Replace Guardian Key with abstracted Guardian Signer #4120

pleasew8t · 2024-09-19T11:22:14Z

This pull request introduces the GuardianSigner interface, defined in the guardiansigner package, which is meant to replace directly using the guardian key (private key) for data signing. In doing so, it becomes easier to introduce alternative signing mechanisms without too much modification of code outside of the new guardiansigner package. Additional signing mechanisms include HSMs or KMS's (such as AWS or GCP).

The changes made to the repository are summarised as follows:

Introduction of the new guardiansigner package, which includes a FileSigner implementation that works with the current guardian key.
Addition of the --guardianSignerUri commandline argument. Node operators can still make use of guardianKeyPath, as support is provided to translate the path to the appropriate guardianSignerUri. As additional signer implementations are introduced, more URI schemes will be added. But for now only file:// is supported, loading a private key from disk.
Replace data signing that used the guardian key with signing using a GuardianSigner.

Notable Code Change

One change in the PR that we are not yet certain about is the use of AddSignature defined in sdk/vaa/structs.go. The changes in node/pkg/adminrpc/adminserver.go removed the use of AddSignature and adds the signature manually, to make use of a GuardianSigner. There were some alternative ideas surrounding this:

An alternative idea was to make AddSignature accept a GuardianSigner instead of a private key. This did not seem right, as it would create a dependency on the node packages that seems unneccessary, and also modify what is defined as an SDK, potentially breaking functionality for other projects that might make use of the SDK.

Additional comment by @johnsaigle that is also worth considering: #4120 (comment)

banescusebi

Just one edge case and some small nits

node/cmd/guardiand/node.go

node/pkg/guardiansigner/guardiansigner.go

johnsaigle

Left some minor comments related to naming and clarity. Overall the implementation looks good

node/cmd/guardiand/node.go

node/hack/accountant/send_obs.go

node/pkg/adminrpc/adminserver.go

node/pkg/guardiansigner/filesigner.go

node/pkg/guardiansigner/generatedsigner.go

node/pkg/guardiansigner/guardiansigner.go

node/pkg/guardiansigner/guardiansigner_test.go

johnsaigle · 2024-09-19T13:56:19Z

AddSignature in sdk/vaa/structs.go is now unused outside of tests. Should we mark it as deprecated? Are there any other related functions that should be deprecated now? Or we could go further and delete the code if the intention is that this new mechanism should totally replace the old one.

Another approach would be to rewrite this function to use the new Guardian signer though it would be a breaking change to modify the function signature.

djb15

Very cool!

node/cmd/guardiand/node.go

node/pkg/accountant/accountant.go

node/pkg/guardiansigner/filesigner.go

node/pkg/guardiansigner/guardiansigner.go

node/pkg/guardiansigner/guardiansigner_test.go

node/pkg/p2p/run_params.go

node/cmd/guardiand/node.go

node/pkg/guardiansigner/generatedsigner.go

node/pkg/guardiansigner/guardiansigner.go

SEJeff

All of my suggestions here are in general nits or things that make future maintenance a bit nicer. This is a nice clean implementation from all I see here. Nicely done sir! 🥳

node/cmd/guardiand/node.go

node/pkg/guardiansigner/filesigner.go

node/pkg/guardiansigner/generatedsigner.go

node/pkg/guardiansigner/guardiansigner_test.go

node/pkg/adminrpc/adminserver.go

node/pkg/adminrpc/adminserver_test.go

node/pkg/guardiansigner/guardiansigner_test.go

…ion#4103) The `set -u` options in these scripts caused them to fail with 'unbound variable' errors when CLI args or env variables were unset. This commit fixes the validation so that the scripts output usage info or helpful errors instead of exiting with unbound variable errors that the user must read the source to diagnose. for the script `ethereum/sh/upgrade_all_testnet.sh`, the commit updates a variable name that appears incorrect. node/hack: Print potential USD stablecoins that appear depegged (wormhole-foundation#4130) * node/hack: Print potential USD stablecoins that appear depegged * PR feedback whitepapers: Clarify CCQ sol_pda support (wormhole-foundation#4129) GitHub: Update code owners for go sdk (wormhole-foundation#4133) Deploy Unichain testnet (wormhole-foundation#4134) * Deploy Unichain testnet * Add snaxchain to proto node: Governor token list update (wormhole-foundation#4126) * node: governor token list update * Manually fix token price --------- Co-authored-by: djb15 <djb15@users.noreply.github.com> docs: Update SECURITY.md Replace Guardian Key with abstracted Guardian Signer (wormhole-foundation#4120) * node: add guardiansigner node/pkg * node: replace use of guardian key with guardian signer * node: replace use of vaa.AddSigner with guardian signer * node: add nolint for armor import and fix test * node: handle error returned from signing * apply draft review suggestions * apply pr reviews * apply pr reviews * apply pr reviews * apply pr reviews --------- Co-authored-by: pleasew8t <jason@asymmetric.re> Deploy Worldchain testnet (wormhole-foundation#4140) * Deploy Worldchain testnet * Update WETH address * Fix cli test and add token bridge VAAs add deprecation warning to the top of SDK readme (wormhole-foundation#4142) spy: respect --port if set (wormhole-foundation#4139) codeowners: Update for audits folder (wormhole-foundation#4144) Deploy Monad Devnet (wormhole-foundation#4145) * Deploy Monad Devnet * Code review rework docs: Audit reports (wormhole-foundation#4143) * docs: Audit reports * Rename cosmwasm: add wormchain ibc receiver tests (wormhole-foundation#4121) cosmwasm: add support for json schemas for all contracts (wormhole-foundation#4118) * cosmwasm: add support for json schemas for all contracts * cosmwasm: fixed formatting as per the linter Node: Remove cutover checks (wormhole-foundation#4149) Add interchaintest tests to wormchain

banescusebi reviewed Sep 19, 2024

View reviewed changes

johnsaigle reviewed Sep 19, 2024

View reviewed changes

pleasew8t marked this pull request as ready for review September 19, 2024 17:32

pleasew8t requested review from bruce-riley, panoel, evan-gray, claudijd, SEJeff and djb15 as code owners September 19, 2024 17:32

djb15 reviewed Sep 24, 2024

View reviewed changes

bruce-riley reviewed Sep 30, 2024

View reviewed changes

node/cmd/guardiand/node.go Show resolved Hide resolved

bruce-riley reviewed Oct 1, 2024

View reviewed changes

node/pkg/guardiansigner/generatedsigner.go Show resolved Hide resolved

bruce-riley reviewed Oct 2, 2024

View reviewed changes

node/pkg/guardiansigner/guardiansigner.go Outdated Show resolved Hide resolved

bruce-riley previously approved these changes Oct 2, 2024

View reviewed changes

pleasew8t dismissed bruce-riley’s stale review via 13e82f8 October 3, 2024 19:49

pleasew8t requested a review from kev1n-peters as a code owner October 3, 2024 20:15

pleasew8t force-pushed the replace-guardian-key-with-abstracted-guardian-signer branch 2 times, most recently from 13e82f8 to 32fa31d Compare October 3, 2024 20:31

bruce-riley reviewed Oct 8, 2024

View reviewed changes

node/pkg/guardiansigner/guardiansigner.go Outdated Show resolved Hide resolved

bruce-riley previously approved these changes Oct 8, 2024

View reviewed changes

djb15 previously approved these changes Oct 8, 2024

View reviewed changes

SEJeff previously approved these changes Oct 14, 2024

View reviewed changes

pleasew8t dismissed stale reviews from SEJeff, djb15, and bruce-riley via 5c19304 October 16, 2024 05:49

pleasew8t added 4 commits October 16, 2024 07:50

node: add guardiansigner node/pkg

0cf74a2

node: replace use of guardian key with guardian signer

65fede3

node: replace use of vaa.AddSigner with guardian signer

2c1435c

node: add nolint for armor import and fix test

a9b08f1

pleasew8t added 6 commits October 16, 2024 07:50

node: handle error returned from signing

ae64048

apply draft review suggestions

fc00bd9

apply pr reviews

729e28a

apply pr reviews

0b82ab0

apply pr reviews

2277e73

apply pr reviews

63ee311

pleasew8t force-pushed the replace-guardian-key-with-abstracted-guardian-signer branch from 5c19304 to 63ee311 Compare October 16, 2024 05:50

djb15 approved these changes Oct 16, 2024

View reviewed changes

bruce-riley approved these changes Oct 17, 2024

View reviewed changes

pleasew8t merged commit e82db71 into wormhole-foundation:main Oct 17, 2024
24 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Replace Guardian Key with abstracted Guardian Signer #4120

Replace Guardian Key with abstracted Guardian Signer #4120

pleasew8t commented Sep 19, 2024 •

edited

Loading

banescusebi left a comment

johnsaigle left a comment

johnsaigle commented Sep 19, 2024 •

edited

Loading

djb15 left a comment

SEJeff left a comment

Replace Guardian Key with abstracted Guardian Signer #4120

Replace Guardian Key with abstracted Guardian Signer #4120

Conversation

pleasew8t commented Sep 19, 2024 • edited Loading

Notable Code Change

banescusebi left a comment

Choose a reason for hiding this comment

johnsaigle left a comment

Choose a reason for hiding this comment

johnsaigle commented Sep 19, 2024 • edited Loading

djb15 left a comment

Choose a reason for hiding this comment

SEJeff left a comment

Choose a reason for hiding this comment

pleasew8t commented Sep 19, 2024 •

edited

Loading

johnsaigle commented Sep 19, 2024 •

edited

Loading