feat: replica-signed queries

.github/workflows/test.yml

@@ -24,10 +24,11 @@ jobs:
             target
           key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}-1
 
-      - name: Install wasm-pack
+      - name: Install wasm-pack and chromedriver
         if: ${{ matrix.os == 'ubuntu-latest' }}
         run: |
           curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
+          sudo apt-get install -y chromium-chromedriver
 
       - name: Run Tests
         shell: bash

ic-agent/Cargo.toml

@@ -16,7 +16,9 @@ include = ["src", "Cargo.toml", "../LICENSE", "README.md"]
 
 [dependencies]
 backoff = "0.4.0"
+cached = { version = "0.46", features = ["ahash"], default-features = false }
 candid = { workspace = true }
+ed25519-dalek = { version = "2" }
 futures-util = "0.3.21"
 hex = { workspace = true }
 http = "0.2.6"
@@ -29,6 +31,7 @@ leb128 = { workspace = true }
 pkcs8 = { version = "0.10.2", features = ["std"] }
 sec1 = { version = "0.7.2", features = ["pem"] }
 rand = "0.8.5"
+rangemap = "1.4"
 ring = { workspace = true, features = ["std"] }
 serde = { workspace = true, features = ["derive"] }
 serde_bytes = { workspace = true }
@@ -102,6 +105,7 @@ wasm-bindgen = [
     "dep:web-sys",
     "time/wasm-bindgen",
     "backoff/wasm-bindgen",
+    "cached/wasm",
 ]
 
 [package.metadata.docs.rs]

ic-agent/src/agent/agent_config.rs

@@ -12,8 +12,10 @@ pub struct AgentConfig {
     pub identity: Arc<dyn Identity>,
     /// See [`with_ingress_expiry`](super::AgentBuilder::with_ingress_expiry).
     pub ingress_expiry: Option<Duration>,
-    /// The [`with_transport`](super::AgentBuilder::with_transport).
+    /// See [`with_transport`](super::AgentBuilder::with_transport).
     pub transport: Option<Arc<dyn Transport>>,
+    /// See [`verify_query_signatures`](super::AgentBuilder::with_verify_query_signatures).
+    pub verify_query_signatures: bool,
 }
 
 impl Default for AgentConfig {
@@ -23,6 +25,7 @@ impl Default for AgentConfig {
             identity: Arc::new(AnonymousIdentity {}),
             ingress_expiry: None,
             transport: None,
+            verify_query_signatures: true,
         }
     }
 }

ic-agent/src/agent/agent_error.rs

@@ -4,6 +4,7 @@ use crate::{agent::status::Status, RequestIdError};
 use ic_certification::Label;
 use ic_transport_types::{InvalidRejectCodeError, RejectResponse};
 use leb128::read;
+use std::time::Duration;
 use std::{
     fmt::{Debug, Display, Formatter},
     str::Utf8Error,
@@ -101,6 +102,14 @@ pub enum AgentError {
     #[error("Certificate is not authorized to respond to queries for this canister. While developing: Did you forget to set effective_canister_id?")]
     CertificateNotAuthorized(),
 
+    /// The certificate was older than allowed by the `ingress_expiry`.
+    #[error("Certificate is stale (over {0:?}). Is the computer's clock synchronized?")]
+    CertificateOutdated(Duration),
+
+    /// The query response did not contain any node signatures.
+    #[error("Query response did not contain any node signatures")]
+    MissingSignature,
+
     /// There was a length mismatch between the expected and actual length of the BLS DER-encoded public key.
     #[error(
         r#"BLS DER-encoded public key must be ${expected} bytes long, but is {actual} bytes long."#