From a7c678fa3de817155eb0a66b2349a7717234e0ce Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Fri, 28 Nov 2025 17:30:15 +0100
Subject: [PATCH] + wip sign_future_keys

---
 tools/dune                 |  2 +-
 tools/offline.ml           | 61 +++++---------------------------------
 tools/offline_signature.ml | 56 ++++++++++++++++++++++++++++++++++
 3 files changed, 65 insertions(+), 54 deletions(-)
 create mode 100644 tools/offline_signature.ml

diff --git a/tools/dune b/tools/dune
index 3366e550..acb8c8bb 100644
--- a/tools/dune
+++ b/tools/dune
@@ -1,5 +1,5 @@
 (executable
  (public_name offline)
  (name offline)
- (modules offline)
+ (modules offline offline_signature)
  (libraries cmdliner bos fmt mirage-crypto ptime mte vif))
diff --git a/tools/offline.ml b/tools/offline.ml
index 15a9743c..7ca308a0 100644
--- a/tools/offline.ml
+++ b/tools/offline.ml
@@ -19,67 +19,22 @@ let setup ~output =
   let priv_data = Mirage_crypto_ec.Ed25519.priv_to_octets priv in
   Bos.OS.File.write output priv_data
 
-let _denom_signature master_priv master_pub
-    Api.FutureDenom.
-      {
-        section_name= _;
-        value;
-        stamp_start;
-        stamp_expire_withdraw;
-        stamp_expire_deposit;
-        stamp_expire_legal;
-        denom_pub;
-        fee_withdraw;
-        fee_deposit;
-        fee_refresh;
-        fee_refund= _;
-        (* TODO check sigs *)
-        denom_secmod_sig= _;
-      } =
-  let pub_octets =
-    let denom_pub =
-      match denom_pub with
-      | Rsa v -> v
-      | CS _ -> Fmt.failwith "CS key types are not supported."
-    in
-    let pub = denom_pub.Api.RsaDenominationKey.rsa_pub in
-    Crypto.RsaPublicKey.to_octets pub
-  in
-  let h_denom_pub = Api.HashCode.hash pub_octets in
-  let master_sig =
-    let open Bin_type in
-    let open Bin_signature.DenominationKeyValidityPS in
-    let denom_key_validity =
-      {
-        master= master_pub;
-        start= stamp_start;
-        expire_withdraw= stamp_expire_withdraw;
-        expire_spend= stamp_expire_deposit;
-        expire_legal= stamp_expire_legal;
-        value;
-        fee_withdraw;
-        fee_deposit;
-        fee_refresh;
-        denom_hash= DenominationHash.hash pub_octets;
-      }
-    in
-    let data = Bin.to_string bin denom_key_validity in
-    Crypto.EddsaSignature.sign ~key:master_priv data
-  in
-  Api.DenomSignature.{ h_denom_pub; master_sig }
-
 let sign ~input ~output ~master_key =
   let open Syntax in
   let open Bos.OS in
   let open Crypto in
   let input = Fpath.v input in
-  let _output = Fpath.v output in
+  let output = Fpath.v output in
   let master_key = Fpath.v master_key in
   let* input = File.read input |> unwrap_err_msg in
   let* master_key = File.read master_key |> unwrap_err_msg in
-  let _master_key = EddsaPrivateKey.of_octets master_key in
-  let* _future_key_response = Api.decode Api.FutureKeysResponse.jsont input in
-  (* TODO sign *)
+  let master_key = EddsaPrivateKey.of_octets master_key in
+  let* future_key_response = Api.decode Api.FutureKeysResponse.jsont input in
+  let master_signatures =
+    Offline_signature.sign_future_keys ~master_key future_key_response
+  in
+  let* s = Api.encode Api.MasterSignatures.jsont master_signatures in
+  let* () = File.write output s |> unwrap_err_msg in
   Ok ()
 
 (* CLI *)
diff --git a/tools/offline_signature.ml b/tools/offline_signature.ml
new file mode 100644
index 00000000..1717c851
--- /dev/null
+++ b/tools/offline_signature.ml
@@ -0,0 +1,56 @@
+let _denom_signature master_priv master_pub
+    Api.FutureDenom.
+      {
+        section_name= _;
+        value;
+        stamp_start;
+        stamp_expire_withdraw;
+        stamp_expire_deposit;
+        stamp_expire_legal;
+        denom_pub;
+        fee_withdraw;
+        fee_deposit;
+        fee_refresh;
+        fee_refund= _;
+        (* TODO check sigs *)
+        denom_secmod_sig= _;
+      } =
+  let pub_octets =
+    let denom_pub =
+      match denom_pub with
+      | Rsa v -> v
+      | CS _ -> Fmt.failwith "CS key types are not supported."
+    in
+    let pub = denom_pub.Api.RsaDenominationKey.rsa_pub in
+    Crypto.RsaPublicKey.to_octets pub
+  in
+  let h_denom_pub = Api.HashCode.hash pub_octets in
+  let master_sig =
+    let open Bin_type in
+    let open Bin_signature.DenominationKeyValidityPS in
+    let denom_key_validity =
+      {
+        master= master_pub;
+        start= stamp_start;
+        expire_withdraw= stamp_expire_withdraw;
+        expire_spend= stamp_expire_deposit;
+        expire_legal= stamp_expire_legal;
+        value;
+        fee_withdraw;
+        fee_deposit;
+        fee_refresh;
+        denom_hash= DenominationHash.hash pub_octets;
+      }
+    in
+    let data = Bin.to_string bin denom_key_validity in
+    Crypto.EddsaSignature.sign ~key:master_priv data
+  in
+  Api.DenomSignature.{ h_denom_pub; master_sig }
+
+let sign_future_keys ~master_key:_ _future_key_response =
+  (*
+  let open Syntax in
+  let open Crypto in
+*)
+  (* TODO sign *)
+  assert false