rob thijssenandClaude Opus 5
ec1399f3f3
The mirror of the same mistake in keyring.createFromJson, fixed the same way. restoreAccount passed `decodeAddress(json.address)` as the public key. For the curve schemes that is correct — the address *is* the public key. An ML-DSA account id is a one-way Poseidon2 hash, so this constructed a pair whose "public key" was a hash of the public key. It did not throw; it produced a pair that was simply wrong. The public key is in `json.encoded`, still encrypted, and the pair is returned *locked* with callers reading `pair.address` off it long before a password appears. So it now passes an accountId — carried as data, used for the address while locked, and checked against the real key once decodePkcs8 supplies one. That check matters here as much as in the keyring: the address field sits outside the encrypted blob, so a tampered one decodes cleanly and yields an account displaying an address its key cannot sign for. The 'ed25519' fallback for version-0 JSON is left alone. Those files predate the crypto type being recorded and are by definition not Quantus, so the guess is safe — but it is commented, because quantus/common#6 removes ed25519 from KeypairType and this becomes a refusal. Build plumbing, all of it dev-time only and all replaced by publishing these packages to a registry (quantus/extension#2): Resolutions point @polkadot/{keyring,util-crypto,networks,util} at the sibling `common` checkout's build output, and @quantus/crypto at `wasm`. tsconfig.base.json gains `*.d.ts` path mappings for them. Without these, node resolves the portal symlink to its realpath and `@polkadot/util-crypto` then resolves inside *common's* tree, where it is the workspace source directory with no exports map — so EncryptedJson silently fails to resolve and KeyringPair$Json loses `encoded` and `encoding`. The `*.d.ts` substitution has to come first because NodeNext will not infer an extension for a bare path, and looks for a `types` directory instead of `types.d.ts`. tsconfig.json overrides those with the runtime `.js` view, because @polkadot/dev-ts reads that file and would otherwise import a declaration file as a module ("Debug Failure. Output generation failed"). tsc reads tsconfig.build.json, which extends the base directly, so each gets the view it needs. The test script sets --preserve-symlinks, which yarn itself warns is required for portals: without it the realpath problem above recurs at runtime. Incidentally, `yarn lint` errors drop from 25 to 8 — resolving those types removed a pile of `any`. The remaining 8 are upstream's own, in loadContract and allowGenesis, and are left alone. Refs quantus/ui#1 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
44 lines
1.1 KiB
JSON
44 lines
1.1 KiB
JSON
{
|
|
"author": "Jaco Greeff <jacogr@gmail.com>",
|
|
"bugs": "https://github.com/polkadot-js/ui/issues",
|
|
"engines": {
|
|
"node": ">=18"
|
|
},
|
|
"homepage": "https://github.com/polkadot-js/ui/tree/master/packages/ui-keyring#readme",
|
|
"license": "Apache-2.0",
|
|
"name": "@polkadot/ui-keyring",
|
|
"repository": {
|
|
"directory": "packages/ui-keyring",
|
|
"type": "git",
|
|
"url": "https://github.com/polkadot-js/ui.git"
|
|
},
|
|
"sideEffects": [
|
|
"./packageDetect.js",
|
|
"./packageDetect.cjs"
|
|
],
|
|
"type": "module",
|
|
"version": "3.16.7",
|
|
"main": "index.js",
|
|
"dependencies": {
|
|
"@polkadot/keyring": "^14.0.3",
|
|
"@polkadot/ui-settings": "3.16.7",
|
|
"@polkadot/util": "^14.0.3",
|
|
"@polkadot/util-crypto": "^14.0.3",
|
|
"mkdirp": "^3.0.1",
|
|
"rxjs": "^7.8.1",
|
|
"store": "^2.0.12",
|
|
"tslib": "^2.8.1"
|
|
},
|
|
"devDependencies": {
|
|
"@quantus/crypto": "^0.1.0",
|
|
"@types/mkdirp": "^2.0.0",
|
|
"@types/store": "^2.0.5",
|
|
"fflate": "^0.8.2"
|
|
},
|
|
"peerDependencies": {
|
|
"@polkadot/keyring": "*",
|
|
"@polkadot/ui-settings": "*",
|
|
"@polkadot/util": "*"
|
|
}
|
|
}
|