vault: reshare zero-downtime PublicKey (plugin, capability, engine, relay) by prashantkumar1982 · Pull Request #23834 · smartcontractkit/chainlink

prashantkumar1982 · 2026-09-27T23:13:51Z

What

Server-side (chainlink node) implementation of vault reshare zero-downtime PublicKey handling. A DKG reshare rotates the per-recipient verification shares (HArray) so the raw VaultPublicKey JSON changes every reshare. This wires every consumer to source the key from something either always-live or truly immutable, so reshares need no manual PublicKey updates and cause no downtime.

chainlink-common dependency

Bumped to v0.11.2-0.20260930165848-901616407c2b, which includes:

#2419 — CRE settings flags + GetSecretsResponse.raw_vault_public_key.
#2427 — Observations.raw_vault_public_key (pure StateTransition).
#2429 — SecretsResponseResult.raw_vault_public_key + GetRawSecretsResponse (runtime relay path).

Changes

1. Vault OCR plugin (core/services/ocr2/plugins/vault/plugin.go)

New VaultGetSecretsIncludePublicKey gate.
Each node broadcasts its DKG public key in its Observation (Observations.RawVaultPublicKey, via observedVaultPublicKey) when the gate is open.
StateTransition aggregates the quorum-agreed key (aggregateVaultPublicKey, ≥ F+1) and attaches it to GetSecretsResponse.RawVaultPublicKey. Sourcing the key from observations rather than node-local config keeps StateTransition a pure function of observations and tolerant of a staggered gate rollout (addresses review feedback). Warns on divergent keys; errors when advertised keys miss quorum.
Gate limiter closed on shutdown.

2. Vault capability (core/capabilities/vault/capability.go)

New encryptOnlyEnabled gate. When open, GetPublicKey returns only the stable encrypt-only sub-key {Group, G_bar, H} (HArray stripped), so encrypt-only consumers (CRE CLI) and the CapReg value are unaffected by reshares. Gate limiter closed on shutdown.

3. Workflow Engine GetSecret() (core/services/workflows/v2/secrets.go)

Decrypt side prefers the response's RawVaultPublicKey (parseVaultPublicKeyHex) over the CapReg-configured VaultPublicKey, falling back when absent.

4. Runtime getSecret via confidential-relay (core/capabilities/confidentialrelay/handler.go, core/services/workflows/v2/secrets.go, capability_executor.go) — addresses review feedback

RawSecretsFetcher/secretsFetcher gain GetRawSecretsResponse (returns the full response incl. the key); GetRawSecrets kept as a deprecated wrapper (non-breaking).
The relay handler calls GetRawSecretsResponse and forwards RawVaultPublicKey into SecretsResponseResult (bound into the signed response hash in chainlink-common), so the enclave verifies runtime secret shares against the live DKG key across reshares.

Tests

core/services/ocr2/plugins/vault/get_secrets_public_key_test.go — attach / aggregate / observe, F+1 quorum, gate-off exclusion.
core/capabilities/vault/public_key_encrypt_only_test.go — HArray stripping.
core/services/workflows/v2/secrets_encrypt_only_test.go — response-key preference + fallback.
core/capabilities/confidentialrelay/handler_test.go, confidential_module_test.go — relay forwarding + stubs.
e2e system-tests/tests/smoke/cre/vault_don_test.go — ExecuteVaultReadSecretsWithReshareFlagsTest (both flags on), SkipIfMixedEnv until baseline images include this; wired in cre_suite_test.go.

Feature gating (all default OFF)

VaultGetSecretsIncludePublicKeyEnabled — plugin includes RawVaultPublicKey in GetSecrets responses.
VaultPublicKeyEncryptOnlyEnabled — GetPublicKey/CapReg return the stable encrypt-only sub-key.

Safety / rollout

Both gates default OFF.
StateTransition reads the key only from observations (pure); safe under staggered gate rollout.
The relay hash binds RawVaultPublicKey only when present, so responses without it hash identically to the pre-field format — backward compatible.
tdh2.PublicKey.Unmarshal tolerates a missing HArray and encryption uses only G_bar+H, so stripping in GetPublicKey is safe for the internal getMasterPublicKey path too.
SkipIfMixedEnv on the e2e until this ships in baseline images.

#added For any new functionality added.
#breaking_change For any functionality that requires manual action for the node to boot.
#bugfix For bug fixes.
#changed For any change to the existing functionality.
#db_update For any feature that introduces updates to database schema.
#deprecation_notice For any upcoming deprecation functionality.
#internal For changesets that need to be excluded from the final changelog.
#nops For any feature that is NOP facing and needs to be in the official Release Notes for the release.
#removed For any functionality/config that is removed.
#updated For any functionality that is updated.
#wip For any change that is not ready yet and external communication about it should be held off till it is feature complete.

trunk-io · 2026-09-27T23:26:11Z

_{View Full Report ↗︎ ⋅ Docs}

…rged SHA

github-actions · 2026-09-28T17:41:28Z

CORA - Pending Reviewers

All codeowners have approved! ✅

For more details, see the full review summary.

prashantkumar1982 · 2026-09-28T19:32:54Z

/vault-audit

app-token-issuer-foundations · 2026-09-28T19:40:12Z

⚠️ Vault audit complete for b158b5c5 — 5 blocking finding(s) (CRITICAL/MUST FIX) must be addressed before merge.

📋 View the full report and findings — private tracking issue, visible to chainlink team members only. Resolve blocking findings there with /resolved <FINDING-ID> <reason>.

… into cre/vault-publickey-reshare-impl

prashantkumar1982 · 2026-09-28T20:46:49Z

/vault-audit

app-token-issuer-foundations · 2026-09-28T20:58:03Z

⚠️ Vault audit complete for 13edc14b — 4 blocking finding(s) (CRITICAL/MUST FIX) must be addressed before merge.

📋 View the full report and findings — private tracking issue, visible to chainlink team members only. Resolve blocking findings there with /resolved <FINDING-ID> <reason>.

cedric-cordenier · 2026-09-29T10:27:58Z

+		if pkb, mErr := r.cfg.PublicKey.Marshal(); mErr != nil {
+			r.lggr.Errorw("could not marshal vault public key for GetSecrets response", "error", mErr)
+		} else {
+			resp.RawVaultPublicKey = hex.EncodeToString(pkb)


Any reason not to add this to the message outside of the plugin, in Execute? This would also reduce the impact on the StateTransition max size

(Also see the audit items, there are a few blockers there)

Any reason not to add this to the message outside of the plugin, in Execute? This would also reduce the impact on the StateTransition max size

We discussed on slack thread that to ensure no downtime when publicKey is changing, we have to include in the OCR response so all nodes agree on a certain publicKey.
Further, since we are soon moving reads out of OCR, this is only temporary for a few weeks, so the increase in StateTransition is ok for short term.

For Vault audit, i did mark them as resolved.
But ran a new audit right now.

russell-stern · 2026-09-29T12:41:12Z

+	// produced these shares so decrypt-side callers read the matching key live from
+	// the response instead of from CapReg / static config. Deterministic across
+	// nodes: the gate is config-sourced and PublicKey is the shared instance key.
+	if open, err := r.cfg.VaultGetSecretsIncludePublicKey.IsOpen(ctx); err != nil {


This should be in Observation, not StateTransition. Each node should broadcast what they think the public key is (could be a new field on Observation instead of per secret request) and StateTransition to aggregate those so it stays as a Pure function

yes, makes sense. Done

…y-reshare-impl

…y-reshare-impl # Conflicts: # core/scripts/go.mod # core/scripts/go.sum # deployment/go.mod # deployment/go.sum # go.mod # go.sum # integration-tests/go.mod # integration-tests/go.sum # integration-tests/load/go.mod # integration-tests/load/go.sum # system-tests/lib/go.mod # system-tests/lib/go.sum # system-tests/tests/go.mod # system-tests/tests/go.sum

prashantkumar1982 · 2026-09-29T18:04:03Z

/vault-audit

app-token-issuer-foundations · 2026-09-29T18:06:41Z

↩️ Superseded by a newer vault audit run.

app-token-issuer-foundations · 2026-09-29T21:27:54Z

⚠️ Vault audit complete for 4905dc90 — 7 blocking finding(s) (CRITICAL/MUST FIX) must be addressed before merge.

📋 View the full report and findings — private tracking issue, visible to chainlink team members only. Resolve blocking findings there with /resolved <FINDING-ID> <reason>.

…hainlink-common

… into cre/vault-publickey-reshare-impl

…ags read

… into cre/vault-publickey-reshare-impl

cl-sonarqube-production · 2026-10-01T03:45:05Z

Quality Gate passed

Issues
2 New issues
11 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

prashantkumar1982 · 2026-10-01T04:04:45Z

/vault-audit

app-token-issuer-foundations · 2026-10-01T04:07:09Z

⚠️ Vault audit complete for f9828aa4 — 2 blocking finding(s) (CRITICAL/MUST FIX) must be addressed before merge.

📋 View the full report and findings — private tracking issue, visible to chainlink team members only. Resolve blocking findings there with /resolved <FINDING-ID> <reason>.

app-token-issuer-foundations · 2026-10-01T14:21:55Z

✅ All vault-audit blocking findings on this PR have been resolved by reviewers. The vault-audit status check is now green.

📋 Tracking issue

vault: wire reshare zero-downtime PublicKey flags

84bdadd

Consume the two cresettings flags added in chainlink-common

prashantkumar1982 requested review from a team as code owners September 27, 2026 23:13

product-security-plaid-production Bot requested a review from DylanTinianov September 27, 2026 23:14

product-security-plaid-production Bot requested review from archseer, justinkaseman and patrickhuie19 September 27, 2026 23:14

prashantkumar1982 added 2 commits September 28, 2026 10:36

vault: client read path + unit/e2e tests; bump chainlink-common to me…

5f84124

…rged SHA

merge develop

d7cf122

prashantkumar1982 requested a review from a team as a code owner September 28, 2026 17:40

product-security-plaid-production Bot requested a review from Tofel September 28, 2026 17:41

vault: satisfy paralleltest in reshare PublicKey tests

b158b5c

prashantkumar1982 added 2 commits September 28, 2026 13:18

Merge branch 'develop' of https://github.com/smartcontractkit/chainlink…

a40570e

… into cre/vault-publickey-reshare-impl

vault: close reshare gate limiters on shutdown; skip e2e in mixed env

13edc14

cedric-cordenier approved these changes Sep 29, 2026

View reviewed changes

cedric-cordenier reviewed Sep 29, 2026

View reviewed changes

cedric-cordenier requested changes Sep 29, 2026

View reviewed changes

russell-stern requested changes Sep 29, 2026

View reviewed changes

prashantkumar1982 mentioned this pull request Sep 29, 2026

vault: add raw_vault_public_key to Observations for pure StateTransition smartcontractkit/chainlink-common#2427

Merged

prashantkumar1982 added 3 commits September 29, 2026 10:20

vault: aggregate public key from observations; bump chainlink-common

50191fe

Merge remote-tracking branch 'origin/develop' into cre/vault-publicke…

88db885

…y-reshare-impl

prashantkumar1982 requested review from cedric-cordenier and russell-stern September 29, 2026 18:16

prashantkumar1982 mentioned this pull request Sep 30, 2026

confidentialrelay: forward vault public key through GetRawSecrets, bind into hash smartcontractkit/chainlink-common#2429

Merged

prashantkumar1982 added 2 commits September 30, 2026 10:21

vault/relay: forward response public key to runtime getSecret; bump c…

520eccb

…hainlink-common

Merge branch 'develop' of https://github.com/smartcontractkit/chainlink…

d132291

… into cre/vault-publickey-reshare-impl

prashantkumar1982 requested a review from a team as a code owner September 30, 2026 18:06

prashantkumar1982 changed the title ~~vault: wire reshare zero-downtime PublicKey flags~~ vault: reshare zero-downtime PublicKey (plugin, capability, engine, relay) Sep 30, 2026

prashantkumar1982 added 3 commits September 30, 2026 14:53

vault: fix gocritic deprecatedComment format on GetRawSecrets

9dc79ee

test(vault e2e): use triggerAndAwaitVaultWorkflowPhase for reshare-fl…

d762ba3

…ags read

Merge branch 'develop' of https://github.com/smartcontractkit/chainlink…

f9828aa

… into cre/vault-publickey-reshare-impl

russell-stern approved these changes Oct 2, 2026

View reviewed changes

Conversation

prashantkumar1982 commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

chainlink-common dependency

Changes

Tests

Feature gating (all default OFF)

Safety / rollout

Related

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

github-actions Bot commented Sep 27, 2026

Uh oh!

trunk-io Bot commented Sep 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CORA - Pending Reviewers

Uh oh!

prashantkumar1982 commented Sep 28, 2026

Uh oh!

app-token-issuer-foundations Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

prashantkumar1982 commented Sep 28, 2026

Uh oh!

app-token-issuer-foundations Bot commented Sep 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cedric-cordenier Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

cedric-cordenier Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

prashantkumar1982 Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

prashantkumar1982 Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

russell-stern Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

prashantkumar1982 Sep 29, 2026

Choose a reason for hiding this comment

Uh oh!

prashantkumar1982 commented Sep 29, 2026

Uh oh!

app-token-issuer-foundations Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

app-token-issuer-foundations Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cl-sonarqube-production Bot commented Oct 1, 2026

Quality Gate passed

Uh oh!

prashantkumar1982 commented Oct 1, 2026

Uh oh!

app-token-issuer-foundations Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

app-token-issuer-foundations Bot commented Oct 1, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

prashantkumar1982 commented Sep 27, 2026 •

edited

Loading

trunk-io Bot commented Sep 27, 2026 •

edited

Loading

github-actions Bot commented Sep 28, 2026 •

edited

Loading

app-token-issuer-foundations Bot commented Sep 28, 2026 •

edited

Loading

app-token-issuer-foundations Bot commented Sep 28, 2026 •

edited

Loading

app-token-issuer-foundations Bot commented Sep 29, 2026 •

edited

Loading

app-token-issuer-foundations Bot commented Sep 29, 2026 •

edited

Loading

app-token-issuer-foundations Bot commented Oct 1, 2026 •

edited

Loading