From 0fed6735db8b302ed7ce016b37d9eb301cd06096 Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Thu, 22 Jan 2026 04:10:26 +0100
Subject: [PATCH] filter un-signed signkeys

---
 src/http_keys.ml | 37 ++++++++++++++++++-------------------
 1 file changed, 18 insertions(+), 19 deletions(-)

diff --git a/src/http_keys.ml b/src/http_keys.ml
index c19ac2b4..3406222d 100644
--- a/src/http_keys.ml
+++ b/src/http_keys.ml
@@ -117,8 +117,11 @@ let mk_keys ~db_conn ~sm ~last_issue_date =
     List.map denomgroup_of_denomdata denom_data_l
   in
 
-  let* signkeys =
-    let+ signkey_data_l = Pg.get_active_signkeys db_conn |> unwrap_err_caqti in
+  let signkeys =
+    (* TODO
+       use database signkey data / verify secmod and database are in sync *)
+    (*let+ signkey_data_l = Pg.get_active_signkeys db_conn |> unwrap_err_caqti in*)
+    let signkey_data_l = Secmod.get_signkeys_data sm in
     let signkey_data_l =
       List.sort
         (fun a b ->
@@ -126,7 +129,7 @@ let mk_keys ~db_conn ~sm ~last_issue_date =
           Stdlib.compare a.stamp_start b.stamp_start)
         signkey_data_l
     in
-    List.map
+    List.filter_map
       (fun Signkey_data.
              {
                pub;
@@ -136,12 +139,12 @@ let mk_keys ~db_conn ~sm ~last_issue_date =
                master_sig;
                revoked_sig= _;
              } ->
-        let master_sig =
-          match master_sig with
-          | None -> Fmt.failwith "signkey_data without master_sig"
-          | Some v -> v
-        in
-        SignKey.{ key= pub; stamp_start; stamp_expire; stamp_end; master_sig })
+        match master_sig with
+        | None -> None
+        | Some master_sig ->
+            Some
+              SignKey.
+                { key= pub; stamp_start; stamp_expire; stamp_end; master_sig })
       signkey_data_l
   in
 
@@ -155,17 +158,13 @@ let mk_keys ~db_conn ~sm ~last_issue_date =
     (* Compact EdDSA signature (binary-only) over the
        contatentation of all of the master_sigs (in reverse
        chronological order by group) in the arrays under "denominations". *)
-    let l =
-      List.map
-        (fun v ->
-          match v.Denom_data.master_sig with
-          | None -> Fmt.failwith "denom_data without master_sig"
-          | Some v -> v)
-        denom_data_l
+    let hc =
+      denom_data_l
+      |> List.filter_map (fun v -> v.Denom_data.master_sig)
+      |> List.map Bin_sig.DenominationKeyValidity.to_octets
+      |> String.concat ""
+      |> Bin_type.Hash_64.hash
     in
-    let l = List.map (fun v -> Bin_sig.DenominationKeyValidity.to_octets v) l in
-    let data = String.concat "" l in
-    let hc = Bin_type.Hash_64.hash data in
     let open Bin_sig.ExchangeKeySet in
     sign_f
       ~f:(Secmod.sign_with_signkey sm ~pub:exchange_pub)