mirror of
https://github.com/luxfi/threshold.git
synced 2026-10-30 15:15:53 +00:00
zeekay
7261e454b0
Adds Sign_TEE to magnetarScheme / pulsarScheme / coronaScheme that
delegates through protocols/{slhdsa,mldsa,rlwe}-tee respectively.
Default JSON-RPC Sign methods stay permissionless — TEE path is the
strict opt-in for institutional custody.
Shared TEE-options helper (tee_options.go):
* TEEVerifyOption + WithNow / WithKDSGetter / WithExpectedReportData
/ WithExpectedMeasurement re-export the cc/attest knobs without
forcing embedders to import luxfi/mpc/cc/attest directly.
* attestKindFromString maps wire-stable kind strings into attest.Kind.
Each scheme gains SetTEEBackend(*Signer); when nil, Sign_TEE refuses
with err{Magnetar,Pulsar,Corona}TEEUnwired (a hard refusal, never a
silent fallback to the permissionless path).
Dependencies bumped:
* github.com/luxfi/mpc v1.14.13 (cc/attest + pkg/kms + pkg/hsm + pkg/approval)
* github.com/luxfi/corona v0.7.5 → v0.7.6 (canonical wire codec)