[ARCH-332] KMS keystore support by connorwstein · Pull Request #1767 · smartcontractkit/chainlink-common

connorwstein · 2026-01-12T21:44:22Z

It seems ed25519 is now also supported in KMS. Will add in a follow up.

Confirmed CLI works against real KMS in staging.

github-actions · 2026-01-12T21:45:30Z

✅ API Diff Results - No breaking changes

connorwstein · 2026-01-12T22:01:53Z

+	"github.com/ethereum/go-ethereum/crypto/secp256k1"
+)
+
+// SPKI represents the SubjectPublicKeyInfo structure as defined in [RFC 5280] in ASN.1 format.


This is partially lifted from https://github.com/smartcontractkit/chainlink-deployments-framework/blob/main/chain/evm/provider/kms_signer.go, however with the following changes:

Ethereum specific terminology removed. SEC1 is a format thats used in Ethereums and blockchains in general, but its not ethereum specific.

Added SEC1->ASN1 conversion functions as well so we can just round trip test converting sig/pubkeys between the 2 formats.

Originally I was going to keep it internal, but if I export the helpers then I can remove the second impl in chainlink-deployments-framework.

connorwstein · 2026-01-12T22:04:22Z

+	kmslib "github.com/aws/aws-sdk-go/service/kms"
+)
+
+// Client is an interface that defines the methods for interacting with AWS KMS. We only expose


Similar to whats used in CLD, except I exposed another 2 functions to allow for the Reader interface to be implemented. I also dropped the region stuff, that can be specified in the AWS profile so seems simpler to just let people specify that there.

connorwstein · 2026-01-12T22:05:27Z

+	KeyID      string
+}
+
+func NewFakeKMSClient(keys []Key) (*FakeKMSClient, error) {


A fake seemed to fit well here instead of mocking/mockery

connorwstein · 2026-01-12T22:11:38Z

 		Short:        "CLI for managing keystore keys",
 		SilenceUsage: true,
 	}
-	cmd.PersistentFlags().String("file-path", "", "Overrides KEYSTORE_FILE_PATH environment variable")


On second thought I don't think these are worth the trouble just removing them (would have to add another one for KMS too).

connorwstein · 2026-01-12T22:12:10Z

-	cmd.PersistentFlags().String("password", "", "Overrides KEYSTORE_PASSWORD environment variable. Not recommended as will leave shell traces.")

-	cmd.AddCommand(NewListCmd(), NewGetCmd(), NewCreateCmd(), NewDeleteCmd(), NewExportCmd(), NewImportCmd(), NewSetMetadataCmd(), NewSignCmd(), NewVerifyCmd(), NewEncryptCmd(), NewDecryptCmd())
+	// Check if KMS profile is set - if so, hide commands that don't work with KMS


CLI can't be used to create KMS keys, so we hide admin intf

pavel-raykov · 2026-01-13T13:29:42Z

+
+// padTo32Bytes pads the given byte slice to 32 bytes by trimming leading zeros and prepending
+// zeros.
+func padTo32Bytes(buffer []byte) []byte {


sorry, what would this function do with make([]byte, 32) input? Will it 1. first trim each of the 32 bytes since they are zero, and 2. then readd each zero byte to the slice?

yeah it would, I suppose it could be optimized for that specific case. But doesn't seem worth the trouble

timweri · 2026-01-14T16:01:47Z

+		}
+
+		keys = append(keys, keystore.GetKeyResponse{
+			KeyInfo: keystore.KeyInfo{


Should newKeyInfo be used instead?

its unexported right now from the main package, I think we could export it though and use it. Can do in the next PR (planning to add ed25519 support for KMS next)

timweri · 2026-01-14T16:04:04Z

+	kmsProfile := os.Getenv("KEYSTORE_KMS_PROFILE")
+	if kmsProfile != "" {
+		client, err := kms.NewClient(kmsProfile)


Would this work with KMS already set in the environment variables? For example, does this work with aws-vault, which I know a lot of people use to have AWS tokens in the Apple Keychain.

yes I believe so because the profile credentials are top of the priority stack. Haven't tested that, but I suspect the KMS pointer/config may need to iterate a bit as we try it out in different scenarios

connorwstein added 7 commits January 12, 2026 14:17

Wip

bbc40a8

Simplify

4246278

Merge

9fb1bf9

Simpler

06974e6

Fix pubkey

c57dde6

Testing

3f33176

test

f976974

connorwstein temporarily deployed to integration January 12, 2026 21:44 — with GitHub Actions Inactive

Lint

a1fb546

connorwstein had a problem deploying to integration January 12, 2026 21:53 — with GitHub Actions Error

connorwstein temporarily deployed to integration January 12, 2026 21:53 — with GitHub Actions Inactive

Expore ASN utilities

9ce4cbd

connorwstein temporarily deployed to integration January 12, 2026 21:58 — with GitHub Actions Inactive

connorwstein commented Jan 12, 2026

View reviewed changes

Linter

de36f94

connorwstein had a problem deploying to integration January 12, 2026 22:10 — with GitHub Actions Error

Old cli thing

01bfee6

connorwstein temporarily deployed to integration January 12, 2026 22:11 — with GitHub Actions Inactive

connorwstein commented Jan 12, 2026

View reviewed changes

connorwstein temporarily deployed to integration January 12, 2026 22:35 — with GitHub Actions Inactive

Lint and simpler interface comp

77e4465

connorwstein had a problem deploying to integration January 12, 2026 23:02 — with GitHub Actions Failure

connorwstein temporarily deployed to integration January 12, 2026 23:02 — with GitHub Actions Inactive

connorwstein marked this pull request as ready for review January 12, 2026 23:03

connorwstein requested review from a team as code owners January 12, 2026 23:03

product-security-plaid-production Bot requested review from harry-anderson and jmank88 January 12, 2026 23:03

connorwstein requested a review from pavel-raykov January 12, 2026 23:17

pavel-raykov reviewed Jan 13, 2026

View reviewed changes

Comment thread keystore/kms/asn1.go Outdated

pavel-raykov reviewed Jan 13, 2026

View reviewed changes

Comments

22b739d

connorwstein had a problem deploying to integration January 13, 2026 16:15 — with GitHub Actions Error

Merge branch 'main' into ARCH-332-kms

b3fc120

pavel-raykov approved these changes Jan 13, 2026

View reviewed changes

connorwstein temporarily deployed to integration January 13, 2026 16:17 — with GitHub Actions Inactive

timweri reviewed Jan 14, 2026

View reviewed changes

jmank88 approved these changes Jan 14, 2026

View reviewed changes

connorwstein added this pull request to the merge queue Jan 14, 2026

Merged via the queue into main with commit 3ff7d6f Jan 14, 2026
35 of 36 checks passed

connorwstein deleted the ARCH-332-kms branch January 14, 2026 16:20

connorwstein mentioned this pull request Jan 15, 2026

ARCH-332 Part 2 KMS ed25519 support #1778

Merged

Conversation

connorwstein commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ API Diff Results - No breaking changes

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

connorwstein Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

connorwstein Jan 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

connorwstein commented Jan 12, 2026 •

edited

Loading

github-actions Bot commented Jan 12, 2026 •

edited

Loading

connorwstein Jan 12, 2026 •

edited

Loading

connorwstein Jan 12, 2026 •

edited

Loading