The high-level nostr_signer_t API only covered 6 of n_signer's 16 verbs
(the Nostr protocol verbs + derive_hmac). The other 10 (get_info,
get_public_key algorithm-based, sign, verify, encapsulate, decapsulate,
derive_shared_secret, otp encrypt/decrypt, mine_event) had no library
wrapper — clients had to drop down to the low-level nsigner_client_call
and hand-build cJSON params.
This adds typed wrappers for all 10:
- nostr_signer_get_info
- nostr_signer_get_public_key_alg
- nostr_signer_sign / nostr_signer_verify
- nostr_signer_encapsulate / nostr_signer_decapsulate
- nostr_signer_derive_shared_secret
- nostr_signer_otp_encrypt / nostr_signer_otp_decrypt
- nostr_signer_mine_event
The local backend returns NOSTR_ERROR_NOT_SUPPORTED for all 10 (they
require signer-side PQ crypto / OTP pads / key derivation the local
backend doesn't hold). The remote nsigner backend builds the correct
wire params and parses the result.
Also adds NOSTR_ERROR_NOT_SUPPORTED (-40) to nostr_common.h.
Tests: 2 new tests in nsigner_client_test.c — local-backend
NOT_SUPPORTED check for all 10 verbs, and a mock-transport test
verifying nostr_signer_sign emits the correct wire request. 8/8 pass.
n_signer removed the bare nostr_index selector (error 2006) and index-on-
nostr-verbs (error 2007). The only accepted selector for nostr_* verbs is
now {"role","role_path"} sent together (2008/2009 if either is missing).
The remote signer backend was emitting {"nostr_index":N} or {"role"}
alone -- both now invalid. This commit:
- Replaces remote struct fields nostr_index/has_nostr_index with
role_path[128]/has_role_path plus derive_index/has_derive_index
- Rewrites signer_remote_params_with_selector to emit both role and
role_path in the options object
- Updates all three call sites (get_public_key, sign_event, encrypt_decrypt)
- Rewrites signer_remote_derive_hmac to emit {algorithm,index} using
derive_index
- Adds nostr_signer_nsigner_set_role_path setter
- Repurposes nostr_signer_nsigner_set_nostr_index as a compatibility shim
that expands N into role=main + role_path=m/44'/1237'/N'/0/0
- Updates nsigner_client_test to send and assert the role+role_path selector
- Updates NSIGNER_INTEGRATION.md (new section 2.1.1) and plan docs
Builds clean (38/39 tests; nip34_test failure is pre-existing/unrelated).
nsigner_client_test 6/6 pass, signer_modules_test 26/26 pass.
Rescued from uncommitted work in sovereign_browser/nostr_core_lib:
- nostr_signer_derive_hmac(): deterministic MAC over caller data using the
signer's secp256k1 private key. Local backend computes HMAC-SHA256 directly;
remote nsigner backend calls the 'derive' verb (algorithm:'secp256k1').
- nsigner_transport_list_serial(): enumerate /dev/ttyUSB* (FTDI/CH340/CP210x/
PL2303 USB-serial adapters) in addition to /dev/ttyACM* CDC-ACM devices.
- tests/nsigner_client_test.c: local derive_hmac reference-match test.
- Added NIP-42 authentication implementation (nip042.c, nip042.h)
- Added NIP-42 test suite (nip42_test.c, nip42_test)
- Updated common core files for NIP-42 support
- Updated build script
- Rebuilt test binaries
BREAKING CHANGE: Library now requires system-installed dependencies
Major Changes:
- Convert secp256k1 from bundled static lib to system dependency
- Convert OpenSSL from bundled static lib to system dependency
- Convert curl from bundled static lib to system dependency
- Update build.sh with pkg-config detection and fallback logic
- Remove all static library extraction/building logic
- Update README.md with new dependency requirements and installation
Build System:
- Add detect_system_secp256k1() with pkg-config support
- Add detect_system_openssl() with pkg-config support
- Add detect_system_curl() with pkg-config support
- Remove secp256k1 building/extraction from ar archive
- Update CFLAGS and LIBS to use system library variables
- Clear error messages for missing dependencies with install commands
Documentation:
- Add system dependency installation for Ubuntu/Debian/CentOS/macOS
- Update all compile/link examples to include -lssl -lcrypto -lcurl -lsecp256k1
- Remove references to 'self-contained' and 'no external dependencies'
- Update integration examples throughout README
Benefits:
- Smaller library size (only internal code bundled)
- Automatic security updates via system package manager
- Standard Linux library distribution pattern
- Reduced build complexity
- Better system integration with pkg-config
Required Installation:
Ubuntu/Debian: sudo apt install libssl-dev libcurl4-openssl-dev libsecp256k1-dev
CentOS/RHEL: sudo yum install openssl-devel libcurl-devel libsecp256k1-devel
macOS: brew install openssl curl secp256k1
- Moved old tests from tests/old/ to main tests/ directory
- Renamed nostr_test_bip32.c to bip32_test.c for consistency
- Renamed nostr_crypto_test.c to crypto_test.c for consistency
- Renamed wss_test.c and moved from old directory
- Fixed unused variable warning in bip32_test.c
- Updated build system and workspace rules
- Cleaned up old compiled test executables
- Updated nostr_common.h and core_relays.c
- Removed obsolete nostr_core.h.old backup file
This consolidates all active tests into the main directory and removes
outdated test files while maintaining a clean, organized structure.
- Complete C library template with OpenSSL-based crypto
- Comprehensive build system (Makefile, build.sh)
- Example code and test suite
- Documentation and usage guides
- Cross-platform compatibility (x64/ARM64)
- Production-ready structure for C library projects
Laan Tungir
laantungir
Your Name