Verifying Key Resharing Proposals

Governance
2

Nice work! Thanks @eichhorl. It’s great to see progress on this since discussions last year.

It’ll be cool once you can get around to actioning point 2 mentioned above too.

I’ve tried out the tool against the test CUP and it works nicely. Output below → 

INFO: Running command line: bazel-bin/rs/cup_explorer/cup_explorer_bin verify-cup-of-halted-subnet --cup-path /ic/io67a_cup.pb
Using mainnet NNS public key.
NNS public key being used:
-----BEGIN PUBLIC KEY-----
MIGCMB0GDSsGAQQBgtx8BQMBAgEGDCsGAQQBgtx8BQMCAQNhAIFMDm7HH6tYOwi9
gTc8JVw8NxsuhIY8mKTx4It0I10U+12cDNVG2WhfkToMCyzFNBWDv0tDkuRn25bW
W5u0y3FxEvhHLg1aTRRQX/10hLASkQkcX4e5iINGP5gJGguqrg==
-----END PUBLIC KEY-----

Registry client created. Latest registry version: 51387

Creating crypto component...
Jun 20 15:17:58.829 INFO s:/n:/ic_crypto_internal_csp/vault Proceeding with an in-replica csp_vault, CryptoConfig: CryptoConfig { crypto_root: "/tmp/ic_crypto_yYMyp2", csp_vault_type: InReplica }
Getting registry value of key crypto_record_nrp3d-ucxdx-h7pyr-q3mwb-qp2ur-dwgjf-2vdj5-5blib-rjvqf-mvow6-rqe_1 at version 51387...
Getting registry value of key crypto_record_nrp3d-ucxdx-h7pyr-q3mwb-qp2ur-dwgjf-2vdj5-5blib-rjvqf-mvow6-rqe_4 at version 51387...
Getting registry value of key crypto_tls_cert_nrp3d-ucxdx-h7pyr-q3mwb-qp2ur-dwgjf-2vdj5-5blib-rjvqf-mvow6-rqe at version 51387...
Getting registry value of key crypto_record_nrp3d-ucxdx-h7pyr-q3mwb-qp2ur-dwgjf-2vdj5-5blib-rjvqf-mvow6-rqe_3 at version 51387...
Getting registry value of key crypto_record_nrp3d-ucxdx-h7pyr-q3mwb-qp2ur-dwgjf-2vdj5-5blib-rjvqf-mvow6-rqe_5 at version 51387...

Reading CUP file at "/ic/io67a_cup.pb"
CUP integrity verified!

Checking CUP signature for subnet io67a-2jmkw-zup3h-snbwi-g6a5n-rm5dn-b6png-lvdpl-nqnto-yih6l-gqe...
Getting registry value of key catch_up_package_contents_io67a-2jmkw-zup3h-snbwi-g6a5n-rm5dn-b6png-lvdpl-nqnto-yih6l-gqe at version 51153...
CUP signature verification successful!

Latest subnet state according to CUP:
                TIME: 1750081799471456224, (2025-06-16 13:49:59.471456224 UTC)
              HEIGHT: 171663500
                HASH: db94cbaff73a1c74e780ff63a30484284da1a9dd69e5374098438390bda5e053
    REGISTRY VERSION: 51153

Verifying that the subnet was halted on this CUP...
Getting registry value of key subnet_record_io67a-2jmkw-zup3h-snbwi-g6a5n-rm5dn-b6png-lvdpl-nqnto-yih6l-gqe at version 51153...

thread 'main' panicked at rs/cup_explorer/src/main.rs:80:17:
Verification failed: Subnet wasn't instructed to halt on this CUP. Therefore, this CUP is NOT guaranteed to represent the latest state of the subnet!
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Once again, thank you :folded_hands: :slightly_smiling_face:

The CO.DELTA team will be ready to make use of this in the upcoming key resharing proposal.

6 Likes