feat(go): remote signer backends to thirteen-backend parity (stacked on #164)

[amilz]

Summary

Builds on #164 (Go foundation: core + memory) to bring the Go implementation to full thirteen-backend parity with Rust and TypeScript:

Memory · Vault · Privy · Turnkey · AWS KMS · Fireblocks · GCP KMS · Dfns · Crossmint · CDP · Para · Openfort · Utila

Stacked on #164. This branch contains #164's commit (rebased onto current main) plus the work below; the diff shown here includes both. If #164 merges first, this PR reduces to the backend work.

What's included

Quality pass on the #164 foundation

• 64-byte keypair bytes now validate the embedded public half against the seed-derived key (parity with Rust Keypair::try_from)
• memory.Config.PrivateKey retyped to []byte — the 32-byte seed form is not a valid ed25519.PrivateKey value
• core.NewHTTPClient honors HTTP(S)_PROXY env config and refuses all redirects (auth headers must never replay against a redirect target)
• Keypair-file error taxonomy: read failures are IO_ERROR, malformed contents INVALID_PRIVATE_KEY

Thirteen backends (go/signers/<pkg>)

Each is a port of the corresponding Rust module (authoritative spec), with the Rust wiremock unit tests ported to httptest/stubbed-client tests — race-clean across all 14 packages:

Backend	Notable behavior ported
vault	transit sign endpoint, vault:vN: prefix stripping, key-metadata health check
turnkey	P-256 API-key stamping (X-Stamp), r/s left-padding quirk + dedicated test
privy	basic auth + privy-app-id, wallet lookup at construction, chain-type guard, authorization-context signing
para	sk_/UUID/HTTPS config validation, hex sign-raw with 0x handling, 5s-bounded availability
awskms	RAW + ED25519_SHA_512, DescribeKey gate (ECC_NIST_EDWARDS25519, enabled, SIGN_VERIFY)
gcpkms	PureEdDSA — raw data, never Digest, EC_SIGN_ED25519 health check
fireblocks	RS256 request JWTs (uri/nonce/bodyHash), RAW polling; UseProgramCall rejected at construction before any network call (PROGRAM_CALL broadcasts on-chain — duplicate-spend risk, parity with Rust #153)
dfns	User Action Signing challenge flow, Ed25519/P-256/RSA credential keys, serde-exact clientData bytes
cdp	EdDSA bearer + ES256 wallet-auth JWTs with key-sorted reqHash, UTF-8-only SignMessage, tamper rejection
crossmint	HKDF delegated-signer derivation, encodeURIComponent-exact locators, create/poll/approve flow, SignMessage intentionally unsupported
openfort	ES256 x-wallet-auth JWTs, dual-format wallet secret (PEM / bare base64 DER)
utila	poll-to-SIGNED flow with tamper detection against the submitted message

Shared conventions across all backends

• Config struct + New constructor returning a ready-to-use signer; backends with a Rust init() take a context.Context and initialize inline (analog of Rust Signer::from_* / TS async factories)
• HTTPS enforced by default via core.NewHTTPClient; optional HTTPClient (or SDK-level client) override is the documented escape hatch — the Go analog of Rust with_client
• Remote signatures verified locally with core.VerifyEd25519 before use, wherever Rust does
• Transport-raised *core.SignerErrors pass through unwrapped in every backend; untrusted remote text passes through core.SanitizeRemoteResponse
• Redacting String()/GoString() on every remote signer; no logging, no globals; signers immutable and concurrency-safe after construction

Integration & tooling

• Vault integration test (-tags=integration) mirroring test_vault_integration.rs, wired to the existing just go-test-integration recipe
• go-ci.yml: build / vet / race-enabled tests / golangci-lint, gated on go/ changes; just go-test runs -race to match
• Cross-language parity vectors pinned on both the Go and Rust sides
• golangci-lint clean at zero findings (including --max-same-issues=0)
• Dependency isolation is structural: every backend is its own Go module (15 modules: core, testutils, 13 signers) — a memory-only consumer's module graph carries no AWS/GCP SDKs, and the go 1.25.8 toolchain floor forced by google.golang.org/api is confined to the gcpkms module (everything else is go 1.25)

Per-backend Go modules

In-repo replace directives wire the modules together (the cargo path-dep pattern); requires get real versions at first tag, releases tag go/core + go/testutils before the signer modules. justfile go recipes and go-ci.yml iterate every go.mod. Until the first go/... tags exist, @latest cannot resolve the in-repo go/core requirement (documented in go/README.md).

Umbrella package: intentionally omitted

The TS umbrella and Rust enum stay lean via tree-shaking / cargo features. Go has no dead-code elimination across a runtime dispatch switch, so an umbrella would force the AWS + GCP SDKs into every consumer's build. Importing the backend package is the Go-native selector; rationale documented in go/README.md.

Known follow-up

• Crossmint: onChain.transaction signature is verified against remote bytes, then placed into the original transaction (all languages) #181 — crossmint's serialized-transaction signature verification semantics (deliberate Rust-parity behavior; to be revisited in all three languages together)

Testing

• just go-build, just go-fmt (gofmt + vet per module) — clean
• just go-test (go test -race -count=1 per module) — 14/14 test packages ok across all 15 modules
• golangci-lint — 0 issues per module (enforced in CI)
• go build -tags=integration ./... — compiles; vault integration runs under just go-test-integration

Deferred

• Publish workflow (go/vX.Y.Z), fork-live-tests for Go
• docs/ADDING_SIGNERS.md Go section + root README three-language presentation
• Audit-scope decision for Go

🤖 Generated with Claude Code

https://claude.ai/code/session_012X3zut1xuLEBvfpGGJfoTT

[greptile-apps]

Greptile Summary

This PR brings the Go implementation to full thirteen-backend parity with the Rust and TypeScript implementations, adding vault, turnkey, privy, awskms, fireblocks, gcpkms, dfns, crossmint, cdp, para, openfort, and utila signers on top of the core + memory foundation from #164. Each backend is its own Go module (15 modules total), isolating heavy dependencies like the AWS and GCP SDKs from minimal consumers.

• Turnkey P-256 key derivation (stamp.go): uses ecdh.P256().NewPrivateKey for scalar validation, then correctly extracts X (bytes 1–32) and Y (bytes 33–64) from the 65-byte uncompressed point to construct ecdsa.PrivateKey — verified end-to-end in TestCreateStamp.
• Crossmint unsigned-wire-format pin (TestSignTransactionSendsPlaceholderSignatures): asserts the posted transaction is exactly [count byte][zero-padded sigs][message bytes], matching Rust Transaction::new_unsigned and the TS kit wire encoding.
• Openfort unconditional HTTPS check (signer.go): the parsed.Scheme != "https" guard fires before the HTTP client is set, even when HTTPClient is supplied — tests use httptest.NewTLSServer to satisfy it; TestNewRejectsNonHTTPSBaseURL documents this is intentional.

Confidence Score: 5/5

All thirteen backends are ready to merge — the three areas added since the last review (turnkey crypto/ecdh derivation, crossmint unsigned-wire-format test pin, openfort unconditional HTTPS check) each check out, and the issues flagged in previous threads are fixed.

The turnkey P-256 key derivation correctly uses ecdh.P256().NewPrivateKey for scalar validation then extracts X and Y from the right offsets of the 65-byte uncompressed point, with an end-to-end test verifying ecdsa.VerifyASN1 round-trips. The crossmint unsigned-wire-format test pins [count][zero-sigs][message] across all three languages. The openfort HTTPS check is unconditional and tests correctly use httptest.NewTLSServer. Previously flagged issues (stagger cancellation wrapping, dfns combineSignature length validation, para/openfort SignerError passthrough) are all addressed. No new correctness or security issues found across the 13 backends and shared core.

No files require special attention.

Important Files Changed

Filename	Overview
go/signers/turnkey/stamp.go	parseP256PrivateKey correctly validates the P-256 scalar via ecdh.P256().NewPrivateKey, then splits the 65-byte uncompressed public key at the right offsets (X=point[1:33], Y=point[33:65]) to build ecdsa.PrivateKey — end-to-end verified by TestCreateStamp.
go/signers/crossmint/signer_test.go	TestSignTransactionSendsPlaceholderSignatures correctly pins the unsigned-transaction wire format ([count][zero sigs][message]) sent to Crossmint, matching Rust and TS cross-language semantics.
go/signers/openfort/signer.go	Unconditional HTTPS base-URL check fires before any network call or client assignment; tests use httptest.NewTLSServer (HTTPS) and TestNewRejectsNonHTTPSBaseURL explicitly documents the custom-client case is intentionally rejected.
go/core/httpclient.go	httpsOnlyTransport and CheckRedirect hook correctly block non-HTTPS and redirect requests, returning *core.SignerError that backends correctly unwrap via errors.As through the url.Error wrapper.
go/signers/dfns/signer.go	combineSignature tightened to require exactly 32-byte r and s (addressed prior review comment); SignTransaction correctly verifies the returned sig against message bytes, not the full serialized transaction.
go/signers/fireblocks/signer.go	UseProgramCall correctly rejected before any network call; pollForSignature properly wraps context cancellation as CodeHTTPError with the cause chained; errors.As guard in doRequest preserves transport-level SignerError codes.
go/signers/crossmint/signer.go	Faithful Rust-parity port; extractSignatureFromSerializedTransaction verifies against remote bytes (deliberate, follow-up filed as #181); HTTPS enforced unconditionally; SignMessage correctly unsupported.
go/core/batch.go	stagger now wraps context cancellation as CodeHTTPError (addressed prior review comment); batch ordering and cancellation are covered by batch_test.go.
go/signers/awskms/signer.go	DescribeKey gate correctly validates ECC_NIST_EDWARDS25519/SIGN_VERIFY/enabled; core.NewHTTPClient transport injected into the AWS SDK HTTP client for HTTPS enforcement.
go/signers/dfns/auth.go	signChallenge correctly dispatches on PKCS#8 key type (Ed25519, ECDSA P-256, RSA) and SEC1 P-256, with proper DER encoding for P-256/RSA and raw bytes for Ed25519.
.github/workflows/go-ci.yml	CI correctly gates on go/ path changes, runs -race tests and golangci-lint across all 15 modules, mirrors the Rust/TS CI structure.

_{Reviews (11): Last reviewed commit: "test(go): port the live integration test..." | Re-trigger Greptile}

[amilz]

@greptile-apps review — bypassing the file limit; the latest push only touched justfile (go-test now runs -race to match CI), CLAUDE.md (three-language / thirteen-backend overview), and a //nolint in the utila redaction test.

---

Generated by Claude Code

[amilz]

@dev-jodee two notes on the latest rounds:

• Openfort's HTTPS base-URL check is now enforced unconditionally (b84fae5), aligning it with crossmint/para/utila per Greptile's last observation; its tests moved to httptest.NewTLSServer to match the pattern you established.
• Greptile's remaining suggestion is in .github/workflows/go-ci.yml: the golangci-lint version is pinned (v2.12.2) but the install script is fetched from the mutable /HEAD/install.sh URL. This session's token can't modify workflow files, so leaving it to you — pinning the script to the release tag (.../v2.12.2/install.sh) or switching to the official golangci/golangci-lint-action closes it.

---

Generated by Claude Code

[amilz]

@greptile-apps review — bypassing the file limit again; since the last full review the branch gained the turnkey crypto/ecdh public-key derivation, the crossmint unsigned-wire-format test pin, and the openfort unconditional HTTPS base-URL check (b84fae5).

---

Generated by Claude Code

[dev-jodee]

r