Add validator-manager (#3502)

## Issue Addressed

Addresses #2557

## Proposed Changes

Adds the `lighthouse validator-manager` command, which provides:

- `lighthouse validator-manager create`
    - Creates a `validators.json` file and a `deposits.json` (same format as https://github.com/ethereum/staking-deposit-cli)
- `lighthouse validator-manager import`
    - Imports validators from a `validators.json` file to the VC via the HTTP API.
- `lighthouse validator-manager move`
    - Moves validators from one VC to the other, utilizing only the VC API.

## Additional Info

In 98bcb947c I've reduced some VC `ERRO` and `CRIT` warnings to `WARN` or `DEBG` for the case where a pubkey is missing from the validator store. These were being triggered when we removed a validator but still had it in caches. It seems to me that `UnknownPubkey` will only happen in the case where we've removed a validator, so downgrading the logs is prudent. All the logs are `DEBG` apart from attestations and blocks which are `WARN`. I thought having *some* logging about this condition might help us down the track.

In 856cd7e37d I've made the VC delete the corresponding password file when it's deleting a keystore. This seemed like nice hygiene. Notably, it'll only delete that password file after it scans the validator definitions and finds that no other validator is also using that password file.

validator_manager/Cargo.toml

@@ -0,0 +1,30 @@
+[package]
+name = "validator_manager"
+version = "0.1.0"
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+bls = { path = "../crypto/bls" }
+clap = "2.33.3"
+types = { path = "../consensus/types" }
+environment = { path = "../lighthouse/environment" }
+eth2_network_config = { path = "../common/eth2_network_config" }
+clap_utils = { path = "../common/clap_utils" }
+eth2_wallet = { path = "../crypto/eth2_wallet" }
+eth2_keystore = { path = "../crypto/eth2_keystore" }
+account_utils = { path = "../common/account_utils" }
+serde = { version = "1.0.116", features = ["derive"] }
+serde_json = "1.0.58"
+ethereum_serde_utils = "0.5.0"
+tree_hash = "0.5.0"
+eth2 = { path = "../common/eth2", features = ["lighthouse"]}
+hex = "0.4.2"
+tokio = { version = "1.14.0", features = ["time", "rt-multi-thread", "macros"] }
+
+[dev-dependencies]
+tempfile = "3.1.0"
+regex = "1.6.0"
+eth2_network_config = { path = "../common/eth2_network_config" }
+validator_client = { path = "../validator_client" }

validator_manager/src/common.rs

@@ -0,0 +1,361 @@
+use account_utils::{strip_off_newlines, ZeroizeString};
+use eth2::lighthouse_vc::std_types::{InterchangeJsonStr, KeystoreJsonStr};
+use eth2::{
+    lighthouse_vc::{
+        http_client::ValidatorClientHttpClient,
+        std_types::{ImportKeystoreStatus, ImportKeystoresRequest, SingleKeystoreResponse, Status},
+        types::UpdateFeeRecipientRequest,
+    },
+    SensitiveUrl,
+};
+use serde::{Deserialize, Serialize};
+use std::fs;
+use std::path::{Path, PathBuf};
+use tree_hash::TreeHash;
+use types::*;
+
+pub const IGNORE_DUPLICATES_FLAG: &str = "ignore-duplicates";
+pub const STDIN_INPUTS_FLAG: &str = "stdin-inputs";
+pub const COUNT_FLAG: &str = "count";
+
+/// When the `ethereum/staking-deposit-cli` tool generates deposit data JSON, it adds a
+/// `deposit_cli_version` to protect the web-based "Launchpad" tool against a breaking change that
+/// was introduced in `ethereum/staking-deposit-cli`. Lighthouse don't really have a version that it
+/// can use here, so we choose a static string that is:
+///
+/// 1. High enough that it's accepted by Launchpad.
+/// 2. Weird enough to identify Lighthouse.
+const LIGHTHOUSE_DEPOSIT_CLI_VERSION: &str = "20.18.20";
+
+#[derive(Debug)]
+pub enum UploadError {
+    InvalidPublicKey,
+    DuplicateValidator(PublicKeyBytes),
+    FailedToListKeys(eth2::Error),
+    KeyUploadFailed(eth2::Error),
+    IncorrectStatusCount(usize),
+    FeeRecipientUpdateFailed(eth2::Error),
+    PatchValidatorFailed(eth2::Error),
+}
+
+#[derive(Clone, Serialize, Deserialize)]
+pub struct ValidatorSpecification {
+    pub voting_keystore: KeystoreJsonStr,
+    pub voting_keystore_password: ZeroizeString,
+    pub slashing_protection: Option<InterchangeJsonStr>,
+    pub fee_recipient: Option<Address>,
+    pub gas_limit: Option<u64>,
+    pub builder_proposals: Option<bool>,
+    pub enabled: Option<bool>,
+}
+
+impl ValidatorSpecification {
+    /// Upload the validator to a validator client via HTTP.
+    pub async fn upload(
+        self,
+        http_client: &ValidatorClientHttpClient,
+        ignore_duplicates: bool,
+    ) -> Result<Status<ImportKeystoreStatus>, UploadError> {
+        let ValidatorSpecification {
+            voting_keystore,
+            voting_keystore_password,
+            slashing_protection,
+            fee_recipient,
+            gas_limit,
+            builder_proposals,
+            enabled,
+        } = self;
+
+        let voting_public_key = voting_keystore
+            .public_key()
+            .ok_or(UploadError::InvalidPublicKey)?
+            .into();
+
+        let request = ImportKeystoresRequest {
+            keystores: vec![voting_keystore],
+            passwords: vec![voting_keystore_password],
+            slashing_protection,
+        };
+
+        // Check to see if this validator already exists on the remote validator.
+        match http_client.get_keystores().await {
+            Ok(response) => {
+                if response
+                    .data
+                    .iter()
+                    .any(|validator| validator.validating_pubkey == voting_public_key)
+                {
+                    if ignore_duplicates {
+                        eprintln!(
+                            "Duplicate validators are ignored, ignoring {:?} which exists \
+                            on the destination validator client",
+                            voting_public_key
+                        );
+                    } else {
+                        return Err(UploadError::DuplicateValidator(voting_public_key));
+                    }
+                }
+            }
+            Err(e) => {
+                return Err(UploadError::FailedToListKeys(e));
+            }
+        };
+
+        let mut statuses = http_client
+            .post_keystores(&request)
+            .await
+            .map_err(UploadError::KeyUploadFailed)?
+            .data;
+
+        let status = statuses.pop().ok_or(UploadError::IncorrectStatusCount(0))?;
+        if !statuses.is_empty() {
+            return Err(UploadError::IncorrectStatusCount(statuses.len() + 1));
+        }
+
+        // Exit early if there's an error uploading.
+        if status.status == ImportKeystoreStatus::Error {
+            return Ok(status);
+        }
+
+        if let Some(fee_recipient) = fee_recipient {
+            http_client
+                .post_fee_recipient(
+                    &voting_public_key,
+                    &UpdateFeeRecipientRequest {
+                        ethaddress: fee_recipient,
+                    },
+                )
+                .await
+                .map_err(UploadError::FeeRecipientUpdateFailed)?;
+        }
+
+        if gas_limit.is_some() || builder_proposals.is_some() || enabled.is_some() {
+            http_client
+                .patch_lighthouse_validators(
+                    &voting_public_key,
+                    enabled,
+                    gas_limit,
+                    builder_proposals,
+                    None, // Grafitti field is not maintained between validator moves.
+                )
+                .await
+                .map_err(UploadError::PatchValidatorFailed)?;
+        }
+
+        Ok(status)
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct CreateSpec {
+    pub mnemonic: String,
+    pub validator_client_url: Option<SensitiveUrl>,
+    pub validator_client_token_path: Option<PathBuf>,
+    pub json_deposit_data_path: Option<PathBuf>,
+    pub ignore_duplicates: bool,
+    pub validators: Vec<ValidatorSpecification>,
+}
+
+/// The structure generated by the `staking-deposit-cli` which has become a quasi-standard for
+/// browser-based deposit submission tools (e.g., the Ethereum Launchpad and Lido).
+///
+/// We assume this code as the canonical definition:
+///
+/// https://github.com/ethereum/staking-deposit-cli/blob/76ed78224fdfe3daca788d12442b3d1a37978296/staking_deposit/credentials.py#L131-L144
+#[derive(Debug, PartialEq, Serialize, Deserialize)]
+pub struct StandardDepositDataJson {
+    #[serde(with = "public_key_bytes_without_0x_prefix")]
+    pub pubkey: PublicKeyBytes,
+    #[serde(with = "hash256_without_0x_prefix")]
+    pub withdrawal_credentials: Hash256,
+    /// The `amount` field is *not* quoted (i.e., a string) like most other `u64` fields in the
+    /// consensus specs, it's a simple integer.
+    pub amount: u64,
+    #[serde(with = "signature_bytes_without_0x_prefix")]
+    pub signature: SignatureBytes,
+    #[serde(with = "bytes_4_without_0x_prefix")]
+    pub fork_version: [u8; 4],
+    pub network_name: String,
+    #[serde(with = "hash256_without_0x_prefix")]
+    pub deposit_message_root: Hash256,
+    #[serde(with = "hash256_without_0x_prefix")]
+    pub deposit_data_root: Hash256,
+    pub deposit_cli_version: String,
+}
+
+impl StandardDepositDataJson {
+    pub fn new(
+        keypair: &Keypair,
+        withdrawal_credentials: Hash256,
+        amount: u64,
+        spec: &ChainSpec,
+    ) -> Result<Self, String> {
+        let deposit_data = {
+            let mut deposit_data = DepositData {
+                pubkey: keypair.pk.clone().into(),
+                withdrawal_credentials,
+                amount,
+                signature: SignatureBytes::empty(),
+            };
+            deposit_data.signature = deposit_data.create_signature(&keypair.sk, spec);
+            deposit_data
+        };
+
+        let deposit_message_root = deposit_data.as_deposit_message().tree_hash_root();
+        let deposit_data_root = deposit_data.tree_hash_root();
+
+        let DepositData {
+            pubkey,
+            withdrawal_credentials,
+            amount,
+            signature,
+        } = deposit_data;
+
+        Ok(Self {
+            pubkey,
+            withdrawal_credentials,
+            amount,
+            signature,
+            fork_version: spec.genesis_fork_version,
+            network_name: spec
+                .config_name
+                .clone()
+                .ok_or("The network specification does not have a CONFIG_NAME set")?,
+            deposit_message_root,
+            deposit_data_root,
+            deposit_cli_version: LIGHTHOUSE_DEPOSIT_CLI_VERSION.to_string(),
+        })
+    }
+}
+
+macro_rules! without_0x_prefix {
+    ($mod_name: ident, $type: ty) => {
+        pub mod $mod_name {
+            use super::*;
+            use std::str::FromStr;
+
+            struct Visitor;
+
+            impl<'de> serde::de::Visitor<'de> for Visitor {
+                type Value = $type;
+
+                fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {
+                    formatter.write_str("ascii hex without a 0x prefix")
+                }
+
+                fn visit_str<E>(self, v: &str) -> Result<Self::Value, E>
+                where
+                    E: serde::de::Error,
+                {
+                    <$type>::from_str(&format!("0x{}", v)).map_err(serde::de::Error::custom)
+                }
+            }
+
+            /// Serialize with quotes.
+            pub fn serialize<S>(value: &$type, serializer: S) -> Result<S::Ok, S::Error>
+            where
+                S: serde::Serializer,
+            {
+                let with_prefix = format!("{:?}", value);
+                let without_prefix = with_prefix
+                    .strip_prefix("0x")
+                    .ok_or_else(|| serde::ser::Error::custom("serialization is missing 0x"))?;
+                serializer.serialize_str(&without_prefix)
+            }
+
+            /// Deserialize with quotes.
+            pub fn deserialize<'de, D>(deserializer: D) -> Result<$type, D::Error>
+            where
+                D: serde::Deserializer<'de>,
+            {
+                deserializer.deserialize_str(Visitor)
+            }
+        }
+    };
+}
+
+without_0x_prefix!(hash256_without_0x_prefix, Hash256);
+without_0x_prefix!(signature_bytes_without_0x_prefix, SignatureBytes);
+without_0x_prefix!(public_key_bytes_without_0x_prefix, PublicKeyBytes);
+
+mod bytes_4_without_0x_prefix {
+    use serde::de::Error;
+
+    const BYTES_LEN: usize = 4;
+
+    pub fn serialize<S>(bytes: &[u8; BYTES_LEN], serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        let hex_string = &hex::encode(bytes);
+        serializer.serialize_str(hex_string)
+    }
+
+    pub fn deserialize<'de, D>(deserializer: D) -> Result<[u8; BYTES_LEN], D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let decoded = deserializer.deserialize_str(serde_utils::hex::HexVisitor)?;
+
+        if decoded.len() != BYTES_LEN {
+            return Err(D::Error::custom(format!(
+                "expected {} bytes for array, got {}",
+                BYTES_LEN,
+                decoded.len()
+            )));
+        }
+
+        let mut array = [0; BYTES_LEN];
+        array.copy_from_slice(&decoded);
+        Ok(array)
+    }
+}
+
+pub async fn vc_http_client<P: AsRef<Path>>(
+    url: SensitiveUrl,
+    token_path: P,
+) -> Result<(ValidatorClientHttpClient, Vec<SingleKeystoreResponse>), String> {
+    let token_path = token_path.as_ref();
+    let token_bytes =
+        fs::read(token_path).map_err(|e| format!("Failed to read {:?}: {:?}", token_path, e))?;
+    let token_string = String::from_utf8(strip_off_newlines(token_bytes))
+        .map_err(|e| format!("Failed to parse {:?} as utf8: {:?}", token_path, e))?;
+    let http_client = ValidatorClientHttpClient::new(url.clone(), token_string).map_err(|e| {
+        format!(
+            "Could not instantiate HTTP client from URL and secret: {:?}",
+            e
+        )
+    })?;
+
+    // Perform a request to check that the connection works
+    let remote_keystores = http_client
+        .get_keystores()
+        .await
+        .map_err(|e| format!("Failed to list keystores on VC: {:?}", e))?
+        .data;
+
+    eprintln!(
+        "Validator client is reachable at {} and reports {} validators",
+        url,
+        remote_keystores.len()
+    );
+
+    Ok((http_client, remote_keystores))
+}
+
+/// Write some object to a file as JSON.
+///
+/// The file must be created new, it must not already exist.
+pub fn write_to_json_file<P: AsRef<Path>, S: Serialize>(
+    path: P,
+    contents: &S,
+) -> Result<(), String> {
+    eprintln!("Writing {:?}", path.as_ref());
+    let mut file = fs::OpenOptions::new()
+        .write(true)
+        .create_new(true)
+        .open(&path)
+        .map_err(|e| format!("Failed to open {:?}: {:?}", path.as_ref(), e))?;
+    serde_json::to_writer(&mut file, contents)
+        .map_err(|e| format!("Failed to write JSON to {:?}: {:?}", path.as_ref(), e))
+}

validator_manager/src/create_validators.rs

@@ -0,0 +1,934 @@
+use super::common::*;
+use crate::DumpConfig;
+use account_utils::{random_password_string, read_mnemonic_from_cli, read_password_from_user};
+use clap::{App, Arg, ArgMatches};
+use eth2::{
+    lighthouse_vc::std_types::KeystoreJsonStr,
+    types::{StateId, ValidatorId},
+    BeaconNodeHttpClient, SensitiveUrl, Timeouts,
+};
+use eth2_wallet::WalletBuilder;
+use serde::{Deserialize, Serialize};
+use std::fs;
+use std::path::PathBuf;
+use std::time::Duration;
+use types::*;
+
+pub const CMD: &str = "create";
+pub const OUTPUT_PATH_FLAG: &str = "output-path";
+pub const DEPOSIT_GWEI_FLAG: &str = "deposit-gwei";
+pub const DISABLE_DEPOSITS_FLAG: &str = "disable-deposits";
+pub const FIRST_INDEX_FLAG: &str = "first-index";
+pub const MNEMONIC_FLAG: &str = "mnemonic-path";
+pub const SPECIFY_VOTING_KEYSTORE_PASSWORD_FLAG: &str = "specify-voting-keystore-password";
+pub const ETH1_WITHDRAWAL_ADDRESS_FLAG: &str = "eth1-withdrawal-address";
+pub const GAS_LIMIT_FLAG: &str = "gas-limit";
+pub const FEE_RECIPIENT_FLAG: &str = "suggested-fee-recipient";
+pub const BUILDER_PROPOSALS_FLAG: &str = "builder-proposals";
+pub const BEACON_NODE_FLAG: &str = "beacon-node";
+pub const FORCE_BLS_WITHDRAWAL_CREDENTIALS: &str = "force-bls-withdrawal-credentials";
+
+pub const VALIDATORS_FILENAME: &str = "validators.json";
+pub const DEPOSITS_FILENAME: &str = "deposits.json";
+
+const BEACON_NODE_HTTP_TIMEOUT: Duration = Duration::from_secs(2);
+
+pub fn cli_app<'a, 'b>() -> App<'a, 'b> {
+    App::new(CMD)
+        .about(
+            "Creates new validators from BIP-39 mnemonic. A JSON file will be created which \
+                contains all the validator keystores and other validator data. This file can then \
+                be imported to a validator client using the \"import-validators\" command. \
+                Another, optional JSON file is created which contains a list of validator \
+                deposits in the same format as the \"ethereum/staking-deposit-cli\" tool.",
+        )
+        .arg(
+            Arg::with_name(OUTPUT_PATH_FLAG)
+                .long(OUTPUT_PATH_FLAG)
+                .value_name("DIRECTORY")
+                .help(
+                    "The path to a directory where the validator and (optionally) deposits \
+                    files will be created. The directory will be created if it does not exist.",
+                )
+                .required(true)
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(DEPOSIT_GWEI_FLAG)
+                .long(DEPOSIT_GWEI_FLAG)
+                .value_name("DEPOSIT_GWEI")
+                .help(
+                    "The GWEI value of the deposit amount. Defaults to the minimum amount \
+                    required for an active validator (MAX_EFFECTIVE_BALANCE)",
+                )
+                .conflicts_with(DISABLE_DEPOSITS_FLAG)
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(FIRST_INDEX_FLAG)
+                .long(FIRST_INDEX_FLAG)
+                .value_name("FIRST_INDEX")
+                .help("The first of consecutive key indexes you wish to create.")
+                .takes_value(true)
+                .required(false)
+                .default_value("0"),
+        )
+        .arg(
+            Arg::with_name(COUNT_FLAG)
+                .long(COUNT_FLAG)
+                .value_name("VALIDATOR_COUNT")
+                .help("The number of validators to create, regardless of how many already exist")
+                .conflicts_with("at-most")
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(MNEMONIC_FLAG)
+                .long(MNEMONIC_FLAG)
+                .value_name("MNEMONIC_PATH")
+                .help("If present, the mnemonic will be read in from this file.")
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(STDIN_INPUTS_FLAG)
+                .takes_value(false)
+                .hidden(cfg!(windows))
+                .long(STDIN_INPUTS_FLAG)
+                .help("If present, read all user inputs from stdin instead of tty."),
+        )
+        .arg(
+            Arg::with_name(DISABLE_DEPOSITS_FLAG)
+                .long(DISABLE_DEPOSITS_FLAG)
+                .help(
+                    "When provided don't generate the deposits JSON file that is \
+                    commonly used for submitting validator deposits via a web UI. \
+                    Using this flag will save several seconds per validator if the \
+                    user has an alternate strategy for submitting deposits.",
+                ),
+        )
+        .arg(
+            Arg::with_name(SPECIFY_VOTING_KEYSTORE_PASSWORD_FLAG)
+                .long(SPECIFY_VOTING_KEYSTORE_PASSWORD_FLAG)
+                .help(
+                    "If present, the user will be prompted to enter the voting keystore \
+                    password that will be used to encrypt the voting keystores. If this \
+                    flag is not provided, a random password will be used. It is not \
+                    necessary to keep backups of voting keystore passwords if the \
+                    mnemonic is safely backed up.",
+                ),
+        )
+        .arg(
+            Arg::with_name(ETH1_WITHDRAWAL_ADDRESS_FLAG)
+                .long(ETH1_WITHDRAWAL_ADDRESS_FLAG)
+                .value_name("ETH1_ADDRESS")
+                .help(
+                    "If this field is set, the given eth1 address will be used to create the \
+                    withdrawal credentials. Otherwise, it will generate withdrawal credentials \
+                    with the mnemonic-derived withdrawal public key in EIP-2334 format.",
+                )
+                .conflicts_with(DISABLE_DEPOSITS_FLAG)
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(GAS_LIMIT_FLAG)
+                .long(GAS_LIMIT_FLAG)
+                .value_name("UINT64")
+                .help(
+                    "All created validators will use this gas limit. It is recommended \
+                    to leave this as the default value by not specifying this flag.",
+                )
+                .required(false)
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(FEE_RECIPIENT_FLAG)
+                .long(FEE_RECIPIENT_FLAG)
+                .value_name("ETH1_ADDRESS")
+                .help(
+                    "All created validators will use this value for the suggested \
+                    fee recipient. Omit this flag to use the default value from the VC.",
+                )
+                .required(false)
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(BUILDER_PROPOSALS_FLAG)
+                .long(BUILDER_PROPOSALS_FLAG)
+                .help(
+                    "When provided, all created validators will attempt to create \
+                    blocks via builder rather than the local EL.",
+                )
+                .required(false)
+                .possible_values(&["true", "false"])
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(BEACON_NODE_FLAG)
+                .long(BEACON_NODE_FLAG)
+                .value_name("HTTP_ADDRESS")
+                .help(
+                    "A HTTP(S) address of a beacon node using the beacon-API. \
+                    If this value is provided, an error will be raised if any validator \
+                    key here is already known as a validator by that beacon node. This helps \
+                    prevent the same validator being created twice and therefore slashable \
+                    conditions.",
+                )
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(FORCE_BLS_WITHDRAWAL_CREDENTIALS)
+                .takes_value(false)
+                .long(FORCE_BLS_WITHDRAWAL_CREDENTIALS)
+                .help(
+                    "If present, allows BLS withdrawal credentials rather than an execution \
+                    address. This is not recommended.",
+                ),
+        )
+}
+
+/// The CLI arguments are parsed into this struct before running the application. This step of
+/// indirection allows for testing the underlying logic without needing to parse CLI arguments.
+#[derive(Clone, PartialEq, Debug, Serialize, Deserialize)]
+pub struct CreateConfig {
+    pub output_path: PathBuf,
+    pub first_index: u32,
+    pub count: u32,
+    pub deposit_gwei: u64,
+    pub mnemonic_path: Option<PathBuf>,
+    pub stdin_inputs: bool,
+    pub disable_deposits: bool,
+    pub specify_voting_keystore_password: bool,
+    pub eth1_withdrawal_address: Option<Address>,
+    pub builder_proposals: Option<bool>,
+    pub fee_recipient: Option<Address>,
+    pub gas_limit: Option<u64>,
+    pub bn_url: Option<SensitiveUrl>,
+    pub force_bls_withdrawal_credentials: bool,
+}
+
+impl CreateConfig {
+    fn from_cli(matches: &ArgMatches, spec: &ChainSpec) -> Result<Self, String> {
+        Ok(Self {
+            output_path: clap_utils::parse_required(matches, OUTPUT_PATH_FLAG)?,
+            deposit_gwei: clap_utils::parse_optional(matches, DEPOSIT_GWEI_FLAG)?
+                .unwrap_or(spec.max_effective_balance),
+            first_index: clap_utils::parse_required(matches, FIRST_INDEX_FLAG)?,
+            count: clap_utils::parse_required(matches, COUNT_FLAG)?,
+            mnemonic_path: clap_utils::parse_optional(matches, MNEMONIC_FLAG)?,
+            stdin_inputs: cfg!(windows) || matches.is_present(STDIN_INPUTS_FLAG),
+            disable_deposits: matches.is_present(DISABLE_DEPOSITS_FLAG),
+            specify_voting_keystore_password: matches
+                .is_present(SPECIFY_VOTING_KEYSTORE_PASSWORD_FLAG),
+            eth1_withdrawal_address: clap_utils::parse_optional(
+                matches,
+                ETH1_WITHDRAWAL_ADDRESS_FLAG,
+            )?,
+            builder_proposals: clap_utils::parse_optional(matches, BUILDER_PROPOSALS_FLAG)?,
+            fee_recipient: clap_utils::parse_optional(matches, FEE_RECIPIENT_FLAG)?,
+            gas_limit: clap_utils::parse_optional(matches, GAS_LIMIT_FLAG)?,
+            bn_url: clap_utils::parse_optional(matches, BEACON_NODE_FLAG)?,
+            force_bls_withdrawal_credentials: matches.is_present(FORCE_BLS_WITHDRAWAL_CREDENTIALS),
+        })
+    }
+}
+
+struct ValidatorsAndDeposits {
+    validators: Vec<ValidatorSpecification>,
+    deposits: Option<Vec<StandardDepositDataJson>>,
+}
+
+impl ValidatorsAndDeposits {
+    async fn new<'a, T: EthSpec>(config: CreateConfig, spec: &ChainSpec) -> Result<Self, String> {
+        let CreateConfig {
+            // The output path is handled upstream.
+            output_path: _,
+            first_index,
+            count,
+            deposit_gwei,
+            mnemonic_path,
+            stdin_inputs,
+            disable_deposits,
+            specify_voting_keystore_password,
+            eth1_withdrawal_address,
+            builder_proposals,
+            fee_recipient,
+            gas_limit,
+            bn_url,
+            force_bls_withdrawal_credentials,
+        } = config;
+
+        // Since Capella, it really doesn't make much sense to use BLS
+        // withdrawal credentials. Try to guide users away from doing so.
+        if eth1_withdrawal_address.is_none() && !force_bls_withdrawal_credentials {
+            return Err(format!(
+                "--{ETH1_WITHDRAWAL_ADDRESS_FLAG} is required. See --help for more information."
+            ));
+        }
+
+        if count == 0 {
+            return Err(format!("--{} cannot be 0", COUNT_FLAG));
+        }
+
+        let bn_http_client = if let Some(bn_url) = bn_url {
+            let bn_http_client =
+                BeaconNodeHttpClient::new(bn_url, Timeouts::set_all(BEACON_NODE_HTTP_TIMEOUT));
+
+            /*
+             * Print the version of the remote beacon node.
+             */
+            let version = bn_http_client
+                .get_node_version()
+                .await
+                .map_err(|e| format!("Failed to test connection to beacon node: {:?}", e))?
+                .data
+                .version;
+            eprintln!("Connected to beacon node running version {}", version);
+
+            /*
+             * Attempt to ensure that the beacon node is on the same network.
+             */
+            let bn_config = bn_http_client
+                .get_config_spec::<types::Config>()
+                .await
+                .map_err(|e| format!("Failed to get spec from beacon node: {:?}", e))?
+                .data;
+            if let Some(config_name) = &bn_config.config_name {
+                eprintln!("Beacon node is on {} network", config_name)
+            }
+            let bn_spec = bn_config
+                .apply_to_chain_spec::<T>(&T::default_spec())
+                .ok_or("Beacon node appears to be on an incorrect network")?;
+            if bn_spec.genesis_fork_version != spec.genesis_fork_version {
+                if let Some(config_name) = bn_spec.config_name {
+                    eprintln!("Beacon node is on {} network", config_name)
+                }
+                return Err("Beacon node appears to be on the wrong network".to_string());
+            }
+
+            Some(bn_http_client)
+        } else {
+            None
+        };
+
+        let mnemonic = read_mnemonic_from_cli(mnemonic_path, stdin_inputs)?;
+        let voting_keystore_password = if specify_voting_keystore_password {
+            eprintln!("Please enter a voting keystore password when prompted.");
+            Some(read_password_from_user(stdin_inputs)?)
+        } else {
+            None
+        };
+
+        /*
+         * Generate a wallet to be used for HD key generation.
+         */
+
+        // A random password is always appropriate for the wallet since it is ephemeral.
+        let wallet_password = random_password_string();
+        // A random password is always appropriate for the withdrawal keystore since we don't ever store
+        // it anywhere.
+        let withdrawal_keystore_password = random_password_string();
+        let mut wallet =
+            WalletBuilder::from_mnemonic(&mnemonic, wallet_password.as_ref(), "".to_string())
+                .map_err(|e| format!("Unable create seed from mnemonic: {:?}", e))?
+                .build()
+                .map_err(|e| format!("Unable to create wallet: {:?}", e))?;
+
+        /*
+         * Start deriving individual validators.
+         */
+
+        eprintln!(
+            "Starting derivation of {} keystores. Each keystore may take several seconds.",
+            count
+        );
+
+        let mut validators = Vec::with_capacity(count as usize);
+        let mut deposits = (!disable_deposits).then(Vec::new);
+
+        for (i, derivation_index) in (first_index..first_index + count).enumerate() {
+            // If the voting keystore password was not provided by the user then use a unique random
+            // string for each validator.
+            let voting_keystore_password = voting_keystore_password
+                .clone()
+                .unwrap_or_else(random_password_string);
+
+            // Set the wallet to the appropriate derivation index.
+            wallet
+                .set_nextaccount(derivation_index)
+                .map_err(|e| format!("Failure to set validator derivation index: {:?}", e))?;
+
+            // Derive the keystore from the HD wallet.
+            let keystores = wallet
+                .next_validator(
+                    wallet_password.as_ref(),
+                    voting_keystore_password.as_ref(),
+                    withdrawal_keystore_password.as_ref(),
+                )
+                .map_err(|e| format!("Failed to derive keystore {}: {:?}", i, e))?;
+            let voting_keystore = keystores.voting;
+            let voting_public_key = voting_keystore
+                .public_key()
+                .ok_or_else(|| {
+                    format!("Validator keystore at index {} is missing a public key", i)
+                })?
+                .into();
+
+            // If the user has provided a beacon node URL, check that the validator doesn't already
+            // exist in the beacon chain.
+            if let Some(bn_http_client) = &bn_http_client {
+                match bn_http_client
+                    .get_beacon_states_validator_id(
+                        StateId::Head,
+                        &ValidatorId::PublicKey(voting_public_key),
+                    )
+                    .await
+                {
+                    Ok(Some(_)) => {
+                        return Err(format!(
+                            "Validator {:?} at derivation index {} already exists in the beacon chain. \
+                            This indicates a slashing risk, be sure to never run the same validator on two \
+                            different validator clients. If you understand the risks and are certain you \
+                            wish to generate this validator again, omit the --{} flag.",
+                            voting_public_key, derivation_index, BEACON_NODE_FLAG
+                        ))?
+                    }
+                    Ok(None) => eprintln!(
+                        "{:?} was not found in the beacon chain",
+                        voting_public_key
+                    ),
+                    Err(e) => {
+                        return Err(format!(
+                            "Error checking if validator exists in beacon chain: {:?}",
+                            e
+                        ))
+                    }
+                }
+            }
+
+            if let Some(deposits) = &mut deposits {
+                // Decrypt the voting keystore so a deposit message can be signed.
+                let voting_keypair = voting_keystore
+                    .decrypt_keypair(voting_keystore_password.as_ref())
+                    .map_err(|e| format!("Failed to decrypt voting keystore {}: {:?}", i, e))?;
+
+                // Sanity check to ensure the keystore is reporting the correct public key.
+                if PublicKeyBytes::from(voting_keypair.pk.clone()) != voting_public_key {
+                    return Err(format!(
+                        "Mismatch for keystore public key and derived public key \
+                        for derivation index {}",
+                        derivation_index
+                    ));
+                }
+
+                let withdrawal_credentials =
+                    if let Some(eth1_withdrawal_address) = eth1_withdrawal_address {
+                        WithdrawalCredentials::eth1(eth1_withdrawal_address, spec)
+                    } else {
+                        // Decrypt the withdrawal keystore so withdrawal credentials can be created. It's
+                        // not strictly necessary to decrypt the keystore since we can read the pubkey
+                        // directly from the keystore. However we decrypt the keystore to be more certain
+                        // that we have access to the withdrawal keys.
+                        let withdrawal_keypair = keystores
+                            .withdrawal
+                            .decrypt_keypair(withdrawal_keystore_password.as_ref())
+                            .map_err(|e| {
+                                format!("Failed to decrypt withdrawal keystore {}: {:?}", i, e)
+                            })?;
+                        WithdrawalCredentials::bls(&withdrawal_keypair.pk, spec)
+                    };
+
+                // Create a JSON structure equivalent to the one generated by
+                // `ethereum/staking-deposit-cli`.
+                let json_deposit = StandardDepositDataJson::new(
+                    &voting_keypair,
+                    withdrawal_credentials.into(),
+                    deposit_gwei,
+                    spec,
+                )?;
+
+                deposits.push(json_deposit);
+            }
+
+            let validator = ValidatorSpecification {
+                voting_keystore: KeystoreJsonStr(voting_keystore),
+                voting_keystore_password: voting_keystore_password.clone(),
+                // New validators have no slashing protection history.
+                slashing_protection: None,
+                fee_recipient,
+                gas_limit,
+                builder_proposals,
+                // Allow the VC to choose a default "enabled" state. Since "enabled" is not part of
+                // the standard API, leaving this as `None` means we are not forced to use the
+                // non-standard API.
+                enabled: None,
+            };
+
+            eprintln!(
+                "Completed {}/{}: {:?}",
+                i.saturating_add(1),
+                count,
+                voting_public_key
+            );
+
+            validators.push(validator);
+        }
+
+        Ok(Self {
+            validators,
+            deposits,
+        })
+    }
+}
+
+pub async fn cli_run<'a, T: EthSpec>(
+    matches: &'a ArgMatches<'a>,
+    spec: &ChainSpec,
+    dump_config: DumpConfig,
+) -> Result<(), String> {
+    let config = CreateConfig::from_cli(matches, spec)?;
+    if dump_config.should_exit_early(&config)? {
+        Ok(())
+    } else {
+        run::<T>(config, spec).await
+    }
+}
+
+async fn run<'a, T: EthSpec>(config: CreateConfig, spec: &ChainSpec) -> Result<(), String> {
+    let output_path = config.output_path.clone();
+
+    if !output_path.exists() {
+        fs::create_dir(&output_path)
+            .map_err(|e| format!("Failed to create {:?} directory: {:?}", output_path, e))?;
+    } else if !output_path.is_dir() {
+        return Err(format!("{:?} must be a directory", output_path));
+    }
+
+    let validators_path = output_path.join(VALIDATORS_FILENAME);
+    if validators_path.exists() {
+        return Err(format!(
+            "{:?} already exists, refusing to overwrite",
+            validators_path
+        ));
+    }
+    let deposits_path = output_path.join(DEPOSITS_FILENAME);
+    if deposits_path.exists() {
+        return Err(format!(
+            "{:?} already exists, refusing to overwrite",
+            deposits_path
+        ));
+    }
+
+    let validators_and_deposits = ValidatorsAndDeposits::new::<T>(config, spec).await?;
+
+    eprintln!("Keystore generation complete");
+
+    write_to_json_file(&validators_path, &validators_and_deposits.validators)?;
+
+    if let Some(deposits) = &validators_and_deposits.deposits {
+        write_to_json_file(&deposits_path, deposits)?;
+    }
+
+    Ok(())
+}
+
+// The tests use crypto and are too slow in debug.
+#[cfg(not(debug_assertions))]
+#[cfg(test)]
+pub mod tests {
+    use super::*;
+    use eth2_network_config::Eth2NetworkConfig;
+    use regex::Regex;
+    use std::path::Path;
+    use std::str::FromStr;
+    use tempfile::{tempdir, TempDir};
+    use tree_hash::TreeHash;
+
+    type E = MainnetEthSpec;
+
+    const TEST_VECTOR_DEPOSIT_CLI_VERSION: &str = "2.3.0";
+
+    fn junk_execution_address() -> Option<Address> {
+        Some(Address::from_str("0x0f51bb10119727a7e5ea3538074fb341f56b09ad").unwrap())
+    }
+
+    pub struct TestBuilder {
+        spec: ChainSpec,
+        output_dir: TempDir,
+        mnemonic_dir: TempDir,
+        config: CreateConfig,
+    }
+
+    impl Default for TestBuilder {
+        fn default() -> Self {
+            Self::new(E::default_spec())
+        }
+    }
+
+    impl TestBuilder {
+        pub fn new(spec: ChainSpec) -> Self {
+            let output_dir = tempdir().unwrap();
+            let mnemonic_dir = tempdir().unwrap();
+            let mnemonic_path = mnemonic_dir.path().join("mnemonic");
+            fs::write(
+                &mnemonic_path,
+                "test test test test test test test test test test test waste",
+            )
+            .unwrap();
+
+            let config = CreateConfig {
+                output_path: output_dir.path().into(),
+                first_index: 0,
+                count: 1,
+                deposit_gwei: spec.max_effective_balance,
+                mnemonic_path: Some(mnemonic_path),
+                stdin_inputs: false,
+                disable_deposits: false,
+                specify_voting_keystore_password: false,
+                eth1_withdrawal_address: junk_execution_address(),
+                builder_proposals: None,
+                fee_recipient: None,
+                gas_limit: None,
+                bn_url: None,
+                force_bls_withdrawal_credentials: false,
+            };
+
+            Self {
+                spec,
+                output_dir,
+                mnemonic_dir,
+                config,
+            }
+        }
+
+        pub fn mutate_config<F: Fn(&mut CreateConfig)>(mut self, func: F) -> Self {
+            func(&mut self.config);
+            self
+        }
+
+        pub async fn run_test(self) -> TestResult {
+            let Self {
+                spec,
+                output_dir,
+                mnemonic_dir,
+                config,
+            } = self;
+
+            let result = run::<E>(config.clone(), &spec).await;
+
+            if result.is_ok() {
+                let validators_file_contents =
+                    fs::read_to_string(output_dir.path().join(VALIDATORS_FILENAME)).unwrap();
+                let validators: Vec<ValidatorSpecification> =
+                    serde_json::from_str(&validators_file_contents).unwrap();
+
+                assert_eq!(validators.len(), config.count as usize);
+
+                for (i, validator) in validators.iter().enumerate() {
+                    let voting_keystore = &validator.voting_keystore.0;
+                    let keypair = voting_keystore
+                        .decrypt_keypair(validator.voting_keystore_password.as_ref())
+                        .unwrap();
+                    assert_eq!(keypair.pk, voting_keystore.public_key().unwrap());
+                    assert_eq!(
+                        voting_keystore.path().unwrap(),
+                        format!("m/12381/3600/{}/0/0", config.first_index as usize + i)
+                    );
+                    assert!(validator.slashing_protection.is_none());
+                    assert_eq!(validator.fee_recipient, config.fee_recipient);
+                    assert_eq!(validator.gas_limit, config.gas_limit);
+                    assert_eq!(validator.builder_proposals, config.builder_proposals);
+                    assert_eq!(validator.enabled, None);
+                }
+
+                let deposits_path = output_dir.path().join(DEPOSITS_FILENAME);
+                if config.disable_deposits {
+                    assert!(!deposits_path.exists());
+                } else {
+                    let deposits_file_contents = fs::read_to_string(&deposits_path).unwrap();
+                    let deposits: Vec<StandardDepositDataJson> =
+                        serde_json::from_str(&deposits_file_contents).unwrap();
+
+                    assert_eq!(deposits.len(), config.count as usize);
+
+                    for (validator, deposit) in validators.iter().zip(deposits.iter()) {
+                        let validator_pubkey = validator.voting_keystore.0.public_key().unwrap();
+                        assert_eq!(deposit.pubkey, validator_pubkey.clone().into());
+                        if let Some(address) = config.eth1_withdrawal_address {
+                            assert_eq!(
+                                deposit.withdrawal_credentials.as_bytes()[0],
+                                spec.eth1_address_withdrawal_prefix_byte
+                            );
+                            assert_eq!(
+                                &deposit.withdrawal_credentials.as_bytes()[12..],
+                                address.as_bytes()
+                            );
+                        } else {
+                            assert_eq!(
+                                deposit.withdrawal_credentials.as_bytes()[0],
+                                spec.bls_withdrawal_prefix_byte
+                            );
+                        }
+                        assert_eq!(deposit.amount, config.deposit_gwei);
+                        let deposit_message = DepositData {
+                            pubkey: deposit.pubkey,
+                            withdrawal_credentials: deposit.withdrawal_credentials,
+                            amount: deposit.amount,
+                            signature: SignatureBytes::empty(),
+                        }
+                        .as_deposit_message();
+                        assert!(deposit.signature.decompress().unwrap().verify(
+                            &validator_pubkey,
+                            deposit_message.signing_root(spec.get_deposit_domain())
+                        ));
+                        assert_eq!(deposit.fork_version, spec.genesis_fork_version);
+                        assert_eq!(&deposit.network_name, spec.config_name.as_ref().unwrap());
+                        assert_eq!(
+                            deposit.deposit_message_root,
+                            deposit_message.tree_hash_root()
+                        );
+                        assert_eq!(
+                            deposit.deposit_data_root,
+                            DepositData {
+                                pubkey: deposit.pubkey,
+                                withdrawal_credentials: deposit.withdrawal_credentials,
+                                amount: deposit.amount,
+                                signature: deposit.signature.clone()
+                            }
+                            .tree_hash_root()
+                        );
+                    }
+                }
+            }
+
+            // The directory containing the mnemonic can now be removed.
+            drop(mnemonic_dir);
+
+            TestResult { result, output_dir }
+        }
+    }
+
+    #[must_use] // Use the `assert_ok` or `assert_err` fns to "use" this value.
+    pub struct TestResult {
+        pub result: Result<(), String>,
+        pub output_dir: TempDir,
+    }
+
+    impl TestResult {
+        pub fn validators_file_path(&self) -> PathBuf {
+            self.output_dir.path().join(VALIDATORS_FILENAME)
+        }
+
+        pub fn validators(&self) -> Vec<ValidatorSpecification> {
+            let contents = fs::read_to_string(self.validators_file_path()).unwrap();
+            serde_json::from_str(&contents).unwrap()
+        }
+
+        fn assert_ok(self) {
+            assert_eq!(self.result, Ok(()))
+        }
+
+        fn assert_err(self) {
+            assert!(self.result.is_err())
+        }
+    }
+
+    #[tokio::test]
+    async fn default_test_values() {
+        TestBuilder::default().run_test().await.assert_ok();
+    }
+
+    #[tokio::test]
+    async fn no_eth1_address_without_force() {
+        TestBuilder::default()
+            .mutate_config(|config| {
+                config.eth1_withdrawal_address = None;
+                config.force_bls_withdrawal_credentials = false
+            })
+            .run_test()
+            .await
+            .assert_err();
+    }
+
+    #[tokio::test]
+    async fn bls_withdrawal_credentials() {
+        TestBuilder::default()
+            .mutate_config(|config| {
+                config.eth1_withdrawal_address = None;
+                config.force_bls_withdrawal_credentials = true
+            })
+            .run_test()
+            .await
+            .assert_ok();
+    }
+
+    #[tokio::test]
+    async fn default_test_values_deposits_disabled() {
+        TestBuilder::default()
+            .mutate_config(|config| config.disable_deposits = true)
+            .run_test()
+            .await
+            .assert_ok();
+    }
+
+    #[tokio::test]
+    async fn count_is_zero() {
+        TestBuilder::default()
+            .mutate_config(|config| config.count = 0)
+            .run_test()
+            .await
+            .assert_err();
+    }
+
+    #[tokio::test]
+    async fn eth1_withdrawal_addresses() {
+        TestBuilder::default()
+            .mutate_config(|config| {
+                config.count = 2;
+                config.eth1_withdrawal_address = junk_execution_address();
+            })
+            .run_test()
+            .await
+            .assert_ok();
+    }
+
+    #[tokio::test]
+    async fn non_zero_first_index() {
+        TestBuilder::default()
+            .mutate_config(|config| {
+                config.first_index = 2;
+                config.count = 2;
+            })
+            .run_test()
+            .await
+            .assert_ok();
+    }
+
+    #[tokio::test]
+    async fn misc_modifications() {
+        TestBuilder::default()
+            .mutate_config(|config| {
+                config.deposit_gwei = 42;
+                config.builder_proposals = Some(true);
+                config.gas_limit = Some(1337);
+            })
+            .run_test()
+            .await
+            .assert_ok();
+    }
+
+    #[tokio::test]
+    async fn bogus_bn_url() {
+        TestBuilder::default()
+            .mutate_config(|config| {
+                config.bn_url =
+                    Some(SensitiveUrl::from_str("http://sdjfvwfhsdhfschwkeyfwhwlga.com").unwrap());
+            })
+            .run_test()
+            .await
+            .assert_err();
+    }
+
+    #[tokio::test]
+    async fn staking_deposit_cli_vectors() {
+        let vectors_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("test_vectors")
+            .join("vectors");
+        for entry in fs::read_dir(vectors_dir).unwrap() {
+            let entry = entry.unwrap();
+            let file_name = entry.file_name();
+            let vector_name = file_name.to_str().unwrap();
+            let path = entry.path();
+            // Leave this `println!` so we can tell which test fails.
+            println!("Running test {}", vector_name);
+            run_test_vector(vector_name, &path).await;
+        }
+    }
+
+    async fn run_test_vector<P: AsRef<Path>>(name: &str, vectors_path: P) {
+        /*
+         * Parse the test vector name into a set of test parameters.
+         */
+        let re = Regex::new(r"(.*)_(.*)_(.*)_(.*)_(.*)_(.*)_(.*)").unwrap();
+        let capture = re.captures_iter(name).next().unwrap();
+        let network = capture.get(1).unwrap().as_str();
+        let first = u32::from_str(capture.get(3).unwrap().as_str()).unwrap();
+        let count = u32::from_str(capture.get(5).unwrap().as_str()).unwrap();
+        let uses_eth1 = bool::from_str(capture.get(7).unwrap().as_str()).unwrap();
+
+        /*
+         * Use the test parameters to generate equivalent files "locally" (i.e., with our code).
+         */
+
+        let spec = Eth2NetworkConfig::constant(network)
+            .unwrap()
+            .unwrap()
+            .chain_spec::<E>()
+            .unwrap();
+
+        let test_result = TestBuilder::new(spec)
+            .mutate_config(|config| {
+                config.first_index = first;
+                config.count = count;
+                if uses_eth1 {
+                    config.eth1_withdrawal_address = Some(
+                        Address::from_str("0x0f51bb10119727a7e5ea3538074fb341f56b09ad").unwrap(),
+                    );
+                } else {
+                    config.eth1_withdrawal_address = None;
+                    config.force_bls_withdrawal_credentials = true;
+                }
+            })
+            .run_test()
+            .await;
+        let TestResult { result, output_dir } = test_result;
+        result.expect("local generation should succeed");
+
+        /*
+         * Ensure the deposit data is identical when parsed as JSON.
+         */
+
+        let local_deposits = {
+            let path = output_dir.path().join(DEPOSITS_FILENAME);
+            let contents = fs::read_to_string(&path).unwrap();
+            let mut deposits: Vec<StandardDepositDataJson> =
+                serde_json::from_str(&contents).unwrap();
+            for deposit in &mut deposits {
+                // Ensures we can match test vectors.
+                deposit.deposit_cli_version = TEST_VECTOR_DEPOSIT_CLI_VERSION.to_string();
+
+                // We use "prater" and the vectors use "goerli" now. The two names refer to the same
+                // network so there should be no issue here.
+                if deposit.network_name == "prater" {
+                    deposit.network_name = "goerli".to_string();
+                }
+            }
+            deposits
+        };
+        let vector_deposits: Vec<StandardDepositDataJson> = {
+            let path = fs::read_dir(vectors_path.as_ref().join("validator_keys"))
+                .unwrap()
+                .find_map(|entry| {
+                    let entry = entry.unwrap();
+                    let file_name = entry.file_name();
+                    if file_name.to_str().unwrap().starts_with("deposit_data") {
+                        Some(entry.path())
+                    } else {
+                        None
+                    }
+                })
+                .unwrap();
+            let contents = fs::read_to_string(path).unwrap();
+            serde_json::from_str(&contents).unwrap()
+        };
+
+        assert_eq!(local_deposits, vector_deposits);
+
+        /*
+         * Note: we don't check the keystores generated by the deposit-cli since there is little
+         * value in this.
+         *
+         * If we check the deposits then we are verifying the signature across the deposit message.
+         * This implicitly verifies that the keypair generated by the deposit-cli is identical to
+         * the one created by Lighthouse.
+         */
+    }
+}

validator_manager/src/import_validators.rs

@@ -0,0 +1,436 @@
+use super::common::*;
+use crate::DumpConfig;
+use clap::{App, Arg, ArgMatches};
+use eth2::{lighthouse_vc::std_types::ImportKeystoreStatus, SensitiveUrl};
+use serde::{Deserialize, Serialize};
+use std::fs;
+use std::path::PathBuf;
+
+pub const CMD: &str = "import";
+pub const VALIDATORS_FILE_FLAG: &str = "validators-file";
+pub const VC_URL_FLAG: &str = "vc-url";
+pub const VC_TOKEN_FLAG: &str = "vc-token";
+
+pub const DETECTED_DUPLICATE_MESSAGE: &str = "Duplicate validator detected!";
+
+pub fn cli_app<'a, 'b>() -> App<'a, 'b> {
+    App::new(CMD)
+        .about(
+            "Uploads validators to a validator client using the HTTP API. The validators \
+                are defined in a JSON file which can be generated using the \"create-validators\" \
+                command.",
+        )
+        .arg(
+            Arg::with_name(VALIDATORS_FILE_FLAG)
+                .long(VALIDATORS_FILE_FLAG)
+                .value_name("PATH_TO_JSON_FILE")
+                .help(
+                    "The path to a JSON file containing a list of validators to be \
+                    imported to the validator client. This file is usually named \
+                    \"validators.json\".",
+                )
+                .required(true)
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(VC_URL_FLAG)
+                .long(VC_URL_FLAG)
+                .value_name("HTTP_ADDRESS")
+                .help(
+                    "A HTTP(S) address of a validator client using the keymanager-API. \
+                    If this value is not supplied then a 'dry run' will be conducted where \
+                    no changes are made to the validator client.",
+                )
+                .default_value("http://localhost:5062")
+                .requires(VC_TOKEN_FLAG)
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(VC_TOKEN_FLAG)
+                .long(VC_TOKEN_FLAG)
+                .value_name("PATH")
+                .help("The file containing a token required by the validator client.")
+                .takes_value(true),
+        )
+        .arg(
+            Arg::with_name(IGNORE_DUPLICATES_FLAG)
+                .takes_value(false)
+                .long(IGNORE_DUPLICATES_FLAG)
+                .help(
+                    "If present, ignore any validators which already exist on the VC. \
+                    Without this flag, the process will terminate without making any changes. \
+                    This flag should be used with caution, whilst it does not directly cause \
+                    slashable conditions, it might be an indicator that something is amiss. \
+                    Users should also be careful to avoid submitting duplicate deposits for \
+                    validators that already exist on the VC.",
+                ),
+        )
+}
+
+#[derive(Clone, PartialEq, Debug, Serialize, Deserialize)]
+pub struct ImportConfig {
+    pub validators_file_path: PathBuf,
+    pub vc_url: SensitiveUrl,
+    pub vc_token_path: PathBuf,
+    pub ignore_duplicates: bool,
+}
+
+impl ImportConfig {
+    fn from_cli(matches: &ArgMatches) -> Result<Self, String> {
+        Ok(Self {
+            validators_file_path: clap_utils::parse_required(matches, VALIDATORS_FILE_FLAG)?,
+            vc_url: clap_utils::parse_required(matches, VC_URL_FLAG)?,
+            vc_token_path: clap_utils::parse_required(matches, VC_TOKEN_FLAG)?,
+            ignore_duplicates: matches.is_present(IGNORE_DUPLICATES_FLAG),
+        })
+    }
+}
+
+pub async fn cli_run<'a>(
+    matches: &'a ArgMatches<'a>,
+    dump_config: DumpConfig,
+) -> Result<(), String> {
+    let config = ImportConfig::from_cli(matches)?;
+    if dump_config.should_exit_early(&config)? {
+        Ok(())
+    } else {
+        run(config).await
+    }
+}
+
+async fn run<'a>(config: ImportConfig) -> Result<(), String> {
+    let ImportConfig {
+        validators_file_path,
+        vc_url,
+        vc_token_path,
+        ignore_duplicates,
+    } = config;
+
+    if !validators_file_path.exists() {
+        return Err(format!("Unable to find file at {:?}", validators_file_path));
+    }
+
+    let validators_file = fs::OpenOptions::new()
+        .read(true)
+        .create(false)
+        .open(&validators_file_path)
+        .map_err(|e| format!("Unable to open {:?}: {:?}", validators_file_path, e))?;
+    let validators: Vec<ValidatorSpecification> = serde_json::from_reader(&validators_file)
+        .map_err(|e| {
+            format!(
+                "Unable to parse JSON in {:?}: {:?}",
+                validators_file_path, e
+            )
+        })?;
+
+    let count = validators.len();
+
+    let (http_client, _keystores) = vc_http_client(vc_url.clone(), &vc_token_path).await?;
+
+    eprintln!(
+        "Starting to submit {} validators to VC, each validator may take several seconds",
+        count
+    );
+
+    for (i, validator) in validators.into_iter().enumerate() {
+        match validator.upload(&http_client, ignore_duplicates).await {
+            Ok(status) => {
+                match status.status {
+                    ImportKeystoreStatus::Imported => {
+                        eprintln!("Uploaded keystore {} of {} to the VC", i + 1, count)
+                    }
+                    ImportKeystoreStatus::Duplicate => {
+                        if ignore_duplicates {
+                            eprintln!("Re-uploaded keystore {} of {} to the VC", i + 1, count)
+                        } else {
+                            eprintln!(
+                                "Keystore {} of {} was uploaded to the VC, but it was a duplicate. \
+                                Exiting now, use --{} to allow duplicates.",
+                                i + 1, count, IGNORE_DUPLICATES_FLAG
+                            );
+                            return Err(DETECTED_DUPLICATE_MESSAGE.to_string());
+                        }
+                    }
+                    ImportKeystoreStatus::Error => {
+                        eprintln!(
+                            "Upload of keystore {} of {} failed with message: {:?}. \
+                                A potential solution is run this command again \
+                                using the --{} flag, however care should be taken to ensure \
+                                that there are no duplicate deposits submitted.",
+                            i + 1,
+                            count,
+                            status.message,
+                            IGNORE_DUPLICATES_FLAG
+                        );
+                        return Err(format!("Upload failed with {:?}", status.message));
+                    }
+                }
+            }
+            e @ Err(UploadError::InvalidPublicKey) => {
+                eprintln!("Validator {} has an invalid public key", i);
+                return Err(format!("{:?}", e));
+            }
+            ref e @ Err(UploadError::DuplicateValidator(voting_public_key)) => {
+                eprintln!(
+                    "Duplicate validator {:?} already exists on the destination validator client. \
+                    This may indicate that some validators are running in two places at once, which \
+                    can lead to slashing. If you are certain that there is no risk, add the --{} flag.",
+                    voting_public_key, IGNORE_DUPLICATES_FLAG
+                );
+                return Err(format!("{:?}", e));
+            }
+            Err(UploadError::FailedToListKeys(e)) => {
+                eprintln!(
+                    "Failed to list keystores. Some keys may have been imported whilst \
+                    others may not have been imported. A potential solution is run this command again \
+                    using the --{} flag, however care should be taken to ensure that there are no \
+                    duplicate deposits submitted.",
+                    IGNORE_DUPLICATES_FLAG
+                );
+                return Err(format!("{:?}", e));
+            }
+            Err(UploadError::KeyUploadFailed(e)) => {
+                eprintln!(
+                    "Failed to upload keystore. Some keys may have been imported whilst \
+                    others may not have been imported. A potential solution is run this command again \
+                    using the --{} flag, however care should be taken to ensure that there are no \
+                    duplicate deposits submitted.",
+                    IGNORE_DUPLICATES_FLAG
+                );
+                return Err(format!("{:?}", e));
+            }
+            Err(UploadError::IncorrectStatusCount(count)) => {
+                eprintln!(
+                    "Keystore was uploaded, however the validator client returned an invalid response. \
+                    A potential solution is run this command again using the --{} flag, however care \
+                    should be taken to ensure that there are no duplicate deposits submitted.",
+                    IGNORE_DUPLICATES_FLAG
+                );
+                return Err(format!(
+                    "Invalid status count in import response: {}",
+                    count
+                ));
+            }
+            Err(UploadError::FeeRecipientUpdateFailed(e)) => {
+                eprintln!(
+                    "Failed to set fee recipient for validator {}. This value may need \
+                    to be set manually. Continuing with other validators. Error was {:?}",
+                    i, e
+                );
+            }
+            Err(UploadError::PatchValidatorFailed(e)) => {
+                eprintln!(
+                    "Failed to set some values on validator {} (e.g., builder, enabled or gas limit. \
+                    These values value may need to be set manually. Continuing with other validators. \
+                    Error was {:?}",
+                    i, e
+                );
+            }
+        }
+    }
+
+    Ok(())
+}
+
+// The tests use crypto and are too slow in debug.
+#[cfg(not(debug_assertions))]
+#[cfg(test)]
+pub mod tests {
+    use super::*;
+    use crate::create_validators::tests::TestBuilder as CreateTestBuilder;
+    use std::fs;
+    use tempfile::{tempdir, TempDir};
+    use validator_client::http_api::{test_utils::ApiTester, Config as HttpConfig};
+
+    const VC_TOKEN_FILE_NAME: &str = "vc_token.json";
+
+    pub struct TestBuilder {
+        import_config: ImportConfig,
+        pub vc: ApiTester,
+        /// Holds the temp directory owned by the `CreateTestBuilder` so it doesn't get cleaned-up
+        /// before we can read it.
+        create_dir: Option<TempDir>,
+        _dir: TempDir,
+    }
+
+    impl TestBuilder {
+        pub async fn new() -> Self {
+            Self::new_with_http_config(ApiTester::default_http_config()).await
+        }
+
+        pub async fn new_with_http_config(http_config: HttpConfig) -> Self {
+            let dir = tempdir().unwrap();
+            let vc = ApiTester::new_with_http_config(http_config).await;
+            let vc_token_path = dir.path().join(VC_TOKEN_FILE_NAME);
+            fs::write(&vc_token_path, &vc.api_token).unwrap();
+
+            Self {
+                import_config: ImportConfig {
+                    // This field will be overwritten later on.
+                    validators_file_path: dir.path().into(),
+                    vc_url: vc.url.clone(),
+                    vc_token_path,
+                    ignore_duplicates: false,
+                },
+                vc,
+                create_dir: None,
+                _dir: dir,
+            }
+        }
+
+        pub fn mutate_import_config<F: Fn(&mut ImportConfig)>(mut self, func: F) -> Self {
+            func(&mut self.import_config);
+            self
+        }
+
+        pub async fn create_validators(mut self, count: u32, first_index: u32) -> Self {
+            let create_result = CreateTestBuilder::default()
+                .mutate_config(|config| {
+                    config.count = count;
+                    config.first_index = first_index;
+                })
+                .run_test()
+                .await;
+            assert!(
+                create_result.result.is_ok(),
+                "precondition: validators are created"
+            );
+            self.import_config.validators_file_path = create_result.validators_file_path();
+            self.create_dir = Some(create_result.output_dir);
+            self
+        }
+
+        /// Imports validators without running the entire test suite in `Self::run_test`. This is
+        /// useful for simulating duplicate imports.
+        pub async fn import_validators_without_checks(self) -> Self {
+            run(self.import_config.clone()).await.unwrap();
+            self
+        }
+
+        pub async fn run_test(self) -> TestResult {
+            let result = run(self.import_config.clone()).await;
+
+            if result.is_ok() {
+                self.vc.ensure_key_cache_consistency().await;
+
+                let local_validators: Vec<ValidatorSpecification> = {
+                    let contents =
+                        fs::read_to_string(&self.import_config.validators_file_path).unwrap();
+                    serde_json::from_str(&contents).unwrap()
+                };
+                let list_keystores_response = self.vc.client.get_keystores().await.unwrap().data;
+
+                assert_eq!(
+                    local_validators.len(),
+                    list_keystores_response.len(),
+                    "vc should have exactly the number of validators imported"
+                );
+
+                for local_validator in &local_validators {
+                    let local_keystore = &local_validator.voting_keystore.0;
+                    let local_pubkey = local_keystore.public_key().unwrap().into();
+                    let remote_validator = list_keystores_response
+                        .iter()
+                        .find(|validator| validator.validating_pubkey == local_pubkey)
+                        .expect("validator must exist on VC");
+                    assert_eq!(&remote_validator.derivation_path, &local_keystore.path());
+                    assert_eq!(remote_validator.readonly, Some(false));
+                }
+            }
+
+            TestResult {
+                result,
+                vc: self.vc,
+            }
+        }
+    }
+
+    #[must_use] // Use the `assert_ok` or `assert_err` fns to "use" this value.
+    pub struct TestResult {
+        pub result: Result<(), String>,
+        pub vc: ApiTester,
+    }
+
+    impl TestResult {
+        fn assert_ok(self) {
+            assert_eq!(self.result, Ok(()))
+        }
+
+        fn assert_err_contains(self, msg: &str) {
+            assert!(self.result.unwrap_err().contains(msg))
+        }
+    }
+
+    #[tokio::test]
+    async fn create_one_validator() {
+        TestBuilder::new()
+            .await
+            .create_validators(1, 0)
+            .await
+            .run_test()
+            .await
+            .assert_ok();
+    }
+
+    #[tokio::test]
+    async fn create_three_validators() {
+        TestBuilder::new()
+            .await
+            .create_validators(3, 0)
+            .await
+            .run_test()
+            .await
+            .assert_ok();
+    }
+
+    #[tokio::test]
+    async fn create_one_validator_with_offset() {
+        TestBuilder::new()
+            .await
+            .create_validators(1, 42)
+            .await
+            .run_test()
+            .await
+            .assert_ok();
+    }
+
+    #[tokio::test]
+    async fn create_three_validators_with_offset() {
+        TestBuilder::new()
+            .await
+            .create_validators(3, 1337)
+            .await
+            .run_test()
+            .await
+            .assert_ok();
+    }
+
+    #[tokio::test]
+    async fn import_duplicates_when_disallowed() {
+        TestBuilder::new()
+            .await
+            .create_validators(1, 0)
+            .await
+            .import_validators_without_checks()
+            .await
+            .run_test()
+            .await
+            .assert_err_contains("DuplicateValidator");
+    }
+
+    #[tokio::test]
+    async fn import_duplicates_when_allowed() {
+        TestBuilder::new()
+            .await
+            .mutate_import_config(|config| {
+                config.ignore_duplicates = true;
+            })
+            .create_validators(1, 0)
+            .await
+            .import_validators_without_checks()
+            .await
+            .run_test()
+            .await
+            .assert_ok();
+    }
+}

validator_manager/src/lib.rs

@@ -0,0 +1,85 @@
+use clap::App;
+use clap::ArgMatches;
+use common::write_to_json_file;
+use environment::Environment;
+use serde::Serialize;
+use std::path::PathBuf;
+use types::EthSpec;
+
+pub mod common;
+pub mod create_validators;
+pub mod import_validators;
+pub mod move_validators;
+
+pub const CMD: &str = "validator_manager";
+
+/// This flag is on the top-level `lighthouse` binary.
+const DUMP_CONFIGS_FLAG: &str = "dump-config";
+
+/// Used only in testing, this allows a command to dump its configuration to a file and then exit
+/// successfully. This allows for testing how the CLI arguments translate to some configuration.
+pub enum DumpConfig {
+    Disabled,
+    Enabled(PathBuf),
+}
+
+impl DumpConfig {
+    /// Returns `Ok(true)` if the configuration was successfully written to a file and the
+    /// application should exit successfully without doing anything else.
+    pub fn should_exit_early<T: Serialize>(&self, config: &T) -> Result<bool, String> {
+        match self {
+            DumpConfig::Disabled => Ok(false),
+            DumpConfig::Enabled(dump_path) => {
+                dbg!(dump_path);
+                write_to_json_file(dump_path, config)?;
+                Ok(true)
+            }
+        }
+    }
+}
+
+pub fn cli_app<'a, 'b>() -> App<'a, 'b> {
+    App::new(CMD)
+        .visible_aliases(&["vm", "validator-manager", CMD])
+        .about("Utilities for managing a Lighthouse validator client via the HTTP API.")
+        .subcommand(create_validators::cli_app())
+        .subcommand(import_validators::cli_app())
+        .subcommand(move_validators::cli_app())
+}
+
+/// Run the account manager, returning an error if the operation did not succeed.
+pub fn run<'a, T: EthSpec>(matches: &'a ArgMatches<'a>, env: Environment<T>) -> Result<(), String> {
+    let context = env.core_context();
+    let spec = context.eth2_config.spec;
+    let dump_config = clap_utils::parse_optional(matches, DUMP_CONFIGS_FLAG)?
+        .map(DumpConfig::Enabled)
+        .unwrap_or_else(|| DumpConfig::Disabled);
+
+    context
+        .executor
+        // This `block_on_dangerous` call reasonable since it is at the very highest level of the
+        // application, the rest of which is all async. All other functions below this should be
+        // async and should never call `block_on_dangerous` themselves.
+        .block_on_dangerous(
+            async {
+                match matches.subcommand() {
+                    (create_validators::CMD, Some(matches)) => {
+                        create_validators::cli_run::<T>(matches, &spec, dump_config).await
+                    }
+                    (import_validators::CMD, Some(matches)) => {
+                        import_validators::cli_run(matches, dump_config).await
+                    }
+                    (move_validators::CMD, Some(matches)) => {
+                        move_validators::cli_run(matches, dump_config).await
+                    }
+                    ("", _) => Err("No command supplied. See --help.".to_string()),
+                    (unknown, _) => Err(format!(
+                        "{} is not a valid {} command. See --help.",
+                        unknown, CMD
+                    )),
+                }
+            },
+            "validator_manager",
+        )
+        .ok_or("Shutting down")?
+}

validator_manager/test_vectors/.gitignore

@@ -0,0 +1 @@
+tmp/

validator_manager/test_vectors/generate.py

@@ -0,0 +1,123 @@
+# This script uses the `ethereum/staking-deposit-cli` tool to generate
+# deposit data files which are then used for testing by Lighthouse.
+#
+# To generate vectors, simply run this Python script:
+#
+# `python generate.py`
+#
+import os
+import sys
+import shutil
+import subprocess
+from subprocess import Popen, PIPE, STDOUT
+
+
+NUM_VALIDATORS=3
+TEST_MNEMONIC = "test test test test test test test test test test test waste"
+WALLET_NAME="test_wallet"
+
+
+tmp_dir = os.path.join(".", "tmp")
+mnemonic_path = os.path.join(tmp_dir, "mnemonic.txt")
+sdc_dir = os.path.join(tmp_dir, "sdc")
+sdc_git_dir = os.path.join(sdc_dir, "staking-deposit-cli")
+vectors_dir = os.path.join(".", "vectors")
+
+
+def setup():
+    cleanup()
+
+    if os.path.exists(vectors_dir):
+        shutil.rmtree(vectors_dir)
+
+    os.mkdir(tmp_dir)
+    os.mkdir(sdc_dir)
+    os.mkdir(vectors_dir)
+
+    setup_sdc()
+    with open(mnemonic_path, "x") as file:
+        file.write(TEST_MNEMONIC)
+
+
+def cleanup():
+    if os.path.exists(tmp_dir):
+        shutil.rmtree(tmp_dir)
+
+    # Remove all the keystores since we don't use them in testing.
+    if os.path.exists(vectors_dir):
+        for root, dirs, files in os.walk(vectors_dir):
+            for file in files:
+                if file.startswith("keystore"):
+                    os.remove(os.path.join(root, file))
+
+
+def setup_sdc():
+    result = subprocess.run([
+        "git",
+        "clone",
+        "--single-branch",
+        "https://github.com/ethereum/staking-deposit-cli.git",
+        str(sdc_git_dir)
+    ])
+    assert(result.returncode == 0)
+    result = subprocess.run([
+        "pip",
+        "install",
+        "-r",
+        "requirements.txt",
+    ], cwd=sdc_git_dir)
+    assert(result.returncode == 0)
+    result = subprocess.run([
+        "python",
+        "setup.py",
+        "install",
+    ], cwd=sdc_git_dir)
+    assert(result.returncode == 0)
+
+
+def sdc_generate(network, first_index, count, eth1_withdrawal_address=None):
+    if eth1_withdrawal_address is not None:
+        eth1_flags = ['--eth1_withdrawal_address', eth1_withdrawal_address]
+        uses_eth1 = True
+    else:
+        eth1_flags = []
+        uses_eth1 = False
+
+    test_name = "{}_first_{}_count_{}_eth1_{}".format(network, first_index, count,
+                                                      str(uses_eth1).lower())
+    output_dir = os.path.join(vectors_dir, test_name)
+    os.mkdir(output_dir)
+
+    command = [
+        '/bin/sh',
+        'deposit.sh',
+        '--language', 'english',
+        '--non_interactive',
+        'existing-mnemonic',
+        '--validator_start_index', str(first_index),
+        '--num_validators', str(count),
+        '--mnemonic', TEST_MNEMONIC,
+        '--chain', network,
+        '--keystore_password', 'MyPassword',
+        '--folder', os.path.abspath(output_dir),
+    ] + eth1_flags
+
+    print("Running " + test_name)
+    process = Popen(command, cwd=sdc_git_dir, text=True, stdin = PIPE)
+    process.wait()
+
+
+def test_network(network):
+    sdc_generate(network, first_index=0, count=1)
+    sdc_generate(network, first_index=0, count=2)
+    sdc_generate(network, first_index=12, count=1)
+    sdc_generate(network, first_index=99, count=2)
+    sdc_generate(network, first_index=1024, count=3)
+    sdc_generate(network, first_index=0, count=2,
+                 eth1_withdrawal_address="0x0f51bb10119727a7e5ea3538074fb341f56b09ad")
+
+
+setup()
+test_network("mainnet")
+test_network("prater")
+cleanup()

validator_manager/test_vectors/vectors/mainnet_first_0_count_1_eth1_false/validator_keys/deposit_data-1660803666.json

@@ -0,0 +1 @@
+[{"pubkey": "88b6b3a9b391fa5593e8bce8d06102df1a56248368086929709fbb4a8570dc6a560febeef8159b19789e9c1fd13572f0", "withdrawal_credentials": "0049b6188ed20314309f617dd4030b8ddfac3c6e65759a03c226a13b2fe4cc72", "amount": 32000000000, "signature": "8ac88247c1b431a2d1eb2c5f00e7b8467bc21d6dc267f1af9ef727a12e32b4299e3b289ae5734a328b3202478dd746a80bf9e15a2217240dca1fc1b91a6b7ff7a0f5830d9a2610c1c30f19912346271357c21bd9af35a74097ebbdda2ddaf491", "deposit_message_root": "a9bc1d21cc009d9b10782a07213e37592c0d235463ed0117dec755758da90d51", "deposit_data_root": "807a20b2801eabfd9065c1b74ed6ae3e991a1ab770e4eaf268f30b37cfd2cbd7", "fork_version": "00000000", "network_name": "mainnet", "deposit_cli_version": "2.3.0"}]

validator_manager/test_vectors/vectors/mainnet_first_0_count_2_eth1_false/validator_keys/deposit_data-1660803669.json

@@ -0,0 +1 @@
+[{"pubkey": "88b6b3a9b391fa5593e8bce8d06102df1a56248368086929709fbb4a8570dc6a560febeef8159b19789e9c1fd13572f0", "withdrawal_credentials": "0049b6188ed20314309f617dd4030b8ddfac3c6e65759a03c226a13b2fe4cc72", "amount": 32000000000, "signature": "8ac88247c1b431a2d1eb2c5f00e7b8467bc21d6dc267f1af9ef727a12e32b4299e3b289ae5734a328b3202478dd746a80bf9e15a2217240dca1fc1b91a6b7ff7a0f5830d9a2610c1c30f19912346271357c21bd9af35a74097ebbdda2ddaf491", "deposit_message_root": "a9bc1d21cc009d9b10782a07213e37592c0d235463ed0117dec755758da90d51", "deposit_data_root": "807a20b2801eabfd9065c1b74ed6ae3e991a1ab770e4eaf268f30b37cfd2cbd7", "fork_version": "00000000", "network_name": "mainnet", "deposit_cli_version": "2.3.0"}, {"pubkey": "a33ab9d93fb53c4f027944aaa11a13be0c150b7cc2e379d85d1ed4db38d178b4e4ebeae05832158b8c746c1961da00ce", "withdrawal_credentials": "00ad3748cbd1adc855c2bdab431f7e755a21663f4f6447ac888e5855c588af5a", "amount": 32000000000, "signature": "84b9fc8f260a1488c4c9a438f875edfa2bac964d651b2bc886d8442829b13f89752e807c8ca9bae9d50b1b506d3a64730015dd7f91e271ff9c1757d1996dcf6082fe5205cf6329fa2b6be303c21b66d75be608757a123da6ee4a4f14c01716d7", "deposit_message_root": "c5271aba974c802ff5b02b11fa33b545d7f430ff3b85c0f9eeef4cd59d83abf3", "deposit_data_root": "cd991ea8ff32e6b3940aed43b476c720fc1abd3040893b77a8a3efb306320d4c", "fork_version": "00000000", "network_name": "mainnet", "deposit_cli_version": "2.3.0"}]

validator_manager/test_vectors/vectors/mainnet_first_0_count_2_eth1_true/validator_keys/deposit_data-1660803684.json

@@ -0,0 +1 @@
+[{"pubkey": "88b6b3a9b391fa5593e8bce8d06102df1a56248368086929709fbb4a8570dc6a560febeef8159b19789e9c1fd13572f0", "withdrawal_credentials": "0100000000000000000000000f51bb10119727a7e5ea3538074fb341f56b09ad", "amount": 32000000000, "signature": "a8461b58a5a5a0573c4af37da6ee4ba63e35894cffad6797d4a2c80f8f2c79d2c30c0de0299d8edde76e0c3f3e6d4f1e03cc377969f56d8760717d6e86f9316da9375573ce7bb87a8520daedb13c49284377f7a4f64a70aa2ca44b1581d47e20", "deposit_message_root": "62967565d11471da4af7769911926cd1826124048036b25616216f99bc320f13", "deposit_data_root": "d26d642a880ff8a109260fe69681840f6e1868c8c1cd2163a1db5a094e8db03a", "fork_version": "00000000", "network_name": "mainnet", "deposit_cli_version": "2.3.0"}, {"pubkey": "a33ab9d93fb53c4f027944aaa11a13be0c150b7cc2e379d85d1ed4db38d178b4e4ebeae05832158b8c746c1961da00ce", "withdrawal_credentials": "0100000000000000000000000f51bb10119727a7e5ea3538074fb341f56b09ad", "amount": 32000000000, "signature": "93a398c09143203beb94c9223c7e18f36e5ea36090875284b222c2fcb16982e6f2e26f27ca9d30e3c6f6b5ad44857fc50f531925f4736810712f68a9d7a9c0eb664a851180f3b7d2e44a35717d43b3d3e4fd555354fa1dfa92f451870f36084d", "deposit_message_root": "ce110433298ffb78d827d67dcc13655344a139cb7e3ce10b341937c0a76b25b7", "deposit_data_root": "7c7617a2c11870ec49e975b3691b9f822d63938df38555161e23aa245b150c66", "fork_version": "00000000", "network_name": "mainnet", "deposit_cli_version": "2.3.0"}]

validator_manager/test_vectors/vectors/mainnet_first_1024_count_3_eth1_false/validator_keys/deposit_data-1660803679.json

@@ -0,0 +1 @@
+[{"pubkey": "92ca8dddba4ae7ada6584c377fc53fb978ad9d5ee8db585b18e226c27682b326b3c68e10f5d99a453e233268c144e0ef", "withdrawal_credentials": "00dd4f8bfd1a48be288c2af8bb7315f6198900b5b3f56df010420d5328e682cb", "amount": 32000000000, "signature": "a0a96851892b257c032284928641021e58e0bcd277c3da5a2c41bcce6633d144781e4761261138277b5a8cf0ead59cce073e5a3bbc4704a37abf8cd1e290dc52e56cb0c334303945ebbb79be453c8177937e44e08f980679f1a2997fe58d2d86", "deposit_message_root": "5421d9177b4d035e6525506509ab702c5f458c53458dad437097b37cb8209b43", "deposit_data_root": "2bedaf48f8315d8631defc97c1c4c05a8152e2dc3fe779fc8e800dd67bd839a2", "fork_version": "00000000", "network_name": "mainnet", "deposit_cli_version": "2.3.0"}, {"pubkey": "86474cd2874663445ef0ee02aca81b2b942a383fd4c7085fa675388e26c67afc0fef44a8666d46f571723e349ae4a0cb", "withdrawal_credentials": "001c31aa161ed1d3c481c1ee8f3ad1853217296a15877917fe3c2f680580ac01", "amount": 32000000000, "signature": "b469179ad8ba9d6ad71b99a3c7ae662d9b77cca3ee53b20ab2eb20beee31874ad47224e94e75578fa6ecd30c1d40a0b300053817f934169d84425691edf13216445fbc6dd9b0953ad3af20c834fba63c1f50c0b0f92dd8bf383cd2cc8e0431f1", "deposit_message_root": "279271f7065c83868c37021c32c014516b21e6188fb2cee4e8543c5d38427698", "deposit_data_root": "69862477671957ab0b3f1167c5cd550c107132a0079eb70eaa4bc5c5fe06b5a0", "fork_version": "00000000", "network_name": "mainnet", "deposit_cli_version": "2.3.0"}, {"pubkey": "997e27aa262238beb01464434694a466321b5270297bdfdb944b65a3b6617b6ce2613628ac35a8f4cf2e9b4b55c46ef8", "withdrawal_credentials": "0097fffee9cf9fd91a6fa89af90e73f1cb8b8a043e742afaeb2e57b83b0845fe", "amount": 32000000000, "signature": "a8b05626657ce5b1801e0824aaeb21de2e1a11bc16cad6100ac911bcb873aaf7e7282f1f8465df4aaea998a1a4e1645f075e7e65f8c6b8688b0162f86be2128541f91fc9feb628bcab3b4afec1f7aeccaba04aaa54dc17c738233d360f94b97e", "deposit_message_root": "187e177721bfdd8ea13cb52c8de2dead29164a0e093efb640457a0e6ac918191", "deposit_data_root": "34ef32901d793cd9a0a3d93e7ee40e7be9abe6fb26f0b49a86b8ff29dc649930", "fork_version": "00000000", "network_name": "mainnet", "deposit_cli_version": "2.3.0"}]

validator_manager/test_vectors/vectors/mainnet_first_12_count_1_eth1_false/validator_keys/deposit_data-1660803672.json

@@ -0,0 +1 @@
+[{"pubkey": "8b181759a027c09a409ef24f6b35db213982c2474e2017f3851d76b1c4e560a4238072f67a0c22cb667f940da4ea9ec9", "withdrawal_credentials": "00cbec90e8570679f565bd4645f73a078981067a705564283e61c93c81707842", "amount": 32000000000, "signature": "a57299cde3c2ea8dc17ad3ce5a38a5f6de69d198599150dc4df02624ba1d8672440d02c0d27c3dc3b8c9f86c679571ab14c798426acd9b059895f1f5887bdee805fb4e31bd8f93ec9e78403c23d7924f23eae6af056154f35fee03bf9ffe0e98", "deposit_message_root": "fcdf3d94740766299a95b3e477e64abadff6ab8978400578f241c93eb367b938", "deposit_data_root": "246619823b45d80f53a30404542ec4be447d4e268cc0afcdf480e6a846d58411", "fork_version": "00000000", "network_name": "mainnet", "deposit_cli_version": "2.3.0"}]

validator_manager/test_vectors/vectors/mainnet_first_99_count_2_eth1_false/validator_keys/deposit_data-1660803675.json

@@ -0,0 +1 @@
+[{"pubkey": "a57a4ed429e415b862cc758e75c93936e3f6339640d0763b969ba133a82c03717827fbdd8ec42fc862ed50e3b5b528dc", "withdrawal_credentials": "00864081ef2f5aec1aa667872615e25027f1fdc256a4948b6318cf75a8d635a3", "amount": 32000000000, "signature": "8ca8a6f30b4346d7b9912e3dcd820652bc472511f89d91fd102acfb0c8df1cfc7a2629f44170727e126e88f2847fe5c9081b13fb0838a2b2343a95cabf16f57708fc0cf846bc5307209ae976c34500cc826ff48ab64169d8bebec99dded5dd1d", "deposit_message_root": "c08d0ecd085bc0f50c35f1b34d8b8937b2b9c8a172a9808de70f8d448c526f07", "deposit_data_root": "c0c6cd40b43ea0fe7fcc284de9acd9c1bd001bb88c059c155393af22a6c85d46", "fork_version": "00000000", "network_name": "mainnet", "deposit_cli_version": "2.3.0"}, {"pubkey": "a2801622bc391724989004b5de78cb85746f85a303572691ecc945d9f5c61ec512127e58482e0dfcb4de77be3294ab01", "withdrawal_credentials": "00edff674c66a7f58285554e700183aeee5e740691de8087f7ce4d81f3597108", "amount": 32000000000, "signature": "8c0784645c611b4f514a6519b737f2d02df3eba0e04cd30efebffcca769af8cc599ce28e4421cefe665ec31d3c34e44c174e0cca4891d8196796085e712459b45e411efecd07cf3258f1d6309a07a6dd52a0ae186e6184d37bf11cee36ec84e8", "deposit_message_root": "f5a530bee9698c2447961ecd210184fbb130bbb8e8916988d802d47e3b147842", "deposit_data_root": "c57790b77ef97318d4ec7b97ea07ea458d08209ba372bfe76171e2ece22d6130", "fork_version": "00000000", "network_name": "mainnet", "deposit_cli_version": "2.3.0"}]

validator_manager/test_vectors/vectors/prater_first_0_count_1_eth1_false/validator_keys/deposit_data-1660803687.json

@@ -0,0 +1 @@
+[{"pubkey": "88b6b3a9b391fa5593e8bce8d06102df1a56248368086929709fbb4a8570dc6a560febeef8159b19789e9c1fd13572f0", "withdrawal_credentials": "0049b6188ed20314309f617dd4030b8ddfac3c6e65759a03c226a13b2fe4cc72", "amount": 32000000000, "signature": "a940e0142ad9b56a1310326137347d1ada275b31b3748af4accc63bd189573376615be8e8ae047766c6d10864e54b2e7098177598edf3a043eb560bbdf1a1c12588375a054d1323a0900e2286d0993cde9675e5b74523e6e8e03715cc96b3ce5", "deposit_message_root": "a9bc1d21cc009d9b10782a07213e37592c0d235463ed0117dec755758da90d51", "deposit_data_root": "28484efb20c961a1354689a556d4c352fe9deb24684efdb32d22e1af17e2a45d", "fork_version": "00001020", "network_name": "goerli", "deposit_cli_version": "2.3.0"}]

validator_manager/test_vectors/vectors/prater_first_0_count_2_eth1_false/validator_keys/deposit_data-1660803690.json

@@ -0,0 +1 @@
+[{"pubkey": "88b6b3a9b391fa5593e8bce8d06102df1a56248368086929709fbb4a8570dc6a560febeef8159b19789e9c1fd13572f0", "withdrawal_credentials": "0049b6188ed20314309f617dd4030b8ddfac3c6e65759a03c226a13b2fe4cc72", "amount": 32000000000, "signature": "a940e0142ad9b56a1310326137347d1ada275b31b3748af4accc63bd189573376615be8e8ae047766c6d10864e54b2e7098177598edf3a043eb560bbdf1a1c12588375a054d1323a0900e2286d0993cde9675e5b74523e6e8e03715cc96b3ce5", "deposit_message_root": "a9bc1d21cc009d9b10782a07213e37592c0d235463ed0117dec755758da90d51", "deposit_data_root": "28484efb20c961a1354689a556d4c352fe9deb24684efdb32d22e1af17e2a45d", "fork_version": "00001020", "network_name": "goerli", "deposit_cli_version": "2.3.0"}, {"pubkey": "a33ab9d93fb53c4f027944aaa11a13be0c150b7cc2e379d85d1ed4db38d178b4e4ebeae05832158b8c746c1961da00ce", "withdrawal_credentials": "00ad3748cbd1adc855c2bdab431f7e755a21663f4f6447ac888e5855c588af5a", "amount": 32000000000, "signature": "87b4b4e9c923aa9e1687219e9df0e838956ee6e15b7ab18142467430d00940dc7aa243c9996e85125dfe72d9dbdb00a30a36e16a2003ee0c86f29c9f5d74f12bfe5b7f62693dbf5187a093555ae8d6b48acd075788549c4b6a249b397af24cd0", "deposit_message_root": "c5271aba974c802ff5b02b11fa33b545d7f430ff3b85c0f9eeef4cd59d83abf3", "deposit_data_root": "ea80b639356a03f6f58e4acbe881fabefc9d8b93375a6aa7e530c77d7e45d3e4", "fork_version": "00001020", "network_name": "goerli", "deposit_cli_version": "2.3.0"}]

validator_manager/test_vectors/vectors/prater_first_0_count_2_eth1_true/validator_keys/deposit_data-1660803705.json

@@ -0,0 +1 @@
+[{"pubkey": "88b6b3a9b391fa5593e8bce8d06102df1a56248368086929709fbb4a8570dc6a560febeef8159b19789e9c1fd13572f0", "withdrawal_credentials": "0100000000000000000000000f51bb10119727a7e5ea3538074fb341f56b09ad", "amount": 32000000000, "signature": "ab32595d8201c2b4e8173aece9151fdc15f4d2ad36008462d0416598ddbf0f37ed0877f06d284a9669e73dbc0885bd2207fe64385e95a4488dc2bcb2c324d5c20da3248a6244463583dfbba8db20805765421e59cb56b0bc3ee6d24a9218216d", "deposit_message_root": "62967565d11471da4af7769911926cd1826124048036b25616216f99bc320f13", "deposit_data_root": "b4df3a3a26dd5f6eb32999d8a7051a7d1a8573a16553d4b45ee706a0d59c1066", "fork_version": "00001020", "network_name": "goerli", "deposit_cli_version": "2.3.0"}, {"pubkey": "a33ab9d93fb53c4f027944aaa11a13be0c150b7cc2e379d85d1ed4db38d178b4e4ebeae05832158b8c746c1961da00ce", "withdrawal_credentials": "0100000000000000000000000f51bb10119727a7e5ea3538074fb341f56b09ad", "amount": 32000000000, "signature": "9655e195eda5517efe6f36bcebd45250c889a4177d7bf5fcd59598d2d03f37f038b5ee2ec079a30a8382ea42f351943f08a6f006bab9c2130db2742bd7315c8ad5aa1f03a0801c26d4c9efdef71c4c59c449c7f9b21fa62600ab8f5f1e2b938a", "deposit_message_root": "ce110433298ffb78d827d67dcc13655344a139cb7e3ce10b341937c0a76b25b7", "deposit_data_root": "7661474fba11bfb453274f62df022cab3c0b6f4a58af4400f6bce83c9cb5fcb8", "fork_version": "00001020", "network_name": "goerli", "deposit_cli_version": "2.3.0"}]

validator_manager/test_vectors/vectors/prater_first_1024_count_3_eth1_false/validator_keys/deposit_data-1660803701.json

@@ -0,0 +1 @@
+[{"pubkey": "92ca8dddba4ae7ada6584c377fc53fb978ad9d5ee8db585b18e226c27682b326b3c68e10f5d99a453e233268c144e0ef", "withdrawal_credentials": "00dd4f8bfd1a48be288c2af8bb7315f6198900b5b3f56df010420d5328e682cb", "amount": 32000000000, "signature": "b5dae79ce8f3d7326b46f93182981c5f3d64257a457f038caa78ec8e5cc25a9fdac52c7beb221ab2a3205404131366ad18e1e13801393b3d486819e8cca96128bf1244884a91d05dced092c74bc1e7259788f30dd3432df15f3d2f629645f345", "deposit_message_root": "5421d9177b4d035e6525506509ab702c5f458c53458dad437097b37cb8209b43", "deposit_data_root": "94213d76aba9e6a434589d4939dd3764e0832df78f66d30db22a760c14ba1b89", "fork_version": "00001020", "network_name": "goerli", "deposit_cli_version": "2.3.0"}, {"pubkey": "86474cd2874663445ef0ee02aca81b2b942a383fd4c7085fa675388e26c67afc0fef44a8666d46f571723e349ae4a0cb", "withdrawal_credentials": "001c31aa161ed1d3c481c1ee8f3ad1853217296a15877917fe3c2f680580ac01", "amount": 32000000000, "signature": "816f38a321c4f84ad5187eda58f6d9c1fd1e81c860ed1722bdb76b920fdd430a1e814b9bb893837ae3b38ad738684fbf1795fa687f617c52121472b1ac8d2e34e5c1127186233a8833ffb54c509d9e52cb7242c6c6a65b5e496296b3caa90d89", "deposit_message_root": "279271f7065c83868c37021c32c014516b21e6188fb2cee4e8543c5d38427698", "deposit_data_root": "7ad1d059d69794680a1deef5e72c33827f0c449a5f0917095821c0343572789d", "fork_version": "00001020", "network_name": "goerli", "deposit_cli_version": "2.3.0"}, {"pubkey": "997e27aa262238beb01464434694a466321b5270297bdfdb944b65a3b6617b6ce2613628ac35a8f4cf2e9b4b55c46ef8", "withdrawal_credentials": "0097fffee9cf9fd91a6fa89af90e73f1cb8b8a043e742afaeb2e57b83b0845fe", "amount": 32000000000, "signature": "95d20c35484dea6b2a0bd7c2da2d2e810d7829e14c03657b2524adfc2111aa5ed95908ecb975ff75ff742c68ce8df417016c048959b0f807675430f6d981478e26d48e594e0830a0406da9817f8a1ecb94bd8be1f9281eeb5e952a82173c72bb", "deposit_message_root": "187e177721bfdd8ea13cb52c8de2dead29164a0e093efb640457a0e6ac918191", "deposit_data_root": "83abfb2a166f7af708526a9bdd2767c4be3cd231c9bc4e2f047a80df88a2860c", "fork_version": "00001020", "network_name": "goerli", "deposit_cli_version": "2.3.0"}]

validator_manager/test_vectors/vectors/prater_first_12_count_1_eth1_false/validator_keys/deposit_data-1660803693.json

@@ -0,0 +1 @@
+[{"pubkey": "8b181759a027c09a409ef24f6b35db213982c2474e2017f3851d76b1c4e560a4238072f67a0c22cb667f940da4ea9ec9", "withdrawal_credentials": "00cbec90e8570679f565bd4645f73a078981067a705564283e61c93c81707842", "amount": 32000000000, "signature": "8f75836ceb390dd4fc8c16bc4be52ca09b9c5aa0ab5bc16dcfdb344787b29ddfd76d877b0a2330bc8e904b233397c6bd124845d1b868e4951cb6daacea023c986bdf0c6ac28d73f65681d941ea96623bc23acc7c84dcfc1304686240d9171cfc", "deposit_message_root": "fcdf3d94740766299a95b3e477e64abadff6ab8978400578f241c93eb367b938", "deposit_data_root": "3011f5cac32f13e86ecc061e89ed6675c27a46ab6ecb1ec6f6e5f133ae1d0287", "fork_version": "00001020", "network_name": "goerli", "deposit_cli_version": "2.3.0"}]

validator_manager/test_vectors/vectors/prater_first_99_count_2_eth1_false/validator_keys/deposit_data-1660803696.json

@@ -0,0 +1 @@
+[{"pubkey": "a57a4ed429e415b862cc758e75c93936e3f6339640d0763b969ba133a82c03717827fbdd8ec42fc862ed50e3b5b528dc", "withdrawal_credentials": "00864081ef2f5aec1aa667872615e25027f1fdc256a4948b6318cf75a8d635a3", "amount": 32000000000, "signature": "a7706e102bfb0b986a5c8050044f7e221919463149771a92c3ca46ff7d4564867db48eaf89b5237fed8db2cdb9c9c057099d0982bbdb3fbfcbe0ab7259ad3f31f7713692b78ee25e6251982e7081d049804632b70b8a24d8c3e59b624a0bd221", "deposit_message_root": "c08d0ecd085bc0f50c35f1b34d8b8937b2b9c8a172a9808de70f8d448c526f07", "deposit_data_root": "8a26fbee0c3a99fe090af1fce68afc525b4e7efa70df72abaa91f29148b2f672", "fork_version": "00001020", "network_name": "goerli", "deposit_cli_version": "2.3.0"}, {"pubkey": "a2801622bc391724989004b5de78cb85746f85a303572691ecc945d9f5c61ec512127e58482e0dfcb4de77be3294ab01", "withdrawal_credentials": "00edff674c66a7f58285554e700183aeee5e740691de8087f7ce4d81f3597108", "amount": 32000000000, "signature": "8b7aa5b0e97d15ec8c2281b919fde9e064f6ac064b163445ea99441ab063f9d10534bfde861b5606021ae46614ff075e0c2305ce5a6cbcc9f0bc8e7df1a177c4d969a5ed4ac062b0ea959bdac963fe206b73565a1a3937adcca736c6117c15f0", "deposit_message_root": "f5a530bee9698c2447961ecd210184fbb130bbb8e8916988d802d47e3b147842", "deposit_data_root": "d38575167a94b516455c5b7e36d24310a612fa0f4580446c5f9d45e4e94f0642", "fork_version": "00001020", "network_name": "goerli", "deposit_cli_version": "2.3.0"}]