CLI: Add --sign-only with durable nonce for transaction submit

Cargo.toml

@@ -44,6 +44,7 @@ solana-instruction = { version = "3.4.1", default-features = false }
 solana-keypair = "3.1.2"
 solana-message = { version = "4.4.1", default-features = false }
 solana-native-token = "3.0.0"
+solana-nonce = "3.2.0"
 solana-program-error = "3.0.1"
 solana-program-pack = "3.1.0"
 solana-remote-wallet = "4.2.1"

clients/cli/Cargo.toml

@@ -33,11 +33,13 @@ solana-hash = { workspace = true }
 solana-keypair = { workspace = true }
 solana-message = { workspace = true, features = ["blake3", "wincode"] }
 solana-native-token = { workspace = true }
+solana-nonce = { workspace = true, features = ["wincode"] }
 solana-remote-wallet = { workspace = true, features = ["agave-unstable-api"] }
 solana-rpc-client = { workspace = true, features = ["agave-unstable-api"] }
 solana-rpc-client-types = { workspace = true, features = ["agave-unstable-api"] }
 solana-signature = { workspace = true, features = ["verify"] }
 solana-signer = { workspace = true }
+solana-system-interface = { workspace = true, features = ["wincode"] }
 solana-transaction = { workspace = true, features = ["wincode"] }
 solana-transaction-status = { workspace = true, features = ["agave-unstable-api"] }
 spl-ed25519-signer-client = { workspace = true }
@@ -52,7 +54,6 @@ wincode = { workspace = true }
 libtest-mimic = { workspace = true }
 solana-instruction = { workspace = true }
 solana-program-pack = { workspace = true }
-solana-system-interface = { workspace = true, features = ["wincode"] }
 solana-test-validator = { workspace = true, features = ["dev-context-only-utils"] }
 spl-token-interface = { workspace = true }
 test-case = { workspace = true }

clients/cli/src/cli.rs

@@ -75,7 +75,8 @@ pub(crate) struct ClientArgs {
     pub(crate) commitment: Option<CommitmentConfig>,
 
     /// Fee payer signer source: a keypair file, usb:// URL, prompt:// URL, or the ASK keyword.
-    /// Defaults to the configured keypair.
+    /// `transaction submit --sign-only` also accepts an address, whose signature is collected
+    /// separately. Defaults to the configured keypair.
     #[clap(long, global = true, value_parser = keypair_source_parser())]
     pub(crate) fee_payer: Option<SignerSource>,
 

clients/cli/src/client.rs

@@ -1,17 +1,21 @@
 use {
     crate::cli::ClientArgs,
-    anyhow::{Context, Result, anyhow, bail},
+    anyhow::{Context, Result, anyhow, bail, ensure},
     clap::ArgMatches,
     solana_account::Account,
     solana_account_decoder_client_types::UiAccountEncoding,
     solana_address::Address,
     solana_clap_v3_utils::{
         input_parsers::{parse_url_or_moniker, signer::SignerSource},
-        keypair::signer_from_source,
+        keypair::{SignerFromPathConfig, signer_from_source_with_config},
     },
     solana_cli_config::{CONFIG_FILE, Config as SolanaCliConfig},
     solana_commitment_config::CommitmentConfig,
     solana_hash::Hash,
+    solana_nonce::{
+        state::{Data, State},
+        versions::Versions,
+    },
     solana_remote_wallet::remote_wallet::RemoteWalletManager,
     solana_rpc_client::nonblocking::rpc_client::RpcClient,
     solana_rpc_client_types::{
@@ -73,30 +77,43 @@ impl Client {
     }
 
     pub(crate) fn fee_payer(&self) -> Result<Box<dyn Signer>> {
-        self.load_signer_or_config_default(self.fee_payer.as_ref(), "fee payer")
+        self.load_signer(&self.fee_payer_source()?, "fee payer", false)
+    }
+
+    /// The `--fee-payer` source, or the configured keypair.
+    pub(crate) fn fee_payer_source(&self) -> Result<SignerSource> {
+        self.fee_payer
+            .clone()
+            .map_or_else(|| self.config_keypair_source(), Ok)
     }
 
-    pub(crate) fn load_signer_or_config_default(
+    /// Load a signer. With `allow_null_signer`, an address source loads a [`NullSigner`] whose
+    /// signature is collected separately.
+    ///
+    /// [`NullSigner`]: solana_signer::null_signer::NullSigner
+    pub(crate) fn load_signer(
         &self,
-        source: Option<&SignerSource>,
+        source: &SignerSource,
         name: &str,
+        allow_null_signer: bool,
     ) -> Result<Box<dyn Signer>> {
-        match source {
-            Some(source) => self.load_signer(source, name),
-            None => {
-                let config_keypair_source = SignerSource::parse(&self.config_keypair_path)
-                    .map_err(|error| anyhow!(error.to_string()))
-                    .with_context(|| format!("invalid {name} signer source"))?;
-                self.load_signer(&config_keypair_source, name)
-            }
-        }
+        let mut wallet_manager = self.wallet_manager.borrow_mut();
+        signer_from_source_with_config(
+            &self.matches,
+            source,
+            name,
+            &mut wallet_manager,
+            &SignerFromPathConfig { allow_null_signer },
+        )
+        .map_err(|error| anyhow!(error.to_string()))
+        .with_context(|| format!("failed to load {name}"))
     }
 
-    pub(crate) fn load_signer(&self, source: &SignerSource, name: &str) -> Result<Box<dyn Signer>> {
-        let mut wallet_manager = self.wallet_manager.borrow_mut();
-        signer_from_source(&self.matches, source, name, &mut wallet_manager)
+    /// The keypair from the Solana CLI configuration.
+    pub(crate) fn config_keypair_source(&self) -> Result<SignerSource> {
+        SignerSource::parse(&self.config_keypair_path)
             .map_err(|error| anyhow!(error.to_string()))
-            .with_context(|| format!("failed to load {name}"))
+            .context("invalid configured keypair path")
     }
 
     pub(crate) async fn minimum_balance_for_rent_exemption(&self, data_len: usize) -> Result<u64> {
@@ -124,6 +141,18 @@ impl Client {
         decode_nonce_account(address, account)
     }
 
+    /// Fetch a System Program nonce account, used as a relay transaction's durable nonce.
+    pub(crate) async fn durable_nonce_account(&self, address: &Address) -> Result<Data> {
+        let account = self
+            .rpc
+            .get_account_with_commitment(address, self.rpc.commitment())
+            .await
+            .with_context(|| format!("failed to fetch account {address}"))?
+            .value
+            .with_context(|| format!("durable nonce account {address} was not found"))?;
+        decode_durable_nonce_account(address, &account)
+    }
+
     /// Simulate without verifying signatures, against the latest blockhash. With
     /// `verbose_accounts`, also requests the inner instructions and the post-simulation state of
     /// those accounts.
@@ -190,6 +219,20 @@ fn decode_nonce_account(address: &Address, account: Account) -> Result<NonceAcco
     })
 }
 
+fn decode_durable_nonce_account(address: &Address, account: &Account) -> Result<Data> {
+    ensure!(
+        account.owner == solana_system_interface::program::id(),
+        "account {address} is owned by {}, not the System Program",
+        account.owner
+    );
+    let versions = wincode::deserialize::<Versions>(&account.data)
+        .with_context(|| format!("account {address} is not a durable nonce account"))?;
+    let State::Initialized(data) = versions.state() else {
+        bail!("durable nonce account {address} is not initialized");
+    };
+    Ok(data.clone())
+}
+
 fn load_cli_config(config_path: Option<&Path>) -> Result<SolanaCliConfig> {
     if let Some(config_path) = config_path {
         let config_path = config_path

clients/cli/src/commands/nonce/create.rs

@@ -42,7 +42,7 @@ pub(super) async fn run(
     output: OutputFormat,
 ) -> Result<String> {
     let nonce_keypair = match &command.nonce_keypair {
-        Some(source) => client.load_signer(source, "nonce account")?,
+        Some(source) => client.load_signer(source, "nonce account", false)?,
         None => Box::new(Keypair::new()),
     };
     let fee_payer = client.fee_payer()?;

clients/cli/src/commands/transaction/sign.rs

@@ -136,12 +136,12 @@ pub(super) fn run(command: SignCommand, client: &Client, output: OutputFormat) -
     let next_nonce = next_nonce(&command.nonce_account, &execution_message).to_string();
 
     let signers = if command.signer.is_empty() {
-        vec![client.load_signer_or_config_default(None, "message authority")?]
+        vec![client.load_signer(&client.config_keypair_source()?, "message authority", false)?]
     } else {
         command
             .signer
             .iter()
-            .map(|source| client.load_signer(source, "message authority"))
+            .map(|source| client.load_signer(source, "message authority", false))
             .collect::<Result<Vec<_>>>()?
     };
     let mut unique_signers = Vec::new();