fix(kms): make the AWS KMS signer support dynamic-fee transactions

[renatomaia]

Problem

The AWS KMS factory is still built with types.NewEIP155Signer(chainId). That signer is legacy-only. Direct geth bindings can create dynamic-fee transactions when GasPrice is nil and the chain has a base fee, which is the normal EIP-1559 path. In that case the KMS code hashes and attaches the signature using the wrong signer family.

Tests

1. Add an unit test first: fake KMS signs a types.DynamicFeeTx, the transaction is signed with types.LatestSignerForChainID, and sender recovery succeeds.
2. Add an integration test using LocalStack and skip unless LOCALSTACK_KMS_ENDPOINT is set.

[mpolitzer]

Old tests needed to fill in the ARN variable with a valid AWS KMS instance to work. That would cost money and expose secrets, so it is disabled by default. But maybe with the localstack setup it could be enabled or refactored, any thoughts on that?

[Copilot]

Pull request overview

This PR updates the AWS KMS-backed transaction signing path to correctly support EIP-1559 (dynamic-fee) transactions by switching to the appropriate signer family, and adds unit + LocalStack-based integration coverage to prevent regressions.

Changes:

• Use types.LatestSignerForChainID for AWS KMS signing (instead of legacy-only NewEIP155Signer).
• Add a unit test ensuring dynamic-fee tx signing + sender recovery works.
• Add a LocalStack KMS integration test and wire LocalStack into the integration compose + shard selection.

Reviewed changes

Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
internal/config/auth/auth.go	Switch AWS KMS signing to latest signer; add optional region/endpoint support (currently has a compile issue to fix).
internal/config/generated.go	Add generated config key + getter for CARTESI_AUTH_AWS_KMS_ENDPOINT.
internal/config/generate/Config.toml	Define the new AWS KMS endpoint config entry for generation.
internal/kms/signtx_test.go	Add unit test for signing DynamicFeeTx with AWS KMS factory.
test/integration/localstack_integration_test.go	New LocalStack KMS integration suite verifying legacy + dynamic-fee signing end-to-end (currently has a config-setting bug to fix).
test/compose/compose.integration.yaml	Add LocalStack service and env wiring for integration-test container.
Makefile	Add LocalStack start/stop/restart targets and register an awskms integration shard.

Files not reviewed (1)

• internal/config/generated.go: Generated file

Comments suppressed due to low confidence (1)

internal/config/auth/auth.go:83

• These errors.Is checks reference config.ErrNotDefined, but this file already dot-imports internal/config. After removing the duplicate config import, these references should use ErrNotDefined directly.

		kmsRegion, err := GetAuthAwsKmsRegion()
		if !errors.Is(err, config.ErrNotDefined) {
			if err != nil {
				return nil, err
			}
			awsOpts = append(awsOpts, aws_cfg.WithRegion(kmsRegion.Value))
		}
		kmsEndpoint, err := GetAuthAwsKmsEndpoint()
		if !errors.Is(err, config.ErrNotDefined) {
			if err != nil {
				return nil, err
			}
			awsOpts = append(awsOpts, aws_cfg.WithBaseEndpoint(kmsEndpoint.Value))
		}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.