Fix support for validator key rotation, add end-to-end test

packages/celotool/src/e2e-tests/utils.ts

@@ -213,7 +213,7 @@ export async function init(gethBinaryPath: string, datadir: string, genesisPath:
 }
 
 export async function importPrivateKey(gethBinaryPath: string, instance: GethInstanceConfig) {
-  const keyFile = '/tmp/key.txt'
+  const keyFile = `/${getDatadir(instance)}/key.txt`
   fs.writeFileSync(keyFile, instance.privateKey)
   console.info(`geth:${instance.name}: import account`)
   await execCmdWithExitOnFailure(

packages/cli/src/commands/account/authorize.test.ts

@@ -8,14 +8,32 @@ process.env.NO_SYNCCHECK = 'true'
 testWithGanache('account:authorize cmd', (web3: Web3) => {
   test('can authorize account', async () => {
     const accounts = await web3.eth.getAccounts()
-    await Register.run(['--from', accounts[0], '--name', 'Chapulin Colorado'])
-    await Authorize.run(['--from', accounts[0], '--role', 'validation', '--to', accounts[1]])
+    await Register.run(['--from', accounts[0]])
+    await Authorize.run([
+      '--from',
+      accounts[0],
+      '--role',
+      'validator',
+      '--signer',
+      accounts[1],
+      '--pop',
+      '0x1b9fca4bbb5bfb1dbe69ef1cddbd9b4202dcb6b134c5170611e1e36ecfa468d7b46c85328d504934fce6c2a1571603a50ae224d2b32685e84d4d1a1eebad8452eb',
+    ])
   })
 
   test('fails if from is not an account', async () => {
     const accounts = await web3.eth.getAccounts()
     await expect(
-      Authorize.run(['--from', accounts[0], '--role', 'validation', '--to', accounts[1]])
+      Authorize.run([
+        '--from',
+        accounts[0],
+        '--role',
+        'validator',
+        '--signer',
+        accounts[1],
+        '--pop',
+        '0x1b9fca4bbb5bfb1dbe69ef1cddbd9b4202dcb6b134c5170611e1e36ecfa468d7b46c85328d504934fce6c2a1571603a50ae224d2b32685e84d4d1a1eebad8452eb',
+      ])
     ).rejects.toThrow()
   })
 })

packages/cli/src/commands/account/authorize.ts

@@ -5,52 +5,47 @@ import { displaySendTx } from '../../utils/cli'
 import { Flags } from '../../utils/command'
 
 export default class Authorize extends BaseCommand {
-  static description = 'Authorize an attestation, validation or vote signing key'
+  static description = 'Authorize an attestation, validator, or vote signer'
 
   static flags = {
     ...BaseCommand.flags,
     from: Flags.address({ required: true }),
     role: flags.string({
       char: 'r',
-      options: ['vote', 'validation', 'attestation'],
+      options: ['vote', 'validator', 'attestation'],
       description: 'Role to delegate',
+      required: true,
     }),
-    to: Flags.address({ required: true }),
+    pop: flags.string({
+      description: 'Proof-of-possession of the signer key',
+      required: true,
+    }),
+    signer: Flags.address({ required: true }),
   }
 
   static args = []
 
   static examples = [
-    'authorize --from 0x5409ED021D9299bf6814279A6A1411A7e866A631 --role vote --to 0xc1912fEE45d61C87Cc5EA59DaE31190FFFFf232d',
+    'authorize --from 0x5409ED021D9299bf6814279A6A1411A7e866A631 --role vote --signer 0x6ecbe1db9ef729cbe972c83fb886247691fb6beb --pop 0x1b9fca4bbb5bfb1dbe69ef1cddbd9b4202dcb6b134c5170611e1e36ecfa468d7b46c85328d504934fce6c2a1571603a50ae224d2b32685e84d4d1a1eebad8452eb',
   ]
 
   async run() {
     const res = this.parse(Authorize)
-
-    if (!res.flags.role) {
-      this.error(`Specify role with --role`)
-      return
-    }
-
-    if (!res.flags.to) {
-      this.error(`Specify authorized address with --to`)
-      return
-    }
-
     this.kit.defaultAccount = res.flags.from
     const accounts = await this.kit.contracts.getAccounts()
+    const sig = accounts.parseSignatureOfAddress(res.flags.from, res.flags.signer, res.flags.pop)
 
     await newCheckBuilder(this)
       .isAccount(res.flags.from)
       .runChecks()
 
     let tx: any
     if (res.flags.role === 'vote') {
-      tx = await accounts.authorizeVoteSigner(res.flags.from, res.flags.to)
-    } else if (res.flags.role === 'validation') {
-      tx = await accounts.authorizeValidationSigner(res.flags.from, res.flags.to)
+      tx = await accounts.authorizeVoteSigner(res.flags.signer, sig)
+    } else if (res.flags.role === 'validator') {
+      tx = await accounts.authorizeValidatorSigner(res.flags.signer, sig)
     } else if (res.flags.role === 'attestation') {
-      tx = await accounts.authorizeAttestationSigner(res.flags.from, res.flags.to)
+      tx = await accounts.authorizeAttestationSigner(res.flags.signer, sig)
     } else {
       this.error(`Invalid role provided`)
       return

packages/cli/src/commands/account/proof-of-possession.ts

@@ -0,0 +1,28 @@
+import { serializeSignature } from '@celo/utils/lib/signatureUtils'
+import { BaseCommand } from '../../base'
+import { printValueMap } from '../../utils/cli'
+import { Flags } from '../../utils/command'
+
+export default class ProofOfPossession extends BaseCommand {
+  static description = 'Generate proof-of-possession to be used to authorize a signer'
+
+  static flags = {
+    ...BaseCommand.flags,
+    signer: Flags.address({ required: true }),
+    account: Flags.address({ required: true }),
+  }
+
+  static examples = [
+    'proof-of-possession --account 0x5409ed021d9299bf6814279a6a1411a7e866a631 --signer 0x6ecbe1db9ef729cbe972c83fb886247691fb6beb',
+  ]
+
+  async run() {
+    const res = this.parse(ProofOfPossession)
+    const accounts = await this.kit.contracts.getAccounts()
+    const pop = await accounts.generateProofOfSigningKeyPossession(
+      res.flags.account,
+      res.flags.signer
+    )
+    printValueMap({ signature: serializeSignature(pop) })
+  }
+}

packages/cli/src/commands/account/register.ts

@@ -9,13 +9,16 @@ export default class Register extends BaseCommand {
 
   static flags = {
     ...BaseCommand.flags,
-    name: flags.string({ required: true }),
+    name: flags.string(),
     from: Flags.address({ required: true }),
   }
 
   static args = []
 
-  static examples = ['register']
+  static examples = [
+    'register --from 0x5409ed021d9299bf6814279a6a1411a7e866a631',
+    'register --from 0x5409ed021d9299bf6814279a6a1411a7e866a631 --name test-account',
+  ]
 
   async run() {
     const res = this.parse(Register)
@@ -26,6 +29,8 @@ export default class Register extends BaseCommand {
       .isNotAccount(res.flags.from)
       .runChecks()
     await displaySendTx('register', accounts.createAccount())
-    await displaySendTx('setName', accounts.setName(res.flags.name))
+    if (res.flags.name) {
+      await displaySendTx('setName', accounts.setName(res.flags.name))
+    }
   }
 }

packages/cli/src/commands/validator/register.ts

@@ -1,21 +1,24 @@
+import { addressToPublicKey } from '@celo/lib/address'
 import { BaseCommand } from '../../base'
 import { newCheckBuilder } from '../../utils/checks'
 import { displaySendTx } from '../../utils/cli'
 import { Flags } from '../../utils/command'
-import { getPubKeyFromAddrAndWeb3 } from '../../utils/helpers'
 
 export default class ValidatorRegister extends BaseCommand {
   static description = 'Register a new Validator'
 
   static flags = {
     ...BaseCommand.flags,
     from: Flags.address({ required: true, description: 'Address for the Validator' }),
-    publicKey: Flags.publicKey({ required: true }),
+    ecdsaKey: Flags.ecdsaPublicKey({ required: true }),
+    blsKey: Flags.blsPublicKey({ required: true }),
+    blsPop: Flags.blsProofOfPossession({ required: true }),
   }
 
   static examples = [
-    'register --from 0x47e172F6CfB6c7D01C1574fa3E2Be7CC73269D95 --publicKey 0xc52f3fab06e22a54915a8765c4f6826090cfac5e40282b43844bf1c0df83aaa632e55b67869758f2291d1aabe0ebecc7cbf4236aaa45e3e0cfbf997eda082ae19d3e1d8f49f6b0d8e9a03d80ca07b1d24cf1cc0557bdcc04f5e17a46e35d02d0d411d956dbd5d2d2464eebd7b74ae30005d223780d785d2abc5644fac7ac29fb0e302bdc80c81a5d45018b68b1045068a4b3a4861c93037685fd0d252d7405011220a66a6257562d0c26dabf64485a1d96bad27bb1c0fd6080a75b0ec9f75b50298a2a8e04b02b2688c8104fca61fb00',
+    'register --from 0x47e172F6CfB6c7D01C1574fa3E2Be7CC73269D95 --ecdsaKey 0xc52f3fab06e22a54915a8765c4f6826090cfac5e40282b43844bf1c0df83aaa632e55b67869758f2291d1aabe0ebecc7cbf4236aaa45e3e0cfbf997eda082ae1 --blsKey 0x9d3e1d8f49f6b0d8e9a03d80ca07b1d24cf1cc0557bdcc04f5e17a46e35d02d0d411d956dbd5d2d2464eebd7b74ae300 --blsPop 0x05d223780d785d2abc5644fac7ac29fb0e302bdc80c81a5d45018b68b1045068a4b3a4861c93037685fd0d252d7405011220a66a6257562d0c26dabf64485a1d96bad27bb1c0fd6080a75b0ec9f75b50298a2a8e04b02b2688c8104fca61fb00',
   ]
+
   async run() {
     const res = this.parse(ValidatorRegister)
     this.kit.defaultAccount = res.flags.from
@@ -31,12 +34,16 @@ export default class ValidatorRegister extends BaseCommand {
 
     await displaySendTx(
       'registerValidator',
-      validators.registerValidator(res.flags.publicKey as any)
+      validators.registerValidator(
+        res.flags.ecdsaKey as any,
+        res.flags.blsKey as any,
+        res.flags.blsPop as any
+      )
     )
 
     // register encryption key on accounts contract
     // TODO: Use a different key data encryption
-    const pubKey = await getPubKeyFromAddrAndWeb3(res.flags.from, this.web3)
+    const pubKey = await addressToPublicKey(res.flags.from, this.web3)
     // TODO fix typing
     const setKeyTx = accounts.setAccountDataEncryptionKey(pubKey as any)
     await displaySendTx('Set encryption key', setKeyTx)

packages/cli/src/commands/validator/update-bls-key.ts

@@ -0,0 +1,36 @@
+import { BaseCommand } from '../../base'
+import { newCheckBuilder } from '../../utils/checks'
+import { displaySendTx } from '../../utils/cli'
+import { Flags } from '../../utils/command'
+
+export default class ValidatorUpdateBlsKey extends BaseCommand {
+  static description = 'Update BLS key for a validator'
+
+  static flags = {
+    ...BaseCommand.flags,
+    from: Flags.address({ required: true, description: "Validator's address" }),
+    blsKey: Flags.blsPublicKey({ required: true }),
+    blsPop: Flags.blsProofOfPossession({ required: true }),
+  }
+
+  static examples = [
+    'update-bls-key --from 0x47e172F6CfB6c7D01C1574fa3E2Be7CC73269D95 --blsKey 0x9d3e1d8f49f6b0d8e9a03d80ca07b1d24cf1cc0557bdcc04f5e17a46e35d02d0d411d956dbd5d2d2464eebd7b74ae300 --blsPop 0x05d223780d785d2abc5644fac7ac29fb0e302bdc80c81a5d45018b68b1045068a4b3a4861c93037685fd0d252d7405011220a66a6257562d0c26dabf64485a1d96bad27bb1c0fd6080a75b0ec9f75b50298a2a8e04b02b2688c8104fca61fb00',
+  ]
+  async run() {
+    const res = this.parse(ValidatorUpdateBlsKey)
+    this.kit.defaultAccount = res.flags.from
+    const validators = await this.kit.contracts.getValidators()
+    const accounts = await this.kit.contracts.getAccounts()
+
+    await newCheckBuilder(this, res.flags.from)
+      .isSignerOrAccount()
+      .canSignValidatorTxs()
+      .signerAccountIsValidator()
+      .runChecks()
+
+    await displaySendTx(
+      'updateBlsKey',
+      validators.updateBlsKey(res.flags.blsKey as any, res.flags.blsPop as any)
+    )
+  }
+}

packages/cli/src/utils/checks.ts

@@ -73,7 +73,7 @@ class CheckBuilder {
       'Signer can sign Validator Txs',
       this.withAccounts((lg) =>
         lg
-          .activeValidationSignerToAccount(this.signer!)
+          .activeValidatorSignerToAccount(this.signer!)
           .then(() => true)
           .catch(() => false)
       )

packages/cli/src/utils/command.ts

@@ -4,14 +4,24 @@ import { IArg, ParseFn } from '@oclif/parser/lib/args'
 import { pathExistsSync } from 'fs-extra'
 import Web3 from 'web3'
 
-const parsePublicKey: ParseFn<string> = (input) => {
-  // Check that the string starts with 0x and has byte length of ecdsa pub key (64 bytes) + bls pub key (48 bytes) + proof of pos (96 bytes)
-  if (Web3.utils.isHex(input) && input.length === 418 && input.startsWith('0x')) {
+const parseBytes = (input, length, msg) => {
+  // Check that the string starts with 0x and has byte length of `length`.
+  if (Web3.utils.isHex(input) && input.length === length && input.startsWith('0x')) {
     return input
   } else {
-    throw new CLIError(`${input} is not a public key`)
+    throw new CLIError(msg)
   }
 }
+
+const parseEcdsaPublicKey: ParseFn<string> = (input) => {
+  parseBytes(input, 64, `${input} is not an ECDSA public key`)
+}
+const parseBlsPublicKey: ParseFn<string> = (input) => {
+  parseBytes(input, 48, `${input} is not a BLS public key`)
+}
+const parseBlsProofOfPossession: ParseFn<string> = (input) => {
+  parseBytes(input, 96, `${input} is not a BLS proof-of-possession`)
+}
 const parseAddress: ParseFn<string> = (input) => {
   if (Web3.utils.isAddress(input)) {
     return input
@@ -58,9 +68,19 @@ export const Flags = {
     description: 'Account Address',
     helpValue: '0xc1912fEE45d61C87Cc5EA59DaE31190FFFFf232d',
   }),
-  publicKey: flags.build({
-    parse: parsePublicKey,
-    description: 'Public Key',
+  ecdsaPublicKey: flags.build({
+    parse: parseEcdsaPublicKey,
+    description: 'ECDSA Public Key',
+    helpValue: '0x',
+  }),
+  blsPublicKey: flags.build({
+    parse: parseBlsPublicKey,
+    description: 'BLS Public Key',
+    helpValue: '0x',
+  }),
+  blsProofOfPossession: flags.build({
+    parse: parseBlsProofOfPossession,
+    description: 'BLS Proof-of-Possession',
     helpValue: '0x',
   }),
   url: flags.build({

packages/cli/src/utils/helpers.ts

@@ -1,29 +1,8 @@
 import { eqAddress } from '@celo/utils/lib/address'
-import ethjsutil from 'ethereumjs-util'
 import Web3 from 'web3'
 import { Block } from 'web3/eth/types'
 import { failWith } from './cli'
 
-import assert = require('assert')
-
-export async function getPubKeyFromAddrAndWeb3(addr: string, web3: Web3) {
-  const msg = new Buffer('dummy_msg_data')
-  const data = '0x' + msg.toString('hex')
-  // Note: Eth.sign typing displays incorrect parameter order
-  const sig = await web3.eth.sign(data, addr)
-
-  const rawsig = ethjsutil.fromRpcSig(sig)
-
-  const prefix = new Buffer('\x19Ethereum Signed Message:\n')
-  const prefixedMsg = ethjsutil.sha3(Buffer.concat([prefix, new Buffer(String(msg.length)), msg]))
-  const pubKey = ethjsutil.ecrecover(prefixedMsg, rawsig.v, rawsig.r, rawsig.s)
-
-  const computedAddr = ethjsutil.pubToAddress(pubKey).toString('hex')
-  assert(eqAddress(computedAddr, addr), 'computed address !== addr')
-
-  return pubKey
-}
-
 export async function nodeIsSynced(web3: Web3): Promise<boolean> {
   if (process.env.NO_SYNCCHECK) {
     return true