Skip to content

fix(evolution): return the COSE_Key from wallet signMessage (#481) - #639

Closed
Kshot3000 wants to merge 1 commit into
IntersectMBO:mainfrom
Kshot3000:fix/signmessage-return-cose-key
Closed

Kshot3000 wants to merge 1 commit into
IntersectMBO:mainfrom
Kshot3000:fix/signmessage-return-cose-key

Conversation

@Kshot3000

Copy link
Copy Markdown

Summary

Fixes #481: CIP-30 signData returns a DataSignature of { signature, key }, where key is the CBOR-encoded COSE_Key needed to verify the signature. SignData.signData produces both, but the wallet's signMessage returned only { payload, signature } and dropped the key, and the wallet SignedMessage interface had no key field — so a consumer could not verify a message signed via the wallet API without obtaining the public key some other way.

Fix

  • packages/evolution/src/sdk/wallet/Wallet.ts — SignedMessage gains a key field (hex-encoded COSE_Key), with the doc comment stating the CIP-30 DataSignature shape.
  • packages/evolution/src/sdk/client/internal/Signing.ts — the seed/private-key wallet's signMessage returns key: Bytes.toHex(signed.key) alongside the signature; the key was already computed by SignData.signData, it was just discarded.
  • packages/evolution/src/sdk/client/internal/Wallets.ts — the CIP-30 api wallet's signMessage carries the extension's result.key through, so both wallet types return a complete DataSignature.

Tests

New file packages/evolution/test/SignMessage.DataSignature.test.ts (4 tests), each verified failing on main first:

  • seed wallet: result.key is undefined on main (expected 'undefined' to be 'string'); after the fix it is a non-empty hex string that decodes as CBOR.
  • seed wallet: SignData.verifyData verifies using only the returned { signature, key } (plus the address and the signer's key hash) — self-contained CIP-30 verification, exactly what was impossible before.
  • seed wallet: the returned key and signature match what SignData.signData produces for the signing key.
  • CIP-30 api wallet: a stub extension returning { signature: "deadbeef", key: "cafebabe" } — on main the key is dropped; after the fix signMessage returns it unchanged.

Full suite: 1682 passed / 75 skipped / 0 failed, test files 102 passed / 1 skipped of 103 — exactly main's 1678 baseline + the 4 new tests. tsc --noEmit clean, eslint clean, and the three touched source files carry exactly the same prettier diff-line counts as unmodified main (5 / 10 / 320 — they fail prettier on main too; no new formatting drift). A patch changeset is included.


Independent builder — not affiliated with the Cardano Foundation, IOG or Intersect.

@Kshot9000 (https://x.com/kshot9000) · ADA donations: addr1q8hnl6vl5a6k3rw3n5g3jtte696zcl76kfatzv7gpswa9r0dj7fma6klq55y4ffm7tf0em09udnyhuk4ah92pl5x9jpqjae44v

cc @cardano-foundation @IntersectMBO

@emmanuel-musau

Copy link
Copy Markdown
Collaborator

Closing: we're not accepting bulk
automated contributions. The linked issues stay open.

@IntersectMBO IntersectMBO locked as spam and limited conversation to collaborators Oct 20, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

signMessage drops the COSE_Key, producing an incomplete CIP-30 DataSignature

2 participants