Creating a Delegated Group Multisig AID #95
Replies: 3 comments 8 replies
-
|
I tried running these scripts. I can get almost everything to complete, except for There is a small typo: |
Beta Was this translation helpful? Give feedback.
-
|
I'm following instructions in chapter 1, with keripy on development branch, the rest on main branches. I'm not using python venv. Is there a particular order the delegator and multisig members should proceed to next step? Or is there something to avoid..? |
Beta Was this translation helpful? Give feedback.
-
|
@psteniusubi I came across the same problem that you described during my first run. My terminals for kli and sigpy freezed while sigts finished. Then, I tried it again, deleting everything in Here is a step-by-step of what I did: I hope this works for you. |
Beta Was this translation helpful? Give feedback.
-
|
When my multisig-kli and multisig-sigfy freezed, I think what happened was that the script in |
Beta Was this translation helpful? Give feedback.
-
|
Thanks @nkongsuwan for figuring out the correct order! This helped me complete the task. |
Beta Was this translation helpful? Give feedback.
-
|
The order of those later steps should not matter since the KERI protocol is asynchronous and the signatures on those events can be processed in any order. The only order I tried to enforce in the script is the initialization of the initial AIDs vs OOBI resolution. Not because it can fail, but because it can take much longer waiting for OOBI retries if you try to resolve OOBIs before the AIDs are created. I can take a look at the ordering of things to ensure nothing is amiss, after I finish with group multisig registry creation. |
Beta Was this translation helpful? Give feedback.
-
|
@pfeairheller If you would not mind, may I suggest that you add one more step before step 4 (Delegator Script) that outlines how to run |
Beta Was this translation helpful? Give feedback.
-
|
I'll probably update the scripts to use config files that don't load those OOBIs since they are not required for this procedure. |
Beta Was this translation helpful? Give feedback.
-
|
With the latest updates on development branches I have some challenges. Should this script work on the development branches? I'm seeing this error from multisig-sigpy.sh |
Beta Was this translation helpful? Give feedback.
-
|
Yes, it should work, but some code pushed to signifypy to update tests broke things. I have a fix I'll be pushing later today. |
Beta Was this translation helpful? Give feedback.
-
This document describes the steps to follow to create a delegated group multisig AID using the command line tool from KERIpy and two agents hosted in KERIA, one controlled using the SignifyPy client library and one controlled using the Signify-ts client library. All the scripts described in this document are located in the scripts directory of Signify-ts.
Overview
This procedure described in this document creates an AID (
delegator) with a single signing key using the KERIpy command line, 3 AIDs (multisig-kli,multisig-sigpy,multisig-sigts) each with a single signing key using the KERIpy command line, the SignifyPy client library and the Signify-ts client library respectively. It then creates a group multisig AID calledmultisigand declares thedelegatorAID as the delegator. Each client waits for the delegation approval and then collaborates with the other members to create Endpoint Role Authorizations for themultisigAID. All AIDs share the "demo witness pool" for witnesses and the two AIDs created using the Signify client libraries share a single KERIA instance for hosting their agents. The rest of this document describes how to launch the necessary components and run the scripts.1. Prerequisites
KERIpy, KERIA and SignifyPy all require Python version 3.10.4 and at least pip version 22.0.4. An up-to-date version of libsodium needs to be installed on the target system. It is recommended to use
venvor similar to create a unique virtual environment for each repository. Signify-ts requiresnodeversion v18.16.1,npmversion 9.5.1 as well asts-nodeto run the scripts mentioned here. The following list of commands details how to initialize each repository:KERIpy
$ git clone https://github.com/WebOfTrust/keripy.git $ cd keripy $ pip install -r requirements.txtKERIA
$ git clone https://github.com/WebOfTrust/keria.git $ cd keria $ git checkout main $ pin install -r requirements.txtSignifyPy
$ git clone https://github.com/WebOfTrust/signifypy.git $ cd signifypy $ git checkout main $ pip install -r requirements.txtSignify-TS
KERIpy and KERIA share database initialization code and will share the same base directory for all databases. The logic for each is to use the base directory of
/usr/local/var/keriif that directory is available and writable. If that directory is not available, each script will create a directory named.keriin the current user's HOME directory (if it does not already exist) and use that as the base for all databases. The scripts described in this document expect that they are starting with empty databases. For each run of the scripts described it is recommended to delete the contents of the base directory available to you.For example, if you have
/usr/local/var/keriwritable for your user, running:$ rm -rf /usr/local/var/keri/*This will clear out the databases created by each script for a clean run of this procedure.
The convention for the rest of this document is to assume the use of
venvfor Python scripts and will preface the prompt in the examples with the name of a suggestedvenvenvironment in parenthesis. For example,(keripy) $for executing commands with the virtual environment for KERIpy.Finally, all scripts are written expecting the Bash shell and have only been tested on MacOS and Linux using the Bash shell on those architectures.
2. Witness Pool
The scripts for the Delegator AID, SignifyPy AID and KERIpy command line AID are all hardcoded to use the same witness AIDs. This approach allows for all environments to be easily configured with endpoints for those witnesses and to use the witnesses that are made available in the KERIpy demo witness pool. To launch the KERIpy demo witness pool, you must run the following command using the KERIpy virtual environment from the KERIpy repository directory. The command will print the witness AIDs that are provided. The command must be left running while all other scripts are run.
3. KERIA Service
The scripts for creating the AIDs for SiginfyPy and SignifyTS are both hardcoded to use a KERIA service launched on the default ports for KERIA (3901 and 3902). To launch the KERIA service you must run the following command using the KERIA virtual environment from the KERIA repository directory. This command will print out a message indicating that it is ready and waiting for requests. This command must be left running while the remaining scripts execute.
(keria) $ keria start --config-dir scripts --config-file demo-witness-oobis The Agency is loaded and waiting for requests...4. Delegator Script
The script for the delegator is located in the
examples/scriptsdirectory of the Signify-ts repository and is calleddelegator.sh. This is the simplest of the scripts. It creates thedelegatorAID with a single signing key and single rotation key that uses 3 of the KERIpy demo witnesses with a witness threshold of 2. To execute this script, you must use the KERIpy virtual environment from theexamples/scriptsdirectory of the Signify-ts repository. Before launching this script, you must "source" the environment initialization file in that directory namedenv.sh. To initialize the delegator, execute the following:The script has created the database and keystore for the delegator AID, loaded all the out-of-band introductions (OOBIs) in its configuration file and created the Delegator AID. It then launches the KERIpy command line command for approving delegation requests. This script must be left running while the rest of the scripts are executed.
5. KERIpy Command Line Multisig Participant
The script for the KERIpy command line AID is located in the
examples/scriptsdirectory of the Signify-ts repository. This script uses the KERIpy command line to create themultisig-kliAID that has a single signing key and single rotation key that uses 3 of the KERIpy demo witness pool witnesses with a witness threshold of 2. To execute this script you must use the KERIpy virtual environment from theexamples/scriptsdirectory of the Signify-ts repository. Before launching this script, you must "source" the environment initialization file in that directory namedenv.sh.At this point, the
multisig-kliAID has been created and published to its witnesses. It is now waiting for confirmation from the user that the other multisig participant scripts have been launched before it tries to resolve the OOBIs for the other participants. This script must be left running while the other scripts are launched.6. SignifyPy Client Library Multisig Participant
The script for the SignifyPy client AID is located in the
examples/scriptsdirectory of the Signify-ts repository. This script uses the SignifyPy client library to create themultisig-sigpyAID hosted in an Agent in the KERIA service. This AID has a single signing key and single rotation key that uses 3 of the KERIpy demo witness pool witnesses with a witness threshold of 2. To execute this script you must use the SignifyPy virtual environment from theexamples/scriptsdirectory of the Signify-ts repository. Before launching this script, you must "source" the environment initialization file in that directory namedenv.sh.At this point, the
multisig-sigpyAID has been created and published to its witnesses. In addition, this script has resolved the OOBIs for thedelegatorAID as well as for themultisig-kliAID. It is now waiting for confirmation from the user that themultisig-sigtsparticipant script has been launched before it tries to resolve the OOBI for that participant. This script must be left running while the final script is launched.7. Signify-ts Client Library Multisig Participant
The script for the Signify-ts client AID is located in the
examples/scriptsdirectory of the Signify-ts repository. This script uses the Signify-ts client library to create themultisig-sigtsAID hosted in an Agent in the KERIA service. This AID has a single signing key and single rotation key. This AID does not use any witnesses for its participant AID. To execute this script you must use the propernodeenvironment from theexamples/scriptsdirectory of the Signify-ts repository. Before launching this script, you must "source" the environment initialization file in that directory namedenv.sh.At this point, the
multisig-sigtsAID has been created. In addition, this script has resolved the OOBIs for thedelegatorAID, themultisig-kliAID and themultisig-sigpyAID. In addition, this script has initiated the creation of the delegated group multisig AID calledmultisig. It is now waiting for confirmation from the user that the other participants have joined themultisiggroup AID, as the delegator has approved the delegation and then it will create the endpoint role authorizations for themultisigAID that allow each participant to receive messages on behalf of themultisigAID. This script must be left running while all other scripts are allowed to continue.8. Confirming Completion of All Scripts
Each script will now prompt the user for the required confirmation that it is able to continue to the next steps. The procedure is asynchronous and the confirmation can be completed in any order for the multisig participant scripts. Hitting
<Enter>in the window for each of the multisig participants will allow them to progress tomultisigAID creation and delegation request submission.The delegator script will not prompt until the
multisigAID has been created by all the participants and the delegation request has been received. The prompt will look as follows:Answering
Yto that prompt will approve the delegation and the rest of the scripts will progress to the next step. At this point, the delegator script will be complete and is no longer needed. Each of the multisig participant scripts will progress to the creation of endpoint role authorizations for themultisigAID. Themultisig-kli.shwill display the configuration it is creating as follows:Entering 'Y' at that prompt will create 3 endpoint role authorizations and submit them to the other members for approval. The remaining two multisig participant scripts will prompt as follows, requiring only the
<Enter>key to complete the creation of the endpoint role authorizations and the completion of all scripts:Press any key to create endpoints for multisig AID...All the multisig participant scripts will wait for fully signed endpoint role authorizations and when received will exit. The scripts and the libraries they use have varying levels logging/debug output enabled so each will look slightly different when complete. The following sections provide examples of successful output for each of the scripts and programs described here:
KERIpy Demo Witness Pool
KERIA Service
Delegator
KERIpy Command Line Multisig Participant
SignifyPy Client Library Multisig Participant
Signify-ts Client Library Multisig Participant
Conclusion.
This process has created 5 AIDs,
delegator,multisig-kli,multisig-sigpy,multisig-sigtsandmultisig. ThemultisigAID has 3 public signing keys and 3 rotation next digests contributed to it from themultisig-kli,multisig-sigpy,multisig-sigtsAIDs and is a delegated AID with thedelegatorAID as its delegator. This represents a group multisig AID with contributing members from across 4 different libraries, KERIpy, KERIA, SignifyPy and Signify-ts. All of these AIDs can be manipulated using their respective client libraries and passcodes to perform operations such as credential issuance, challenge-response workflows and OOBI exchanges.Beta Was this translation helpful? Give feedback.
All reactions