From e8349ed701e719acf1c106398d48fe8a4c05284c Mon Sep 17 00:00:00 2001
From: swrup <swrup@protonmail.com>
Date: Fri, 28 Nov 2025 17:43:27 +0100
Subject: [PATCH]

---
 tools/offline.ml           |  6 +++--
 tools/offline_signature.ml | 53 ++++++++++++++++++++++++++++++--------
 2 files changed, 46 insertions(+), 13 deletions(-)

diff --git a/tools/offline.ml b/tools/offline.ml
index 7ca308a0..347c5f09 100644
--- a/tools/offline.ml
+++ b/tools/offline.ml
@@ -15,7 +15,9 @@ let download ~base_url ~output =
 let setup ~output =
   let output = Fpath.v output in
   let () = Mirage_crypto_rng_unix.use_default () in
-  let priv, _pub = Mirage_crypto_ec.Ed25519.generate () in
+  let priv, pub = Mirage_crypto_ec.Ed25519.generate () in
+  Fmt.pr "generated master public key:@\n%s@."
+    (Mirage_crypto_ec.Ed25519.pub_to_octets pub |> B32.encode);
   let priv_data = Mirage_crypto_ec.Ed25519.priv_to_octets priv in
   Bos.OS.File.write output priv_data
 
@@ -31,7 +33,7 @@ let sign ~input ~output ~master_key =
   let master_key = EddsaPrivateKey.of_octets master_key in
   let* future_key_response = Api.decode Api.FutureKeysResponse.jsont input in
   let master_signatures =
-    Offline_signature.sign_future_keys ~master_key future_key_response
+    Offline_signature.master_signatures ~master_key future_key_response
   in
   let* s = Api.encode Api.MasterSignatures.jsont master_signatures in
   let* () = File.write output s |> unwrap_err_msg in
diff --git a/tools/offline_signature.ml b/tools/offline_signature.ml
index 4d88aff9..c01708b6 100644
--- a/tools/offline_signature.ml
+++ b/tools/offline_signature.ml
@@ -1,4 +1,4 @@
-let _denom_signature ~key ~key_pub
+let denom_signature ~master_key
     Api.FutureDenom.
       {
         section_name= _;
@@ -28,8 +28,10 @@ let _denom_signature ~key ~key_pub
   let master_sig =
     let open Bin_type in
     let open Bin_signature.DenominationKeyValidityPS in
+    let master = Crypto.EddsaPrivateKey.(pub_of_priv master_key) in
+    let denom_hash = DenominationHash.hash pub_octets in
     {
-      master= key_pub;
+      master;
       start= stamp_start;
       expire_withdraw= stamp_expire_withdraw;
       expire_spend= stamp_expire_deposit;
@@ -38,17 +40,46 @@ let _denom_signature ~key ~key_pub
       fee_withdraw;
       fee_deposit;
       fee_refresh;
-      denom_hash= DenominationHash.hash pub_octets;
+      denom_hash;
     }
     |> Bin.to_string bin
-    |> Crypto.EddsaSignature.sign ~key
+    |> Crypto.EddsaSignature.sign ~key:master_key
   in
   Api.DenomSignature.{ h_denom_pub; master_sig }
 
-let sign_future_keys ~master_key:_ _future_key_response =
-  (*
-  let open Syntax in
-  let open Crypto in
-*)
-  (* TODO sign *)
-  assert false
+let signkey_signature ~master_key
+    Api.FutureSignKey.
+      {
+        key;
+        stamp_start;
+        stamp_expire;
+        stamp_end;
+        (* TODO check sigs *)
+        signkey_secmod_sig= _;
+      } =
+  let master_sig =
+    let open Bin_signature.ExchangeSigningKeyValidityPS in
+    {
+      start= stamp_start;
+      expire= stamp_expire;
+      end_= stamp_end;
+      signkey_pub= key;
+    }
+    |> Bin.to_string bin
+    |> Crypto.EddsaSignature.sign ~key:master_key
+  in
+  Api.SignKeySignature.{ key; master_sig }
+
+let master_signatures ~master_key
+    Api.FutureKeysResponse.
+      {
+        future_denoms;
+        future_signkeys;
+        (* TODO check sigs *)
+        master_pub= _;
+        denom_secmod_public_key= _;
+        signkey_secmod_public_key= _;
+      } =
+  let denom_sigs = List.map (denom_signature ~master_key) future_denoms in
+  let signkey_sigs = List.map (signkey_signature ~master_key) future_signkeys in
+  Api.MasterSignatures.{ denom_sigs; signkey_sigs }