update readme, add test and check to remote signer

README.md

@@ -146,6 +146,22 @@ sudo sh -c 'printf "%s\n" "YOUR_KEYRING_PASSWORD" > /etc/layer-daemons/reporter-
 
 Make sure the service `User` can read the file. When `KEYRING_PASSWORD_FILE` is set, startup fails and the daemon exits if the file cannot be read, is empty, or cannot unlock the configured `--from` account. If `KEYRING_PASSWORD_FILE` is not set, the daemon falls back to reading the keyring password from stdin.
 
+## Remote Signer
+
+Set `REMOTE_SIGNER_ADDR` / `--remote-signer-addr` to delegate transaction signing to a bridge remote signer gRPC service instead of loading a local private key from the reporter keyring.
+
+When remote signing is enabled, `--from` / `FROM` is still required as the local account name used by the Cosmos client context, but the signing key and account address are fetched from the remote signer. Startup fails if the signer cannot be reached, does not return a 33-byte compressed secp256k1 public key, or returns a Tellor address that does not match that public key.
+
+Example:
+
+```bash
+LAYER_HOME=/home/reporter/.layer \
+GRPC_NODES=your-grpc-host:9090 \
+RPC_NODES=tcp://your-rpc-host:26657 \
+REMOTE_SIGNER_ADDR=127.0.0.1:9191 \
+reporterd --from reporter
+```
+
 ## Reward Withdrawals And Auto-Unbonding
 
 The reporter periodically withdraws earned tips/rewards with `MsgWithdrawTip`. The interval is configured by `WITHDRAW_FREQUENCY` in seconds and defaults to `43200` (12 hours). By default, the validator operator address is derived from the reporter account address. If the reporter account is delegated to a different validator, set `REPORTERS_VALIDATOR_ADDRESS` to that validator's `tellorvaloper...` address.

env.example

@@ -30,6 +30,9 @@ ALCHEMY_API_KEY=YOUR_ALCHEMY_API_KEY
 # LOG_LEVEL=info
 # PROMETHEUS_PORT=26661
 
+# Remote signer (optional; delegates tx signing instead of using the local keyring):
+# REMOTE_SIGNER_ADDR=127.0.0.1:9191
+
 # Set Automatic Reward withdrawals:
 # REPORTERS_VALIDATOR_ADDRESS=tellorvaloper1...
 # WITHDRAW_FREQUENCY=43200

reporter/client/remote_signer_keyring.go

@@ -60,6 +60,9 @@ func (r *remoteSignerKeyring) SupportedAlgorithms() (keyring.SigningAlgoList, ke
 
 // Key implements keyring.Keyring. Returns the offline record for the managed key.
 func (r *remoteSignerKeyring) Key(uid string) (*keyring.Record, error) {
+	if uid != r.keyName {
+		return nil, fmt.Errorf("remoteSignerKeyring.Key: key %q not found", uid)
+	}
 	rec, err := keyring.NewOfflineRecord(uid, r.pubKey)
 	if err != nil {
 		return nil, fmt.Errorf("remoteSignerKeyring.Key: %w", err)
@@ -118,7 +121,10 @@ func (r *remoteSignerKeyring) SaveMultisig(_ string, _ cryptotypes.PubKey) (*key
 
 // Sign implements keyring.Signer (part of keyring.Keyring).
 // Computes sha256(msg) and calls SignRaw on the remote signer, returning a 64-byte (r||s) signature.
-func (r *remoteSignerKeyring) Sign(_ string, msg []byte, _ signing.SignMode) ([]byte, cryptotypes.PubKey, error) {
+func (r *remoteSignerKeyring) Sign(uid string, msg []byte, _ signing.SignMode) ([]byte, cryptotypes.PubKey, error) {
+	if uid != r.keyName {
+		return nil, nil, fmt.Errorf("remoteSignerKeyring.Sign: key %q not found", uid)
+	}
 	hash := sha256.Sum256(msg)
 	resp, err := r.signerConn.SignRaw(context.Background(), &signerv1.SignRawRequest{
 		Msg:       hash[:],
@@ -217,17 +223,30 @@ func newKeyringFromRemoteSigner(ctx context.Context, keyName, addr, caCert, clie
 		return nil, nil, nil, fmt.Errorf("GetAddress from remote signer: %w", err)
 	}
 
-	accAddr, err := sdk.AccAddressFromBech32(addrResp.Address)
+	kr, err := newRemoteSignerKeyring(keyName, pubKeyResp.PublicKey, signerClient)
 	if err != nil {
 		conn.Close()
-		return nil, nil, nil, fmt.Errorf("parse address %q from remote signer: %w", addrResp.Address, err)
+		return nil, nil, nil, err
 	}
 
-	kr, err := newRemoteSignerKeyring(keyName, pubKeyResp.PublicKey, signerClient)
+	accAddr, err := remoteSignerAccountAddress(kr.pubKey, addrResp.Address)
 	if err != nil {
 		conn.Close()
 		return nil, nil, nil, err
 	}
 
 	return kr, accAddr, conn, nil
 }
+
+func remoteSignerAccountAddress(pubKey cryptotypes.PubKey, bech32Addr string) (sdk.AccAddress, error) {
+	accAddr, err := sdk.AccAddressFromBech32(bech32Addr)
+	if err != nil {
+		return nil, fmt.Errorf("parse address %q from remote signer: %w", bech32Addr, err)
+	}
+
+	expectedAddr := sdk.AccAddress(pubKey.Address())
+	if !expectedAddr.Equals(accAddr) {
+		return nil, fmt.Errorf("remote signer address %q does not match fetched public key", bech32Addr)
+	}
+	return accAddr, nil
+}

reporter/client/remote_signer_keyring_test.go

@@ -0,0 +1,52 @@
+package client
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	_ "github.com/tellor-io/layer/app/config"
+
+	cosmossecp "github.com/cosmos/cosmos-sdk/crypto/keys/secp256k1"
+	sdk "github.com/cosmos/cosmos-sdk/types"
+	"github.com/cosmos/cosmos-sdk/types/bech32"
+	"github.com/cosmos/cosmos-sdk/types/tx/signing"
+)
+
+func TestRemoteSignerAccountAddressRequiresPublicKeyMatch(t *testing.T) {
+	pubKey := &cosmossecp.PubKey{Key: testCompressedPubKey(1)}
+	addr, err := bech32.ConvertAndEncode("tellor", sdk.AccAddress(pubKey.Address()))
+	require.NoError(t, err)
+
+	accAddr, err := remoteSignerAccountAddress(pubKey, addr)
+	require.NoError(t, err)
+	require.True(t, accAddr.Equals(sdk.AccAddress(pubKey.Address())))
+
+	otherAddr, err := bech32.ConvertAndEncode("tellor", sdk.AccAddress(make([]byte, 20)))
+	require.NoError(t, err)
+
+	_, err = remoteSignerAccountAddress(pubKey, otherAddr)
+	require.Error(t, err)
+	require.ErrorContains(t, err, "does not match fetched public key")
+}
+
+func TestRemoteSignerKeyringRejectsUnknownKeyName(t *testing.T) {
+	kr, err := newRemoteSignerKeyring("reporter", testCompressedPubKey(2), nil)
+	require.NoError(t, err)
+
+	_, err = kr.Key("other")
+	require.Error(t, err)
+	require.ErrorContains(t, err, "not found")
+
+	_, _, err = kr.Sign("other", []byte("sign-doc"), signing.SignMode_SIGN_MODE_DIRECT)
+	require.Error(t, err)
+	require.ErrorContains(t, err, "not found")
+}
+
+func testCompressedPubKey(seed byte) []byte {
+	key := make([]byte, 33)
+	key[0] = 0x02
+	for i := 1; i < len(key); i++ {
+		key[i] = seed + byte(i)
+	}
+	return key
+}