feat(awskms): add awskms support for grpc signing by mattac21 · Pull Request #11 · cosmos/kms

mattac21 · 2026-06-23T21:29:13Z

No description provided.

…med Backend, freeing up the name Signer for the implementors of the Signing interface

greptile-apps · 2026-06-23T21:40:21Z

Greptile Summary

This PR wires AWS KMS as a signing backend for the gRPC SignerService, complementing the existing consensus (privval) path. It also applies a consistent Backend rename across file, awskms, and pkcs11 packages to distinguish consensus-path types from the new gRPC Signer adapter.

New awskms.Signer (signing/awskms/signer.go) adapts *Backend to signing.Signer; OpenSigner rejects non-ed25519 algorithms before any AWS call and delegates Sign/PubKey/Close to the wrapped backend.
BuildGRPC extended with a closers/deferred-cleanup pattern matching Build, awskms support in newGRPCSigner, and a returned cleanup func() consumed by main.go.
validateGRPC now resolves and writes back the absolute key_file path for file-backend keys (closing the asymmetry noted in a prior review), and validates awskms keys with the same key_id/algorithm checks used by the consensus path.

Confidence Score: 5/5

Safe to merge; the new awskms gRPC path follows the same cleanup, validation, and error-return conventions as the established consensus path.

The cleanup-on-error pattern in BuildGRPC mirrors Build exactly (deferred func checks the named return err). Path resolution for file-backend gRPC keys is now done once in validateGRPC and written back, so newGRPCSigner correctly consumes the absolute path without a second AbsPath call. The awskms.Signer adapter is thin and correct — it reuses the Backend's cached public key and Sign path, and the compile-time interface assertion in signer.go guards all implementations. No logic errors were found in the changed paths.

No files require special attention.

Important Files Changed

Filename	Overview
signing/awskms/signer.go	New adapter wrapping Backend to satisfy the gRPC signing.Signer interface; correctly delegates PubKey, Scheme, Sign, and Close. OpenSigner adds a guard rejecting non-ed25519 algorithms before any AWS call.
internal/app/build.go	BuildGRPC gains awskms support and a closers/cleanup pattern matching Build; deferred cleanup on error prevents leaks; newGRPCSigner now resolves file paths via Validate rather than an inline AbsPath call.
config/validate.go	validateGRPC extended with awskms backend validation; file key now resolves and writes back the absolute path (k.KeyFile = AbsPath), closing the asymmetry noted in the prior review thread.
signing/signer.go	Adds Close() error to the signing.Signer interface; all existing implementations (file, awskms, memEd25519 in tests) already have no-op implementations, and the compile-time assertion in server_test.go enforces the contract.
internal/app/build_awskms_test.go	Splits the existing test into consensus/grpc sub-tests; grpc sub-test discards the cleanup function without registering it with t.Cleanup, inconsistent with the consensus sub-test pattern.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant main as cmd/kms/main.go
    participant build as app.BuildGRPC
    participant val as config.Validate
    participant ns as newGRPCSigner
    participant oss as awskms.OpenSigner
    participant kms as AWS KMS

    main->>val: cfg.Validate(home)
    val-->>main: ok (resolves key paths, validates key_id/algorithm)

    main->>build: BuildGRPC(cfg, home, logger)
    build->>build: setup closers + deferred cleanup
    loop for each grpc.key
        build->>ns: newGRPCSigner(home, k)
        alt "backend=awskms"
            ns->>oss: "OpenSigner(ctx, Config{KeyID, Region, ...})"
            oss->>kms: GetPublicKey(keyID)
            kms-->>oss: PublicKey bytes
            oss-->>ns: "*Signer"
        else "backend=file"
            ns-->>ns: file.LoadSecp256k1(k.KeyFile)
        end
        ns-->>build: signing.Signer
        build->>build: append to closers
    end
    build->>build: load TLS creds, grpc.NewServer, net.Listen
    build-->>main: gs, cleanupGRPC, lis, nil

    main->>main: defer cleanupGRPC()
    main->>main: defer gs.GracefulStop()
    main->>main: go gs.Serve(lis)

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant main as cmd/kms/main.go
    participant build as app.BuildGRPC
    participant val as config.Validate
    participant ns as newGRPCSigner
    participant oss as awskms.OpenSigner
    participant kms as AWS KMS

    main->>val: cfg.Validate(home)
    val-->>main: ok (resolves key paths, validates key_id/algorithm)

    main->>build: BuildGRPC(cfg, home, logger)
    build->>build: setup closers + deferred cleanup
    loop for each grpc.key
        build->>ns: newGRPCSigner(home, k)
        alt "backend=awskms"
            ns->>oss: "OpenSigner(ctx, Config{KeyID, Region, ...})"
            oss->>kms: GetPublicKey(keyID)
            kms-->>oss: PublicKey bytes
            oss-->>ns: "*Signer"
        else "backend=file"
            ns-->>ns: file.LoadSecp256k1(k.KeyFile)
        end
        ns-->>build: signing.Signer
        build->>build: append to closers
    end
    build->>build: load TLS creds, grpc.NewServer, net.Listen
    build-->>main: gs, cleanupGRPC, lis, nil

    main->>main: defer cleanupGRPC()
    main->>main: defer gs.GracefulStop()
    main->>main: go gs.Serve(lis)

_{Reviews (2): Last reviewed commit: "normalize config path for grpc key files..." | Re-trigger Greptile}

linear-code · 2026-06-23T21:40:30Z

FOU-365

…GRPC that main defers on shutdown

…or the consensus signer

mattac21 · 2026-06-25T16:55:01Z

@greptile review again and update your previous review

mattac21 · 2026-06-25T17:02:04Z

-// Signer is a file-backed Ed25519 key held in memory.
-type Signer struct {
+// Backend is a file-backed Ed25519 key held in memory.
+type Backend struct {


did a refactor of the existing implementors of the Backend interface. All of the implementors were named Signer, which as the obvious name for the implementors of the Signing interface. I changed the Backend implementors to be called Backend to free up the Signer name for my new structs.

mattac21 · 2026-06-25T17:03:18Z

+	// Close contains any logic that should be called on cleanup.
+	Close() error


not necessarily required until we get grpc signing support for pkcs11 keys, but ai kept flagging the asymmetry where we did not call close on the Signers on exit, so I added this and cleanup on exit of the grpc server that matches cleaning up the backends.

dhfang

I don't have full context on the motivation for starting with ed25519 support, but from what I understand this won't have any consumers. Validators don't rely on gRPC signing and we don't have solana relaying support planned yet. For the relayer and attestor we will rely on secp for the release.

swift1337 · 2026-06-26T09:55:23Z

+	ID        string  `yaml:"id"`
+	Backend   Backend `yaml:"backend"`   // "file" (default) | "awskms"
+	Algorithm string  `yaml:"algorithm"` // file: "secp256k1" (default); awskms: "ed25519" (default)
+	KeyID     string  `yaml:"key_id"`    // awskms: KMS id, ARN, or alias/<name>


Suggested change

KeyID string `yaml:"key_id"` // awskms: KMS id, ARN, or alias/<name>

AWSKeyID string `yaml:"aws_key_id"` // awskms: KMS id, ARN, or alias/<name>

swift1337 · 2026-06-26T09:59:35Z

-	KeyFile   string `yaml:"key_file"`
+	ID        string  `yaml:"id"`
+	Backend   Backend `yaml:"backend"`   // "file" (default) | "awskms"
+	Algorithm string  `yaml:"algorithm"` // file: "secp256k1" (default); awskms: "ed25519" (default)


ed26619 is relevant not only to AWS Keys

swift1337 · 2026-06-26T10:00:31Z

+		// gRPC keys carry their own (small) backend validation rather than sharing
+		// the consensus per-backend validators: only file and awskms are supported
+		// here, and a gRPC key is bound by id, not chain_ids.
+		if k.Backend == "" {


imo, we should explicitly fail if it's not specified. Even when the backend is "", we still need a key file path.

swift1337 · 2026-06-26T10:03:03Z

 // grpc config. Returns (nil, nil, nil) when no grpc block is configured.
 // The caller owns starting/stopping the server and closing the listener.
-func BuildGRPC(c *config.Config, home string, logger log.Logger) (*grpc.Server, net.Listener, error) {
+func BuildGRPC(c *config.Config, home string, logger log.Logger) (gs *grpc.Server, cleanup func(), lis net.Listener, err error) {


Can we wrap all of this into Server with s.Close(), s.Listener(), etc... and return only (*Server, error) ?

swift1337 · 2026-06-26T10:04:33Z

-		algo = "secp256k1"
+		switch be {
+		case config.BackendAWSKMS:
+			algo = "ed25519"


let' move all algo types to const Algo* eg AlgoSecp256k1 (applies to all files)

mattac21 added 3 commits June 23, 2026 16:39

rename Signer types (that implemented the Backend interface) to be na…

98f06b0

…med Backend, freeing up the name Signer for the implementors of the Signing interface

update config and config validation for awskms backed grpc signing

1308053

add awskms grpc signing for ed25519 keys

3b972c3

mattac21 requested a review from a team as a code owner June 23, 2026 21:29

greptile-apps Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread config/validate.go

mattac21 added 2 commits June 25, 2026 12:49

add Close to Signing interface and return cleanup function from Build…

ded89ae

…GRPC that main defers on shutdown

normalize config path for grpc key files to the absolute path, like f…

1f655ed

…or the consensus signer

mattac21 commented Jun 25, 2026

View reviewed changes

mattac21 requested review from dhfang and swift1337 June 25, 2026 17:42

dhfang reviewed Jun 26, 2026

View reviewed changes

swift1337 reviewed Jun 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(awskms): add awskms support for grpc signing#11

feat(awskms): add awskms support for grpc signing#11
mattac21 wants to merge 5 commits into
mainfrom
ma/aws-kms-grpc

mattac21 commented Jun 23, 2026

Uh oh!

greptile-apps Bot commented Jun 23, 2026 •

edited

Loading

Sequence Diagram

Uh oh!

Uh oh!

linear-code Bot commented Jun 23, 2026

Uh oh!

mattac21 commented Jun 25, 2026 •

edited

Loading

Uh oh!

mattac21 Jun 25, 2026

Uh oh!

mattac21 Jun 25, 2026

Uh oh!

dhfang left a comment •

edited

Loading

Uh oh!

swift1337 Jun 26, 2026

Uh oh!

swift1337 Jun 26, 2026

Uh oh!

swift1337 Jun 26, 2026

Uh oh!

swift1337 Jun 26, 2026

Uh oh!

swift1337 Jun 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		// Close contains any logic that should be called on cleanup.
		Close() error

	KeyID string `yaml:"key_id"` // awskms: KMS id, ARN, or alias/<name>
	AWSKeyID string `yaml:"aws_key_id"` // awskms: KMS id, ARN, or alias/<name>

Uh oh!

Conversation

mattac21 commented Jun 23, 2026

Uh oh!

greptile-apps Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

linear-code Bot commented Jun 23, 2026

Uh oh!

mattac21 commented Jun 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mattac21 Jun 25, 2026

Choose a reason for hiding this comment

Uh oh!

mattac21 Jun 25, 2026

Choose a reason for hiding this comment

Uh oh!

dhfang left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

swift1337 Jun 26, 2026

Choose a reason for hiding this comment

Uh oh!

swift1337 Jun 26, 2026

Choose a reason for hiding this comment

Uh oh!

swift1337 Jun 26, 2026

Choose a reason for hiding this comment

Uh oh!

swift1337 Jun 26, 2026

Choose a reason for hiding this comment

Uh oh!

swift1337 Jun 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

greptile-apps Bot commented Jun 23, 2026 •

edited

Loading

mattac21 commented Jun 25, 2026 •

edited

Loading

dhfang left a comment •

edited

Loading

swift1337 Jun 26, 2026 •

edited

Loading