feat: nns recovery canister

.github/CODEOWNERS

@@ -164,6 +164,7 @@ go_deps.bzl               @dfinity/idx
 /rs/monitoring/pprof/                                   @dfinity/consensus @dfinity/ic-message-routing-owners
 /rs/nervous_system/                                     @dfinity/nns-team
 /rs/nns/                                                @dfinity/nns-team
+/rs/nns/handlers/recovery                               @dfinity/dre
 /rs/orchestrator/                                       @dfinity/consensus
 /rs/orchestrator/src/hostos_upgrade.rs                  @dfinity/consensus @dfinity/node
 /rs/p2p/                                                @dfinity/consensus

Cargo.Bazel.Fuzzing.json.lock

@@ -1,5 +1,5 @@
 {
-  "checksum": "4ae7b3c97aa8a5afd939403aaa5919e419cc497d77a0fef55b643a99ef0c998b",
+  "checksum": "16d0eb2166458263a56ae3cc3dab0b8ac6dfb6c1d217c06d46674723608d9c0c",
   "crates": {
     "abnf 0.12.0": {
       "name": "abnf",
@@ -19967,6 +19967,10 @@
               "id": "ic-http-gateway 0.1.0",
               "target": "ic_http_gateway"
             },
+            {
+              "id": "ic-identity-hsm 0.39.2",
+              "target": "ic_identity_hsm"
+            },
             {
               "id": "ic-metrics-encoder 1.1.1",
               "target": "ic_metrics_encoder"
@@ -91429,6 +91433,7 @@
     "ic-certified-map 0.3.4",
     "ic-http-certification 3.0.2",
     "ic-http-gateway 0.1.0",
+    "ic-identity-hsm 0.39.2",
     "ic-metrics-encoder 1.1.1",
     "ic-response-verification 3.0.2",
     "ic-sha3 1.0.0",

Cargo.Bazel.Fuzzing.toml.lock

@@ -3299,6 +3299,7 @@ dependencies = [
  "ic-certified-map",
  "ic-http-certification",
  "ic-http-gateway",
+ "ic-identity-hsm",
  "ic-metrics-encoder",
  "ic-response-verification",
  "ic-sha3",

Cargo.Bazel.json.lock

@@ -1,5 +1,5 @@
 {
-  "checksum": "3f10fe866380ffcf94872915ab98dc48eb140f9fd8fb8be016d15092561ee5f4",
+  "checksum": "71b5a5e66eaef8dd9b3113fc3de526af7b3199a43d1bc5ed8c2671250a6797f4",
   "crates": {
     "abnf 0.12.0": {
       "name": "abnf",
@@ -19795,6 +19795,10 @@
               "id": "ic-http-gateway 0.1.0",
               "target": "ic_http_gateway"
             },
+            {
+              "id": "ic-identity-hsm 0.39.3",
+              "target": "ic_identity_hsm"
+            },
             {
               "id": "ic-metrics-encoder 1.1.1",
               "target": "ic_metrics_encoder"
@@ -91342,6 +91346,7 @@
     "ic-certified-map 0.3.4",
     "ic-http-certification 3.0.2",
     "ic-http-gateway 0.1.0",
+    "ic-identity-hsm 0.39.3",
     "ic-metrics-encoder 1.1.1",
     "ic-response-verification 3.0.2",
     "ic-sha3 1.0.0",

Cargo.Bazel.toml.lock

@@ -3288,6 +3288,7 @@ dependencies = [
  "ic-certified-map",
  "ic-http-certification",
  "ic-http-gateway",
+ "ic-identity-hsm",
  "ic-metrics-encoder",
  "ic-response-verification",
  "ic-sha3",

Cargo.toml

@@ -213,6 +213,7 @@ members = [
     "rs/nns/governance/protobuf_generator",
     "rs/nns/handlers/lifeline/impl",
     "rs/nns/handlers/lifeline/interface",
+    "rs/nns/handlers/recovery/impl",
     "rs/nns/handlers/root/impl",
     "rs/nns/handlers/root/impl/protobuf_generator",
     "rs/nns/handlers/root/interface",
@@ -438,6 +439,8 @@ members = [
     "rs/xnet/hyper",
     "rs/xnet/payload_builder",
     "rs/xnet/uri",
+    "rs/nns/handlers/recovery/interface",
+    "rs/nns/handlers/recovery/client",
 ]
 
 resolver = "2"
@@ -561,6 +564,7 @@ hyper-rustls = { version = "0.27.3", default-features = false, features = [
 hyper-socks2 = { version = "0.9.1", default-features = false }
 hyper-util = { version = "0.1.10", features = ["full"] }
 ic-agent = { version = "0.39.2", features = ["pem", "ring"] }
+ic-identity-hsm = "0.39.2"
 ic-bn-lib = { git = "https://github.com/dfinity/ic-bn-lib", rev = "d74a6527fbaf8a2c1a7076983cc84f5c5a727923" }
 ic-btc-interface = "0.2.2"
 ic-canister-sig-creation = { git = "https://github.com/dfinity/ic-canister-sig-creation", rev = "7f9e931954637526295269155881207f6c832d6d" }

bazel/external_crates.bzl

@@ -573,6 +573,9 @@ def external_crates_repository(name, cargo_lockfile, lockfile, sanitizers_enable
                 version = "^0.39.2",
                 features = ["pem", "ring"],
             ),
+            "ic-identity-hsm": crate.spec(
+                version = "^0.39.2",
+            ),
             "ic-bn-lib": crate.spec(
                 git = "https://github.com/dfinity/ic-bn-lib",
                 rev = "d74a6527fbaf8a2c1a7076983cc84f5c5a727923",

rs/nns/handlers/recovery/client/BUILD.bazel

@@ -0,0 +1,55 @@
+load("@rules_rust//rust:defs.bzl", "rust_library", "rust_test")
+
+package(default_visibility = ["//visibility:public"])
+
+DEPENDENCIES = [
+    # Keep sorted.
+    "//packages/ic-ed25519",
+    "//packages/ic-secp256k1",
+    "//rs/nns/handlers/recovery/interface",
+    "@crate_index//:candid",
+    "@crate_index//:ed25519-dalek",
+    "@crate_index//:ic-agent",
+    "@crate_index//:ic-identity-hsm",
+    "@crate_index//:k256",
+    "@crate_index//:serde",
+]
+
+MACRO_DEPENDENCIES = [
+    "@crate_index//:async-trait",
+]
+
+DEV_DEPENDENCIES = [
+    "//packages/pocket-ic",
+    "@crate_index//:p256",
+    "@crate_index//:tokio",
+]
+
+ALIASES = {}
+
+rust_library(
+    name = "client",
+    srcs = glob(["src/**/*.rs"]),
+    aliases = ALIASES,
+    crate_name = "ic_nns_handler_recovery_client",
+    proc_macro_deps = MACRO_DEPENDENCIES,
+    version = "0.1.0",
+    deps = DEPENDENCIES,
+)
+
+rust_test(
+    name = "client-tests",
+    srcs = glob(["src/**/*.rs"]),
+    aliases = ALIASES,
+    data = [
+        "//rs/nns/handlers/recovery/impl:recovery-canister",
+        "//rs/pocket_ic_server:pocket-ic-server",
+    ],
+    env = {
+        "RECOVERY_WASM_PATH": "$(rootpath //rs/nns/handlers/recovery/impl:recovery-canister)",
+        "POCKET_IC_BIN": "$(rootpath //rs/pocket_ic_server:pocket-ic-server)",
+    },
+    proc_macro_deps = MACRO_DEPENDENCIES,
+    version = "0.1.0",
+    deps = DEV_DEPENDENCIES + DEPENDENCIES + [":client"],
+)

rs/nns/handlers/recovery/client/Cargo.toml

@@ -0,0 +1,25 @@
+[package]
+name = "ic-nns-handler-recovery-client"
+version.workspace = true
+authors.workspace = true
+description.workspace = true
+documentation.workspace = true
+edition.workspace = true
+
+
+[dependencies]
+candid = { workspace = true }
+serde = { workspace = true }
+ic-agent.workspace = true
+async-trait.workspace = true
+ic-nns-handler-recovery-interface.path = "../interface"
+ic-identity-hsm.workspace = true
+k256.workspace = true
+ed25519-dalek.workspace = true
+ic-secp256k1.path = "../../../../../packages/ic-secp256k1"
+ic-ed25519.path = "../../../../../packages/ic-ed25519"
+
+[dev-dependencies]
+tokio.workspace = true
+pocket-ic.path = "../../../../../packages/pocket-ic"
+p256.workspace = true