# Starling : Numbers Q3 Thread

## 2022-08-09

### Agenda

1. Signature investigation work into existing photos https://github.com/starlinglab/starling-capture-verifications-2022
- whether we have automated way of verifying old photos
2. Starling Capture (signatures)
- whether Starling can use the app in the future
3. Pablo's photos IOTA registrations
4. Current status of the Starling projects and Numbers Protocol registrations moving forward
- back-to-back calls reliability
- new NFT contracts that need to be set up
- wallet funding

### Notes

#### 1 Existing SJP Photos

- Bofu discussed with Zion engineer
- We know the problem and updated the verification tool
- Confirmed we can verify all non-session based signatures, for photos _before and after_
- (wip) https://github.com/numbersprotocol/starling-capture/tree/fix-verify-legacy-zion-signature/util/verification/verification
- Currently working on session-based
- should not involve app change, all on verification side
- Goal here is to try and verify everything in above repo

#### 2 Starling Capture

- The app needs two patches:
1. non-session-based signature (already applied on [develop](https://github.com/numbersprotocol/starling-capture/commits/develop))
2. session-based signature
- The non-session based is already applied
- The session-based patch should come with the verification tool
- Then a new release will be generated off master
- Starling to send PR off develop to swap https://github.com/numbersprotocol/starling-capture/blob/master/app/build.gradle#L45
- Align versions when releasing official builds

#### 3 Pablo IOTA

- Pablo data based on CAI injection
- Want to update to new spec
- Starling Capture -> DIA server -> push to third-party systems
- Dropbox with Pablo's photos on Starling side: https://www.dropbox.com/scl/fo/trkv5tgweru1k6csjohpz/h?dl=0&rlkey=1wnc8pk0oqjo6hpunvai2c4h4
- DIA owner: [e-mail]
- Tammy sent me https://explorer.iota.org/mainnet/indexed/bafybeifaz2ehhibdtr3mlhjbw3nygen7g33rqmjoih6ankjd32z2qd2cdu for one of them, but how come content in the Dropbox does not have the IOTA registration?
- Should be in `integrity_verification_hash` but missing in the Dropbox dump, but Tammy can find them in Numbers internal system
- Just need to take the `cid` and pop into [IOTA explorer](https://explorer.iota.org/mainnet/indexed/bafybeicg4ha5dr57s72bqyaq2z7aq7bjpgnf3vv5pl7hvlcl4a3ifjny5i) and we can find the registration

#### 4 Starling Protocol API

- back-to-back calls reliability
- shared example that triggers this
- finality around 10-13 seconds
- on-chain nonce assignment
- short-term: make sure we don't do back-to-back calls (> 15 seconds)
- long-term: Tammy and Bofu to recommend
- new NFT contracts that need to be set up
- https://hackmd.io/URP-xe6IRX2aiXxJXZi50A?view contracts will be set up by end of Wed
- wallet funding
- one reg is 2 calls (reg + NFT), costs about 25c
- currently we have 5 AVAX in the wallet and can register about 500+ assets
- Starling should pay for this

## 2022-08-16

### Notes

#### 1 Existing SJP Photos

>1. Between 78 Days and Pantanal, Zion has a breaking change that required a patch on Starling Capture, it is suspected the patch has broken Zion signatures (B) and (C).
- 78 Days: still need photo examples from Jonathan from 78 days, or Bofu will try to find some
- Pantanal: Bofu has data on DIA, should be able to check

>2. Between 1.7.0 and 1.8.0 Numbers version of Starling Capture, there is a change in how proof information is sorted (https://github.com/numbersprotocol/starling-capture/commit/5f53d87f17a71cb490e8aa8bb746c0c1faba430d). If this is a fix to incorrectly sorted proofs, this could mean all proofs at or before 1.7.0 is not verifiable (unless we can find the original order) and 1.8.0 and beyond is fixed. This may affect all signatures.
>3. It seems that Starling's builds of the app (deployed for Pantanal and beyond) are forked before this patch, and therefore does not have the patch that is incorporated into Numbers 1.8.0 (https://github.com/starlinglab/starling-capture/commits/starling-1.0.1). This may affect all signature types.
- Pantanal is based on 1.7.0 app, not 1.8.0, not sure if it affects signature process
- Bofu to confirm in this verification
- If Pantanal verification works, it means all Numbers side issues are resolved ‼️

>4. Starling Integrity when receiving the HTTP POST, unintentionally alters the ordering of the meta name in the multipart message, and therefore the exact signed message may have been lost (unless we can find the original order) even if the Android app is sending the correctly ordered message. This would affect all signatures in deployments that target Starling Integrity as backend (LegCo Election 2021 and beyond). See starlinglab/integrity-backend#91 for details.
- Anything _after_ Pantanal will have this additional problem due to Starling backend
- Plan is to "reverse transform" the JSONs to Android's ordering (the same order sent in the HTTP message before Starling backend re-sorted the keys)

##### Next steps
- Verify existing sigs
- Priorities:
- Pablo
- SCMP
- 78 Days

#### 2 Starling Capture

- Session-based HW signature working now on `1.9.2`: https://github.com/numbersprotocol/starling-capture/tree/develop
- Passes verification code
- [Demo video](https://app.claap.io/numbers-protocol/starling-capture-verification-tool-usage-c-O35CsUM4Uy-tMNLTN7e4OB_)
- [Updated Wiki page with signature/verification flowcharts](https://github.com/numbersprotocol/starling-capture/wiki/Development#verification)
- two versions auto-detected 1.8.0 "classic", with patchs in 1.9.2 "non-classic"