Merge branch 'main' into relax-exec-id-check

Author: vreff

go.mod

@@ -43,7 +43,7 @@ require (
 	github.com/scylladb/go-reflectx v1.0.1
 	github.com/shopspring/decimal v1.4.0
 	github.com/smartcontractkit/chain-selectors v1.0.100
-	github.com/smartcontractkit/chainlink-common/pkg/chipingress v0.0.11-0.20260528204832-58c7145c53f8
+	github.com/smartcontractkit/chainlink-common/pkg/chipingress v0.0.11-0.20260626151909-052e55e62e62
 	github.com/smartcontractkit/chainlink-protos/billing/go v0.0.0-20251024234028-0988426d98f4
 	github.com/smartcontractkit/chainlink-protos/cre/go v0.0.0-20260622152157-c8e129347b8b
 	github.com/smartcontractkit/chainlink-protos/linking-service/go v0.0.0-20251002192024-d2ad9222409b

go.sum

@@ -1,6 +1,7 @@
 package ocr2key
 
 import (
+	"bytes"
 	"crypto/ed25519"
 	"encoding/binary"
 	"errors"
@@ -90,7 +91,10 @@ func (ckr *cosmosKeyring) VerifyBlob(pubkey ocrtypes.OnchainPublicKey, b, sig []
 	if len(pubkey) != ed25519.PublicKeySize {
 		return false
 	}
-	return ed25519consensus.Verify(ed25519.PublicKey(pubkey), b, sig[32:])
+	if !bytes.Equal(pubkey, sig[:ed25519.PublicKeySize]) {
+		return false
+	}
+	return ed25519consensus.Verify(ed25519.PublicKey(pubkey), b, sig[ed25519.PublicKeySize:])
 }
 
 func (ckr *cosmosKeyring) MaxSignatureLength() int {

keystore/corekeys/ocr2key/cosmos_keyring.go

@@ -1,6 +1,7 @@
 package ocr2key
 
 import (
+	"bytes"
 	"crypto/ed25519"
 	"crypto/sha256"
 	"errors"
@@ -93,7 +94,10 @@ func (tkr *tonKeyring) VerifyBlob(pubkey ocrtypes.OnchainPublicKey, b, sig []byt
 	if len(pubkey) != ed25519.PublicKeySize {
 		return false
 	}
-	return ed25519consensus.Verify(ed25519.PublicKey(pubkey), b, sig[32:])
+	if !bytes.Equal(pubkey, sig[:ed25519.PublicKeySize]) {
+		return false
+	}
+	return ed25519consensus.Verify(ed25519.PublicKey(pubkey), b, sig[ed25519.PublicKeySize:])
 }
 
 func (tkr *tonKeyring) MaxSignatureLength() int {

keystore/corekeys/ocr2key/ton_keyring.go

@@ -117,9 +117,14 @@ func (sk *OCR2Key) Verify(publicKey types.OnchainPublicKey, reportCtx types.Repo
 	if len(signature) < sOffset+componentLen {
 		return false
 	}
+	author := new(big.Int).SetBytes(signature[:rOffset])
 	r := new(big.Int).SetBytes(signature[rOffset : rOffset+componentLen])
 	s := new(big.Int).SetBytes(signature[sOffset : sOffset+componentLen])
 
+	if pubX.Cmp(author) != 0 {
+		return false
+	}
+
 	// Only allow canonical signatures to avoid signature malleability. Verify s <= N/2
 	if s.Cmp(new(big.Int).Rsh(curveOrder, 1)) == 1 {
 		return false

keystore/corekeys/starkkey/ocr2key.go

@@ -67,7 +67,6 @@ message CreateSecretResponse {
 
 message CreateSecretsResponse {
   repeated CreateSecretResponse responses = 1;
-  string request_id = 2;
 }
 
 message UpdateSecretsRequest {
@@ -85,7 +84,6 @@ message UpdateSecretResponse {
 
 message UpdateSecretsResponse {
   repeated UpdateSecretResponse responses = 1;
-  string request_id = 2;
 }
 
 message DeleteSecretsRequest {
@@ -103,7 +101,6 @@ message DeleteSecretResponse {
 
 message DeleteSecretsResponse {
   repeated DeleteSecretResponse responses = 1;
-  string request_id = 2;
 }
 
 message ListSecretIdentifiersRequest {
@@ -118,7 +115,6 @@ message ListSecretIdentifiersResponse {
   repeated SecretIdentifier identifiers = 1;
   bool success = 2;
   string error = 3;
-  string request_id = 4;
 }
 
 enum RequestType {

pkg/capabilities/actions/vault/messages.pb.go

@@ -299,6 +299,9 @@ func NewEvent(domain, entity string, payload []byte, attributes map[string]any)
 	if val, ok := attributes["subject"].(string); ok {
 		event.SetSubject(val)
 	}
+	if val, ok := attributes[IdempotencyKeyAttr].(string); ok && val != "" {
+		event.SetExtension(IdempotencyKeyAttr, val)
+	}
 
 	err := event.SetData(ceformat.ContentTypeProtobuf, payload)
 	if err != nil {

pkg/capabilities/actions/vault/messages.proto

@@ -137,6 +137,36 @@ func TestNewEvent(t *testing.T) {
 	assert.Equal(t, testProto.Message, resultProto.Message)
 }
 
+func TestNewEvent_IdempotencyKey(t *testing.T) {
+	payload := []byte("body")
+
+	t.Run("non-empty key is set as extension", func(t *testing.T) {
+		attrs := map[string]any{IdempotencyKeyAttr: "my-key-123"}
+		event, err := NewEvent("domain", "entity", payload, attrs)
+		require.NoError(t, err)
+		ext := event.Extensions()
+		require.NotNil(t, ext)
+		assert.Equal(t, "my-key-123", ext[IdempotencyKeyAttr])
+	})
+
+	t.Run("empty key is not set as extension", func(t *testing.T) {
+		attrs := map[string]any{IdempotencyKeyAttr: ""}
+		event, err := NewEvent("domain", "entity", payload, attrs)
+		require.NoError(t, err)
+		ext := event.Extensions()
+		_, present := ext[IdempotencyKeyAttr]
+		assert.False(t, present, "empty idempotency key must not appear as an extension")
+	})
+
+	t.Run("absent key leaves extension unset", func(t *testing.T) {
+		event, err := NewEvent("domain", "entity", payload, nil)
+		require.NoError(t, err)
+		ext := event.Extensions()
+		_, present := ext[IdempotencyKeyAttr]
+		assert.False(t, present, "absent idempotency key must not appear as an extension")
+	})
+}
+
 func TestEventToProto(t *testing.T) {
 	// Create a test protobuf message
 	testProto := pb.PingResponse{Message: "test message"}

pkg/chipingress/client.go

@@ -7,6 +7,12 @@ import (
 	"github.com/smartcontractkit/chainlink-common/pkg/chipingress/pb"
 )
 
+// IdempotencyKeyAttr is the CloudEvent extension attribute name for a per-event idempotency key.
+// Set it via the attributes map of NewEvent.
+// When the event is emitted over Kafka using the CloudEvents Kafka binding, extensions become
+// Kafka headers named "ce_<name>" (e.g., ce_idempotencykey), enabling downstream deduplication.
+const IdempotencyKeyAttr = "idempotencykey"
+
 type (
 	// Cloudevents types
 	CloudEvent   = ce.Event