WIP: Integrate KES agent

cabal.project

@@ -62,6 +62,8 @@ allow-newer:
   , ekg-forward:ouroboros-network-framework
   , ekg-wai:time
 
+  , cardano-api
+
 -- IMPORTANT
 -- Do NOT add more source-repository-package stanzas here unless they are strictly
 -- temporary! Please read the section in CONTRIBUTING about updating dependencies.
@@ -98,3 +100,79 @@ if impl (ghc >= 9.12)
     , ouroboros-network-api:base
     , ouroboros-network-framework:base
     , ouroboros-network-protocols:base
+
+allow-newer:
+  cardano-ledger-core,
+  cardano-ledger-byron,
+  serdoc-core:tasty-quickcheck,
+
+source-repository-package
+  type: git
+  location: https://github.com/input-output-hk/kes-agent
+  tag: 07437ed49022b13759c87c4e314f08fcff64b81a
+  --sha256: sha256-oTsxaFAs1c/H0oYLhiivO5mr48oHNsPi5k2XyXxwCJg=
+  subdir:
+      kes-agent
+
+source-repository-package
+   type: git
+   location: https://github.com/IntersectMBO/ouroboros-network
+   tag: 3e8d3b4b8c87ead794876c62d7fe25f32efb5142
+   --sha256: 08fpkx3iagj83nn413h9a865zjcj3lrf7017a756qd2wg2jg3amq
+   subdir:
+     ouroboros-network-api
+
+source-repository-package
+   type: git
+   location: https://github.com/IntersectMBO/cardano-ledger
+   tag: b44ce911475794a15f908ad27a6f497d6a27e8ba
+   --sha256: sha256-MXaVKKH9siUsmOnJmYyL6if48dx11zugux7AWGPABfA=
+   subdir:
+      eras/allegra/impl
+      eras/alonzo/impl
+      eras/alonzo/test-suite
+      eras/babbage/impl
+      eras/babbage/test-suite
+      eras/byron/chain/executable-spec
+      eras/byron/crypto
+      eras/byron/ledger/executable-spec
+      eras/byron/ledger/impl
+      eras/conway/impl
+      eras/conway/test-suite
+      eras/mary/impl
+      eras/shelley/impl
+      eras/shelley-ma/test-suite
+      eras/shelley/test-suite
+      libs/cardano-data
+      libs/cardano-ledger-api
+      libs/cardano-ledger-binary
+      libs/cardano-ledger-core
+      libs/cardano-ledger-test
+      libs/cardano-protocol-tpraos
+      libs/constrained-generators
+      libs/non-integral
+      libs/set-algebra
+      libs/small-steps
+      libs/vector-map
+
+source-repository-package
+  type: git
+  location: https://github.com/IntersectMBO/ouroboros-consensus
+  tag: 9fdeacc0ba74009bd3078f08cd6b443a3f296515
+  --sha256: sha256-oTsxaFAs1c/H0oYLhiivO5mr48oHNsPi5k2XyXxwCJg=
+  subdir:
+      ouroboros-consensus
+      ouroboros-consensus-cardano
+      ouroboros-consensus-diffusion
+      ouroboros-consensus-protocol
+      sop-extras
+      strict-sop-core
+
+source-repository-package
+  type: git
+  location: https://github.com/IntersectMBO/cardano-api
+  tag: 5e32849f753e40b9db852a3999ccf506da776a44
+  --sha256: sha256-oTsxaFAs1c/H0oYLhiivO5mr48oHNsPi5k2XyXxwCJg=
+  subdir:
+      cardano-api
+

cardano-node/cardano-node.cabal

@@ -181,6 +181,7 @@ library
                       , hostname
                       , io-classes >= 1.5
                       , iohk-monitoring ^>= 0.2
+                      , kes-agent
                       , microlens
                       , network-mux
                       , iproute

cardano-node/src/Cardano/Node/Configuration/NodeAddress.hs

@@ -34,7 +34,7 @@ import           Cardano.Api
 
 import           Ouroboros.Network.PeerSelection.RelayAccessPoint (DomainAccessPoint (..))
 
-import           Data.Aeson (FromJSON (..), ToJSON (..), Value (..), object, withObject, (.:), (.=))
+import           Data.Aeson (Value (..), object, withObject, (.:), (.=))
 import           Data.IP (IP (..), IPv4, IPv6)
 import qualified Data.IP as IP
 import           Data.Text (Text)

cardano-node/src/Cardano/Node/Parsers.hs

@@ -56,7 +56,7 @@ nodeRunParser = do
   -- Protocol files
   byronCertFile   <- optional parseByronDelegationCert
   byronKeyFile    <- optional parseByronSigningKey
-  shelleyKESFile  <- optional parseKesKeyFilePath
+  shelleyKESSource  <- optional parseKesSourceFilePath
   shelleyVRFFile  <- optional parseVrfKeyFilePath
   shelleyCertFile <- optional parseOperationalCertFilePath
   shelleyBulkCredsFile <- optional parseBulkCredsFilePath
@@ -89,7 +89,7 @@ nodeRunParser = do
            , pncProtocolFiles = Last $ Just ProtocolFilepaths
              { byronCertFile
              , byronKeyFile
-             , shelleyKESFile
+             , shelleyKESSource
              , shelleyVRFFile
              , shelleyCertFile
              , shelleyBulkCredsFile
@@ -334,15 +334,33 @@ parseBulkCredsFilePath =
         <> completer (bashCompleter "file")
     )
 
---TODO: pass the current KES evolution, not the KES_0
-parseKesKeyFilePath :: Parser FilePath
-parseKesKeyFilePath =
-  strOption
-    ( long "shelley-kes-key"
-        <> metavar "FILEPATH"
-        <> help "Path to the KES signing key."
-        <> completer (bashCompleter "file")
-    )
+-- --TODO: pass the current KES evolution, not the KES_0
+-- parseKesKeyFilePath :: Parser FilePath
+-- parseKesKeyFilePath =
+--   strOption
+--     ( long "shelley-kes-key"
+--         <> metavar "FILEPATH"
+--         <> help "Path to the KES signing key."
+--         <> completer (bashCompleter "file")
+--     )
+
+parseKesSourceFilePath :: Parser KESSource
+parseKesSourceFilePath = asum
+  [ KESKeyFilePath <$>
+      strOption
+        ( long "shelley-kes-key"
+            <> metavar "FILEPATH"
+            <> help "Path to the KES signing key."
+            <> completer (bashCompleter "file")
+        )
+  , KESAgentSocketPath <$>
+      strOption
+        ( long "shelley-kes-agent-socket"
+            <> metavar "SOCKET_FILEPATH"
+            <> help "Path to the KES Agent socket"
+            <> completer (bashCompleter "file")
+        )
+  ]
 
 parseVrfKeyFilePath :: Parser FilePath
 parseVrfKeyFilePath =

cardano-node/src/Cardano/Node/Protocol/Alonzo.hs

@@ -9,7 +9,6 @@ module Cardano.Node.Protocol.Alonzo
   ) where
 
 import           Cardano.Api
-import           Cardano.Api.Shelley
 
 import qualified Cardano.Ledger.Alonzo.Genesis as Alonzo
 import           Cardano.Node.Orphans ()

cardano-node/src/Cardano/Node/Protocol/Byron.hs

@@ -13,6 +13,7 @@ module Cardano.Node.Protocol.Byron
   ) where
 
 import           Cardano.Api.Byron
+import           Cardano.Api
 
 import qualified Cardano.Chain.Genesis as Genesis
 import qualified Cardano.Chain.Update as Update

cardano-node/src/Cardano/Node/Protocol/Shelley.hs

@@ -23,7 +23,7 @@ module Cardano.Node.Protocol.Shelley
   ) where
 
 import qualified Cardano.Api as Api
-import           Cardano.Api.Shelley hiding (FileError)
+import           Cardano.Api hiding (FileError)
 
 import qualified Cardano.Crypto.Hash.Class as Crypto
 import           Cardano.Ledger.BaseTypes (ProtVer (..), natVersion)
@@ -39,7 +39,7 @@ import           Cardano.Protocol.Crypto (StandardCrypto)
 import           Cardano.Tracing.OrphanInstances.HardFork ()
 import           Cardano.Tracing.OrphanInstances.Shelley ()
 import qualified Ouroboros.Consensus.Cardano as Consensus
-import           Ouroboros.Consensus.Protocol.Praos.Common (PraosCanBeLeader (..))
+import           Ouroboros.Consensus.Protocol.Praos.Common (PraosCanBeLeader (..), PraosCredentialsSource(..))
 import           Ouroboros.Consensus.Shelley.Node (Nonce (..), ProtocolParamsShelleyBased (..),
                    ShelleyLeaderCredentials (..))
 
@@ -141,27 +141,38 @@ readLeaderCredentialsSingleton
    ProtocolFilepaths
      { shelleyCertFile      = Nothing,
        shelleyVRFFile       = Nothing,
-       shelleyKESFile       = Nothing
+       shelleyKESSource     = Nothing
      } = pure []
 -- Or to supply all of the files
 readLeaderCredentialsSingleton
   ProtocolFilepaths { shelleyCertFile = Just opCertFile,
                       shelleyVRFFile = Just vrfFile,
-                      shelleyKESFile = Just kesFile
+                      shelleyKESSource = Just kesSource
                     } = do
     vrfSKey <-
       firstExceptT FileError (newExceptT $ readFileTextEnvelope (File vrfFile))
 
-    (opCert, kesSKey) <- opCertKesKeyCheck (File kesFile) (File opCertFile)
+    (credentialsSource, vkey) <- case kesSource of
+      KESKeyFilePath kesFile -> do
+        (OperationalCertificate opCert vkey, KesSigningKey kesKey) <-
+          opCertKesKeyCheck (File kesFile) (File opCertFile)
+        pure (PraosCredentialsUnsound opCert kesKey, vkey)
 
-    return [mkPraosLeaderCredentials opCert vrfSKey kesSKey]
+      -- TODO: minor yikes: when we're using an agent, we don't check that the
+      -- opcert and the key provided by the KES agent match, like we do when
+      -- the key is provided in a file on the command line
+      KESAgentSocketPath socketFile -> do
+        OperationalCertificate _ vkey <- firstExceptT FileError $ newExceptT $ readFileTextEnvelope $ File opCertFile
+        pure (PraosCredentialsAgent socketFile, vkey)
+
+    return [mkPraosLeaderCredentials credentialsSource vkey vrfSKey]
 
 -- But not OK to supply some of the files without the others.
 readLeaderCredentialsSingleton ProtocolFilepaths {shelleyCertFile = Nothing} =
      left OCertNotSpecified
 readLeaderCredentialsSingleton ProtocolFilepaths {shelleyVRFFile = Nothing} =
      left VRFKeyNotSpecified
-readLeaderCredentialsSingleton ProtocolFilepaths {shelleyKESFile = Nothing} =
+readLeaderCredentialsSingleton ProtocolFilepaths {shelleyKESSource = Nothing} =
      left KESKeyNotSpecified
 
 opCertKesKeyCheck
@@ -200,10 +211,11 @@ readLeaderCredentialsBulk ProtocolFilepaths { shelleyBulkCredsFile = mfp } =
      :: ShelleyCredentials
      -> ExceptT PraosLeaderCredentialsError IO (ShelleyLeaderCredentials StandardCrypto)
    parseShelleyCredentials ShelleyCredentials { scCert, scVrf, scKes } = do
-     mkPraosLeaderCredentials
-       <$> parseEnvelope scCert
-       <*> parseEnvelope scVrf
-       <*> parseEnvelope scKes
+    OperationalCertificate opCert vkey <- parseEnvelope scCert
+    scVrf' <- parseEnvelope scVrf
+    KesSigningKey scKes' <- parseEnvelope scKes
+    pure $
+      mkPraosLeaderCredentials (PraosCredentialsUnsound opCert scKes') vkey scVrf'
 
    readBulkFile
      :: Maybe FilePath
@@ -225,22 +237,21 @@ readLeaderCredentialsBulk ProtocolFilepaths { shelleyBulkCredsFile = mfp } =
                              (teKes,  loc "kes")
 
 mkPraosLeaderCredentials ::
-     OperationalCertificate
+     PraosCredentialsSource StandardCrypto
+  -> VerificationKey StakePoolKey
   -> SigningKey VrfKey
-  -> SigningKey KesKey
   -> ShelleyLeaderCredentials StandardCrypto
 mkPraosLeaderCredentials
-    (OperationalCertificate opcert (StakePoolVerificationKey vkey))
-    (VrfSigningKey vrfKey)
-    (KesSigningKey kesKey) =
+    credentialsSource
+    (StakePoolVerificationKey vkey)
+    (VrfSigningKey vrfKey) =
     ShelleyLeaderCredentials
     { shelleyLeaderCredentialsCanBeLeader =
         PraosCanBeLeader {
-        praosCanBeLeaderOpCert     = opcert,
+          praosCanBeLeaderCredentialsSource = credentialsSource,
           praosCanBeLeaderColdVerKey = coerceKeyRole vkey,
           praosCanBeLeaderSignKeyVRF = vrfKey
         },
-      shelleyLeaderCredentialsInitSignKey = kesKey,
       shelleyLeaderCredentialsLabel = "Shelley"
     }
 

cardano-node/src/Cardano/Node/Queries.hs

@@ -260,8 +260,10 @@ instance Shelley.EraCertState era => LedgerQueries (Shelley.ShelleyBlock protoco
     . Shelley.shelleyLedgerState
   ledgerDRepCount =
       Map.size
-    . Shelley.vsDReps
-    . (^. Shelley.certVStateL)
+    . undefined
+    -- . State.vsDReps
+    -- . (^. vsDRepsL)
+    -- . (^. Shelley.certVStateL)
     . Shelley.lsCertState
     . Shelley.esLState
     . Shelley.nesEs

cardano-node/src/Cardano/Node/Run.hs

@@ -22,8 +22,7 @@ module Cardano.Node.Run
   , checkVRFFilePermissions
   ) where
 
-import           Cardano.Api (File (..), FileDirection (..))
-import           Cardano.Api.Internal.Error (displayError)
+import           Cardano.Api (File (..), FileDirection (..), displayError)
 import qualified Cardano.Api as Api
 import           System.Random (randomIO)
 
@@ -249,7 +248,7 @@ handleNodeWithTracers cmdPc nc0 p@(SomeConsensusProtocol blockType runP) = do
             EnabledP2PMode -> nc0
       case ncTraceConfig nc of
         TraceDispatcher{} -> do
-          blockForging <- snd (Api.protocolInfo runP)
+          blockForging <- snd (Api.protocolInfo runP) nullTracer -- FIXME: this should be a real tracer
           tracers <-
             initTraceDispatcher
               nc
@@ -308,7 +307,7 @@ handleNodeWithTracers cmdPc nc0 p@(SomeConsensusProtocol blockType runP) = do
 
           traceWith (nodeVersionTracer tracers) getNodeVersion
           let isNonProducing = ncStartAsNonProducingNode nc
-          blockForging <- snd (Api.protocolInfo runP)
+          blockForging <- snd (Api.protocolInfo runP) nullTracer -- FIXME: this should be a real tracer
           traceWith (startupTracer tracers)
                     (BlockForgingUpdate (if isNonProducing || null blockForging
                                           then DisabledBlockForging
@@ -506,7 +505,7 @@ handleSimpleNode blockType runP p2pMode tracers nc onKernel = do
               , rnProtocolInfo   = pInfo
               , rnNodeKernelHook = \registry nodeKernel -> do
                   -- set the initial block forging
-                  blockForging <- snd (Api.protocolInfo runP)
+                  blockForging <- snd (Api.protocolInfo runP) nullTracer -- FIXME: this should be a real tracer
 
                   unless (ncStartAsNonProducingNode nc) $
                     setBlockForging nodeKernel blockForging
@@ -604,7 +603,7 @@ handleSimpleNode blockType runP p2pMode tracers nc onKernel = do
                 , rnProtocolInfo   = pInfo
                 , rnNodeKernelHook = \registry nodeKernel -> do
                     -- set the initial block forging
-                    blockForging <- snd (Api.protocolInfo runP)
+                    blockForging <- snd (Api.protocolInfo runP)nullTracer -- FIXME: this should be a real tracer
 
                     unless (ncStartAsNonProducingNode nc) $
                       setBlockForging nodeKernel blockForging
@@ -813,7 +812,7 @@ updateBlockForging startupTracer blockType nodeKernel nc = do
       case Api.reflBlockType blockType blockType' of
         Just Refl -> do
           -- TODO: check if runP' has changed
-          blockForging <- snd (Api.protocolInfo runP')
+          blockForging <- snd (Api.protocolInfo runP') nullTracer -- FIXME: this should be a real tracer
           traceWith startupTracer
                     (BlockForgingUpdate (if null blockForging
                                           then DisabledBlockForging

cardano-node/src/Cardano/Node/Tracing/Era/Shelley.hs

@@ -19,7 +19,7 @@ module Cardano.Node.Tracing.Era.Shelley () where
 
 import           Cardano.Api (textShow)
 import           Cardano.Api.Ledger (fromVRFVerKeyHash)
-import qualified Cardano.Api.Shelley as Api
+import qualified Cardano.Api as Api
 
 import qualified Cardano.Crypto.Hash.Class as Crypto
 import qualified Cardano.Crypto.VRF.Class as Crypto
@@ -740,9 +740,6 @@ instance
   ) => LogFormatting (ShelleyNewEpochPredFailure era) where
   forMachine dtal (EpochFailure f) = forMachine dtal f
   forMachine dtal (MirFailure f) = forMachine dtal f
-  forMachine _dtal (CorruptRewardUpdate update) =
-    mconcat [ "kind" .= String "CorruptRewardUpdate"
-             , "update" .= String (textShow update) ]
 
 
 instance

cardano-node/src/Cardano/Node/Tracing/Render.hs

@@ -30,7 +30,7 @@ module Cardano.Node.Tracing.Render
   , renderMissingRedeemers
   ) where
 
-import qualified Cardano.Api.Shelley as Api
+import qualified Cardano.Api as Api
 
 import qualified Cardano.Crypto.Hash.Class as Crypto
 import           Cardano.Ledger.Alonzo.Scripts (AlonzoPlutusPurpose (..), AsItem (..),