Skip to content

[Draft] Feat/relay cosigner#157

Closed
anhthii wants to merge 23 commits intomasterfrom
feat/relay-cosigner
Closed

[Draft] Feat/relay cosigner#157
anhthii wants to merge 23 commits intomasterfrom
feat/relay-cosigner

Conversation

@anhthii
Copy link
Copy Markdown
Contributor

@anhthii anhthii commented Apr 18, 2026

No description provided.

…ssion management, and participant event processing. Update Go module version and dependencies. Add README documentation for the coordinator and its components.
…entity management, and session handling. Introduce badger storage for session artifacts and implement NATS messaging topics for peer communication.
…mes, including YAML configuration files. Introduce a coordinator client for key generation requests and enhance logging throughout the runtime processes. Update .gitignore to include new configuration files.
…ntity handling. Introduce validation and default application for configuration parameters. Implement transport abstraction for NATS messaging, improving session management and peer communication. Add new interfaces for storage management of preparams, shares, and session artifacts.
…ludes source file name. Update Error function to skip an additional stack frame for accurate caller reporting.
…. Introduce Relay interface for unified messaging operations, enhancing configuration management and session handling. Update runtime to utilize relay abstraction, improving flexibility and maintainability.
…duce configuration management for relay settings, including credential loading and topic mapping. Implement runtime for handling MQTT and NATS messaging, enhancing session management and peer communication.
…type. Enhance NATS relay initialization with TLS support and credential management. Update validation logic to ensure required fields are checked for NATS relay provider.
…introduce ECDSA preparams handling. Update .gitignore to include new configuration files and dependencies. Improve session management with default values for configuration parameters.
… initialization and improving key generation request handling. Introduce UUID-based wallet ID generation and update validation logic to ensure proper session management. Refactor configuration management to apply default values and validate required fields, enhancing overall robustness.
…ement request and validation logic for signing operations, including participant management and session handling. Enhance client functionality with detailed error logging and timeout management for improved reliability.
… signing examples to use hex decoding for public keys. Enhance error messages in coordinator validation logic for better clarity. Improve logging in cosigner runtime to include identity public key in startup messages.
…cosigners. Include configuration details, run order, and troubleshooting steps for coordinator, relay, and cosigner nodes.
…and various source files. This change ensures consistency in the usage of the mpcium-sdk across the project.
…ls on directory structure and `go.mod` replace directive for seamless integration of the SDK during local development.
@socket-security
Copy link
Copy Markdown

socket-security Bot commented Apr 18, 2026

@gitguardian
Copy link
Copy Markdown

gitguardian Bot commented Apr 18, 2026

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request
GitGuardian id GitGuardian status Secret Commit Filename
30450280 Triggered Generic High Entropy Secret d36a786 coordinator.config.yaml View secret
🛠 Guidelines to remediate hardcoded secrets
  1. Understand the implications of revoking this secret by investigating where it is used in your code.
  2. Replace and store your secret safely. Learn here the best practices.
  3. Revoke and rotate this secret.
  4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider


🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Introduce composable runtime startup with optional gRPC orchestration transport, extend coordinator config/runtime plumbing, and support dual-protocol keygen result aggregation in coordinator state handling.

Made-with: Cursor
Allow the coordinator client and example flows to submit keygen/sign requests and await results over gRPC while keeping NATS transport compatibility and adding dedicated gRPC client tests.

Made-with: Cursor
Clarify that gRPC is used for client orchestration while participant transport, control fan-out, and session/result messaging remain on NATS and relay paths.

Made-with: Cursor
Enhance the sessionToProtoResult function to include ECDSA and EdDSA public keys in the gRPC response. Update the coordinator client to decode and return these keys in the session result structure, improving the key sharing capabilities of the client.
Enhance coordinator dual-protocol keygen flow to reuse existing wallet protocol keys, publish a stable aggregate result, and expand integration-style tests for gRPC and NATS request/result behavior.

Made-with: Cursor
Protect session transitions with operation-level locking and buffer peer MPC packets that arrive before local party startup, then flush them safely when MPC begins.

Made-with: Cursor
Trim and normalize protocol values in NATS/gRPC keygen requests, add transport-level coverage for empty and "both" protocol inputs, and update the keygen example to use NATS aggregated key output.

Made-with: Cursor
…structure. Update related functions and tests to accommodate changes from KeyShare to Keygen, ensuring consistency across the codebase.
@sonarqubecloud
Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
3.7% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

@socket-security
Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
High CVE: NATS allows MQTT clients to bypass ACL checks in golang github.com/nats-io/nats-server/v2

CVE: GHSA-jxxm-27vp-c3m5 NATS allows MQTT clients to bypass ACL checks (HIGH)

Affected versions: < 2.11.15; >= 2.12.0-RC.1 < 2.12.6

Patched version: 2.11.15

From: go.modgolang/github.com/nats-io/nats-server/v2@v2.10.29

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/nats-io/nats-server/v2@v2.10.29. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
High CVE: NATS credentials are exposed in monitoring port via command-line argv in golang github.com/nats-io/nats-server/v2

CVE: GHSA-x6g4-f6q3-fqvv NATS credentials are exposed in monitoring port via command-line argv (HIGH)

Affected versions: < 2.11.15; >= 2.12.0-RC.1 < 2.12.6

Patched version: 2.11.15

From: go.modgolang/github.com/nats-io/nats-server/v2@v2.10.29

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/nats-io/nats-server/v2@v2.10.29. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
High CVE: NATS has pre-auth server panic via leafnode handling in golang github.com/nats-io/nats-server/v2

CVE: GHSA-vprv-35vv-q339 NATS has pre-auth server panic via leafnode handling (HIGH)

Affected versions: < 2.11.15; >= 2.12.0-RC.1 < 2.12.6

Patched version: 2.11.15

From: go.modgolang/github.com/nats-io/nats-server/v2@v2.10.29

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/nats-io/nats-server/v2@v2.10.29. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
High CVE: NATS Server panic via malicious compression on leafnode port in golang github.com/nats-io/nats-server/v2

CVE: GHSA-52jh-2xxh-pwh6 NATS Server panic via malicious compression on leafnode port (HIGH)

Affected versions: < 2.11.14; >= 2.12.0-RC.1 < 2.12.5

Patched version: 2.11.14

From: go.modgolang/github.com/nats-io/nats-server/v2@v2.10.29

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/nats-io/nats-server/v2@v2.10.29. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
High CVE: NATS has MQTT plaintext password disclosure in golang github.com/nats-io/nats-server/v2

CVE: GHSA-v722-jcv5-w7mc NATS has MQTT plaintext password disclosure (HIGH)

Affected versions: < 2.11.15; >= 2.12.0-RC.1 < 2.12.6

Patched version: 2.11.15

From: go.modgolang/github.com/nats-io/nats-server/v2@v2.10.29

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/nats-io/nats-server/v2@v2.10.29. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
High CVE: NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead in golang github.com/nats-io/nats-server/v2

CVE: GHSA-pq2q-rcw4-3hr6 NATS: Pre-auth remote server crash via WebSocket frame length overflow in wsRead (HIGH)

Affected versions: >= 2.2.0 < 2.11.14; >= 2.12.0 < 2.12.5

Patched version: 2.11.14

From: go.modgolang/github.com/nats-io/nats-server/v2@v2.10.29

ℹ Read more on: This package | This alert | What is a CVE?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore golang/github.com/nats-io/nats-server/v2@v2.10.29. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@anhthii anhthii closed this Apr 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants