fix concurrent map write

signer/cosigner_security_ecies.go

@@ -20,6 +20,12 @@ type CosignerSecurityECIES struct {
 	eciesPubKeys map[int]CosignerECIESPubKey
 }
 
+// CosignerECIESKey is a cosigner's ECIES public key.
+type CosignerECIESPubKey struct {
+	ID        int
+	PublicKey *ecies.PublicKey
+}
+
 // NewCosignerSecurityECIES creates a new CosignerSecurityECIES.
 func NewCosignerSecurityECIES(key CosignerECIESKey, eciesPubKeys []CosignerECIESPubKey) *CosignerSecurityECIES {
 	c := &CosignerSecurityECIES{

signer/cosigner_security_rsa.go

@@ -19,6 +19,12 @@ type CosignerSecurityRSA struct {
 	rsaPubKeys map[int]CosignerRSAPubKey
 }
 
+// CosignerRSAKey is a cosigner's RSA public key.
+type CosignerRSAPubKey struct {
+	ID        int
+	PublicKey rsa.PublicKey
+}
+
 // NewCosignerSecurityRSA creates a new CosignerSecurityRSA.
 func NewCosignerSecurityRSA(key CosignerRSAKey, rsaPubKeys []CosignerRSAPubKey) *CosignerSecurityRSA {
 	c := &CosignerSecurityRSA{

signer/local_cosigner.go

@@ -1,15 +1,13 @@
 package signer
 
 import (
-	"crypto/rsa"
 	"errors"
 	"fmt"
 	"sync"
 	"time"
 
 	cometcrypto "github.com/cometbft/cometbft/crypto"
 	cometcryptoed25519 "github.com/cometbft/cometbft/crypto/ed25519"
-	ecies "github.com/ecies/go/v2"
 	"golang.org/x/sync/errgroup"
 )
 
@@ -104,16 +102,6 @@ func (hrst *HRSTKey) Less(other HRSTKey) bool {
 	return false
 }
 
-type CosignerRSAPubKey struct {
-	ID        int
-	PublicKey rsa.PublicKey
-}
-
-type CosignerECIESPubKey struct {
-	ID        int
-	PublicKey *ecies.PublicKey
-}
-
 type CosignerGetNonceRequest struct {
 	ChainID   string
 	ID        int
@@ -278,13 +266,15 @@ func (cosigner *LocalCosigner) sign(req CosignerSignRequest) (CosignerSignRespon
 		}
 	}
 
+	ccs.mu.Lock()
 	for existingKey := range ccs.nonces {
 		// delete any HRS lower than our signed level
 		// we will not be providing parts for any lower HRS
 		if existingKey.Less(hrst) {
 			delete(ccs.nonces, existingKey)
 		}
 	}
+	ccs.mu.Unlock()
 
 	res.Signature = sig