Open nedgar opened 2 years ago
Alternatively, since GcpKmsSigner
doesn't take the Google credentials, the KeyManagementServiceClient
could be made a singleton field in the utils for now. At least that would reduce leakage to just that instance and its channels.
In
src/util/gcp-kms-utils.ts
it instantiates a newKeyManagementServiceClient
each timesign
orgetPublicKey
is called. See: https://github.com/openlawteam/ethers-gcp-kms-signer/blob/45a5186c9b3f27bd2bcf5c53bef138fe3fb43c24/src/util/gcp-kms-utils.ts#L25https://github.com/openlawteam/ethers-gcp-kms-signer/blob/45a5186c9b3f27bd2bcf5c53bef138fe3fb43c24/src/util/gcp-kms-utils.ts#L43
The client maintains a gRPC channel, plus one in its referenced IAM client.
close()
should be called on the client when it's no longer needed.The logical lifetime of the client is that of the
GcpKmsSigner
. I suggest changing it to instantiate theKeyManagementServiceClient
, and pass that to the util methods.