src/bin_sig.ml

@@ -92,6 +92,10 @@ end) : sig
 
   val jsont : t Jsont.t
   val caqti : t Caqti_type.t
+
+  (* TODO rm *)
+  (* escape hatch, only needed for /keys `exchange_sig` (signature over contatentation of all of the master_sigs) *)
+  val to_octets : t -> string
 end = struct
   open Crypto
 
@@ -102,6 +106,7 @@ end = struct
   let verify_f ~f t r = f t ~msg:(Bin.to_string R.bin r)
   let jsont = EddsaSignature.jsont
   let caqti : EddsaSignature.t Caqti_type.t = EddsaSignature.caqti
+  let to_octets t = EddsaSignature.to_octets t
 end
 
 module DenominationKeyAnnouncement = struct

src/http_keys.ml

@@ -93,10 +93,52 @@ let mk_keys ~db_conn ~sm ~last_issue_date =
   let wallet_balance_limit_without_kyc = None in
   let hard_limits = [] in
   let zero_limits = [] in
-  let* denominations =
-    let+ denom_data_l = Pg.get_denominations db_conn |> unwrap_err_caqti in
+  let* denom_data_l = Pg.get_denominations db_conn |> unwrap_err_caqti in
+  (* TODO check order!! *)
+  let denom_data_l =
+    List.sort
+      (fun a b ->
+        let open Denom_data in
+        Stdlib.compare a.stamp_start b.stamp_start)
+      denom_data_l
+  in
+  let list_issue_date =
+    (* TODO is this the last [stamp_start] value? *)
+    (* date when the denomination keys were last updated *)
+    match denom_data_l with
+    | [] -> None
+    | v :: _ -> v.stamp_start
+  in
+  let denominations =
+    (* TODO really need to understand and correctly group denoms *)
     List.map denomgroup_of_denomdata denom_data_l
   in
+
+  let exchange_pub =
+    (* the eddsa pub key used to sign exchange_sig *)
+    Obj.magic ""
+  in
+  let exchange_sig =
+    (* Compact EdDSA signature (binary-only) over the
+       contatentation of all of the master_sigs (in reverse
+       chronological order by group) in the arrays under "denominations". *)
+    let l =
+      List.map
+        (fun v ->
+          match v.Denom_data.master_sig with
+          | None -> Fmt.failwith "denom_data without master_sig"
+          | Some v -> v)
+        denom_data_l
+    in
+    let l = List.map (fun v -> Bin_sig.DenominationKeyValidity.to_octets v) l in
+    let data = String.concat "" l in
+    let hc = Bin_type.Hash_64.hash data in
+    let open Bin_sig.ExchangeKeySet in
+    sign_f
+      ~f:(Secmod.sign_with_signkey sm ~pub:exchange_pub)
+      R.{ list_issue_date; hc }
+  in
+
   (*
       {
         version;

src/secmod.mli

@@ -1,3 +1,4 @@
+(* TODO functorize *)
 open Crypto
 
 type t