fix: accept delegation chains issued by a non-mainnet auth provider

Cargo.toml

@@ -54,6 +54,7 @@ hmac = { version = "0.13", features = ["zeroize"] }
 hybrid-array = { version = "0.4.10", features = ["zeroize"] }
 httptest = "0.16.3"
 ic-agent = { version = "0.49.1" }
+ic-certification = { version = "3.2.0" }
 ic-ed25519 = "0.6.0"
 ic-ledger-types = "0.16.0"
 ic-management-canister-types = { version = "0.9.0" }
@@ -95,6 +96,7 @@ send_ctrlc = "0.6"
 semver = "1"
 serial_test = { version = "3.2.0", features = ["file_locks"] }
 serde = { version = "1.0", features = ["derive"] }
+serde_bytes = "0.11.19"
 serde_cbor = "0.11.2"
 serde_json = "1.0"
 serde_yaml = "0.9.34"

crates/icp-cli/src/commands/canister/create.rs

@@ -355,13 +355,12 @@ async fn create_project_canister(ctx: &Context, args: &CreateArgs) -> Result<(),
         return Ok(());
     }
 
-    let identity = ctx.get_identity(&selections.identity, None).await?;
-    let caller = identity
-        .sender()
-        .map_err(|e| anyhow!("failed to get caller principal: {e}"))?;
     let agent = ctx
         .get_agent_for_env(&selections.identity, &selections.environment)
         .await?;
+    let caller = agent
+        .get_principal()
+        .map_err(|e| anyhow!("failed to get caller principal: {e}"))?;
     let ids = ctx
         .ids_by_environment(&selections.environment)
         .await

crates/icp-cli/src/commands/canister/settings/update.rs

@@ -2,7 +2,6 @@ use anyhow::bail;
 use candid::Nat;
 use clap::{ArgAction, Args};
 use dialoguer::Confirm;
-use ic_agent::Identity;
 use ic_agent::export::Principal;
 use ic_management_canister_types::{
     CanisterIdRecord, CanisterSettings, CanisterStatusResult, EnvironmentVariable,
@@ -391,18 +390,16 @@ pub(crate) struct UpdateArgs {
 
 pub(crate) async fn exec(ctx: &Context, args: &UpdateArgs) -> Result<(), anyhow::Error> {
     let selections = args.cmd_args.selections();
-    let identity = ctx.get_identity(&selections.identity, None).await?;
-    let caller_principal = identity
-        .sender()
-        .map_err(|e| anyhow::anyhow!("failed to get caller principal: {e}"))?;
-
     let agent = ctx
         .get_agent(
             &selections.identity,
             &selections.network,
             &selections.environment,
         )
         .await?;
+    let caller_principal = agent
+        .get_principal()
+        .map_err(|e| anyhow::anyhow!("failed to get caller principal: {e}"))?;
     let cid = ctx
         .get_canister_id(
             &selections.canister,

crates/icp/Cargo.toml

@@ -31,6 +31,7 @@ hex = { workspace = true }
 hmac = { workspace = true }
 hybrid-array = { workspace = true }
 ic-agent = { workspace = true }
+ic-certification = { workspace = true }
 ic-ed25519 = { workspace = true }
 ic-identity-hsm = { workspace = true }
 ic-ledger-types = { workspace = true }
@@ -61,6 +62,7 @@ scrypt = { workspace = true }
 semver = { workspace = true }
 sec1 = { workspace = true }
 serde = { workspace = true }
+serde_bytes = { workspace = true }
 serde_cbor = { workspace = true }
 serde_json = { workspace = true }
 serde_yaml = { workspace = true }