6 releases

0.1.5 Dec 20, 2023
0.1.4 Jul 25, 2023
0.1.3 Jun 5, 2023
0.1.2 Apr 19, 2023

#2 in #ethers-rs

Download history 80/week @ 2024-07-24 172/week @ 2024-07-31 99/week @ 2024-08-07 86/week @ 2024-08-14 98/week @ 2024-08-21 169/week @ 2024-08-28 185/week @ 2024-09-04 138/week @ 2024-09-11 156/week @ 2024-09-18 169/week @ 2024-09-25 137/week @ 2024-10-02 121/week @ 2024-10-09 210/week @ 2024-10-16 130/week @ 2024-10-23 133/week @ 2024-10-30 79/week @ 2024-11-06

567 downloads per month

MIT/Apache

17KB
303 lines

ethers-gcp-kms-signer

Crates.io Docs.rs CI

Installation

Cargo

cargo add ethers-gcp-kms-signer

Usage

Signer

use ethers::prelude::*;
use ethers_gcp_kms_signer::{GcpKeyRingRef, GcpKmsProvider, GcpKmsSigner};

let project_id = std::env::var("GOOGLE_PROJECT_ID").expect("GOOGLE_PROJECT_ID");
let location = std::env::var("GOOGLE_LOCATION").expect("GOOGLE_LOCATION");
let keyring = std::env::var("GOOGLE_KEYRING").expect("GOOGLE_KEYRING");
let key_name = std::env::var("GOOGLE_KEY_NAME").expect("GOOGLE_KEY_NAME");

let keyring = GcpKeyRingRef::new(&project_id, &location, &keyring);
let provider = GcpKmsProvider::new(keyring)
    .await
    .expect("Failed to create GCP KMS provider");
let signer = GcpKmsSigner::new(provider, key_name.to_string(), 1, 1)
    .await
    .expect("get key");

You can then use it as regular ethers signer:

let provider = Provider::<Http>::try_from(RPC_URL).unwrap().with_signer(signer);

Credentials

The library will attempt to load credentials in the typical fashion for GCP-

  • If the application is running in a k8s cluster, it should automatically pick up credentials
  • If the GOOGLE_APPLICATION_CREDENTIALS environment is set, attempt to load a service account JSON from this path

Demo

An example app is included in the repo, with terraform manifests to provision a HSM-based key, create a service account with permission to sign using the key, and export a json key with the credentials of this service account.

First, init and apply the terraform:

$ cd example/terraform
$ terraform init
$ terraform apply

Output the service account credentials:

$ terraform output service_account_key > service_account_key.json

To export the service account key in a usable format:

$ cat service_account_key.json | jq -r | base64 -d > ../demo-app/service_account_key.json

To run the example:

 export GOOGLE_PROJECT_ID=<project_id>
 export GOOGLE_LOCATION=<location>
 export GOOGLE_KEYRING=<keyring-name>
 export GOOGLE_KEY_NAME=<key-name>
 export GOOGLE_APPLICATION_CREDENTIALS=service_account_key.json
 cargo run
   Compiling demo-app v0.1.0 (/home/grw/src/ethers-gcp-kms-signer/example/demo-app)
    Finished dev [unoptimized + debuginfo] target(s) in 6.14s
     Running `target/debug/demo-app`
Created signer: GcpKmsSigner { ... }
Signer address: 0xa2e83c0ecc9ffeddb34e027bf3c44971c45fca12
Anvil running at `http://localhost:40023`
Sent 1 ETH to the signer
Sent 1 Wei from the signer
Signer balance: 999960621324999999

License

Licensed under either of

at your option.

Contribution

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.

See CONTRIBUTING.md.

Dependencies

~125MB
~2M SLoC