From a3519d9fd0500c3daf57c2ff046c1acb422a6b6c Mon Sep 17 00:00:00 2001 From: Adel El-Beik Date: Fri, 18 Oct 2024 13:55:43 +0100 Subject: [PATCH 1/2] ENT-12314: Updated signature attachment constraint warning message to mention the key may be a rotated key. --- .../kotlin/net/corda/core/contracts/AttachmentConstraint.kt | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/core/src/main/kotlin/net/corda/core/contracts/AttachmentConstraint.kt b/core/src/main/kotlin/net/corda/core/contracts/AttachmentConstraint.kt index a5e5e7cd7d..9f090ef51b 100644 --- a/core/src/main/kotlin/net/corda/core/contracts/AttachmentConstraint.kt +++ b/core/src/main/kotlin/net/corda/core/contracts/AttachmentConstraint.kt @@ -117,7 +117,9 @@ data class SignatureAttachmentConstraint(val key: PublicKey) : AttachmentConstra override fun isSatisfiedBy(attachment: Attachment): Boolean { log.debug("Checking signature constraints: verifying $key in contract attachment signer keys: ${attachment.signerKeys}") return if (!key.isFulfilledBy(attachment.signerKeys.map { it })) { - log.warn("Untrusted signing key: expected $key. but contract attachment contains ${attachment.signerKeys}") + log.warn("Untrusted signing key: expected $key. but contract attachment contains ${attachment.signerKeys}." + + "The key on the attachment may be a rotated key. Will recheck. To remove this warning you should update your" + + "output state signature attachment constraint to use the same key as on the attachment.") false } else true From 8d9120713cb0464c403f3e71526461e12f1497cd Mon Sep 17 00:00:00 2001 From: Adel El-Beik Date: Tue, 5 Nov 2024 18:17:58 +0000 Subject: [PATCH 2/2] ENT-12314: Dont display warning for sig constraint fail if checking for rotated keys after. --- .../corda/core/contracts/AttachmentConstraint.kt | 15 +++++++++++---- .../TransactionVerifierServiceInternal.kt | 3 ++- .../corda/core/transactions/TransactionBuilder.kt | 2 +- 3 files changed, 14 insertions(+), 6 deletions(-) diff --git a/core/src/main/kotlin/net/corda/core/contracts/AttachmentConstraint.kt b/core/src/main/kotlin/net/corda/core/contracts/AttachmentConstraint.kt index 9f090ef51b..ef6a4ab960 100644 --- a/core/src/main/kotlin/net/corda/core/contracts/AttachmentConstraint.kt +++ b/core/src/main/kotlin/net/corda/core/contracts/AttachmentConstraint.kt @@ -114,14 +114,21 @@ object AutomaticPlaceholderConstraint : AttachmentConstraint { */ @KeepForDJVM data class SignatureAttachmentConstraint(val key: PublicKey) : AttachmentConstraint { - override fun isSatisfiedBy(attachment: Attachment): Boolean { + override fun isSatisfiedBy(attachment: Attachment) = isSatisfiedBy(attachment, disableWarnings = false) + fun isSatisfiedBy(attachment: Attachment, disableWarnings: Boolean): Boolean { log.debug("Checking signature constraints: verifying $key in contract attachment signer keys: ${attachment.signerKeys}") return if (!key.isFulfilledBy(attachment.signerKeys.map { it })) { - log.warn("Untrusted signing key: expected $key. but contract attachment contains ${attachment.signerKeys}." + - "The key on the attachment may be a rotated key. Will recheck. To remove this warning you should update your" + - "output state signature attachment constraint to use the same key as on the attachment.") + if (!disableWarnings) log.warn("Untrusted signing key: expected $key. but contract attachment contains ${attachment.signerKeys}") false } else true } } + +fun isSatisfiedByWithNoWarnForSigConstraint(constraint: AttachmentConstraint, attachment: Attachment): Boolean { + return if (constraint is SignatureAttachmentConstraint) { + constraint.isSatisfiedBy(attachment, true) + } else { + constraint.isSatisfiedBy(attachment) + } +} diff --git a/core/src/main/kotlin/net/corda/core/internal/TransactionVerifierServiceInternal.kt b/core/src/main/kotlin/net/corda/core/internal/TransactionVerifierServiceInternal.kt index 74cb1577f5..c0a922b911 100644 --- a/core/src/main/kotlin/net/corda/core/internal/TransactionVerifierServiceInternal.kt +++ b/core/src/main/kotlin/net/corda/core/internal/TransactionVerifierServiceInternal.kt @@ -32,6 +32,7 @@ import net.corda.core.contracts.TransactionVerificationException.TransactionMiss import net.corda.core.contracts.TransactionVerificationException.TransactionNonMatchingEncumbranceException import net.corda.core.contracts.TransactionVerificationException.TransactionNotaryMismatchEncumbranceException import net.corda.core.contracts.TransactionVerificationException.TransactionRequiredContractUnspecifiedException +import net.corda.core.contracts.isSatisfiedByWithNoWarnForSigConstraint import net.corda.core.crypto.CompositeKey import net.corda.core.crypto.SecureHash import net.corda.core.internal.rules.StateContractValidationEnforcementRule @@ -430,7 +431,7 @@ private class Validator(private val ltx: LedgerTransaction, private val transact if (HashAttachmentConstraint.disableHashConstraints && constraint is HashAttachmentConstraint) logger.warnOnce("Skipping hash constraints verification.") - else if (!constraint.isSatisfiedBy(constraintAttachment)) { + else if (!isSatisfiedByWithNoWarnForSigConstraint(constraint, constraintAttachment)) { verifyConstraintUsingRotatedKeys(constraint, constraintAttachment, contract) } } diff --git a/core/src/main/kotlin/net/corda/core/transactions/TransactionBuilder.kt b/core/src/main/kotlin/net/corda/core/transactions/TransactionBuilder.kt index afc2b8d3e4..163c4446ee 100644 --- a/core/src/main/kotlin/net/corda/core/transactions/TransactionBuilder.kt +++ b/core/src/main/kotlin/net/corda/core/transactions/TransactionBuilder.kt @@ -573,7 +573,7 @@ open class TransactionBuilder( // Sanity check that the selected attachment actually passes. - if (!defaultOutputConstraint.isSatisfiedBy(constraintAttachment)) { + if (!isSatisfiedByWithNoWarnForSigConstraint(defaultOutputConstraint, constraintAttachment)) { // The defaultOutputConstraint is the input constraint by the attachment in use currently may have a rotated key if (defaultOutputConstraint is SignatureAttachmentConstraint && (getRotatedKeys(serviceHub).canBeTransitioned(defaultOutputConstraint.key, constraintAttachment.signerKeys))) { return Pair(makeSignatureAttachmentConstraint(attachmentToUse.signerKeys), constraintAttachment)