStore(km),
+		ocr2:         newOCR2KeyStore(km),
+		p2p:          newP2PKeyStore(km),
+		solana:       newSolanaKeyStore(km),
+		starknet:     newStarkNetKeyStore(km),
+		aptos:        newAptosKeyStore(km),
+		tron:         newTronKeyStore(km),
+		ton:          newTONKeyStore(km),
+		vrf:          newVRFKeyStore(km),
+		workflow:     newWorkflowKeyStore(km),
+		dkgRecipient: newDKGRecipientKeyStore(km),
 	}
 }

core/services/ocr2/delegate.go

@@ -135,6 +135,7 @@ type Delegate struct {
 	ks                    keystore.OCR2
 	ethKs                 keystore.Eth
 	workflowKs            keystore.Workflow
+	dkgRecipientKs        keystore.DKGRecipient
 	RelayGetter
 	isNewlyCreatedJob     bool // Set to true if this is a new job freshly added, false if job was present already on node boot.
 	mailMon               *mailbox.Monitor
@@ -256,6 +257,7 @@ type DelegateOpts struct {
 	RetirementReportCache          retirement.RetirementReportCache
 	GatewayConnectorServiceWrapper *gatewayconnector.ServiceWrapper
 	WorkflowKs                     keystore.Workflow
+	DKGRecipientKs                 keystore.DKGRecipient
 	WorkflowRegistrySyncer         syncerV2.WorkflowRegistrySyncer
 }
 
@@ -278,6 +280,7 @@ func NewDelegate(
 		ks:                             opts.Ks,
 		ethKs:                          opts.EthKs,
 		workflowKs:                     opts.WorkflowKs,
+		dkgRecipientKs:                 opts.DKGRecipientKs,
 		RelayGetter:                    opts.Relayers,
 		isNewlyCreatedJob:              false,
 		mailMon:                        opts.MailMon,
@@ -685,6 +688,15 @@ func (d *Delegate) newServicesVaultPlugin(
 		return nil, errors.New("failed to instantiate vault plugin: gateway service wrapper is not configured")
 	}
 
+	dkgRecipientKeys, err := d.dkgRecipientKs.GetAll()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get DKG recipient keys: %w", err)
+	}
+	if len(dkgRecipientKeys) == 0 {
+		return nil, errors.New("failed to instantiate vault plugin: no DKG recipient keys found")
+	}
+	dkgRecipientKey := dkgRecipientKeys[0]
+
 	gwconnector := wrapper.GetGatewayConnector()
 	if gwconnector == nil {
 		return nil, errors.New("failed to instantiate vault plugin: gateway connector is not set")
@@ -796,7 +808,7 @@ func (d *Delegate) newServicesVaultPlugin(
 	if err != nil {
 		return nil, fmt.Errorf("failed to instantiate vault plugin: failed to get DKG keys: %w", err)
 	}
-	rpf, err := vaultocrplugin.NewReportingPluginFactory(lggr, requestStore, pk, secKeyShare)
+	rpf, err := vaultocrplugin.NewReportingPluginFactory(lggr, requestStore, nil, &dkgRecipientKey, pk, secKeyShare)
 	if err != nil {
 		return nil, fmt.Errorf("failed to instantiate vault plugin: failed to create reporting plugin factory: %w", err)
 	}