1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
//! # Network Prover Builder
//!
//! This module provides a builder for the [`NetworkProver`].
use alloy_primitives::Address;
use crate::{
network::{signer::NetworkSigner, NetworkMode, TEE_NETWORK_RPC_URL},
NetworkProver,
};
/// A builder for the [`NetworkProver`].
///
/// The builder is used to configure the [`NetworkProver`] before it is built.
#[derive(Default)]
pub struct NetworkProverBuilder {
pub(crate) private_key: Option<String>,
pub(crate) rpc_url: Option<String>,
pub(crate) tee_signers: Option<Vec<Address>>,
pub(crate) signer: Option<NetworkSigner>,
pub(crate) network_mode: Option<NetworkMode>,
}
impl NetworkProverBuilder {
/// Creates a new [`NetworkProverBuilder`].
#[must_use]
pub const fn new() -> Self {
Self {
private_key: None,
rpc_url: None,
tee_signers: None,
signer: None,
network_mode: None,
}
}
/// Sets the Secp256k1 private key (same format as the one used by Ethereum).
///
/// # Details
/// Sets the private key that will be used sign requests sent to the network. By default, the
/// private key is read from the `NETWORK_PRIVATE_KEY` environment variable.
///
/// # Example
/// ```rust,no_run
/// use sp1_sdk::ProverClient;
///
/// let prover = ProverClient::builder().network().private_key("...").build();
/// ```
#[must_use]
pub fn private_key(mut self, private_key: &str) -> Self {
self.private_key = Some(private_key.to_string());
self
}
/// Sets the remote procedure call URL.
///
/// # Details
/// The URL determines the network that the client will connect to. By default, the URL is
/// read from the `NETWORK_RPC_URL` environment variable.
///
/// # Example
/// ```rust,no_run
/// use sp1_sdk::ProverClient;
///
/// let prover = ProverClient::builder().network().rpc_url("...").build();
/// ```
#[must_use]
pub fn rpc_url(mut self, rpc_url: &str) -> Self {
self.rpc_url = Some(rpc_url.to_string());
self
}
/// Process proofs inside a TEE.
///
/// # Details
/// In order to keep the inputs private, it is possible to route the proof
/// requests to a TEE enclave.
///
/// # Example
/// ```rust,no_run
/// use sp1_sdk::ProverClient;
///
/// let prover = ProverClient::builder().network().private().build();
/// ```
#[must_use]
pub fn private(mut self) -> Self {
self.rpc_url = Some(TEE_NETWORK_RPC_URL.to_string());
self
}
/// Sets the list of TEE signers, used for verifying TEE proofs.
#[must_use]
pub fn tee_signers(mut self, tee_signers: &[Address]) -> Self {
self.tee_signers = Some(tee_signers.to_vec());
self
}
/// Sets the network signer to use for signing requests.
///
/// # Details
/// This method allows you to provide a custom signer implementation, such as AWS KMS or
/// a local private key signer. If both `signer` and `private_key` are provided, the signer
/// takes precedence.
///
/// # Examples
///
/// Using a local private key:
/// ```rust,no_run
/// use sp1_sdk::{network::signer::NetworkSigner, ProverClient};
///
/// let private_key = "...";
/// let signer = NetworkSigner::local(private_key).unwrap();
/// let prover = ProverClient::builder().network().signer(signer).build();
/// ```
///
/// Using AWS KMS:
/// ```rust,no_run
/// use sp1_sdk::{network::signer::NetworkSigner, ProverClient};
///
/// # async fn example() {
/// let kms_key_arn = "arn:aws:kms:us-east-1:123456789:key/key-id";
/// let signer = NetworkSigner::aws_kms(kms_key_arn).await.unwrap();
/// let prover = ProverClient::builder().network().signer(signer).build();
/// # }
/// ```
#[must_use]
pub fn signer(mut self, signer: NetworkSigner) -> Self {
self.signer = Some(signer);
self
}
/// Builds a [`NetworkProver`].
///
/// # Details
/// This method will build a [`NetworkProver`] with the given parameters. If `signer` is
/// provided, it will be used directly. Otherwise, if `private_key` is provided, a local
/// signer will be created from it. If neither is provided, the method will look for the
/// `NETWORK_PRIVATE_KEY` environment variable.
///
/// # Examples
///
/// Using a private key:
/// ```rust,no_run
/// use sp1_sdk::ProverClient;
///
/// let prover = ProverClient::builder().network().private_key("...").rpc_url("...").build();
/// ```
///
/// Using a local signer:
/// ```rust,no_run
/// use sp1_sdk::{network::signer::NetworkSigner, ProverClient};
///
/// let private_key = "...";
/// let signer = NetworkSigner::local(private_key).unwrap();
/// let prover = ProverClient::builder().network().signer(signer).build();
/// ```
///
/// Using AWS KMS:
/// ```rust,no_run
/// use sp1_sdk::{network::signer::NetworkSigner, ProverClient};
///
/// # async fn example() {
/// let kms_key_arn = "arn:aws:kms:us-east-1:123456789:key/key-id";
/// let signer = NetworkSigner::aws_kms(kms_key_arn).await.unwrap();
/// let prover = ProverClient::builder().network().signer(signer).build();
/// # }
/// ```
#[must_use]
pub async fn build(self) -> NetworkProver {
let signer = if let Some(provided_signer) = self.signer {
provided_signer
} else {
let private_key = self
.private_key
.or_else(|| std::env::var("NETWORK_PRIVATE_KEY").ok().filter(|k| !k.is_empty()))
.expect(
"NETWORK_PRIVATE_KEY environment variable is not set. \
Please set it to your private key or use the .private_key() method.",
);
NetworkSigner::local(&private_key).expect("Failed to create local signer")
};
let network_mode = self.network_mode.unwrap_or_default();
let rpc_url = match self.rpc_url {
Some(rpc_url) => rpc_url,
None => std::env::var("NETWORK_RPC_URL")
.unwrap_or_else(|_| super::utils::get_default_rpc_url_for_mode(network_mode)),
};
let tee_signers = match self.tee_signers {
Some(tee_signers) => tee_signers,
#[cfg(feature = "tee-2fa")]
None => crate::network::retry::retry_operation(
|| async { crate::network::tee::get_tee_signers().await.map_err(Into::into) },
Some(crate::network::retry::DEFAULT_RETRY_TIMEOUT),
"get tee signers",
)
.await
.expect("Failed to get TEE signers"),
#[cfg(not(feature = "tee-2fa"))]
None => vec![],
};
NetworkProver::new(signer, &rpc_url, network_mode).await.with_tee_signers(tee_signers)
}
}