feat: Attested Signatures + UCAN Principal Clarification

.github/workflows/workspace-test.yml

@@ -0,0 +1,16 @@
+name: Workspace Test
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: workspace-test-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  workspace-test:
+    uses: fil-forge/libforge/.github/workflows/go-workspace-test.yml@v1

cmd/cli/identity/root.go

@@ -6,7 +6,7 @@ import (
 	"os"
 
 	"github.com/fil-forge/libforge/identity"
-	"github.com/fil-forge/ucantone/principal/ed25519"
+	"github.com/fil-forge/ucantone/multikey/ed25519"
 	"github.com/spf13/cobra"
 )
 
@@ -53,11 +53,11 @@ func init() {
 }
 
 func doGenerate(cmd *cobra.Command, _ []string) error {
-	signer, err := ed25519.Generate()
+	signer, err := ed25519.GenerateIssuer()
 	if err != nil {
 		return fmt.Errorf("generate key: %w", err)
 	}
-	pem, err := identity.EncodeEd25519SignerToPEM(signer)
+	pem, err := identity.EncodeSignerToPEM(signer)
 	if err != nil {
 		return fmt.Errorf("encoding ed25519 private key to PEM: %w", err)
 	}
@@ -78,11 +78,11 @@ func doParse(cmd *cobra.Command, args []string) error {
 	if err != nil {
 		return fmt.Errorf("reading pem file: %w", err)
 	}
-	key, err := identity.DecodeEd25519SignerFromPEM(pemData)
+	key, err := identity.DecodeSignerFromPEM(pemData)
 	if err != nil {
 		return fmt.Errorf("decoding ed25519 private key: %w", err)
 	}
-	cmd.Printf("# %s\n", key.DID().String())
+	cmd.Printf("# %s\n", key.KeyDID().String())
 	return nil
 }
 

cmd/cli/serve/full.go

@@ -333,7 +333,7 @@ func fullServer(cmd *cobra.Command, _ []string) error {
 
 	if err := initTelemetry(
 		cmd.Context(),
-		appCfg.Identity.Signer.DID().String(),
+		appCfg.Identity.Issuer.DID().String(),
 		userCfg.Network,
 		appCfg.Storage.DataDir,
 		appCfg.Telemetry,
@@ -384,7 +384,7 @@ func fullServer(cmd *cobra.Command, _ []string) error {
 			lc.Append(fx.Hook{
 				OnStart: func(ctx context.Context) error {
 					// Print server startup information
-					cliutil.PrintHero(cmd.OutOrStdout(), appCfg.Identity.Signer.DID())
+					cliutil.PrintHero(cmd.OutOrStdout(), appCfg.Identity.Issuer.DID())
 					cmd.Println("Piri Running on: " + appCfg.Server.Host + ":" + strconv.Itoa(int(appCfg.Server.Port)))
 					cmd.Println("Piri Public Endpoint: " + appCfg.Server.PublicURL.String())
 
@@ -393,7 +393,7 @@ func fullServer(cmd *cobra.Command, _ []string) error {
 						"com/fil-forge/piri/cli/serve"),
 						ctx,
 						"full",
-						attribute.String("did", appCfg.Identity.Signer.DID().String()),
+						attribute.String("did", appCfg.Identity.Issuer.DID().String()),
 						attribute.String("owner_address", appCfg.PDPService.OwnerAddress.String()),
 						attribute.String("public_url", appCfg.Server.PublicURL.String()),
 						attribute.Int64("proof_set", int64(appCfg.UCANService.ProofSetID)),

cmd/cli/setup/register.go

@@ -19,7 +19,6 @@ import (
 	replicacmds "github.com/fil-forge/libforge/commands/blob/replica"
 	"github.com/fil-forge/libforge/commands/pdp"
 	"github.com/fil-forge/ucantone/did"
-	"github.com/fil-forge/ucantone/principal"
 	"github.com/fil-forge/ucantone/ucan"
 	"github.com/fil-forge/ucantone/ucan/container"
 	"github.com/fil-forge/ucantone/ucan/delegation"
@@ -686,7 +685,7 @@ func walletKeyFromWalletFile(walletPath string) (*wallet.Key, error) {
 	return wallet.NewKey(keystore.KeyInfo{PrivateKey: ki.PrivateKey})
 }
 
-func registerWithContract(ctx context.Context, cmd *cobra.Command, id principal.Signer, pdpSvc *service.PDPService) (uint64, error) {
+func registerWithContract(ctx context.Context, cmd *cobra.Command, id ucan.Issuer, pdpSvc *service.PDPService) (uint64, error) {
 	// check if the provider is already registered with the contract
 	status, err := pdpSvc.GetProviderStatus(ctx)
 	if err != nil {
@@ -793,7 +792,7 @@ func registerWithDelegator(ctx context.Context, cmd *cobra.Command, cfg *appcfg.
 		return "", "", fmt.Errorf("creating delegator client: %w", err)
 	}
 
-	operatorDID := cfg.Identity.Signer.DID().String()
+	operatorDID := cfg.Identity.Issuer.DID().String()
 
 	registered, err := c.IsRegistered(ctx, &delgclient.IsRegisteredRequest{DID: operatorDID})
 	if err != nil {
@@ -808,7 +807,7 @@ func registerWithDelegator(ctx context.Context, cmd *cobra.Command, cfg *appcfg.
 		if uploadDID == did.Undef {
 			return "", "", fmt.Errorf("upload service DID is not configured")
 		}
-		self := cfg.Identity.Signer
+		self := cfg.Identity.Issuer
 
 		cmds := []ucan.Command{
 			blob.Allocate.Command,
@@ -891,7 +890,7 @@ func encodeProofChain(wire []byte) (string, error) {
 	return base64.StdEncoding.EncodeToString(wire), nil
 }
 
-func requestContractApproval(ctx context.Context, id principal.Signer, flags *initFlags, ownerAddress common.Address) error {
+func requestContractApproval(ctx context.Context, id ucan.Issuer, flags *initFlags, ownerAddress common.Address) error {
 	// create a signature by signing our own did with the private key of our did
 	signature := id.Sign([]byte(id.DID().String()))
 
@@ -1026,12 +1025,12 @@ func doInit(cmd *cobra.Command, _ []string) error {
 		return err
 	}
 	defer fxApp.Stop(ctx)
-	cmd.PrintErrf("✅ Node created with DID: %s\n", cfg.Identity.Signer.DID().String())
+	cmd.PrintErrf("✅ Node created with DID: %s\n", cfg.Identity.Issuer.DID().String())
 	cmd.PrintErrln()
 
 	// Step 3: Register with the smart contract
 	cmd.PrintErrln("[3/7] Registering provider with contract...")
-	providerID, err := registerWithContract(ctx, cmd, cfg.Identity.Signer, pdpSvc)
+	providerID, err := registerWithContract(ctx, cmd, cfg.Identity.Issuer, pdpSvc)
 	if err != nil {
 		return err
 	}
@@ -1040,7 +1039,7 @@ func doInit(cmd *cobra.Command, _ []string) error {
 
 	// Step 4: Request approval to join contract from storacha
 	cmd.PrintErrln("[4/7] Requesting approval to join contract from Storacha...")
-	if err := requestContractApproval(ctx, cfg.Identity.Signer, flags, ownerAddress); err != nil {
+	if err := requestContractApproval(ctx, cfg.Identity.Issuer, flags, ownerAddress); err != nil {
 		return err
 	}
 	cmd.PrintErrln("✅ Node approved to join contract by Storacha")

go.mod

@@ -15,9 +15,9 @@ require (
 	github.com/fil-forge/delegator v0.0.0-20260619085531-c96197bec34c
 	github.com/fil-forge/filecoin-services/go v0.0.0-20260507172456-36ebe4467390
 	github.com/fil-forge/go-ipni-tools v0.0.0-20260519194815-545b9421aec0
-	github.com/fil-forge/libforge v0.0.0-20260619084920-1753f2265c95
-	github.com/fil-forge/piri-signing-service v0.0.0-20260527011208-918512802357
-	github.com/fil-forge/ucantone v0.0.0-20260527115858-517b03bc3c72
+	github.com/fil-forge/libforge v0.0.0-20260619083649-eb26d871cda1
+	github.com/fil-forge/piri-signing-service v0.0.0-20260619151844-6c3d40a4bf54
+	github.com/fil-forge/ucantone v0.0.0-20260619013642-7985ec010b88
 	github.com/filecoin-project/go-address v1.2.0
 	github.com/filecoin-project/go-commp-utils v0.1.4
 	github.com/filecoin-project/go-commp-utils/nonffi v0.0.0-20240802040721-2a04ffc8ffe8
@@ -303,7 +303,7 @@ require (
 	go.uber.org/mock v0.6.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a // indirect
+	golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 // indirect
 	golang.org/x/net v0.52.0 // indirect
 	golang.org/x/sys v0.43.0 // indirect
 	golang.org/x/term v0.42.0 // indirect

go.sum

@@ -553,12 +553,12 @@ github.com/fil-forge/go-ipni-tools v0.0.0-20260519194815-545b9421aec0 h1:HAfXUPv
 github.com/fil-forge/go-ipni-tools v0.0.0-20260519194815-545b9421aec0/go.mod h1:3NRV/7wc4/0uzzrGdI7NoN/yeF1UvqKRwMyjBqGc5s0=
 github.com/fil-forge/go-ucanto v0.0.0-20260507172450-5cb5d073f8ab h1:2J2cDThqTKP6/0k3SfdlSxfyPa3aLqjTYnmvbEcryfg=
 github.com/fil-forge/go-ucanto v0.0.0-20260507172450-5cb5d073f8ab/go.mod h1:lZF3UXZ2hGLKYmXdquG50JqI9pRlUrV6lubGtgOYfwc=
-github.com/fil-forge/libforge v0.0.0-20260619084920-1753f2265c95 h1:GUnpBYLuWK3mzDsGVXt0CEIHIFeEd3B+Ne2FkqnBfJU=
-github.com/fil-forge/libforge v0.0.0-20260619084920-1753f2265c95/go.mod h1:1ytnrneNEeJcskEbsRDtNZY/Jvgo2Yw5szIUI/9EWPk=
-github.com/fil-forge/piri-signing-service v0.0.0-20260527011208-918512802357 h1:sTK8Yc/kds7MkG0cpK5DGDtDCtU1ZwgQWc4OzRf3ZP4=
-github.com/fil-forge/piri-signing-service v0.0.0-20260527011208-918512802357/go.mod h1:fgg5hE/BlnFlR5qXsT0POv6GWVu7cj526s7v2+mdJXo=
-github.com/fil-forge/ucantone v0.0.0-20260527115858-517b03bc3c72 h1:FFK4CC7IfLfwa5ZQExdkZayPc6Tg0JgVK4jhn2hd2cY=
-github.com/fil-forge/ucantone v0.0.0-20260527115858-517b03bc3c72/go.mod h1:xQ1oQ2UgA8xFpNxpyj2v+jiW2KVDAi90xjy1OjUkNXI=
+github.com/fil-forge/libforge v0.0.0-20260619083649-eb26d871cda1 h1:BZUTgenH/AawsAzH8xOx2tFyGXIhSacGiir4PwojX2M=
+github.com/fil-forge/libforge v0.0.0-20260619083649-eb26d871cda1/go.mod h1:0kXihIQ4L2uZ00nR5XrZ/Y8Db7Ht/qQNuiWslwMJ95M=
+github.com/fil-forge/piri-signing-service v0.0.0-20260619151844-6c3d40a4bf54 h1:KzQzCcEBBF6AfhZOwbQIPh5W2HwCgLS8VFTmch0oMgo=
+github.com/fil-forge/piri-signing-service v0.0.0-20260619151844-6c3d40a4bf54/go.mod h1:O3GqUy+G7hb+oiGW6Wp77W2lRmZs7bewM9s/Vy4D6qo=
+github.com/fil-forge/ucantone v0.0.0-20260619013642-7985ec010b88 h1:N0gbL3Ik+XBYk4y/5BxTVymwbRGlxRXwC5eNWzi1bGI=
+github.com/fil-forge/ucantone v0.0.0-20260619013642-7985ec010b88/go.mod h1:rTIRXz4xErI4U+YlBU9ZvhlTbr4Hs5tJhVMwereVkSg=
 github.com/filecoin-project/filecoin-ffi v1.34.0 h1:OvcsvsFUCwzLOGT949dsJEqSLyGx4d8TPPRrmrzlQbk=
 github.com/filecoin-project/filecoin-ffi v1.34.0/go.mod h1:AXLJk1PscWAwEa9CdqdiFwj1ttVJ+UIm8YQDPpTqBjg=
 github.com/filecoin-project/go-address v0.0.3/go.mod h1:jr8JxKsYx+lQlQZmF5i2U0Z+cGQ59wMIps/8YW/lDj8=
@@ -1946,8 +1946,8 @@ golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EH
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/exp v0.0.0-20230206171751-46f607a40771/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
-golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a h1:ovFr6Z0MNmU7nH8VaX5xqw+05ST2uO1exVfZPVqRC5o=
-golang.org/x/exp v0.0.0-20260212183809-81e46e3db34a/go.mod h1:K79w1Vqn7PoiZn+TkNpx3BUWUQksGO3JcVX6qIjytmA=
+golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90 h1:jiDhWWeC7jfWqR9c/uplMOqJ0sbNlNWv0UkzE0vX1MA=
+golang.org/x/exp v0.0.0-20260312153236-7ab1446f8b90/go.mod h1:xE1HEv6b+1SCZ5/uscMRjUBKtIxworgEcEi+/n9NQDQ=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=

pkg/admin/httpapi/client/client.go

@@ -12,12 +12,12 @@ import (
 	"os"
 	"time"
 
-	"github.com/fil-forge/ucantone/principal"
 	"github.com/golang-jwt/jwt/v4"
 
 	"github.com/fil-forge/libforge/identity"
 	"github.com/fil-forge/piri/pkg/admin/httpapi"
 	"github.com/fil-forge/piri/pkg/config"
+	"github.com/fil-forge/ucantone/multikey"
 )
 
 type Client struct {
@@ -39,12 +39,12 @@ func WithHTTPClient(client *http.Client) Option {
 	}
 }
 
-// WithBearerFromSigner configures the Authorization header using a JWT signed by the provided signer.
-func WithBearerFromSigner(id principal.Signer) Option {
+// WithBearerFromSigner configures the Authorization header using a JWT signed by the provided issuer.
+func WithBearerFromSigner(id multikey.Signer) Option {
 	return func(c *Client) error {
 		authHeader, err := createAuthBearerTokenFromID(id)
 		if err != nil {
-			return fmt.Errorf("creating auth header from signer: %w", err)
+			return fmt.Errorf("creating auth header from issuer: %w", err)
 		}
 		c.authHeader = authHeader
 		return nil
@@ -89,7 +89,7 @@ func NewFromConfig(cfg config.Client) (*Client, error) {
 		return nil, fmt.Errorf("reading identity key file: %w", err)
 	}
 
-	id, err := identity.DecodeEd25519SignerFromPEM(pem)
+	id, err := identity.DecodeSignerFromPEM(pem)
 	if err != nil {
 		return nil, fmt.Errorf("loading identity key file: %w", err)
 	}
@@ -327,7 +327,7 @@ func (c *Client) ReloadConfig(ctx context.Context) (*httpapi.ConfigResponse, err
 	return &resp, nil
 }
 
-func createAuthBearerTokenFromID(id principal.Signer) (string, error) {
+func createAuthBearerTokenFromID(id multikey.Signer) (string, error) {
 	claims := jwt.MapClaims{
 		"service_name": "storacha",
 	}

pkg/admin/httpapi/handlers/routes.go

@@ -1,7 +1,6 @@
 package handlers
 
 import (
-	"crypto/ed25519"
 	"fmt"
 
 	"github.com/golang-jwt/jwt/v4"
@@ -31,12 +30,11 @@ type AdminRoutesParams struct {
 }
 
 func NewRoutes(params AdminRoutesParams) (echofx.RouteRegistrar, error) {
-	if params.Identity.Signer == nil {
+	if params.Identity.Issuer == nil {
 		return nil, fmt.Errorf("missing identity signer for jwt auth")
 	}
-	publicKey := ed25519.PublicKey(params.Identity.Signer.Verifier().Raw())
 	jwtMiddleware := echojwt.WithConfig(echojwt.Config{
-		SigningKey:    publicKey,
+		SigningKey:    params.Identity.Issuer.PublicKey(),
 		SigningMethod: jwt.SigningMethodEdDSA.Alg(),
 	})
 

pkg/config/app/identity.go

@@ -1,11 +1,9 @@
 package app
 
-import (
-	"github.com/fil-forge/ucantone/principal"
-)
+import "github.com/fil-forge/ucantone/multikey"
 
 // IdentityConfig contains identity-related configuration
 type IdentityConfig struct {
-	// The principal signer for this service
-	Signer principal.Signer
+	// The principal issuer for this service
+	Issuer multikey.Issuer
 }

pkg/config/identity.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/fil-forge/libforge/identity"
 	"github.com/fil-forge/piri/pkg/config/app"
+	"github.com/fil-forge/ucantone/multikey"
 )
 
 type IdentityConfig struct {
@@ -21,11 +22,11 @@ func (i IdentityConfig) ToAppConfig() (app.IdentityConfig, error) {
 	if err != nil {
 		return app.IdentityConfig{}, fmt.Errorf("reading identity key file: %w", err)
 	}
-	id, err := identity.DecodeEd25519SignerFromPEM(pem)
+	id, err := identity.DecodeSignerFromPEM(pem)
 	if err != nil {
 		return app.IdentityConfig{}, fmt.Errorf("decoding identity key file: %w", err)
 	}
 	return app.IdentityConfig{
-		Signer: id,
+		Issuer: multikey.KeyIssuer(id),
 	}, nil
 }

pkg/fx/app/common.go

@@ -35,7 +35,7 @@ func CommonModules(cfg app.AppConfig) fx.Option {
 		fx.Supply(cfg.PDPService.Aggregation.Manager),
 		fx.Supply(cfg.PDPService.Gas),
 
-		identity.Module, // Provides principal.Signer
+		identity.Module, // Provides ucan.Signer
 		proofs.Module,   // Provides service for requesting service proofs
 		echo.Module,     // Provides Echo server with route registration
 		database.Module, // Provides SQLite database for job queues

pkg/fx/identity/provider.go

@@ -1,17 +1,17 @@
 package identity
 
 import (
-	"github.com/fil-forge/ucantone/principal"
 	"go.uber.org/fx"
 
+	"github.com/fil-forge/libforge/identity"
 	"github.com/fil-forge/piri/pkg/config/app"
 )
 
 var Module = fx.Module("identity",
 	fx.Provide(ProvideIdentity),
 )
 
-// ProvideIdentity extracts the principal signer from the identity config.
-func ProvideIdentity(cfg app.IdentityConfig) principal.Signer {
-	return cfg.Signer
+// ProvideIdentity extracts the issuer from the identity config.
+func ProvideIdentity(cfg app.IdentityConfig) identity.Identity {
+	return identity.Identity{Issuer: cfg.Issuer}
 }

pkg/fx/pdp/provider.go

@@ -82,7 +82,7 @@ type Params struct {
 func ProvidePDPService(params Params) (*service.PDPService, error) {
 	return service.New(
 		params.Config,
-		params.ID.Signer,
+		params.ID.Issuer,
 		params.ServerConfig.PublicURL,
 		params.DB,
 		params.BlobStore,

pkg/fx/root/provider.go

@@ -1,10 +1,10 @@
 package root
 
 import (
-	"github.com/fil-forge/ucantone/principal"
 	"github.com/labstack/echo/v4"
 	"go.uber.org/fx"
 
+	"github.com/fil-forge/libforge/identity"
 	echofx "github.com/fil-forge/piri/pkg/fx/echo"
 	"github.com/fil-forge/piri/pkg/server"
 )
@@ -24,11 +24,11 @@ var _ echofx.RouteRegistrar = (*Handler)(nil)
 
 // Handler provides the root route handler
 type Handler struct {
-	id principal.Signer
+	id identity.Identity
 }
 
 // NewRootHandler creates a new root handler
-func NewRootHandler(id principal.Signer) *Handler {
+func NewRootHandler(id identity.Identity) *Handler {
 	return &Handler{id: id}
 }