arkd-signer: native ArkadeScript signing via emulator library#1122
Draft
Kukks wants to merge 13 commits into
Draft
arkd-signer: native ArkadeScript signing via emulator library#1122Kukks wants to merge 13 commits into
Kukks wants to merge 13 commits into
Conversation
- go.mod: require + replace for emulator/pkg/emulator, emulator/pkg/arkade, emulator/api-spec; all pointing to C:/Git/_emulator_ref local paths. grpchandler is a sub-package of pkg/emulator (no separate module). - config: add ComputeLimits field parsed from ARKD_SIGNER_EMULATOR_COMPUTE_LIMITS (empty => DefaultComputeLimits(), OPCODE=limit overrides via OpcodeByName map). - config_test: add TestComputeLimitsDefault asserting non-nil ComputeLimits.
…Service
- config: build emulator.Service in initServices() with nil finalizer
(signing-only). Converts []DeprecatedSignerKey -> []*btcec.PrivateKey.
Sets arkdPubKey = our own operator pubkey so SubmitOnchainTx rejects
inputs that also contain the arkd signer key.
- service.go Start(): register grpchandler.New("", emulatorSvc) as
EmulatorServiceServer and wire REST gateway handler beside the signer.
- emulator_signing_test.go: TestEmulatorGetInfoReturnsOperatorPubkey
constructs emulator.New with nil finalizer, asserts GetInfo returns the
operator pubkey both via the Service interface and via the gRPC handler.
TestArkdSignerSignsOnchainArkade builds a fully synthetic PSBT — no explorer, no chain access — by deriving the funding txid directly from prevoutTx.TxHash(). The prevout tx uses a coinbase-style input to avoid the btcd segwit-marker ambiguity that causes MsgTx.Deserialize to fail on zero-input transactions. Asserts that SubmitOnchainTx produces a TaprootScriptSpendSig entry keyed by the arkade-tweaked operator pubkey.
Root gains gnark-crypto (VM pairing) + the 3 emulator modules; no go-sdk. The emulator replaces point to a local checkout for dev; switch to the released tag before opening the PR.
Switch the 3 emulator modules (pkg/emulator, pkg/arkade, api-spec) from local dev replaces to pseudo-versions off the arkade-library-export branch (emulator#102). Repoint to the merged commit once #102 lands.
Contributor
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Add TestArkdSignerEmulatorOnchainSigning to internal/test/e2e that dials the running arkd-signer gRPC service (localhost:6061, insecure h2c) and exercises SubmitOnchainTx end-to-end with a synthetic onchain ArkadeScript spend PSBT built against the compose-default operator key. Asserts that the returned signed PSBT carries a TaprootScriptSpendSig for the tweaked operator key, proving the real server signs correctly. Also promotes emulator/api-spec and emulator/pkg/arkade from indirect to direct in go.mod (same pinned pseudo-version; no version bump). The compose port mapping 6061:6061 was already present and required no change.
Kukks
force-pushed
the
arkd-signer-emulator
branch
from
June 23, 2026 06:44
ba969fb to
e8ec560
Compare
…A1019 x/net 0.55 deprecates h2c.NewHandler; suppress SA1019 via golangci-lint exclusion. Mirrors the #1118 base fix; self-drops on rebase onto a bumped master.
Kukks
force-pushed
the
arkd-signer-emulator
branch
from
June 23, 2026 07:16
6c9b3ad to
4ea6916
Compare
Add offchain, intent, finalization-guard, and arkd-key-reject signing tests; fold the onchain test into emulator_signing_test.go as t.Run subtests. Wrap the initServices error with %w.
Bring in the updated base (merged with master). Conflicts in pkg/arkd-signer/config, both resolved: - config.go: keep the base's json:"-" redaction on SignerSvc and extend it to EmulatorSvc, which likewise holds the operator key; keep the added EmulatorSvc/ComputeLimits fields. - config_test.go: keep both TestComputeLimitsDefault and the base's TestConfigStringRedactsSecrets.
…essage
Bump the three emulator modules (api-spec, pkg/arkade, pkg/emulator)
from the 17dd9d4 pseudo-version to 24936ba, the current emulator#102
(arkade-library-export) tip.
emulator.Intent.Message is now the IntentMessage interface, so pass
&intent.RegisterMessage{} (Decode has a pointer receiver) in the
signing test.
Interim pin to the PR branch tip; repoint again to the squash/merge
commit once emulator#102 lands on master.
…tests parseComputeLimits now logs a WARN on each skipped entry (malformed pair, bad value, unknown opcode) instead of silently swallowing it, so an operator typo cannot quietly weaken the VM compute guard. Add TestArkdSignerEmulator/SharedKeyNeverSignsRawOperatorKey: in shared-key signing-only mode, with the raw operator pubkey in the vtxo closure next to the tweaked arkade key, the emulator must sign only its tweaked key and never the raw operator key. Locks that guarantee on the offchain path. Consolidate the compute-limit config test into a grouped TestComputeLimits (default/valid/malformed/unknown), and close EmulatorSvc on service Stop().
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Gives
arkd-signernative ArkadeScript signing for all four spend shapes (onchain, offchain-tx, intent, finalization), signing-only, by importing the emulator as a library (emulator#102) instead of running a separate emulator process.emulator.Servicewith the operator key, arkd-signer's own pubkey asarkdPubKey, and a nil finalizer (signing-only — no arkd round-trip, no go-sdk).EmulatorService(+ REST gateway) on arkd-signer's existing gRPC server, next toSignerService.SignerService).ARKD_SIGNER_EMULATOR_COMPUTE_LIMITS(optional VM caps); noARKD_SIGNER_ARKD_URL.go.modgainsgnark-crypto(the VM's pairing) only — no go-sdk.Compatibility
signerv1/emulatorv1wire-protocol changes.Testing
pkg/arkd-signerunit tests pass, incl. a synthetic onchain arkade-signing test asserting the tweaked-key signature (no Nigiri).internal/test/e2e): dials the running arkd-signer'semulatorv1SubmitOnchainTxand round-trips an onchain arkade spend, asserting the tweaked-key signature — exercised by the Nigiri integration suites (postgres/redis + sqlite/badger).cmd/arkd-signer+arkd+./...cross-build (linux/amd64).go.mod/go.sum.Before un-drafting
masteronce Extract standalone arkd-signer + shared txsigner lib (BREAKING: ARKD_SIGNER_ADDR required) #1118 merges.CI note — repo-wide security bump (self-dropping): This branch also carries a
golang.org/x/crypto→v0.52.0 /golang.org/x/net→v0.55.0 bump across all 10 modules, clearing a newly-published Trivy CVE batch (x/crypto/ssh+x/net/html) that was failing every arkd build (master included).x/net0.55 deprecatesh2c.NewHandler, so SA1019 is suppressed via a targeted.golangci.ymlexclusion (not inline//nolint, which trips the golines length limit). The bump is shared with #1118 and self-drops when this rebases onto amasterthat already carries it. Migrating offh2ctohttp.Server’sProtocolsfield is a tracked follow-up.