From 222e0934a574b1a7df8562839ed2319a02259c36 Mon Sep 17 00:00:00 2001 From: Yoshihito Aso Date: Mon, 16 Mar 2026 12:04:38 +0900 Subject: [PATCH 1/5] Add AWS Secrets Manager/KMS node key support Add support for loading P2P node keys from AWS Secrets Manager with optional AWS KMS decryption. --- README.md | 5 ++ cmd/geth/main.go | 2 + cmd/utils/common/aws_client.go | 51 ++++++++++++++ cmd/utils/common/aws_client_test.go | 17 +++++ cmd/utils/flags.go | 67 ++++++++++++++++-- cmd/utils/nodekey/constants/constants.go | 11 +++ cmd/utils/nodekey/decrypter/aws_kms.go | 77 +++++++++++++++++++++ cmd/utils/nodekey/decrypter/aws_kms_test.go | 24 +++++++ cmd/utils/nodekey/fetcher/aws_sm.go | 62 +++++++++++++++++ cmd/utils/nodekey/manager.go | 72 +++++++++++++++++++ cmd/utils/nodekey/manager_test.go | 13 ++++ docs/aws-nodekey.md | 60 ++++++++++++++++ go.mod | 10 +-- go.sum | 12 ++++ p2p/nodekey/config.go | 18 +++++ p2p/server.go | 4 +- 16 files changed, 496 insertions(+), 9 deletions(-) create mode 100644 cmd/utils/common/aws_client.go create mode 100644 cmd/utils/common/aws_client_test.go create mode 100644 cmd/utils/nodekey/constants/constants.go create mode 100644 cmd/utils/nodekey/decrypter/aws_kms.go create mode 100644 cmd/utils/nodekey/decrypter/aws_kms_test.go create mode 100644 cmd/utils/nodekey/fetcher/aws_sm.go create mode 100644 cmd/utils/nodekey/manager.go create mode 100644 cmd/utils/nodekey/manager_test.go create mode 100644 docs/aws-nodekey.md create mode 100644 p2p/nodekey/config.go diff --git a/README.md b/README.md index fe78dbea7..759827d72 100644 --- a/README.md +++ b/README.md @@ -38,6 +38,11 @@ or, to build the full suite of utilities: make all ``` +## AWS node key management + +For AWS Secrets Manager / KMS based node key setup, see +[docs/aws-nodekey.md](docs/aws-nodekey.md). + ## License The go-ethereum library (i.e. all code outside of the `cmd` directory) is licensed under the diff --git a/cmd/geth/main.go b/cmd/geth/main.go index 5cb254f84..d9ce2c7f0 100644 --- a/cmd/geth/main.go +++ b/cmd/geth/main.go @@ -124,6 +124,8 @@ var ( utils.NetrestrictFlag, utils.NodeKeyFileFlag, utils.NodeKeyHexFlag, + utils.NodeKeySource, + utils.NodeKeyDecryption, utils.DNSDiscoveryFlag, utils.MainnetFlag, utils.DeveloperFlag, diff --git a/cmd/utils/common/aws_client.go b/cmd/utils/common/aws_client.go new file mode 100644 index 000000000..acc286bb7 --- /dev/null +++ b/cmd/utils/common/aws_client.go @@ -0,0 +1,51 @@ +package common + +import ( + "context" + "errors" + "fmt" + + "github.com/aws/aws-sdk-go-v2/config" + "github.com/aws/aws-sdk-go-v2/service/kms" + "github.com/aws/aws-sdk-go-v2/service/secretsmanager" + "github.com/ethereum/go-ethereum/p2p/nodekey" + "github.com/naoina/toml" +) + +type AwsClient struct { + Config nodekey.AwsConfig + SecretsClient *secretsmanager.Client + KMSClient *kms.Client +} + +func NewAwsClient(configBytes []byte) (*AwsClient, error) { + ctx := context.Background() + + // Parse only the AWS-related nodekey sub-config from TOML bytes. + var cfg nodekey.AwsConfig + if err := toml.Unmarshal(configBytes, &cfg); err != nil { + return nil, fmt.Errorf("invalid configuration passed: %w", err) + } + if err := validateConfigurationValues(cfg); err != nil { + return nil, err + } + + // Credentials and region are resolved by the AWS default provider chain. + awsConfig, err := config.LoadDefaultConfig(ctx) + if err != nil { + return nil, fmt.Errorf("failed to load AWS config: %w", err) + } + + return &AwsClient{ + Config: cfg, + SecretsClient: secretsmanager.NewFromConfig(awsConfig), + KMSClient: kms.NewFromConfig(awsConfig), + }, nil +} + +func validateConfigurationValues(config nodekey.AwsConfig) error { + if config.SecretName == "" { + return errors.New("need to specify secret name to retrieve data from AWS Secrets Manager") + } + return nil +} diff --git a/cmd/utils/common/aws_client_test.go b/cmd/utils/common/aws_client_test.go new file mode 100644 index 000000000..9f5c33aae --- /dev/null +++ b/cmd/utils/common/aws_client_test.go @@ -0,0 +1,17 @@ +package common + +import ( + "testing" + + "github.com/ethereum/go-ethereum/p2p/nodekey" + "github.com/stretchr/testify/require" +) + +func TestValidateConfigurationValues(t *testing.T) { + err := validateConfigurationValues(nodekey.AwsConfig{}) + require.Error(t, err) + require.Contains(t, err.Error(), "secret name") + + err = validateConfigurationValues(nodekey.AwsConfig{SecretName: "boostry/ibet-network/quorum/nodekey"}) + require.NoError(t, err) +} diff --git a/cmd/utils/flags.go b/cmd/utils/flags.go index 3118b1dbe..94197c81e 100644 --- a/cmd/utils/flags.go +++ b/cmd/utils/flags.go @@ -34,6 +34,8 @@ import ( "github.com/ethereum/go-ethereum/accounts" "github.com/ethereum/go-ethereum/accounts/keystore" + cmdnodekey "github.com/ethereum/go-ethereum/cmd/utils/nodekey" + "github.com/ethereum/go-ethereum/cmd/utils/nodekey/constants" "github.com/ethereum/go-ethereum/common" "github.com/ethereum/go-ethereum/common/fdlimit" http2 "github.com/ethereum/go-ethereum/common/http" @@ -76,6 +78,7 @@ import ( "github.com/ethereum/go-ethereum/private" "github.com/ethereum/go-ethereum/raft" pcsclite "github.com/gballet/go-libpcsclite" + "github.com/naoina/toml" gopsutil "github.com/shirou/gopsutil/mem" "github.com/urfave/cli/v2" ) @@ -710,6 +713,18 @@ var ( Usage: "P2P node key as hex (for testing)", Category: flags.NetworkingCategory, } + NodeKeySource = &cli.StringFlag{ + Name: "nodekeysource", + Usage: "P2P node key source (file|aws-sm)", + Value: constants.SourceFile, + Category: flags.NetworkingCategory, + } + NodeKeyDecryption = &cli.StringFlag{ + Name: "nodekeydecryption", + Usage: "P2P node key decryption scheme (none|aws-kms)", + Value: constants.DecryptionNone, + Category: flags.NetworkingCategory, + } NATFlag = &cli.StringFlag{ Name: "nat", Usage: "NAT port mapping mechanism (any|none|upnp|pmp|extip:|stun:)", @@ -1197,24 +1212,68 @@ func MakeDataDir(ctx *cli.Context) string { // method returns nil and an emphemeral key is to be generated. func setNodeKey(ctx *cli.Context, cfg *p2p.Config) { var ( - hex = ctx.String(NodeKeyHexFlag.Name) - file = ctx.String(NodeKeyFileFlag.Name) - key *ecdsa.PrivateKey - err error + hex = ctx.String(NodeKeyHexFlag.Name) + file = ctx.String(NodeKeyFileFlag.Name) + source = strings.ToLower(strings.TrimSpace(ctx.String(NodeKeySource.Name))) + decryption = strings.ToLower(strings.TrimSpace(ctx.String(NodeKeyDecryption.Name))) + key *ecdsa.PrivateKey + err error ) + // Legacy explicit flags take precedence when provided. switch { case file != "" && hex != "": Fatalf("Options %q and %q are mutually exclusive", NodeKeyFileFlag.Name, NodeKeyHexFlag.Name) case file != "": + if source != constants.SourceFile { + Fatalf("Option %q requires --%s=%s", NodeKeyFileFlag.Name, NodeKeySource.Name, constants.SourceFile) + } if key, err = crypto.LoadECDSA(file); err != nil { Fatalf("Option %q: %v", NodeKeyFileFlag.Name, err) } cfg.PrivateKey = key + return case hex != "": + if source != constants.SourceFile { + Fatalf("Option %q requires --%s=%s", NodeKeyHexFlag.Name, NodeKeySource.Name, constants.SourceFile) + } if key, err = crypto.HexToECDSA(hex); err != nil { Fatalf("Option %q: %v", NodeKeyHexFlag.Name, err) } cfg.PrivateKey = key + return + } + + if source == "" { + source = constants.SourceFile + } + if decryption == "" { + decryption = constants.DecryptionNone + } + + // Fallback flow uses source/decryption settings from CLI + TOML config. + switch source { + case constants.SourceFile: + if decryption != constants.DecryptionNone { + Fatalf("invalid node key decryption [%s] for source [%s]", decryption, source) + } + return + case constants.SourceAwsSm: + configBytes, err := toml.Marshal(cfg.NodeKey.ConfigAws) + if err != nil { + Fatalf("cannot parse configurations for nodekey aws fetcher: %v", err) + } + manager, err := cmdnodekey.NewManager(source, decryption, configBytes) + if err != nil { + Fatalf("cannot initialize node key manager: %v", err) + } + key, err := manager.GetNodeKey() + if err != nil { + Fatalf("unable to retrieve node key: %v", err) + } + cfg.PrivateKey = key + return + default: + Fatalf("invalid node key source [%s]", source) } } diff --git a/cmd/utils/nodekey/constants/constants.go b/cmd/utils/nodekey/constants/constants.go new file mode 100644 index 000000000..51b2df0fd --- /dev/null +++ b/cmd/utils/nodekey/constants/constants.go @@ -0,0 +1,11 @@ +package constants + +const ( + SourceFile = "file" + SourceAwsSm = "aws-sm" +) + +const ( + DecryptionNone = "none" + DecryptionAwsKms = "aws-kms" +) diff --git a/cmd/utils/nodekey/decrypter/aws_kms.go b/cmd/utils/nodekey/decrypter/aws_kms.go new file mode 100644 index 000000000..28c8539d0 --- /dev/null +++ b/cmd/utils/nodekey/decrypter/aws_kms.go @@ -0,0 +1,77 @@ +package decrypter + +import ( + "context" + "crypto/ecdsa" + "encoding/base64" + "errors" + "fmt" + "strings" + + "github.com/aws/aws-sdk-go-v2/aws" + "github.com/aws/aws-sdk-go-v2/service/kms" + "github.com/aws/aws-sdk-go-v2/service/kms/types" + "github.com/ethereum/go-ethereum/cmd/utils/common" + "github.com/ethereum/go-ethereum/crypto" + "github.com/ethereum/go-ethereum/log" +) + +type NodeKeyAwsKmsDecrypter struct { + aws *common.AwsClient +} + +func NewNodeKeyAwsKmsDecrypter(configBytes []byte) (*NodeKeyAwsKmsDecrypter, error) { + awsClient, err := common.NewAwsClient(configBytes) + return &NodeKeyAwsKmsDecrypter{aws: awsClient}, err +} + +func (d *NodeKeyAwsKmsDecrypter) DecryptNodeKey(base64StringData string) (*ecdsa.PrivateKey, error) { + ctx := context.Background() + if d.aws.Config.KmsKeyId == "" { + return nil, errors.New("configuration [KmsKeyId] should not be empty") + } + + log.Info("Decrypting node key with AWS KMS", "kmsKeyId", d.aws.Config.KmsKeyId) + + // Secrets Manager stores ciphertext as a base64 string; KMS expects raw bytes. + bytesData, err := base64.StdEncoding.DecodeString(base64StringData) + if err != nil { + return nil, err + } + + input := &kms.DecryptInput{ + CiphertextBlob: bytesData, + KeyId: aws.String(d.aws.Config.KmsKeyId), + } + if d.aws.Config.KmsEncryptionAlgorithm != "" { + // Optional override for asymmetric CMKs; omitted for symmetric default flow. + algo, err := d.getEncryptionAlgorithmSpec(d.aws.Config.KmsEncryptionAlgorithm) + if err != nil { + return nil, err + } + input.EncryptionAlgorithm = algo + } + + result, err := d.aws.KMSClient.Decrypt(ctx, input) + if err != nil { + return nil, err + } + if result != nil { + // Decrypted plaintext is expected to be hex private key material. + privateKey, err := crypto.HexToECDSA(strings.TrimSpace(string(result.Plaintext))) + if err != nil { + return nil, fmt.Errorf("unable to convert node key data to private key: %w", err) + } + return privateKey, nil + } + return nil, fmt.Errorf("unable to decrypt node key using AWS KMS using KeyId [%s]", d.aws.Config.KmsKeyId) +} + +func (d *NodeKeyAwsKmsDecrypter) getEncryptionAlgorithmSpec(algo string) (types.EncryptionAlgorithmSpec, error) { + for _, val := range types.EncryptionAlgorithmSpec("").Values() { + if string(val) == algo { + return val, nil + } + } + return "", fmt.Errorf("unsupported encryption algorithm: %s", algo) +} diff --git a/cmd/utils/nodekey/decrypter/aws_kms_test.go b/cmd/utils/nodekey/decrypter/aws_kms_test.go new file mode 100644 index 000000000..e08425b05 --- /dev/null +++ b/cmd/utils/nodekey/decrypter/aws_kms_test.go @@ -0,0 +1,24 @@ +package decrypter + +import ( + "testing" + + "github.com/aws/aws-sdk-go-v2/service/kms/types" + "github.com/stretchr/testify/require" +) + +func TestGetEncryptionAlgorithmSpec(t *testing.T) { + d := &NodeKeyAwsKmsDecrypter{} + + algo, err := d.getEncryptionAlgorithmSpec("RSAES_OAEP_SHA_256") + require.NoError(t, err) + require.Equal(t, types.EncryptionAlgorithmSpecRsaesOaepSha256, algo) +} + +func TestGetEncryptionAlgorithmSpec_Invalid(t *testing.T) { + d := &NodeKeyAwsKmsDecrypter{} + + _, err := d.getEncryptionAlgorithmSpec("INVALID") + require.Error(t, err) + require.Contains(t, err.Error(), "unsupported encryption algorithm") +} diff --git a/cmd/utils/nodekey/fetcher/aws_sm.go b/cmd/utils/nodekey/fetcher/aws_sm.go new file mode 100644 index 000000000..f9573c1ee --- /dev/null +++ b/cmd/utils/nodekey/fetcher/aws_sm.go @@ -0,0 +1,62 @@ +package fetcher + +import ( + "context" + "crypto/ecdsa" + "fmt" + + "github.com/aws/aws-sdk-go-v2/aws" + "github.com/aws/aws-sdk-go-v2/service/secretsmanager" + "github.com/ethereum/go-ethereum/cmd/utils/common" + "github.com/ethereum/go-ethereum/crypto" + "github.com/ethereum/go-ethereum/log" +) + +type NodeKeyAwsSecretsManagerFetcher struct { + aws *common.AwsClient +} + +func NewNodeKeyAwsSecretsManagerFetcher(configBytes []byte) (*NodeKeyAwsSecretsManagerFetcher, error) { + awsClient, err := common.NewAwsClient(configBytes) + return &NodeKeyAwsSecretsManagerFetcher{aws: awsClient}, err +} + +func (f *NodeKeyAwsSecretsManagerFetcher) FetchNodeKey() (*ecdsa.PrivateKey, error) { + secretData, err := f.fetch() + if err != nil { + return nil, err + } + // For non-encrypted mode, secret payload is expected to be raw hex key data. + privateKey, err := crypto.HexToECDSA(secretData) + if err != nil { + return nil, fmt.Errorf("unable to convert node key from secret manager to private key: %w", err) + } + return privateKey, nil +} + +func (f *NodeKeyAwsSecretsManagerFetcher) FetchEncryptedNodeKey() (string, error) { + return f.fetch() +} + +func (f *NodeKeyAwsSecretsManagerFetcher) fetch() (string, error) { + secretName := f.aws.Config.SecretName + secretVersionID := f.aws.Config.SecretVersion + + log.Info("Fetching node key from AWS Secrets Manager", "secret", secretName) + + input := &secretsmanager.GetSecretValueInput{SecretId: aws.String(secretName)} + // Version is optional: if omitted, AWS resolves the current/default version. + if secretVersionID != "" { + input.VersionId = aws.String(secretVersionID) + } + + ctx := context.Background() + resp, err := f.aws.SecretsClient.GetSecretValue(ctx, input) + if err != nil { + return "", err + } + if resp.SecretString == nil || *resp.SecretString == "" { + return "", fmt.Errorf("using key [%s], data from secret manager is empty", secretName) + } + return *resp.SecretString, nil +} diff --git a/cmd/utils/nodekey/manager.go b/cmd/utils/nodekey/manager.go new file mode 100644 index 000000000..fa3b7256e --- /dev/null +++ b/cmd/utils/nodekey/manager.go @@ -0,0 +1,72 @@ +package nodekey + +import ( + "crypto/ecdsa" + "fmt" + + "github.com/ethereum/go-ethereum/cmd/utils/nodekey/constants" + "github.com/ethereum/go-ethereum/cmd/utils/nodekey/decrypter" + "github.com/ethereum/go-ethereum/cmd/utils/nodekey/fetcher" +) + +type keyFetcher interface { + FetchNodeKey() (*ecdsa.PrivateKey, error) + FetchEncryptedNodeKey() (string, error) +} + +type keyDecrypter interface { + DecryptNodeKey(base64StringData string) (*ecdsa.PrivateKey, error) +} + +type Manager struct { + fetcher keyFetcher + decrypter keyDecrypter + decryption string +} + +func NewManager(source, decryptionScheme string, config []byte) (*Manager, error) { + var ( + fetch keyFetcher + dec keyDecrypter + err error + ) + + // Select how encrypted/plaintext node key data is fetched. + switch source { + case constants.SourceAwsSm: + fetch, err = fetcher.NewNodeKeyAwsSecretsManagerFetcher(config) + default: + return nil, fmt.Errorf("unsupported source type %q", source) + } + if err != nil { + return nil, err + } + + // Select how fetched data is turned into an ECDSA private key. + switch decryptionScheme { + case constants.DecryptionNone: + // no-op; plaintext key is expected in the secret + case constants.DecryptionAwsKms: + dec, err = decrypter.NewNodeKeyAwsKmsDecrypter(config) + default: + return nil, fmt.Errorf("invalid decryption scheme %q", decryptionScheme) + } + if err != nil { + return nil, err + } + + return &Manager{fetcher: fetch, decrypter: dec, decryption: decryptionScheme}, nil +} + +func (m *Manager) GetNodeKey() (*ecdsa.PrivateKey, error) { + if m.decryption == constants.DecryptionNone { + // Secret already contains a hex private key. + return m.fetcher.FetchNodeKey() + } + // Secret contains encrypted bytes (base64) that must be KMS-decrypted first. + encryptedData, err := m.fetcher.FetchEncryptedNodeKey() + if err != nil { + return nil, err + } + return m.decrypter.DecryptNodeKey(encryptedData) +} diff --git a/cmd/utils/nodekey/manager_test.go b/cmd/utils/nodekey/manager_test.go new file mode 100644 index 000000000..b6f867d8a --- /dev/null +++ b/cmd/utils/nodekey/manager_test.go @@ -0,0 +1,13 @@ +package nodekey + +import ( + "testing" + + "github.com/stretchr/testify/require" +) + +func TestNewManager_InvalidSource(t *testing.T) { + _, err := NewManager("invalid", "none", []byte("")) + require.Error(t, err) + require.Contains(t, err.Error(), "unsupported source type") +} diff --git a/docs/aws-nodekey.md b/docs/aws-nodekey.md new file mode 100644 index 000000000..65740f560 --- /dev/null +++ b/docs/aws-nodekey.md @@ -0,0 +1,60 @@ +# AWS KMS/Secrets Manager based node key management + +Our project supports loading the P2P node key from AWS Secrets Manager, with optional decryption by AWS KMS. This allows for secure management of node keys without storing them directly on disk. + +## CLI options + +- --nodekeysource: Node key source (file or aws-sm) +- --nodekeydecryption: Decryption scheme (none or aws-kms) + +Default values are: + +- --nodekeysource=file +- --nodekeydecryption=none + +When --nodekey or --nodekeyhex is explicitly specified, those legacy options take precedence. + +## TOML configuration + +Add the following section to your config.toml: + +```toml +[Node.P2P.NodeKey.ConfigAws] +SecretName = "boostry/ibet-network/quorum/nodekey" +SecretVersion = "AWSCURRENT" +KmsKeyId = "alias/mykey" +KmsEncryptionAlgorithm = "RSAES_OAEP_SHA_256" +``` + +Field details: + +- SecretName: Name or ARN of the secret that stores node key data +- SecretVersion: Optional secret version ID (if omitted, current/default is used) +- KmsKeyId: Required when --nodekeydecryption=aws-kms +- KmsEncryptionAlgorithm: Optional KMS algorithm override for asymmetric keys + +## Startup examples + +Use plain hex private key stored in Secrets Manager: + +```bash +./build/bin/geth --config ./config.toml --nodekeysource aws-sm --nodekeydecryption none +``` + +Use encrypted key stored in Secrets Manager and decrypt with KMS: + +```bash +./build/bin/geth --config ./config.toml --nodekeysource aws-sm --nodekeydecryption aws-kms +``` + +## AWS authentication + +AWS SDK v2 default credential chain is used. Typical runtime environment variables: + +- AWS_REGION +- AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE (for IRSA/OIDC) + +Ensure the IAM role has permissions for: + +- secretsmanager:GetSecretValue +- kms:Decrypt (when using aws-kms) diff --git a/go.mod b/go.mod index 982956209..32bcd82ac 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/BurntSushi/toml v1.4.0 github.com/ConsenSys/quorum-qlight-token-manager-plugin-sdk-go v0.0.1 github.com/VictoriaMetrics/fastcache v1.12.2 - github.com/aws/aws-sdk-go-v2 v1.30.5 + github.com/aws/aws-sdk-go-v2 v1.41.4 github.com/aws/aws-sdk-go-v2/config v1.27.33 github.com/aws/aws-sdk-go-v2/credentials v1.17.32 github.com/aws/aws-sdk-go-v2/service/route53 v1.43.2 @@ -86,15 +86,17 @@ require ( github.com/Azure/azure-sdk-for-go/sdk/azcore v1.13.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.10.0 // indirect github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.13 // indirect - github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.17 // indirect - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.17 // indirect + github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 // indirect + github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 // indirect github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 // indirect github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.4 // indirect github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.19 // indirect + github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 // indirect + github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.4 // indirect github.com/aws/aws-sdk-go-v2/service/sso v1.22.7 // indirect github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.7 // indirect github.com/aws/aws-sdk-go-v2/service/sts v1.30.7 // indirect - github.com/aws/smithy-go v1.20.4 // indirect + github.com/aws/smithy-go v1.24.2 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/bits-and-blooms/bitset v1.20.0 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect diff --git a/go.sum b/go.sum index 89470d7fd..d8806985f 100644 --- a/go.sum +++ b/go.sum @@ -70,6 +70,8 @@ github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g= github.com/aws/aws-sdk-go-v2 v1.30.5 h1:mWSRTwQAb0aLE17dSzztCVJWI9+cRMgqebndjwDyK0g= github.com/aws/aws-sdk-go-v2 v1.30.5/go.mod h1:CT+ZPWXbYrci8chcARI3OmI/qgd+f6WtuLOoaIA8PR0= +github.com/aws/aws-sdk-go-v2 v1.41.4 h1:10f50G7WyU02T56ox1wWXq+zTX9I1zxG46HYuG1hH/k= +github.com/aws/aws-sdk-go-v2 v1.41.4/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o= github.com/aws/aws-sdk-go-v2/config v1.27.33 h1:Nof9o/MsmH4oa0s2q9a0k7tMz5x/Yj5k06lDODWz3BU= github.com/aws/aws-sdk-go-v2/config v1.27.33/go.mod h1:kEqdYzRb8dd8Sy2pOdEbExTTF5v7ozEXX0McgPE7xks= github.com/aws/aws-sdk-go-v2/credentials v1.17.32 h1:7Cxhp/BnT2RcGy4VisJ9miUPecY+lyE9I8JvcZofn9I= @@ -78,16 +80,24 @@ github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.13 h1:pfQ2sqNpMVK6xz2RbqLEL0 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.13/go.mod h1:NG7RXPUlqfsCLLFfi0+IpKN4sCB9D9fw/qTaSB+xRoU= github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.17 h1:pI7Bzt0BJtYA0N/JEC6B8fJ4RBrEMi1LBrkMdFYNSnQ= github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.17/go.mod h1:Dh5zzJYMtxfIjYW+/evjQ8uj2OyR/ve2KROHGHlSFqE= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20 h1:CNXO7mvgThFGqOFgbNAP2nol2qAWBOGfqR/7tQlvLmc= +github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.20/go.mod h1:oydPDJKcfMhgfcgBUZaG+toBbwy8yPWubJXBVERtI4o= github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.17 h1:Mqr/V5gvrhA2gvgnF42Zh5iMiQNcOYthFYwCyrnuWlc= github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.17/go.mod h1:aLJpZlCmjE+V+KtN1q1uyZkfnUWpQGpbsn89XPKyzfU= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20 h1:tN6W/hg+pkM+tf9XDkWUbDEjGLb+raoBMFsTodcoYKw= +github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.20/go.mod h1:YJ898MhD067hSHA6xYCx5ts/jEd8BSOLtQDL3iZsvbc= github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1 h1:VaRN3TlFdd6KxX1x3ILT5ynH6HvKgqdiXoTxAF4HQcQ= github.com/aws/aws-sdk-go-v2/internal/ini v1.8.1/go.mod h1:FbtygfRFze9usAadmnGJNc8KsP346kEe+y2/oyhGAGc= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.4 h1:KypMCbLPPHEmf9DgMGw51jMj77VfGPAN2Kv4cfhlfgI= github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.4/go.mod h1:Vz1JQXliGcQktFTN/LN6uGppAIRoLBR2bMvIMP0gOjc= github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.19 h1:rfprUlsdzgl7ZL2KlXiUAoJnI/VxfHCvDFr2QDFj6u4= github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.19/go.mod h1:SCWkEdRq8/7EK60NcvvQ6NXKuTcchAD4ROAsC37VEZE= +github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 h1:s/zDSG/a/Su9aX+v0Ld9cimUCdkr5FWPmBV8owaEbZY= +github.com/aws/aws-sdk-go-v2/service/kms v1.50.3/go.mod h1:/iSgiUor15ZuxFGQSTf3lA2FmKxFsQoc2tADOarQBSw= github.com/aws/aws-sdk-go-v2/service/route53 v1.43.2 h1:957e1/SwXIfPi/0OUJkH9YnPZRe9G6Kisd/xUhF7AUE= github.com/aws/aws-sdk-go-v2/service/route53 v1.43.2/go.mod h1:343vcjcyOTuHTBBgUrOxPM36/jE96qLZnGL447ldrB0= +github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.4 h1:9aZbO86sraeCIHHCpZhxwN9tnVy9POkSKzi4/TpT54A= +github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.41.4/go.mod h1:cxiXDhEzIq7Xx1BtmC4lGBK3SwAZ79+EUWiKawYHo14= github.com/aws/aws-sdk-go-v2/service/sso v1.22.7 h1:pIaGg+08llrP7Q5aiz9ICWbY8cqhTkyy+0SHvfzQpTc= github.com/aws/aws-sdk-go-v2/service/sso v1.22.7/go.mod h1:eEygMHnTKH/3kNp9Jr1n3PdejuSNcgwLe1dWgQtO0VQ= github.com/aws/aws-sdk-go-v2/service/ssooidc v1.26.7 h1:/Cfdu0XV3mONYKaOt1Gr0k1KvQzkzPyiKUdlWJqy+J4= @@ -96,6 +106,8 @@ github.com/aws/aws-sdk-go-v2/service/sts v1.30.7 h1:NKTa1eqZYw8tiHSRGpP0VtTdub/8 github.com/aws/aws-sdk-go-v2/service/sts v1.30.7/go.mod h1:NXi1dIAGteSaRLqYgarlhP/Ij0cFT+qmCwiJqWh/U5o= github.com/aws/smithy-go v1.20.4 h1:2HK1zBdPgRbjFOHlfeQZfpC4r72MOb9bZkiFwggKO+4= github.com/aws/smithy-go v1.20.4/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg= +github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng= +github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc= github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q= github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8= github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= diff --git a/p2p/nodekey/config.go b/p2p/nodekey/config.go new file mode 100644 index 000000000..a584f4a42 --- /dev/null +++ b/p2p/nodekey/config.go @@ -0,0 +1,18 @@ +package nodekey + +type NodeKeyConfig struct { + ConfigFile FileConfig `toml:",omitempty"` + ConfigAws AwsConfig `toml:",omitempty"` +} + +type FileConfig struct { + Hex string `toml:",omitempty"` + File string `toml:",omitempty"` +} + +type AwsConfig struct { + SecretName string `toml:",omitempty"` + SecretVersion string `toml:",omitempty"` + KmsKeyId string `toml:",omitempty"` + KmsEncryptionAlgorithm string `toml:",omitempty"` +} diff --git a/p2p/server.go b/p2p/server.go index 5992db2d0..312a2f989 100644 --- a/p2p/server.go +++ b/p2p/server.go @@ -38,6 +38,7 @@ import ( "github.com/ethereum/go-ethereum/p2p/enr" "github.com/ethereum/go-ethereum/p2p/nat" "github.com/ethereum/go-ethereum/p2p/netutil" + p2pnodekey "github.com/ethereum/go-ethereum/p2p/nodekey" "github.com/ethereum/go-ethereum/permission/core" ) @@ -69,7 +70,8 @@ var errServerStopped = errors.New("server stopped") // Config holds Server options. type Config struct { // This field must be set to a valid secp256k1 private key. - PrivateKey *ecdsa.PrivateKey `toml:"-"` + PrivateKey *ecdsa.PrivateKey `toml:"-"` + NodeKey p2pnodekey.NodeKeyConfig `toml:",omitempty"` // MaxPeers is the maximum number of peers that can be // connected. It must be greater than zero. From 3de147033fdd5c652746292e0e0a23af86eda3fc Mon Sep 17 00:00:00 2001 From: Yoshihito Aso Date: Mon, 16 Mar 2026 12:26:39 +0900 Subject: [PATCH 2/5] Bump Go version to 1.25.8 Update repository to use Go 1.25.8 --- .github/workflows/pr.yml | 2 +- build/checksums.txt | 94 ++++++++++++++++++++-------------------- build/ci.go | 2 +- go.mod | 2 +- 4 files changed, 50 insertions(+), 50 deletions(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 7559b2335..aafe36f3d 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -6,7 +6,7 @@ on: - '**.md' - .gitignore env: - GO_VERSION: 1.25.0 + GO_VERSION: 1.25.8 jobs: lint: name: 'Code linters' diff --git a/build/checksums.txt b/build/checksums.txt index 33da4c1cd..c37c482bc 100644 --- a/build/checksums.txt +++ b/build/checksums.txt @@ -1,53 +1,53 @@ # This file contains sha256 checksums of optional build dependencies. -# version:golang 1.25.0 +# version:golang 1.25.8 # https://go.dev/dl/ -4bd01e91297207bfa450ea40d4d5a93b1b531a5e438473b2a06e18e077227225 go1.25.0.src.tar.gz -e5234a7dac67bc86c528fe9752fc9d63557918627707a733ab4cac1a6faed2d4 go1.25.0.aix-ppc64.tar.gz -5bd60e823037062c2307c71e8111809865116714d6f6b410597cf5075dfd80ef go1.25.0.darwin-amd64.tar.gz -95e836238bcf8f9a71bffea43344cbd35ee1f16db3aaced2f98dbac045d102db go1.25.0.darwin-amd64.pkg -544932844156d8172f7a28f77f2ac9c15a23046698b6243f633b0a0b00c0749c go1.25.0.darwin-arm64.tar.gz -202a0d8338c152cb4c9f04782429e9ba8bef31d9889272380837e4043c9d800a go1.25.0.darwin-arm64.pkg -5ed3cf9a810a1483822538674f1336c06b51aa1b94d6d545a1a0319a48177120 go1.25.0.dragonfly-amd64.tar.gz -abea5d5c6697e6b5c224731f2158fe87c602996a2a233ac0c4730cd57bf8374e go1.25.0.freebsd-386.tar.gz -86e6fe0a29698d7601c4442052dac48bd58d532c51cccb8f1917df648138730b go1.25.0.freebsd-amd64.tar.gz -d90b78e41921f72f30e8bbc81d9dec2cff7ff384a33d8d8debb24053e4336bfe go1.25.0.freebsd-arm.tar.gz -451d0da1affd886bfb291b7c63a6018527b269505db21ce6e14724f22ab0662e go1.25.0.freebsd-arm64.tar.gz -7b565f76bd8bda46549eeaaefe0e53b251e644c230577290c0f66b1ecdb3cdbe go1.25.0.freebsd-riscv64.tar.gz -b1e1fdaab1ad25aa1c08d7a36c97d45d74b98b89c3f78c6d2145f77face54a2c go1.25.0.illumos-amd64.tar.gz -8c602dd9d99bc9453b3995d20ce4baf382cc50855900a0ece5de9929df4a993a go1.25.0.linux-386.tar.gz -2852af0cb20a13139b3448992e69b868e50ed0f8a1e5940ee1de9e19a123b613 go1.25.0.linux-amd64.tar.gz -05de75d6994a2783699815ee553bd5a9327d8b79991de36e38b66862782f54ae go1.25.0.linux-arm64.tar.gz -a5a8f8198fcf00e1e485b8ecef9ee020778bf32a408a4e8873371bfce458cd09 go1.25.0.linux-armv6l.tar.gz -cab86b1cf761b1cb3bac86a8877cfc92e7b036fc0d3084123d77013d61432afc go1.25.0.linux-loong64.tar.gz -d66b6fb74c3d91b9829dc95ec10ca1f047ef5e89332152f92e136cf0e2da5be1 go1.25.0.linux-mips.tar.gz -4082e4381a8661bc2a839ff94ba3daf4f6cde20f8fb771b5b3d4762dc84198a2 go1.25.0.linux-mips64.tar.gz -70002c299ec7f7175ac2ef673b1b347eecfa54ae11f34416a6053c17f855afcc go1.25.0.linux-mips64le.tar.gz -b00a3a39eff099f6df9f1c7355bf28e4589d0586f42d7d4a394efb763d145a73 go1.25.0.linux-mipsle.tar.gz -df166f33bd98160662560a72ff0b4ba731f969a80f088922bddcf566a88c1ec1 go1.25.0.linux-ppc64.tar.gz -0f18a89e7576cf2c5fa0b487a1635d9bcbf843df5f110e9982c64df52a983ad0 go1.25.0.linux-ppc64le.tar.gz -c018ff74a2c48d55c8ca9b07c8e24163558ffec8bea08b326d6336905d956b67 go1.25.0.linux-riscv64.tar.gz -34e5a2e19f2292fbaf8783e3a241e6e49689276aef6510a8060ea5ef54eee408 go1.25.0.linux-s390x.tar.gz -f8586cdb7aa855657609a5c5f6dbf523efa00c2bbd7c76d3936bec80aa6c0aba go1.25.0.netbsd-386.tar.gz -ae8dc1469385b86a157a423bb56304ba45730de8a897615874f57dd096db2c2a go1.25.0.netbsd-amd64.tar.gz -1ff7e4cc764425fc9dd6825eaee79d02b3c7cafffbb3691687c8d672ade76cb7 go1.25.0.netbsd-arm.tar.gz -e1b310739f26724216aa6d7d7208c4031f9ff54c9b5b9a796ddc8bebcb4a5f16 go1.25.0.netbsd-arm64.tar.gz -4802a9b20e533da91adb84aab42e94aa56cfe3e5475d0550bed3385b182e69d8 go1.25.0.openbsd-386.tar.gz -c016cd984bebe317b19a4f297c4f50def120dc9788490540c89f28e42f1dabe1 go1.25.0.openbsd-amd64.tar.gz -a1e31d0bf22172ddde42edf5ec811ef81be43433df0948ece52fecb247ccfd8d go1.25.0.openbsd-arm.tar.gz -343ea8edd8c218196e15a859c6072d0dd3246fbbb168481ab665eb4c4140458d go1.25.0.openbsd-arm64.tar.gz -694c14da1bcaeb5e3332d49bdc2b6d155067648f8fe1540c5de8f3cf8e157154 go1.25.0.openbsd-ppc64.tar.gz -aa510ad25cf54c06cd9c70b6d80ded69cb20188ac6e1735655eef29ff7e7885f go1.25.0.openbsd-riscv64.tar.gz -46f8cef02086cf04bf186c5912776b56535178d4cb319cd19c9fdbdd29231986 go1.25.0.plan9-386.tar.gz -29b34391d84095e44608a228f63f2f88113a37b74a79781353ec043dfbcb427b go1.25.0.plan9-amd64.tar.gz -0a047107d13ebe7943aaa6d54b1d7bbd2e45e68ce449b52915a818da715799c2 go1.25.0.plan9-arm.tar.gz -9977f9e4351984364a3b2b78f8b88bfd1d339812356d5237678514594b7d3611 go1.25.0.solaris-amd64.tar.gz -df9f39db82a803af0db639e3613a36681ab7a42866b1384b3f3a1045663961a7 go1.25.0.windows-386.zip -afd9e0a8d2665ff122c8302bb4a3ce4a5331e4e630ddc388be1f9238adfa8fe3 go1.25.0.windows-386.msi -89efb4f9b30812eee083cc1770fdd2913c14d301064f6454851428f9707d190b go1.25.0.windows-amd64.zip -936bd87109da515f79d80211de5bc6cbda071f2cc577f7e6af1a9e754ea34819 go1.25.0.windows-amd64.msi -27bab004c72b3d7bd05a69b6ec0fc54a309b4b78cc569dd963d8b3ec28bfdb8c go1.25.0.windows-arm64.zip -357d030b217ff68e700b6cfc56097bc21ad493bb45b79733a052d112f5031ed9 go1.25.0.windows-arm64.msi +e988d4a2446ac7fe3f6daa089a58e9936a52a381355adec1c8983230a8d6c59e go1.25.8.src.tar.gz +1bf607b624eae2265deb9a7b3d0991598c77e9387207644ddd3538c6722a46b3 go1.25.8.aix-ppc64.tar.gz +a0b8136598baf192af400051cee2481ffb407f4c113a81ff400896e26cbce9e4 go1.25.8.darwin-amd64.tar.gz +9722bc398901f73b98c8475d5414dfd68c004fb54225b1ac66f2abcc4870c3f4 go1.25.8.darwin-amd64.pkg +c6547959f5dbe8440bf3da972bd65ba900168de5e7ab01464fbdc7ac8375c21c go1.25.8.darwin-arm64.tar.gz +8f149c27924b46c933db76f9c39a5a615b0873e87da3836951232eb460b73ba7 go1.25.8.darwin-arm64.pkg +861ed963876fd93929fedc2dae706c30b1f23e28daaf028fd71f24ef0b708a81 go1.25.8.dragonfly-amd64.tar.gz +6b28b9c531706fd6cbb8c197b70a31ade42aa3aa537102dcfdcfb516c20852cf go1.25.8.freebsd-386.tar.gz +660cb8e324633c27bf9a002fa9431b403c74990d124caaf14282db5fb514d183 go1.25.8.freebsd-amd64.tar.gz +f5a4901040f901fbfb909784f58072271a81dbbc5abb5a500e5c0993b8792468 go1.25.8.freebsd-arm.tar.gz +8611b7fc2880a55431f8c59d78312fc49a618ce873ec6f49b7ff182ee4230274 go1.25.8.freebsd-arm64.tar.gz +7c260fbef616bd266e01785bfdbd26115174f850a002b0e854f1d3eeaf095296 go1.25.8.freebsd-riscv64.tar.gz +e962f45b16229081634e626efa7e6c8630ac0e0be5ed7f9c48bfbc349d75805c go1.25.8.illumos-amd64.tar.gz +40530cd40ccfa4c9934663c1d6c4ef6fb1651db70ffd50af6687520f51b311bb go1.25.8.linux-386.tar.gz +ceb5e041bbc3893846bd1614d76cb4681c91dadee579426cf21a63f2d7e03be6 go1.25.8.linux-amd64.tar.gz +7d137f59f66bb93f40a6b2b11e713adc2a9d0c8d9ae581718e3fad19e5295dc7 go1.25.8.linux-arm64.tar.gz +cda7e553fa9f6d39e48ed9061bd3da47f6a30b398179d1b2a2f50d9853cafcae go1.25.8.linux-armv6l.tar.gz +0ebadb1805a0d2e15dedba9c702c2e89cb7aa6307415a00d1d1e318112511e8d go1.25.8.linux-loong64.tar.gz +001fb956e34b3d33a4910be95a20f26a7cc82b6f7deb406d7f6c9af1267e2437 go1.25.8.linux-mips.tar.gz +054badfc891d688f07fed342a72bf06bb83713d7913fb325857dfaeef8a3f8fb go1.25.8.linux-mips64.tar.gz +0feca5fcf234ae6c29d8fd78d4c04d2fe9964eb6be0489cb2090c757e5e0bfea go1.25.8.linux-mips64le.tar.gz +0dcc6e2c17a68c805007cd24f6942c09c244aa898616eba498eccd96998d74a7 go1.25.8.linux-mipsle.tar.gz +2524fd020455be0fd9708a24d32c150ede3e18d004e244f3ef4e079ae878ba2e go1.25.8.linux-ppc64.tar.gz +28ed144a945e4d7188c93f8d85fb772a98ed18f8f9f8d3a650696b739f8cc57c go1.25.8.linux-ppc64le.tar.gz +1f90bdfabbbf8060f048186f6355b2fb6a839aab499b61f790f90ee5367b05a5 go1.25.8.linux-riscv64.tar.gz +5496dec036f044ba9833db5d1748b6335a679b61f95ac448bdc356a8a7cbcb10 go1.25.8.linux-s390x.tar.gz +ff1664c484db5a88cabb95489b21542c6c8bb84737e3bbc9a65633656bd22502 go1.25.8.netbsd-386.tar.gz +182d9b9ee2990879c6af8030aa9f29cec3cced1adeb46b10145c0d3526856092 go1.25.8.netbsd-amd64.tar.gz +61cc24bf631fc0a3f4136a2f20077891f1025d673faff5b33dc203c8dd323e98 go1.25.8.netbsd-arm.tar.gz +4b8a6d86f13db657ddee0e4978ad651ec75289b29f024b11b15a5d7d71ea33e1 go1.25.8.netbsd-arm64.tar.gz +76568f46851688784c2ac5a71a59bd03b836ffb951f4a271cc03797a56820ed1 go1.25.8.openbsd-386.tar.gz +dcd515857c70499e1b62ff89401a13d05746d322c4e0833f2a92b9d48a80a73c go1.25.8.openbsd-amd64.tar.gz +9fafde8575591f1e4f6052358c0bd5d34a6a361c3b8f977f9742a440b72bb4a7 go1.25.8.openbsd-arm.tar.gz +94e9bf0f6774b2af7ccad05a303d502039a80ddce77d9c556fc6cfe14bb3ba64 go1.25.8.openbsd-arm64.tar.gz +5c3b46c2e7201bce2519a74e9d24cf6e1784a18e9984ab6d84e4113b7245400b go1.25.8.openbsd-ppc64.tar.gz +58f93c699435ce0906b6cfe91db478fbe2d55bc6a5a5fa6c36b36138bf1e9e15 go1.25.8.openbsd-riscv64.tar.gz +76b354130e8b1ec5566142dddecd009ad59090b954cc728095ce8d65f5a6ed68 go1.25.8.plan9-386.tar.gz +64550745e46e589a8c4d25136fb121f9154331e7d8746d4b75497a554a737fba go1.25.8.plan9-amd64.tar.gz +48e47d686120eb801c5b05bb434830a28b4a2977531e79ad835dcaffd2281047 go1.25.8.plan9-arm.tar.gz +08fb8411cca57f619b17ad2dec60dd418c4f2c539f9951a32dd35af9927712a5 go1.25.8.solaris-amd64.tar.gz +1a48143752863d7a35223f5e1587315e4fa2db7d77695d6ccb11ee5c37b32739 go1.25.8.windows-386.zip +c6bd560a7825c108d6432ec4fa8ca376df217b1a04d75b45d54c5207ead00201 go1.25.8.windows-386.msi +8d4ed9a270b33df7a6d3ff3a5316e103e0042fcc4f0c9a80e40378700bab6794 go1.25.8.windows-amd64.zip +df006a579f55ecc18fbe7c90d27045c070b76641a0c251101a0ca32e314f863b go1.25.8.windows-amd64.msi +0ffaef4a9617a8819294b5f52aefca1415dce644a70f5ad155676293ab052a31 go1.25.8.windows-arm64.zip +ef9df3df960787900e9a680241d624c8556cb09e5f4fabb1e82a928086a999c5 go1.25.8.windows-arm64.msi # version:golangci 2.4.0 # https://github.com/golangci/golangci-lint/releases/ diff --git a/build/ci.go b/build/ci.go index 4a600bc90..72be3a326 100644 --- a/build/ci.go +++ b/build/ci.go @@ -130,7 +130,7 @@ var ( // This is the version of go that will be downloaded by // // go run ci.go install -dlgo - dlgoVersion = "1.25.0" + dlgoVersion = "1.25.8" ) var GOBIN, _ = filepath.Abs(filepath.Join("build", "bin")) diff --git a/go.mod b/go.mod index 32bcd82ac..479db4ae6 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/ethereum/go-ethereum -go 1.25.0 +go 1.25.8 // Quorum - Replace Go modules that use modifications done by us replace github.com/coreos/etcd => github.com/Consensys/etcd v3.3.13-quorum197+incompatible From 3b20fa55d8b1d8c95532297b2710d0e2b00a7c4e Mon Sep 17 00:00:00 2001 From: Yoshihito Aso Date: Mon, 16 Mar 2026 12:28:39 +0900 Subject: [PATCH 3/5] Update pr.yml --- .github/workflows/pr.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index aafe36f3d..d1272372d 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -38,7 +38,7 @@ jobs: runs-on: ${{ matrix.os }} steps: - name: 'Setup Go ${{ env.GO_VERSION }}' - uses: actions/setup-go@v1 + uses: actions/setup-go@v5 with: go-version: ${{ env.GO_VERSION }} - name: 'Check out project files' From ef08e6b2fc0bb1c43dd5be5382277c9b282ba559 Mon Sep 17 00:00:00 2001 From: Yoshihito Aso Date: Mon, 16 Mar 2026 12:52:34 +0900 Subject: [PATCH 4/5] Support AWS secret version id or stage for nodekey --- cmd/utils/common/aws_client.go | 6 ++++ cmd/utils/common/aws_client_test.go | 21 +++++++++++++ cmd/utils/nodekey/fetcher/aws_sm.go | 28 ++++++++++++++--- cmd/utils/nodekey/fetcher/aws_sm_test.go | 40 ++++++++++++++++++++++++ docs/aws-nodekey.md | 7 +++-- p2p/nodekey/config.go | 3 +- 6 files changed, 97 insertions(+), 8 deletions(-) create mode 100644 cmd/utils/nodekey/fetcher/aws_sm_test.go diff --git a/cmd/utils/common/aws_client.go b/cmd/utils/common/aws_client.go index acc286bb7..253f0f522 100644 --- a/cmd/utils/common/aws_client.go +++ b/cmd/utils/common/aws_client.go @@ -47,5 +47,11 @@ func validateConfigurationValues(config nodekey.AwsConfig) error { if config.SecretName == "" { return errors.New("need to specify secret name to retrieve data from AWS Secrets Manager") } + if config.SecretVersionId == "" && config.SecretVersionStage == "" { + return errors.New("need to specify either secret version id or secret version stage") + } + if config.SecretVersionId != "" && config.SecretVersionStage != "" { + return errors.New("secret version id and secret version stage are mutually exclusive") + } return nil } diff --git a/cmd/utils/common/aws_client_test.go b/cmd/utils/common/aws_client_test.go index 9f5c33aae..f839170e9 100644 --- a/cmd/utils/common/aws_client_test.go +++ b/cmd/utils/common/aws_client_test.go @@ -13,5 +13,26 @@ func TestValidateConfigurationValues(t *testing.T) { require.Contains(t, err.Error(), "secret name") err = validateConfigurationValues(nodekey.AwsConfig{SecretName: "boostry/ibet-network/quorum/nodekey"}) + require.Error(t, err) + require.Contains(t, err.Error(), "either secret version id or secret version stage") + + err = validateConfigurationValues(nodekey.AwsConfig{ + SecretName: "boostry/ibet-network/quorum/nodekey", + SecretVersionStage: "AWSCURRENT", + }) + require.NoError(t, err) + + err = validateConfigurationValues(nodekey.AwsConfig{ + SecretName: "boostry/ibet-network/quorum/nodekey", + SecretVersionId: "f368ae7f-41e6-4d25-8e8e-a3aad0130846", + }) require.NoError(t, err) + + err = validateConfigurationValues(nodekey.AwsConfig{ + SecretName: "boostry/ibet-network/quorum/nodekey", + SecretVersionId: "f368ae7f-41e6-4d25-8e8e-a3aad0130846", + SecretVersionStage: "AWSCURRENT", + }) + require.Error(t, err) + require.Contains(t, err.Error(), "mutually exclusive") } diff --git a/cmd/utils/nodekey/fetcher/aws_sm.go b/cmd/utils/nodekey/fetcher/aws_sm.go index f9573c1ee..4b2048ebf 100644 --- a/cmd/utils/nodekey/fetcher/aws_sm.go +++ b/cmd/utils/nodekey/fetcher/aws_sm.go @@ -3,6 +3,7 @@ package fetcher import ( "context" "crypto/ecdsa" + "errors" "fmt" "github.com/aws/aws-sdk-go-v2/aws" @@ -40,14 +41,14 @@ func (f *NodeKeyAwsSecretsManagerFetcher) FetchEncryptedNodeKey() (string, error func (f *NodeKeyAwsSecretsManagerFetcher) fetch() (string, error) { secretName := f.aws.Config.SecretName - secretVersionID := f.aws.Config.SecretVersion + secretVersionID := f.aws.Config.SecretVersionId + secretVersionStage := f.aws.Config.SecretVersionStage log.Info("Fetching node key from AWS Secrets Manager", "secret", secretName) - input := &secretsmanager.GetSecretValueInput{SecretId: aws.String(secretName)} - // Version is optional: if omitted, AWS resolves the current/default version. - if secretVersionID != "" { - input.VersionId = aws.String(secretVersionID) + input, err := buildGetSecretValueInput(secretName, secretVersionID, secretVersionStage) + if err != nil { + return "", err } ctx := context.Background() @@ -60,3 +61,20 @@ func (f *NodeKeyAwsSecretsManagerFetcher) fetch() (string, error) { } return *resp.SecretString, nil } + +func buildGetSecretValueInput(secretName, versionID, versionStage string) (*secretsmanager.GetSecretValueInput, error) { + input := &secretsmanager.GetSecretValueInput{SecretId: aws.String(secretName)} + if versionID == "" && versionStage == "" { + return nil, errors.New("either secret version id or secret version stage must be specified") + } + if versionID != "" && versionStage != "" { + return nil, errors.New("secret version id and secret version stage cannot both be specified") + } + if versionID != "" { + input.VersionId = aws.String(versionID) + } + if versionStage != "" { + input.VersionStage = aws.String(versionStage) + } + return input, nil +} diff --git a/cmd/utils/nodekey/fetcher/aws_sm_test.go b/cmd/utils/nodekey/fetcher/aws_sm_test.go new file mode 100644 index 000000000..a82a1e59a --- /dev/null +++ b/cmd/utils/nodekey/fetcher/aws_sm_test.go @@ -0,0 +1,40 @@ +package fetcher + +import ( + "testing" + + "github.com/stretchr/testify/require" +) + +func TestBuildGetSecretValueInput_WithVersionID(t *testing.T) { + input, err := buildGetSecretValueInput("boostry/ibet-network/quorum/nodekey", "f368ae7f-41e6-4d25-8e8e-a3aad0130846", "") + require.NoError(t, err) + require.NotNil(t, input) + require.Equal(t, "boostry/ibet-network/quorum/nodekey", *input.SecretId) + require.NotNil(t, input.VersionId) + require.Equal(t, "f368ae7f-41e6-4d25-8e8e-a3aad0130846", *input.VersionId) + require.Nil(t, input.VersionStage) +} + +func TestBuildGetSecretValueInput_WithVersionStage(t *testing.T) { + input, err := buildGetSecretValueInput("boostry/ibet-network/quorum/nodekey", "", "AWSCURRENT") + require.NoError(t, err) + require.NotNil(t, input) + require.Equal(t, "boostry/ibet-network/quorum/nodekey", *input.SecretId) + require.NotNil(t, input.VersionStage) + require.Equal(t, "AWSCURRENT", *input.VersionStage) + require.Nil(t, input.VersionId) +} + +func TestBuildGetSecretValueInput_WithoutVersionSelector(t *testing.T) { + _, err := buildGetSecretValueInput("boostry/ibet-network/quorum/nodekey", "", "") + require.Error(t, err) + require.Contains(t, err.Error(), "must be specified") +} + +func TestBuildGetSecretValueInput_WithBothSelectors(t *testing.T) { + _, err := buildGetSecretValueInput("boostry/ibet-network/quorum/nodekey", "f368ae7f-41e6-4d25-8e8e-a3aad0130846", "AWSCURRENT") + require.Error(t, err) + require.Contains(t, err.Error(), "cannot both be specified") + +} diff --git a/docs/aws-nodekey.md b/docs/aws-nodekey.md index 65740f560..f210c1134 100644 --- a/docs/aws-nodekey.md +++ b/docs/aws-nodekey.md @@ -21,7 +21,7 @@ Add the following section to your config.toml: ```toml [Node.P2P.NodeKey.ConfigAws] SecretName = "boostry/ibet-network/quorum/nodekey" -SecretVersion = "AWSCURRENT" +SecretVersionStage = "AWSCURRENT" KmsKeyId = "alias/mykey" KmsEncryptionAlgorithm = "RSAES_OAEP_SHA_256" ``` @@ -29,7 +29,10 @@ KmsEncryptionAlgorithm = "RSAES_OAEP_SHA_256" Field details: - SecretName: Name or ARN of the secret that stores node key data -- SecretVersion: Optional secret version ID (if omitted, current/default is used) +- SecretVersionId: Optional AWS secret version ID +- SecretVersionStage: Optional AWS secret version stage (for example AWSCURRENT) +- Either SecretVersionId or SecretVersionStage must be specified +- SecretVersionId and SecretVersionStage cannot both be specified - KmsKeyId: Required when --nodekeydecryption=aws-kms - KmsEncryptionAlgorithm: Optional KMS algorithm override for asymmetric keys diff --git a/p2p/nodekey/config.go b/p2p/nodekey/config.go index a584f4a42..df0c072ca 100644 --- a/p2p/nodekey/config.go +++ b/p2p/nodekey/config.go @@ -12,7 +12,8 @@ type FileConfig struct { type AwsConfig struct { SecretName string `toml:",omitempty"` - SecretVersion string `toml:",omitempty"` + SecretVersionId string `toml:",omitempty"` + SecretVersionStage string `toml:",omitempty"` KmsKeyId string `toml:",omitempty"` KmsEncryptionAlgorithm string `toml:",omitempty"` } From c481ecdf34ba89451987f7bbd91545b1682534cf Mon Sep 17 00:00:00 2001 From: Yoshihito Aso Date: Mon, 16 Mar 2026 12:59:21 +0900 Subject: [PATCH 5/5] Fix lint error --- cmd/utils/nodekey/fetcher/aws_sm_test.go | 1 - 1 file changed, 1 deletion(-) diff --git a/cmd/utils/nodekey/fetcher/aws_sm_test.go b/cmd/utils/nodekey/fetcher/aws_sm_test.go index a82a1e59a..fe89fd035 100644 --- a/cmd/utils/nodekey/fetcher/aws_sm_test.go +++ b/cmd/utils/nodekey/fetcher/aws_sm_test.go @@ -36,5 +36,4 @@ func TestBuildGetSecretValueInput_WithBothSelectors(t *testing.T) { _, err := buildGetSecretValueInput("boostry/ibet-network/quorum/nodekey", "f368ae7f-41e6-4d25-8e8e-a3aad0130846", "AWSCURRENT") require.Error(t, err) require.Contains(t, err.Error(), "cannot both be specified") - }