ethers-gcp-kms-signer icon indicating copy to clipboard operation
ethers-gcp-kms-signer copied to clipboard

KeyManagementServiceClient is leaked on each call to sign or getPublicKey

Open nedgar opened this issue 2 years ago • 1 comments

In src/util/gcp-kms-utils.ts it instantiates a new KeyManagementServiceClient each time sign or getPublicKey is called. See: https://github.com/openlawteam/ethers-gcp-kms-signer/blob/45a5186c9b3f27bd2bcf5c53bef138fe3fb43c24/src/util/gcp-kms-utils.ts#L25

https://github.com/openlawteam/ethers-gcp-kms-signer/blob/45a5186c9b3f27bd2bcf5c53bef138fe3fb43c24/src/util/gcp-kms-utils.ts#L43

The client maintains a gRPC channel, plus one in its referenced IAM client. close() should be called on the client when it's no longer needed.

The logical lifetime of the client is that of the GcpKmsSigner. I suggest changing it to instantiate the KeyManagementServiceClient, and pass that to the util methods.

nedgar avatar Aug 08 '22 18:08 nedgar

Alternatively, since GcpKmsSigner doesn't take the Google credentials, the KeyManagementServiceClient could be made a singleton field in the utils for now. At least that would reduce leakage to just that instance and its channels.

nedgar avatar Aug 08 '22 18:08 nedgar