feat: add da client can be initialized with the gcs seed

[JayT106]

Implement DA client can init with a encrypted seed from google cloud storage. The encrypted seed has been encrypted by a HSM key stored in google KMS.

There are 3 environment variables need to be setup for enabling this feature.

DA_SECRETS_FROM_GCS="true"
DA_SECRETS_GCS_BUCKET_NAME="cronos-zkevm-encrypt-seed--bucket-test"
DA_SECRETS_KMS_DECRYPT_KEY_NAME="projects/zkevm-research/locations/northamerica-northeast2/keyRings/gkms_signer_test/cryptoKeys/avail-signer-seed-op"

Note:
There is a tooling can generate a random seed, encrypted with the assigned kms key, and then upload to the gcs bucket.
https://github.com/JayT106/avail-seed-with-kms/blob/main/src/main.rs

run avail-seed-with-kms  [kms key path] [gcs bucket name]

i.e.
avail-seed-with-kms projects/zkevm-research/locations/northamerica-northeast2/keyRings/gkms_signer_test/cryptoKeys/avail-signer-seed-op  cronos-zkevm-encrypt-seed--bucket-test

[thomas-nguy]

looks good however not sure it is relevant in this cronos version.

could you open up a PR upstream and see if they would like to merge it?

[JayT106]

Implement DA client can init with a encrypted seed from google cloud storage. The encrypted seed has been encrypted by a HSM key stored in google KMS.

There are 3 environment variables need to be setup for enabling this feature.

DA_SECRETS_FROM_GCS="true" DA_SECRETS_GCS_BUCKET_NAME="cronos-zkevm-encrypt-seed--bucket-test" DA_SECRETS_KMS_DECRYPT_KEY_NAME="projects/zkevm-research/locations/northamerica-northeast2/keyRings/gkms_signer_test/cryptoKeys/avail-signer-seed-op"

looks good however not sure it is relevant in this cronos version.

could you open up a PR upstream and see if they would like to merge it?

Open an PR
matter-labs/zksync-era#3315

[thomas-nguy]

Okay to merge because it seems harmless and its a mini improvement.

Some changes is being done on the DA layer with the gateway integration. Will see if it is still useful in later version