Skip to content

core/services/ccv: per-aggregator verifier secrets #22907

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
makramkd wants to merge 2 commits into
base: develop
Choose a base branch
from
Draft

core/services/ccv: per-aggregator verifier secrets #22907

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d8038f3
core/services/ccv: per-aggregator verifier secrets
makramkd Jun 20, 2026
a4fed62
re-trigger ci
makramkd Jun 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions core/scripts/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ require (
github.com/shopspring/decimal v1.4.0
github.com/smartcontractkit/chain-selectors v1.0.103
github.com/smartcontractkit/chainlink-automation v0.8.1
github.com/smartcontractkit/chainlink-ccip/chains/evm v0.0.0-20260608180601-efa81bfdfda9
github.com/smartcontractkit/chainlink-ccip/chains/evm v0.0.0-20260618155522-3600f66e26cd
github.com/smartcontractkit/chainlink-common v0.11.2-0.20260616172018-16271fdba62c
github.com/smartcontractkit/chainlink-common/keystore v1.2.0
github.com/smartcontractkit/chainlink-data-streams v0.1.15-0.20260522094612-5f9f748bd87a
Expand Down Expand Up @@ -478,7 +478,7 @@ require (
github.com/smartcontractkit/chainlink-ccip v0.1.1-solana.0.20260428205619-2db1389501a1 // indirect
github.com/smartcontractkit/chainlink-ccip/chains/solana v0.0.0-20260506144252-c100eabfda74 // indirect
github.com/smartcontractkit/chainlink-ccip/chains/solana/gobindings v0.0.0-20260511195239-0f6e1b177fc7 // indirect
github.com/smartcontractkit/chainlink-ccv v0.0.2-0.20260617194919-3078e69b2aa0 // indirect
github.com/smartcontractkit/chainlink-ccv v0.0.2-0.20260620063431-1cbd75def867 // indirect
github.com/smartcontractkit/chainlink-common/pkg/chipingress v0.0.11-0.20260601211238-9f526774fef0 // indirect
github.com/smartcontractkit/chainlink-evm/contracts/cre/gobindings v0.0.0-20260403151002-2c91155b5501 // indirect
github.com/smartcontractkit/chainlink-feeds v0.1.2-0.20250227211209-7cd000095135 // indirect
Expand Down
8 changes: 4 additions & 4 deletions core/scripts/go.sum
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

36 changes: 30 additions & 6 deletions core/services/ccv/ccvcommitteeverifier/delegate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,7 +125,7 @@ func (d *Delegate) ServicesForSpec(ctx context.Context, spec job.Job) (services
return nil, fmt.Errorf("onchain public key does not match signer address in config, want %s, got %s", signingKey.OnChainPublicKey(), decodedCfg.SignerAddress)
}

apiKey, apiSecret, err := getAggregatorSecrets(d.ccvConfig, decodedCfg.VerifierID)
aggregatorSecrets, err := buildAggregatorSecrets(d.ccvConfig, decodedCfg)
if err != nil {
return nil, fmt.Errorf("failed to get aggregator secrets from secrets toml: %w", err)
}
Expand All @@ -135,10 +135,7 @@ func (d *Delegate) ServicesForSpec(ctx context.Context, spec job.Job) (services
Named("CCVCommitteeVerificationCoordinator").
Named(decodedCfg.VerifierID),
decodedCfg,
&hmac.ClientConfig{
APIKey: apiKey,
Secret: apiSecret,
},
aggregatorSecrets,
common.HexToAddress(decodedCfg.SignerAddress).Bytes(),
newSignerAdapter(signingKey),
legacyChains,
Expand All @@ -153,7 +150,34 @@ func (d *Delegate) ServicesForSpec(ctx context.Context, spec job.Job) (services
return services, nil
}

func getAggregatorSecrets(ccvConfig config.CCV, verifierID string) (string, string, error) {
// buildAggregatorSecrets resolves one HMAC credential per aggregator the verifier writes to,
// keyed by AggregatorConnection.SecretName (the key NewVerificationCoordinator looks up). Each
// aggregator's credential is found in the secrets TOML by matching its SecretName against the
// entry's VerifierID. A legacy single-aggregator config has an empty SecretName, so its
// credential is looked up by the job's VerifierID and stored under the "" key.
func buildAggregatorSecrets(ccvConfig config.CCV, decodedCfg commit.Config) (map[string]*hmac.ClientConfig, error) {
aggregators, err := decodedCfg.ResolvedAggregators()
if err != nil {
return nil, fmt.Errorf("failed to resolve aggregators: %w", err)
}

secrets := make(map[string]*hmac.ClientConfig, len(aggregators))
for _, agg := range aggregators {
lookupID := agg.SecretName
if lookupID == "" {
// Legacy single-aggregator config: the secret is keyed by the job's verifier_id.
lookupID = decodedCfg.VerifierID
}
apiKey, apiSecret, err := findAggregatorSecret(ccvConfig, lookupID)
if err != nil {
return nil, err
}
secrets[agg.SecretName] = &hmac.ClientConfig{APIKey: apiKey, Secret: apiSecret}
}
return secrets, nil
}

func findAggregatorSecret(ccvConfig config.CCV, verifierID string) (string, string, error) {
verifierIDs := make([]string, 0, len(ccvConfig.AggregatorSecrets()))
for _, secret := range ccvConfig.AggregatorSecrets() {
if secret.VerifierID() == verifierID {
Expand Down
4 changes: 2 additions & 2 deletions deployment/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ require (
github.com/smartcontractkit/chain-selectors v1.0.103
github.com/smartcontractkit/chainlink-aptos v0.0.0-20260609211101-71d38bd6a0a9
github.com/smartcontractkit/chainlink-ccip v0.1.1-solana.0.20260428205619-2db1389501a1
github.com/smartcontractkit/chainlink-ccip/chains/evm v0.0.0-20260608180601-efa81bfdfda9
github.com/smartcontractkit/chainlink-ccip/chains/evm v0.0.0-20260618155522-3600f66e26cd
github.com/smartcontractkit/chainlink-ccip/chains/solana v0.0.0-20260415165642-49f23e4d76cc
github.com/smartcontractkit/chainlink-ccip/chains/solana/gobindings v0.0.0-20260511195239-0f6e1b177fc7
github.com/smartcontractkit/chainlink-ccip/deployment v0.0.0-20260526183310-eb2e6d9cf68a
Expand Down Expand Up @@ -416,7 +416,7 @@ require (
github.com/sigurn/crc16 v0.0.0-20211026045750-20ab5afb07e3 // indirect
github.com/sirupsen/logrus v1.9.4 // indirect
github.com/smartcontractkit/chainlink-automation v0.8.1 // indirect
github.com/smartcontractkit/chainlink-ccv v0.0.2-0.20260617194919-3078e69b2aa0 // indirect
github.com/smartcontractkit/chainlink-ccv v0.0.2-0.20260620063431-1cbd75def867 // indirect
github.com/smartcontractkit/chainlink-common/pkg/chipingress v0.0.11-0.20260601211238-9f526774fef0 // indirect
github.com/smartcontractkit/chainlink-feeds v0.1.2-0.20250227211209-7cd000095135 // indirect
github.com/smartcontractkit/chainlink-framework/capabilities v0.0.0-20260423135514-5b1a7565a99c // indirect
Expand Down
12 changes: 6 additions & 6 deletions deployment/go.sum
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,10 +81,10 @@ require (
github.com/smartcontractkit/chainlink-aptos v0.0.0-20260609211101-71d38bd6a0a9
github.com/smartcontractkit/chainlink-automation v0.8.1
github.com/smartcontractkit/chainlink-ccip v0.1.1-solana.0.20260428205619-2db1389501a1
github.com/smartcontractkit/chainlink-ccip/chains/evm v0.0.0-20260608180601-efa81bfdfda9
github.com/smartcontractkit/chainlink-ccip/chains/evm v0.0.0-20260618155522-3600f66e26cd
github.com/smartcontractkit/chainlink-ccip/chains/solana v0.0.0-20260415165642-49f23e4d76cc
github.com/smartcontractkit/chainlink-ccip/chains/solana/gobindings v0.0.0-20260415165642-49f23e4d76cc
github.com/smartcontractkit/chainlink-ccv v0.0.2-0.20260617194919-3078e69b2aa0
github.com/smartcontractkit/chainlink-ccv v0.0.2-0.20260620063431-1cbd75def867
github.com/smartcontractkit/chainlink-common v0.11.2-0.20260611160104-87b1e75d2c33
github.com/smartcontractkit/chainlink-common/keystore v1.2.0
github.com/smartcontractkit/chainlink-common/pkg/chipingress v0.0.11-0.20260601211238-9f526774fef0
Expand Down
8 changes: 4 additions & 4 deletions go.sum
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions integration-tests/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ require (
github.com/smartcontractkit/chain-selectors v1.0.103
github.com/smartcontractkit/chainlink-aptos v0.0.0-20260609211101-71d38bd6a0a9
github.com/smartcontractkit/chainlink-ccip v0.1.1-solana.0.20260428205619-2db1389501a1
github.com/smartcontractkit/chainlink-ccip/chains/evm v0.0.0-20260608180601-efa81bfdfda9
github.com/smartcontractkit/chainlink-ccip/chains/evm v0.0.0-20260618155522-3600f66e26cd
github.com/smartcontractkit/chainlink-ccip/chains/solana v0.0.0-20260506144252-c100eabfda74
github.com/smartcontractkit/chainlink-ccip/chains/solana/gobindings v0.0.0-20260511195239-0f6e1b177fc7
github.com/smartcontractkit/chainlink-common v0.11.2-0.20260616172018-16271fdba62c
Expand Down Expand Up @@ -393,7 +393,7 @@ require (
github.com/smartcontractkit/ccip-owner-contracts v0.1.0 // indirect
github.com/smartcontractkit/chainlink-automation v0.8.1 // indirect
github.com/smartcontractkit/chainlink-ccip/deployment v0.0.0-20260526183310-eb2e6d9cf68a // indirect
github.com/smartcontractkit/chainlink-ccv v0.0.2-0.20260617194919-3078e69b2aa0 // indirect
github.com/smartcontractkit/chainlink-ccv v0.0.2-0.20260620063431-1cbd75def867 // indirect
github.com/smartcontractkit/chainlink-common/pkg/chipingress v0.0.11-0.20260601211238-9f526774fef0 // indirect
github.com/smartcontractkit/chainlink-data-streams v0.1.15-0.20260522094612-5f9f748bd87a // indirect
github.com/smartcontractkit/chainlink-evm/contracts/cre/gobindings v0.0.0-20260403151002-2c91155b5501 // indirect
Expand Down
12 changes: 6 additions & 6 deletions integration-tests/go.sum
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading