feat(scripts): import member signing keys from Nomad job definitions

migrate-dev-nodes.sh now takes the network as its first argument and, before
the image swap, pulls MPC_ACCOUNT_ID/MPC_ACCOUNT_SK from each job's Env and
imports any key missing from the local near-cli keystore. The secret is
masked in the echoed command. test_sign keeps a manual interactive import
(ensure_signing_key) as fallback.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: SimonRastikian

RELEASES.md

@@ -180,7 +180,11 @@ confirmation prompt, so a run can be stopped at any step. Nothing
 cluster-specific is stored in this repo; addresses and credentials are typed in
 per run, or supplied through the per-network `NOMAD_ADDR_DEV_*`,
 `NOMAD_HTTP_AUTH_DEV_*`, and `MPC_NODE_ADDRS_DEV_*` environment variables to
-skip the matching prompt.
+skip the matching prompt. The on-chain steps sign with near-cli; the node step
+imports member-account keys it finds in the Nomad job definitions into the
+local keystore, and the test-signature step offers a manual
+`near account import-account` as fallback. Keys are masked in the echoed
+commands.
 
 ## Re-running after a failure
 

scripts/ops/dev-cluster/dev-common.sh

@@ -80,6 +80,28 @@ nomad_auth_state() {
     else echo "(none)"; fi
 }
 
+# Probes the legacy ~/.near-credentials layout only; OS-keychain keys can't be.
+have_signing_key() {
+    [[ -f "${HOME}/.near-credentials/${NEAR_NET}/${1}.json" ]]
+}
+
+# Best-effort: a miss is advisory (the key may be in the OS keychain). Offers
+# near-cli's interactive import; the key is typed into near-cli's own prompt.
+ensure_signing_key() {
+    local account=$1
+    have_signing_key "$account" && return 0
+    warn "No ~/.near-credentials/${NEAR_NET}/${account}.json — fine if the key is in the OS keychain."
+    confirm "Import a key for ${account} with near-cli now?" || return 0
+    run_cmd near account import-account \
+        || warn "Import did not complete — signing as ${account} may fail."
+}
+
+# Read-only contract query against the resolved cluster.
+near_view() {
+    run_cmd near contract call-function as-read-only "$CONTRACT" "$1" \
+        json-args '{}' network-config "$NEAR_NET" now
+}
+
 # Retries per node (warm-up delay after allocation starts).
 verify_nodes() {
     local version=$1
@@ -115,6 +137,7 @@ test_sign() {
     require_cmds near
 
     local signer=${MEMBER_ACCOUNTS%% *}
+    ensure_signing_key "$signer"
     local payload='[12,1,2,0,4,5,6,8,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,44]'
     local cmd=(near contract call-function as-transaction "$CONTRACT" sign
         json-args "{\"request\": {\"payload\": ${payload}, \"path\": \"test\", \"key_version\": 0}}"

scripts/ops/dev-cluster/dev-menu.sh

@@ -44,8 +44,8 @@ resolve_version() {
 
 resolve_network "${1:-}"
 resolve_version "${2:-}"
-
 resolve_dev_cluster "$NETWORK"
+
 prompt_nomad_ip "$NETWORK"
 [[ -n "${NOMAD_HTTP_AUTH+set}" ]] || prompt_http_auth
 prompt_node_addrs
@@ -61,7 +61,7 @@ EOF
 confirm "Proceed?" || { echo "Aborted."; exit 0; }
 
 step "### Step 1 — nodes"
-run_cmd "${SCRIPT_DIR}/migrate-dev-nodes.sh" "$VERSION" \
+run_cmd "${SCRIPT_DIR}/migrate-dev-nodes.sh" "$NETWORK" "$VERSION" \
     || die "Node upgrade did not complete."
 
 step "### Verify"

scripts/ops/dev-cluster/first-time-setup.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+#
+# first-time-setup.sh — first-run helpers that copy the member accounts'
+# signing keys from the Nomad job definitions into the local near-cli
+# keystore (source, don't run). The node signs with MPC_ACCOUNT_SK already,
+# so the key is on-chain — only the operator's local copy can be missing.
+#
+
+# "account sk" per MPC task, from a job definition on stdin. Secrets injected
+# via a template stanza instead of Env come out empty and are skipped upstream.
+job_signing_creds() {
+    jq -r --arg prefix "$NODE_IMAGE_PREFIX" \
+        '.TaskGroups[].Tasks[]
+         | select(.Config.image // "" | startswith($prefix))
+         | "\(.Env.MPC_ACCOUNT_ID // "") \(.Env.MPC_ACCOUNT_SK // "")"'
+}
+
+# near-cli offers no stdin path for the key, so it rides argv (visible in
+# /proc for its lifetime) — but it is masked in the echoed command.
+import_signing_key() {
+    local account=$1 sk=$2
+    show_cmd near account import-account using-private-key '<MPC_ACCOUNT_SK>' \
+        network-config "$NEAR_NET"
+    near account import-account using-private-key "$sk" network-config "$NEAR_NET" \
+        || warn "Import did not complete — signing as ${account} may fail."
+}
+
+# Imports any missing member-account keys found in a job's definition.
+ensure_job_keys() {
+    local job_id=$1 job account sk
+    job=$(nomad_curl GET "/job/${job_id}") || { warn "Could not fetch ${job_id}."; return; }
+    while read -r account sk; do
+        [[ -n "$account" && -n "$sk" ]] || continue
+        if have_signing_key "$account"; then
+            ok "${account}: key already in ~/.near-credentials."
+        else
+            import_signing_key "$account" "$sk"
+        fi
+    done < <(job_signing_creds <<<"$job")
+}

scripts/ops/dev-cluster/migrate-dev-nodes.sh

@@ -4,10 +4,12 @@
 # mpc-node-* Nomad job to nearone/mpc-node-gcp:<VERSION> — plan, confirm, run.
 # Verification is the caller's job (dev-menu.sh runs it next).
 #
-# Usage: ./scripts/ops/dev-cluster/migrate-dev-nodes.sh <VERSION>
+# Usage: ./scripts/ops/dev-cluster/migrate-dev-nodes.sh <testnet|mainnet> <VERSION>
 # The Nomad IP address and its basic-auth credentials are prompted for. Exporting
 # NOMAD_ADDR / NOMAD_HTTP_AUTH="user:password" skips the matching prompt;
 # NOMAD_TOKEN adds an ACL token header; NOMAD_NAMESPACE targets that namespace.
+# Member-account keys found in the job definitions are imported into the local
+# near-cli keystore if missing, so the later signing steps can run.
 #
 
 set -euo pipefail
@@ -17,6 +19,8 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 source "${SCRIPT_DIR}/../common.sh"
 # shellcheck source=dev-common.sh
 source "${SCRIPT_DIR}/dev-common.sh"
+# shellcheck source=first-time-setup.sh
+source "${SCRIPT_DIR}/first-time-setup.sh"
 
 # curl -K parses values as quoted strings with backslash escapes.
 curl_cfg_escape() {
@@ -137,10 +141,12 @@ upgrade_nomad_job() {
     wait_for_alloc "$job_id"
 }
 
-[[ $# -eq 1 ]] || die "Usage: $0 <VERSION>  (e.g. 3.14.0)"
-VERSION=$1
+[[ $# -eq 2 ]] || die "Usage: $0 <testnet|mainnet> <VERSION>  (e.g. testnet 3.14.0)"
+NETWORK=$1
+VERSION=$2
 check_version "$VERSION"
-require_cmds curl jq
+require_cmds curl jq near
+resolve_dev_cluster "$NETWORK"
 prompt_nomad_ip
 [[ -n "${NOMAD_HTTP_AUTH+set}" ]] || prompt_http_auth
 
@@ -158,6 +164,11 @@ JOB_IDS=$(nomad_curl GET "/jobs?prefix=mpc-node" | jq -r '.[].ID') \
     || die "Could not list jobs from ${NOMAD_ADDR}."
 [[ -n "$JOB_IDS" ]] || die "No mpc-node-* jobs found at ${NOMAD_ADDR}."
 
+step "==> Local signing keys"
+for job_id in $JOB_IDS; do
+    ensure_job_keys "$job_id"
+done
+
 for job_id in $JOB_IDS; do
     upgrade_nomad_job "$job_id" "$IMAGE"
 done