@chainsafe/lodestar 1.41.0-dev.988363dff3 → 1.41.0-dev.9939b12b53

package/src/cmds/validator/signers/index.ts

@@ -20,8 +20,8 @@ const KEYSTORE_IMPORT_PROGRESS_MS = 10000;
  * --interopIndexes
  * --fromMnemonic, then requires --mnemonicIndexes
  * --importKeystores, then requires --importKeystoresPassword
- * --externalSigner.fetch, then requires --externalSigner.url
- * --externalSigner.pubkeys, then requires --externalSigner.url
+ * --externalSigner.fetch, then requires --externalSigner.urls
+ * --externalSigner.pubkeys, then requires --externalSigner.urls
  * else load from persisted
  * - both remote keys and local keystores
  *
@@ -52,7 +52,7 @@ export async function getSignersFromArgs(
     const indexes = args.interopIndexes;
     // Using a remote signer with TESTNETS
     if (args["externalSigner.pubkeys"] || args["externalSigner.fetch"]) {
-      return getRemoteSigners(args);
+      return getRemoteSigners(args, logger);
     }
     return indexes.map((index) => ({type: SignerType.Local, secretKey: interopSecretKey(index)}));
   }
@@ -105,7 +105,7 @@ export async function getSignersFromArgs(
 
   // Remote keys are declared manually or will be fetched from external signer
   if (args["externalSigner.pubkeys"] || args["externalSigner.fetch"]) {
-    return getRemoteSigners(args);
+    return getRemoteSigners(args, logger);
   }
 
   // Read keys from local account manager
@@ -153,24 +153,91 @@ export function getSignerPubkeyHex(signer: Signer): string {
   }
 }
 
-async function getRemoteSigners(args: IValidatorCliArgs & GlobalArgs): Promise<Signer[]> {
-  const externalSignerUrl = args["externalSigner.url"];
-  if (!externalSignerUrl) {
+async function getRemoteSigners(
+  args: IValidatorCliArgs & GlobalArgs,
+  logger: Pick<Logger, LogLevel.info | LogLevel.warn | LogLevel.debug>
+): Promise<Signer[]> {
+  const externalSignerUrls = args["externalSigner.urls"] ?? [];
+
+  if (externalSignerUrls.length === 0) {
     throw new YargsError(
-      `Must set externalSigner.url with ${
+      `Must set externalSigner.urls with ${
         args["externalSigner.pubkeys"] ? "externalSigner.pubkeys" : "externalSigner.fetch"
       }`
     );
   }
-  if (!isValidHttpUrl(externalSignerUrl)) {
-    throw new YargsError(`Invalid external signer URL: ${externalSignerUrl}`);
+
+  for (const url of externalSignerUrls) {
+    if (!isValidHttpUrl(url)) {
+      throw new YargsError(`Invalid external signer URL: ${url}`);
+    }
   }
+
   if (args["externalSigner.pubkeys"] && args["externalSigner.pubkeys"].length === 0) {
     throw new YargsError("externalSigner.pubkeys is set to an empty list");
   }
 
-  const pubkeys = args["externalSigner.pubkeys"] ?? (await externalSignerGetKeys(externalSignerUrl));
-  assertValidPubkeysHex(pubkeys);
+  const signers: Signer[] = [];
+
+  if (args["externalSigner.pubkeys"]) {
+    // If pubkeys are explicitly provided with multiple URLs, warn user about limitation
+    if (externalSignerUrls.length > 1) {
+      throw new YargsError(
+        "Cannot use --externalSigner.pubkeys with multiple --externalSigner.urls. " +
+          "When using --externalSigner.pubkeys, only a single URL is allowed. " +
+          "To use multiple signers, use --externalSigner.fetch instead to fetch pubkeys from each signer."
+      );
+    }
+    // If pubkeys are explicitly provided, assign them to the first (and only) URL
+    // This maintains backward compatibility
+    const pubkeys = args["externalSigner.pubkeys"];
+    assertValidPubkeysHex(pubkeys);
+    for (const pubkey of pubkeys) {
+      signers.push({type: SignerType.Remote, pubkey, url: externalSignerUrls[0]});
+    }
+  } else {
+    // Fetch pubkeys from all external signer URLs, fail startup if any signer is unavailable
+    const results: {url: string; pubkeys: string[]}[] = [];
+    const failures: {url: string; error: string}[] = [];
+    await Promise.all(
+      externalSignerUrls.map(async (url) => {
+        try {
+          const pubkeys = await externalSignerGetKeys(url);
+          results.push({url, pubkeys});
+        } catch (e) {
+          const errorMsg = e instanceof Error ? e.message : String(e);
+          failures.push({url, error: errorMsg});
+        }
+      })
+    );
+    if (failures.length > 0) {
+      const errorMessages = failures.map((f) => `  ${f.url}: ${f.error}`).join("\n");
+      throw new YargsError(
+        `Failed to fetch pubkeys from external signer(s):\n${errorMessages}\n` +
+          "Please verify the signer URLs are correct and reachable."
+      );
+    }
+
+    const seenPubkeys = new Map<string, string>();
+    for (const {url, pubkeys} of results) {
+      if (pubkeys.length > 0) {
+        assertValidPubkeysHex(pubkeys);
+        for (const pubkey of pubkeys) {
+          const firstUrl = seenPubkeys.get(pubkey);
+          if (firstUrl !== undefined) {
+            logger.warn("Duplicate pubkey found on multiple signers, using first occurrence only", {
+              pubkey,
+              firstUrl,
+              duplicateUrl: url,
+            });
+            continue;
+          }
+          seenPubkeys.set(pubkey, url);
+          signers.push({type: SignerType.Remote, pubkey, url});
+        }
+      }
+    }
+  }
 
-  return pubkeys.map((pubkey) => ({type: SignerType.Remote, pubkey, url: externalSignerUrl}));
+  return signers;
 }

package/src/cmds/validator/signers/logSigners.ts

@@ -69,7 +69,7 @@ export function warnOrExitNoSigners(args: IValidatorCliArgs, logger: Pick<Logger
       "No local keystores or remote keys found with current args, expecting to be added via keymanager or fetched from external signer later"
     );
   } else {
-    if (args["externalSigner.url"]) {
+    if (args["externalSigner.urls"]) {
       throw new YargsError(
         "No remote keys found with current args, start with --externalSigner.fetch to automatically fetch from external signer"
       );

package/src/cmds/validator/voluntaryExit.ts

@@ -37,7 +37,7 @@ If no `pubkeys` are provided, it will exit all validators that have been importe
     },
     {
       command:
-        "validator voluntary-exit --network hoodi --externalSigner.url http://signer:9000 --externalSigner.fetch --pubkeys 0xF00",
+        "validator voluntary-exit --network hoodi --externalSigner.urls http://signer:9000 --externalSigner.fetch --pubkeys 0xF00",
       description:
         "Perform a voluntary exit for the validator who has a public key 0xF00 and its secret key is on an external signer",
     },

package/src/options/beaconNodeOptions/network.ts

@@ -7,20 +7,25 @@ import {YargsError} from "../../util/index.js";
 export const defaultListenAddress = "0.0.0.0";
 export const defaultListenAddress6 = "::";
 export const defaultP2pPort = 9000;
+export const defaultQuicPort = 9001;
 
 export type NetworkArgs = {
   discv5?: boolean;
   listenAddress?: string;
   port?: number;
   discoveryPort?: number;
+  quicPort?: number;
   listenAddress6?: string;
   port6?: number;
   discoveryPort6?: number;
+  quicPort6?: number;
   bootnodes?: string[];
   targetPeers?: number;
   subscribeAllSubnets?: boolean;
   slotsToSubscribeBeforeAggregatorDuty?: number;
   disablePeerScoring?: boolean;
+  quic?: boolean;
+  tcp?: boolean;
   mdns?: boolean;
   directPeers?: string[];
   "network.maxPeers"?: number;
@@ -65,43 +70,79 @@ export function parseListenArgs(args: NetworkArgs) {
   const listenAddress = args.listenAddress ?? (args.listenAddress6 ? undefined : defaultListenAddress);
   const port = listenAddress ? (args.port ?? defaultP2pPort) : undefined;
   const discoveryPort = listenAddress ? (args.discoveryPort ?? port) : undefined;
+  const quicPort = listenAddress ? (args.quicPort ?? (port !== undefined ? port + 1 : defaultQuicPort)) : undefined;
 
   // If listenAddress6 is explicitly set, use it
   // If listenAddress is not set, use defaultListenAddress6
   const listenAddress6 = args.listenAddress6 ?? (args.listenAddress ? undefined : defaultListenAddress6);
   const port6 = listenAddress6 ? (args.port6 ?? args.port ?? defaultP2pPort) : undefined;
   const discoveryPort6 = listenAddress6 ? (args.discoveryPort6 ?? port6) : undefined;
+  const quicPort6 = listenAddress6
+    ? (args.quicPort6 ?? (port6 !== undefined ? port6 + 1 : defaultQuicPort))
+    : undefined;
 
-  return {listenAddress, port, discoveryPort, listenAddress6, port6, discoveryPort6};
+  return {listenAddress, port, discoveryPort, quicPort, listenAddress6, port6, discoveryPort6, quicPort6};
 }
 
 export function parseArgs(args: NetworkArgs): IBeaconNodeOptions["network"] {
-  const {listenAddress, port, discoveryPort, listenAddress6, port6, discoveryPort6} = parseListenArgs(args);
+  const {listenAddress, port, discoveryPort, quicPort, listenAddress6, port6, discoveryPort6, quicPort6} =
+    parseListenArgs(args);
+  const quic = args.quic ?? false;
+  const tcp = args.tcp ?? true;
+
+  if (!quic && !tcp) {
+    throw new YargsError("Cannot disable both TCP and QUIC transports");
+  }
+
   // validate ip, ip6, ports
   const muArgs = {
     listenAddress: listenAddress ? `/ip4/${listenAddress}` : undefined,
     port: listenAddress ? `/tcp/${port}` : undefined,
     discoveryPort: listenAddress ? `/udp/${discoveryPort}` : undefined,
+    quicPort: listenAddress ? `/udp/${quicPort}/quic-v1` : undefined,
     listenAddress6: listenAddress6 ? `/ip6/${listenAddress6}` : undefined,
     port6: listenAddress6 ? `/tcp/${port6}` : undefined,
     discoveryPort6: listenAddress6 ? `/udp/${discoveryPort6}` : undefined,
+    quicPort6: listenAddress6 ? `/udp/${quicPort6}/quic-v1` : undefined,
   };
 
-  for (const key of [
+  const keysToValidate: (keyof typeof muArgs)[] = [
     "listenAddress",
     "port",
     "discoveryPort",
     "listenAddress6",
     "port6",
     "discoveryPort6",
-  ] as (keyof typeof muArgs)[]) {
+  ];
+
+  if (quic) {
+    keysToValidate.push("quicPort");
+    keysToValidate.push("quicPort6");
+  }
+
+  for (const key of keysToValidate) {
     validateMultiaddrArg(muArgs, key);
   }
 
+  if (quic) {
+    if (discoveryPort !== undefined && quicPort !== undefined && discoveryPort === quicPort) {
+      throw new YargsError(
+        `discoveryPort and quicPort must not collide, both are UDP. Got discoveryPort=${discoveryPort} quicPort=${quicPort}`
+      );
+    }
+    if (discoveryPort6 !== undefined && quicPort6 !== undefined && discoveryPort6 === quicPort6) {
+      throw new YargsError(
+        `discoveryPort6 and quicPort6 must not collide, both are UDP. Got discoveryPort6=${discoveryPort6} quicPort6=${quicPort6}`
+      );
+    }
+  }
+
   const bindMu = listenAddress ? `${muArgs.listenAddress}${muArgs.discoveryPort}` : undefined;
-  const localMu = listenAddress ? `${muArgs.listenAddress}${muArgs.port}` : undefined;
+  const localMu = listenAddress && tcp ? `${muArgs.listenAddress}${muArgs.port}` : undefined;
+  const quicMu = listenAddress && quic ? `${muArgs.listenAddress}${muArgs.quicPort}` : undefined;
   const bindMu6 = listenAddress6 ? `${muArgs.listenAddress6}${muArgs.discoveryPort6}` : undefined;
-  const localMu6 = listenAddress6 ? `${muArgs.listenAddress6}${muArgs.port6}` : undefined;
+  const localMu6 = listenAddress6 && tcp ? `${muArgs.listenAddress6}${muArgs.port6}` : undefined;
+  const quicMu6 = listenAddress6 && quic ? `${muArgs.listenAddress6}${muArgs.quicPort6}` : undefined;
 
   const targetPeers = args.targetPeers;
   const maxPeers = args["network.maxPeers"] ?? (targetPeers !== undefined ? Math.floor(targetPeers * 1.1) : undefined);
@@ -137,11 +178,13 @@ export function parseArgs(args: NetworkArgs): IBeaconNodeOptions["network"] {
       : null,
     maxPeers: maxPeers ?? defaultOptions.network.maxPeers,
     targetPeers: targetPeers ?? defaultOptions.network.targetPeers,
-    localMultiaddrs: [localMu, localMu6].filter(Boolean) as string[],
+    localMultiaddrs: [quicMu, quicMu6, localMu, localMu6].filter(Boolean) as string[],
     subscribeAllSubnets: args.subscribeAllSubnets,
     slotsToSubscribeBeforeAggregatorDuty:
       args.slotsToSubscribeBeforeAggregatorDuty ?? defaultOptions.network.slotsToSubscribeBeforeAggregatorDuty,
     disablePeerScoring: args.disablePeerScoring,
+    quic,
+    tcp,
     connectToDiscv5Bootnodes: args["network.connectToDiscv5Bootnodes"],
     discv5FirstQueryDelayMs: args["network.discv5FirstQueryDelayMs"],
     dontSendGossipAttestationsToForkchoice: args["network.dontSendGossipAttestationsToForkchoice"],
@@ -192,6 +235,13 @@ export const options: CliCommandOptions<NetworkArgs> = {
     group: "network",
   },
 
+  quicPort: {
+    description: "The UDP port that QUIC will listen on. Defaults to `port` + 1",
+    type: "number",
+    defaultDescription: "`port` + 1",
+    group: "network",
+  },
+
   listenAddress6: {
     type: "string",
     description: "The IPv6 address to listen for p2p UDP and TCP connections",
@@ -214,6 +264,13 @@ export const options: CliCommandOptions<NetworkArgs> = {
     group: "network",
   },
 
+  quicPort6: {
+    description: "The UDP port that QUIC will listen on. Defaults to `port6` + 1",
+    type: "number",
+    defaultDescription: "`port6` + 1",
+    group: "network",
+  },
+
   bootnodes: {
     type: "array",
     description: "Bootnodes for discv5 discovery",
@@ -254,6 +311,21 @@ export const options: CliCommandOptions<NetworkArgs> = {
     group: "network",
   },
 
+  quic: {
+    type: "boolean",
+    description: "Enable QUIC transport",
+    default: false,
+    group: "network",
+  },
+
+  tcp: {
+    hidden: true,
+    type: "boolean",
+    description: "Enable TCP transport",
+    default: true,
+    group: "network",
+  },
+
   mdns: {
     type: "boolean",
     description: "Enable mdns local peer discovery",