fix(kms): make the AWS KMS signer support dynamic-fee transactions

[renatomaia]

Problem

The AWS KMS factory is still built with types.NewEIP155Signer(chainId). That signer is legacy-only. Direct geth bindings can create dynamic-fee transactions when GasPrice is nil and the chain has a base fee, which is the normal EIP-1559 path. In that case the KMS code hashes and attaches the signature using the wrong signer family.

AI Review Findings

This PR also implements some improvements described in review here.

Divergences from Proposed Fixes

1. C3 is ignored because CreateAWSTransactOptsFactory is actually called on Claimer and PRT with a time-bounded context (CARTESI_MAX_STARTUP_TIME).
2. C4 is implemented as recommended in the review, however this fix only for a particular cause of service failue (KMS authentication failure on startup), and we intend to emulate the multi-process service lifecyle in the single-process mode in PR#785.
3. H7 and Y6 are ignored because we don't want to run AWS Local Stack locally by default.

Commit relation to Findings

The table below lists the commits, and column ID indicates which improvement is introduced.

ID	Commit	Change	Component	Description
	7a3951d	fix	kms	make the AWS KMS signer support dynamic-fee transactions
H1	5b17f6d	test	kms	add unit test for AWS KMS authentication
	7e388a3	test	integration	add make target to run AWS LocalStack
H2	ad56d20	test	integration	fix AWS KMS subtest execution
H3	4b17c3d	test	integration	use new style for Ethereum transactions for better test coverage
H6	4445d6c	test	integration	only run AWS Local Stack for required tests
H8	e5bcf39	test	integration	fix clean up of configurations used in tests
H9	d6579d7	test	integration	isolate AWS KMS funding account
Y5	c302b18	test	integration	allow built-in readness check of AWS LocalStack image
Y9	cd3705e	test	integration	clean up AWS KMS test resources
C1,H4,H12	71fa8fe	fix	kms	remove redundant configuration variables for AWS KMS
H5	a989251	fix	kms	handle invalid AWS KMS authentication
H10	8658356	test	kms	improve test coverage of AWS KMS authentication
Y3,Y7,Y8	67da6ca	refactor	kms	fix small details in implementation and tests
	7db8476	style	kms	avoid lint errors
C2	2eda6ed	feat	claimer,prt	log submitter identity on service startup
H11	05ee583	fix	cli	use a single authentication for all deposit transactions
C4	275baf3	feat	node	delay startup of services until able to authenticate

[mpolitzer]

Old tests needed to fill in the ARN variable with a valid AWS KMS instance to work. That would cost money and expose secrets, so it is disabled by default. But maybe with the localstack setup it could be enabled or refactored, any thoughts on that?

[Copilot]

Pull request overview

This PR updates the AWS KMS-backed transaction signing path to correctly support EIP-1559 (dynamic-fee) transactions by switching to the appropriate signer family, and adds unit + LocalStack-based integration coverage to prevent regressions.

Changes:

• Use types.LatestSignerForChainID for AWS KMS signing (instead of legacy-only NewEIP155Signer).
• Add a unit test ensuring dynamic-fee tx signing + sender recovery works.
• Add a LocalStack KMS integration test and wire LocalStack into the integration compose + shard selection.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
internal/config/auth/auth.go	Switch AWS KMS signing to latest signer; add optional region/endpoint support (currently has a compile issue to fix).
internal/config/generated.go	Add generated config key + getter for CARTESI_AUTH_AWS_KMS_ENDPOINT.
internal/config/generate/Config.toml	Define the new AWS KMS endpoint config entry for generation.
internal/kms/signtx_test.go	Add unit test for signing DynamicFeeTx with AWS KMS factory.
test/integration/localstack_integration_test.go	New LocalStack KMS integration suite verifying legacy + dynamic-fee signing end-to-end (currently has a config-setting bug to fix).
test/compose/compose.integration.yaml	Add LocalStack service and env wiring for integration-test container.
Makefile	Add LocalStack start/stop/restart targets and register an awskms integration shard.

Files not reviewed (1)

• internal/config/generated.go: Generated file

Comments suppressed due to low confidence (1)

internal/config/auth/auth.go:83

• These errors.Is checks reference config.ErrNotDefined, but this file already dot-imports internal/config. After removing the duplicate config import, these references should use ErrNotDefined directly.

		kmsRegion, err := GetAuthAwsKmsRegion()
		if !errors.Is(err, config.ErrNotDefined) {
			if err != nil {
				return nil, err
			}
			awsOpts = append(awsOpts, aws_cfg.WithRegion(kmsRegion.Value))
		}
		kmsEndpoint, err := GetAuthAwsKmsEndpoint()
		if !errors.Is(err, config.ErrNotDefined) {
			if err != nil {
				return nil, err
			}
			awsOpts = append(awsOpts, aws_cfg.WithBaseEndpoint(kmsEndpoint.Value))
		}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.