{"id":23263810,"url":"https://github.com/orlowskilp/evm-signer-kms","last_synced_at":"2025-07-17T03:07:37.029Z","repository":{"id":257821324,"uuid":"869336077","full_name":"orlowskilp/evm-signer-kms","owner":"orlowskilp","description":"Rust library for signing EVM transaction with secp256k1 keys hosted in AWS KMS","archived":false,"fork":false,"pushed_at":"2025-07-11T11:46:59.000Z","size":227,"stargazers_count":23,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-07-11T15:25:42.799Z","etag":null,"topics":["aws-kms","blockchain","cryptocurrency","cryptography","evm","evm-blockchain","kms","signature"],"latest_commit_sha":null,"homepage":"","language":"Rust","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/orlowskilp.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-10-08T06:05:41.000Z","updated_at":"2025-05-11T08:46:48.000Z","dependencies_parsed_at":null,"dependency_job_id":"386248e8-d464-4fd3-8a03-0dbf02b9107a","html_url":"https://github.com/orlowskilp/evm-signer-kms","commit_stats":null,"previous_names":["orlowskilp/evm-signer-kms"],"tags_count":9,"template":false,"template_full_name":null,"purl":"pkg:github/orlowskilp/evm-signer-kms","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/orlowskilp%2Fevm-signer-kms","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/orlowskilp%2Fevm-signer-kms/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/orlowskilp%2Fevm-signer-kms/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/orlowskilp%2Fevm-signer-kms/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/orlowskilp","download_url":"https://codeload.github.com/orlowskilp/evm-signer-kms/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/orlowskilp%2Fevm-signer-kms/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":265562206,"owners_count":23788482,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws-kms","blockchain","cryptocurrency","cryptography","evm","evm-blockchain","kms","signature"],"created_at":"2024-12-19T14:27:41.619Z","updated_at":"2025-07-17T03:07:37.022Z","avatar_url":"https://github.com/orlowskilp.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Library for signing EVM transactions with AWS KMS\n\n![Crates.io Version](https://img.shields.io/crates/v/evm-signer-kms)\n[![evm-signer-kms](https://github.com/orlowskilp/evm-signer-kms/actions/workflows/build-and-test.yml/badge.svg)](https://github.com/orlowskilp/evm-signer-kms/actions/workflows/build-and-test.yml)\n[![codecov](https://codecov.io/github/orlowskilp/evm-signer-kms/branch/master/graph/badge.svg?token=DGY9EZFV5L)](https://codecov.io/github/orlowskilp/evm-signer-kms)\n[![MIT License](https://img.shields.io/badge/license-MIT-green)](/LICENSE)\n\nEVM transaction signing library using key pairs generated and stored in\n[AWS KMS](https://aws.amazon.com/kms).\n\n**Built for**:\n\n* Security - AWS KMS managed keys which never leave HSM devices.\n* Speed and reliability - Implemented in Rust.\n\n## Features\n\n* Legacy (type 0) transactions\n* [EIP-2930](https://eips.ethereum.org/EIPS/eip-2930) (type 1) transactions\n* [EIP-1559](https://eips.ethereum.org/EIPS/eip-1559) (type 2) transactions\n* Easily expandable to future [EIP-2718](https://eips.ethereum.org/EIPS/eip-2718) typed transactions\n* [EIP-55](https://eips.ethereum.org/EIPS/eip-55) address checksum validation if address has uppercase chars\n\n## Tool chain compatibility\n\nWorks with [MUSL](https://musl.libc.org) and [GNU](https://www.gnu.org/software/libc) tool chains.\n\n### Building\n\nI suggest using the provided [`Makefile`](./Makefile) to get things running fast. The default build\ntarget is `x86_64-unknown-linux-gnu`, so this command will build the library with the GNU tool\nchain:\n\n```bash\nmake build\n```\n\nIf you wish to build it with a different tool chain, it suffices to specify it with the\n`RUSTUP_TOOLCHAIN` environment variable, e.g.:\n\n```bash\nRUSTUP_TOOLCHAIN=1.81 make build\n ```\n\nSimilarly, if you want to build for a different target, you need to set the `CARGO_BUILD_TARGET`\nvariable.\n\n```bash\nCARGO_BUILD_TARGET=x86_64-unknown-linux-musl make build\n```\n\n## Setting up\n\nThe library communicates with AWS KMS API endpoints and thus requires authorization. Additionally it\nrequires AWS region and KMS key ID to be specified in the environment. This is because it was\ndesigned with containers and container orchestration in mind.\n\nThere are good chances that you will want to inject some secrets into the client application in\nthe container orchestration solution (e.g. using\n[AWS Secrets Manager](https://aws.amazon.com/secrets-manager/) or\n[HashiCorp Vault](https://www.hashicorp.com/products/vault)).\n\n### Key access policy\n\nAt the very least the key policy must allow these actions for the IAM role which you are going to\nuse as the principal (see [documentation](https://docs.rs/evm-signer-kms) for more details):\n\n```test\nkms:DescribeKey\nkms:GetPublicKey\nkms:Sign\nkms:Verify\n```\n\n### Authorization\n\nI suggest using STS to assume a role which is granted permissions to use the\n[secp256k1](https://docs.aws.amazon.com/kms/latest/developerguide/symm-asymm-choose-key-spec.html)\nkey pair in KMS. Once the IAM role is set up, you can assume it by e.g. setting the following\nenvironment variables:\n\n```bash\nexport AWS_ACCESS_KEY_ID=\"[REDACTED]\"\nexport AWS_SECRET_ACCESS_KEY=\"[REDACTED]\"\nexport AWS_SESSION_TOKEN=\"[REDACTED]\"\n```\n\n### Region specification\n\nThe region needs to be inferred from the environment, e.g.:\n\n```bash\nexport AWS_REGION=\"[REDACTED]\"\n```\n\n### KMS key ID\n\nThe KMS key which is going to be used for message digests signing can be identified using a key ID\nin the UUID format:\n\n```bash\nexport KMS_KEY_ID=\"[REDACTED]\"\n```\n\n**Note:** The library doesn't understand the `KMS_KEY_ID` variable itself, it is just a suggested\nway to pass the key ID to the library logic (see examples in the\n[documentation](https://docs.rs/evm-signer-kms)) for more details.\n\n### Testing configuration\n\nThe easiest way to check whether everything works the way it should is by running tests.\n\nBefore running the tests you need to download the public key PEM file and copy it to\n`./tests/data/pub-key.pem` and then decode it to `./tests/data/pub-key.der`.\n\n[`Makefile`](./Makefile) provides a directive for that:\n\n```bash\nmake fetch-public-key\n```\n\nOnce the PEM and DER files are there, run the tests with:\n\n```bash\nmake test\n```\n\n**Note**: If you downloaded the PEM file using the management console it is going to have the\nfollowing format:\n\n```text\n-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----\n```\n\nYou can use the supplied helper [`pem2der.sh`](./tests/data/scripts/pem2der.sh) shell script:\n\n```bash\ncd tests/data\n./scripts/pem2der.sh ./pub-key.pem \u003e pub-key.der\n```\n\nIf the tests pass, you're all set!\n\n## What's needed\n\n* More more and better tests\n* Derivation paths support\n* ARM `aarch64` support\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Forlowskilp%2Fevm-signer-kms","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Forlowskilp%2Fevm-signer-kms","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Forlowskilp%2Fevm-signer-kms/lists"}