From 642a76a65326d2287c218e9923ed2b73cb75ecd9 Mon Sep 17 00:00:00 2001
From: vishal <1117327+vishalchangrani@users.noreply.github.com>
Date: Sat, 7 Nov 2026 00:27:02 -0500
Subject: [PATCH] accounts: honor configured hash algorithm on Google KMS
 signer

Google KMS keys expose a native hash algorithm (SHA2_256 for the
EC_SIGN_P256_SHA256 and EC_SIGN_SECP256K1_SHA256 key types), but Flow
accounts can be registered with either SHA2_256 or SHA3_256 as the on-chain
hash algorithm. Passing the account's HashAlgo() straight through to the
KMS signer lets flow-cli sign for accounts whose public key is registered
with SHA3_256; the SDK Signer pre-hashes the message client-side and
submits the digest, so KMS signs it as-is without re-hashing.

Requires onflow/flow-go-sdk#1048.

Issue: https://github.com/onflow/flow-cli/issues/2367
---
 accounts/keys.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/accounts/keys.go b/accounts/keys.go
index c27632b6..5c7bcd87 100644
--- a/accounts/keys.go
+++ b/accounts/keys.go
@@ -163,9 +163,13 @@ func (a *KMSKey) Signer(ctx context.Context) (crypto.Signer, error) {
 		return nil, err
 	}
 
-	accountKMSSigner, err := kmsClient.SignerForKey(
+	// Honor the hash algorithm declared in flow.json. GCP KMS only supports SHA2_256
+	// natively for its EC_SIGN_P256_SHA256 key type, so if the on-chain key is
+	// registered with SHA3_256 we need to pre-hash client-side and submit the digest.
+	accountKMSSigner, err := kmsClient.SignerForKeyWithHashAlgo(
 		ctx,
 		a.kmsKey,
+		a.HashAlgo(),
 	)
 	if err != nil {
 		return nil, err