feat: private keys support for testing

.github/workflows/ci.yml

@@ -187,8 +187,7 @@ jobs:
         arch: [
           # build on native runners instead of using emulation
           {platform: linux/amd64, runner: buildjet-8vcpu-ubuntu-2204},
-          # don't currently need arm builds
-          # {platform: linux/arm64, runner: buildjet-8vcpu-ubuntu-2204-arm}
+          {platform: linux/arm64, runner: buildjet-8vcpu-ubuntu-2204-arm}
         ]
     runs-on: ${{ matrix.arch.runner }}
     permissions:

committer/Cargo.toml

@@ -13,7 +13,7 @@ rust-version = { workspace = true }
 actix-web = { workspace = true, features = ["macros"] }
 clap = { workspace = true, features = ["default", "derive"] }
 clock = { workspace = true }
-config = { workspace = true, features = ["toml", "async"] }
+config = { workspace = true, features = ["async"] }
 eth = { workspace = true }
 fuel = { workspace = true }
 fuel-block-committer-encoding = { workspace = true }

committer/src/config.rs

@@ -6,7 +6,7 @@ use std::{
 };
 
 use clap::{command, Parser};
-use eth::Address;
+use eth::{Address, L1Keys};
 use fuel_block_committer_encoding::bundle::CompressionLevel;
 use serde::Deserialize;
 use storage::DbConfig;
@@ -21,12 +21,15 @@ pub struct Config {
 
 impl Config {
     pub fn validate(&self) -> crate::errors::Result<()> {
-        if let Some(blob_pool_wallet_key) = &self.eth.blob_pool_key_arn {
-            if blob_pool_wallet_key == &self.eth.main_key_arn {
-                return Err(crate::errors::Error::Other(
-                    "Wallet key and blob pool wallet key must be different".to_string(),
-                ));
-            }
+        let keys = &self.eth.l1_keys;
+        if keys
+            .blob
+            .as_ref()
+            .is_some_and(|blob_key| blob_key == &keys.main)
+        {
+            return Err(crate::errors::Error::Other(
+                "Wallet key and blob pool wallet key must be different".to_string(),
+            ));
         }
 
         if self.app.bundle.fragments_to_accumulate.get() > 6 {
@@ -56,10 +59,8 @@ pub struct Fuel {
 
 #[derive(Debug, Clone, Deserialize)]
 pub struct Eth {
-    /// The AWS KMS key ID authorized by the L1 bridging contracts to post block commitments.
-    pub main_key_arn: String,
-    /// The AWS KMS key ID for posting L2 state to L1.
-    pub blob_pool_key_arn: Option<String>,
+    /// L1 keys for calling the state contract and for posting state
+    pub l1_keys: L1Keys,
     /// URL to a Ethereum RPC endpoint.
     #[serde(deserialize_with = "parse_url")]
     pub rpc: Url,

committer/src/main.rs

@@ -67,7 +67,7 @@ async fn main() -> Result<()> {
 
     // If the blob pool wallet key is set, we need to start
     // the state committer and state importer
-    if config.eth.blob_pool_key_arn.is_some() {
+    if config.eth.l1_keys.blob.is_some() {
         let block_bundler = setup::block_bundler(
             fuel_adapter.clone(),
             storage.clone(),

committer/src/setup.rs

@@ -1,7 +1,7 @@
 use std::{num::NonZeroU32, time::Duration};
 
 use clock::SystemClock;
-use eth::{AwsConfig, BlobEncoder, KmsKeys};
+use eth::{BlobEncoder, Signers};
 use fuel_block_committer_encoding::bundle;
 use metrics::{
     prometheus::{IntGauge, Registry},
@@ -13,7 +13,7 @@ use tokio::task::JoinHandle;
 use tokio_util::sync::CancellationToken;
 use tracing::{error, info};
 
-use crate::{config, errors::Result, AwsClient, Database, FuelApi, L1};
+use crate::{config, errors::Result, Database, FuelApi, L1};
 
 pub fn wallet_balance_tracker(
     internal_config: &config::Internal,
@@ -190,19 +190,11 @@ pub async fn l1_adapter(
     internal_config: &config::Internal,
     registry: &Registry,
 ) -> Result<(L1, HealthChecker)> {
-    let aws_config = AwsConfig::from_env().await;
-
-    let aws_client = AwsClient::new(aws_config);
-
     let l1 = L1::connect(
         config.eth.rpc.clone(),
         config.eth.state_contract_address,
-        KmsKeys {
-            main_key_arn: config.eth.main_key_arn.clone(),
-            blob_pool_key_arn: config.eth.blob_pool_key_arn.clone(),
-        },
+        Signers::for_keys(config.eth.l1_keys.clone()).await?,
         internal_config.eth_errors_before_unhealthy,
-        aws_client,
         eth::TxConfig {
             tx_max_fee: config.app.tx_max_fee as u128,
             send_tx_request_timeout: config.app.send_tx_request_timeout,

e2e/src/committer.rs

@@ -43,11 +43,13 @@ impl Committer {
         let db_port = get_field!(db_port);
         let db_name = get_field!(db_name);
 
+        let main_key = format!("Kms({})", get_field!(main_key_arn));
+        let blob_key = self.blob_key_arn.map(|k| format!("Kms({k})"));
         cmd.env("E2E_TEST_AWS_ENDPOINT", kms_url)
             .env("AWS_REGION", "us-east-1")
             .env("AWS_ACCESS_KEY_ID", "test")
             .env("AWS_SECRET_ACCESS_KEY", "test")
-            .env("COMMITTER__ETH__MAIN_KEY_ARN", get_field!(main_key_arn))
+            .env("COMMITTER__ETH__L1_KEYS__MAIN", main_key)
             .env("COMMITTER__ETH__RPC", get_field!(eth_rpc).as_str())
             .env(
                 "COMMITTER__ETH__STATE_CONTRACT_ADDRESS",
@@ -112,8 +114,8 @@ impl Committer {
             .current_dir(Path::new(env!("CARGO_MANIFEST_DIR")).parent().unwrap())
             .kill_on_drop(true);
 
-        if let Some(blob_wallet_key_arn) = self.blob_key_arn {
-            cmd.env("COMMITTER__ETH__BLOB_POOL_KEY_ARN", blob_wallet_key_arn);
+        if let Some(key) = blob_key {
+            cmd.env("COMMITTER__ETH__L1_KEYS__BLOB", key);
         }
 
         let sink = if self.show_logs {

e2e/src/eth_node/state_contract.rs

@@ -7,7 +7,7 @@ use alloy::{
     providers::{Provider, ProviderBuilder, WsConnect},
     rpc::types::TransactionRequest,
 };
-use eth::{AwsClient, AwsConfig, WebsocketClient};
+use eth::{AwsClient, AwsConfig, Signer, Signers, WebsocketClient};
 use fs_extra::dir::{copy, CopyOptions};
 use ports::{fuel::FuelBlock, types::Address};
 use serde::Deserialize;
@@ -34,12 +34,11 @@ impl DeployedContract {
         let chain_state_contract = WebsocketClient::connect(
             url,
             address,
-            eth::KmsKeys {
-                main_key_arn: key.id,
-                blob_pool_key_arn: None,
+            Signers {
+                main: Signer::make_aws_signer(&aws_client, key.id).await?,
+                blob: None,
             },
             5,
-            aws_client,
             eth::TxConfig {
                 tx_max_fee,
                 send_tx_request_timeout,

e2e/src/whole_stack.rs

@@ -103,7 +103,7 @@ impl WholeStack {
 
         let committer = {
             let committer_builder = Committer::default()
-                .with_show_logs(true)
+                .with_show_logs(logs)
                 .with_eth_rpc((eth_node).ws_url().clone())
                 .with_fuel_rpc(fuel_node.url())
                 .with_db_port(db.port())

packages/eth/Cargo.toml

@@ -17,6 +17,7 @@ alloy = { workspace = true, features = [
   "kzg",
   "contract",
   "signer-aws",
+  "signer-local",
   "rpc-types",
   "reqwest-rustls-tls",
 ] }
@@ -41,6 +42,7 @@ alloy = { workspace = true, features = [
   "node-bindings",
   "json-rpc",
 ] }
+serde_json = { workspace = true }
 mockall = { workspace = true }
 ports = { workspace = true, features = ["l1", "test-helpers"] }
 pretty_assertions = { workspace = true, features = ["default"] }

packages/eth/src/lib.rs

@@ -22,7 +22,7 @@ mod websocket;
 pub use alloy::primitives::Address;
 pub use aws::*;
 use fuel_block_committer_encoding::blob::{self, generate_sidecar};
-pub use websocket::{KmsKeys, TxConfig, WebsocketClient};
+pub use websocket::{L1Key, L1Keys, Signer, Signers, TxConfig, WebsocketClient};
 
 impl Contract for WebsocketClient {
     delegate! {