near/near-cli-rs

Extend Transaction Signing options with `sign-offline`

frol opened this issue · 0 comments

frol commented

Currently, all the available singing options require a user to have their access key on the same machine as they prepare the transaction. I want to be able to use an air-gapped machine to sign my transactions.

This is the flow:

  1. [online or offline] Prepare a transaction - select sign-offline to get an unsigned transaction [this issue] with empty-values instead of public_key, nonce, and block_hash
  2. [offline] Sign the prepared transaction by combining together:
    a. [offline] The prepared unsigned transaction (we can use base64 encoding to simplify copy-pasting)
    b. [offline] The public_key of the access key that corresponds to the signer_id of the transaction
    c. [online] The nonce for the access key and a recent block_hash should be obtained from a computer that has access to NEAR network (usually connected to the Internet)
  3. [online] Submit the signed transaction from a computer that has access to NEAR network (see #200)

As of today, near-cli-rs does this all in one go, and only allows users to opt-out of sending a signed transaction immediately (effectively, you can only do (1) and (2) together), and while near-cli-rs can be used in air-gapped environment to prepare and sign a transaction, it would be great to have more granular control.