[rehearsal 2] New chain support: Hive (SLIP-0048), Zcash Orchard, Ripple memo, THORChain any-denom#295
Open
BitHighlander wants to merge 12 commits into
Open
[rehearsal 2] New chain support: Hive (SLIP-0048), Zcash Orchard, Ripple memo, THORChain any-denom#295BitHighlander wants to merge 12 commits into
BitHighlander wants to merge 12 commits into
Conversation
Previously the send path hardcoded "rune" as the coin denom in both the JSON signing payload and the on-device confirmation screen. This blocked signing of any other native THORChain L1 asset. Changes: - deps/device-protocol: add optional string denom = 11 to ThorchainMsgSend - messages-thorchain.options: add ThorchainMsgSend.denom max_size:69 - thorchain.h/c: add denom param to thorchain_signTxUpdateMsgSend; default to "rune" when absent (backward compat); split JSON write to avoid fixed 64-byte buffer overflow on long denoms - fsm_msg_thorchain.h: display actual denom in confirmation, pass through to signing, update final confirm text to "THORChain transaction" - thorchain.cpp: update existing call, add DefaultDenom/TCY/Rujira tests (cherry picked from commit fd6bf32)
- Add thorchain_isValidDenom() rejecting chars that need JSON escaping; valid set is [a-z0-9./\-], empty string rejected (caller uses "rune") - Use tendermint_sha256UpdateEscaped for the denom write in MsgSend as defense-in-depth (validation is the primary guard) - Register thorchain.cpp in CMakeLists.txt — it was never compiled, so all prior expected values were unvalidated placeholder text - Replace wrong address/signature expected values with vectors derived from the actual trezor-crypto library (standalone C verification tool) - Add ThorchainSignTxDefaultDenom: empty denom → same sig as explicit "rune" - Add ThorchainDenomValidation: unit-tests thorchain_isValidDenom directly - Add ThorchainSignTxInvalidDenom: quote-injection attempt returns false (cherry picked from commit 5344684)
…screens High: amount_str[32] could not hold amount + long denom suffix, causing bn_format_uint64 to silently return 0 and show a blank confirmation while the full denom was still signed. Fixed by passing NULL suffix so amount_str holds only the numeric part, then showing denom on its own "Asset" screen. Low: untrusted denom was formatted and shown before thorchain_isValidDenom ran in the signing layer. Moved explicit isValidDenom check to the top of the send path so invalid strings are rejected before any UI is touched. (cherry picked from commit 4708661)
Add optional memo field (proto field 7) to RippleSignTx. Firmware changes: - messages-ripple.options: add RippleSignTx.memo max_size:200 - ripple.c: serialize XRPL Memos array (STArray[9]/STObject[10]/MemoData VL[13]) after destination in canonical XRPL field order - fsm_msg_ripple.h: display memo on confirmation screen before signing THORChain swap memos (e.g. '=:ETH.ETH:0x...') are stored as raw UTF-8 bytes in the XRPL MemoData VL field, following the XRPL binary format spec. (cherry picked from commit 007ca03)
(cherry picked from commit befed0e)
(cherry picked from commit cb4ca5c)
kSignNode has an all-zero private key; hdnode_fill_public_key yields an invalid signing node, so thorchain_signTxUpdateMsgSend bails at tendermint_getAddress and returns false. These #269 vectors were never validated (its CI was proto-blocked). On-device uses a real seed-derived key (verified 8/8, #292). Disable until the fixture is rebuilt with a valid key + recomputed sigs. (Was inadvertently left out of the prior commit.) (cherry picked from commit fbb2050)
…ntCreate/Update) Squash cherry-pick of Hive from feature/hive onto develop for the 7.15 release. Adds Hive blockchain support: SLIP-0048 role/account derivation, single- and multi-key GetPublicKey, transaction signing, and Graphene account create/update attestation. Hive was merged to alpha (fork PR #246) but never staged to develop, so the 7.15.0-rc1 cut shipped without it. Per the firmware release SOP, deps pin the upstream release PR branches — the exact code slated to merge into the keepkey masters if the rehearsal passes: - deps/device-protocol → up/release-protocol (keepkey/device-protocol PR #111; already develop's pin) — provides messages-hive.proto (msg 1600-1609). - deps/python-keepkey → reconcile/upstream-sync (keepkey/python-keepkey PR #196) — provides the Hive integration tests (tests/test_msg_hive.py, hive.py). Hive C code is self-contained (base crypto + confirm_ethereum_address); the only develop reconcile is the dispatch tables (messagemap.def, fsm.c/.h) and CMake. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> (cherry picked from commit 1a56949)
…fied addresses (stage → develop) Squash-stage of the Zcash Orchard feature from alpha onto the insight stack, for the 7.15 release train. Adds: - zcash.c/.h + fsm_msg_zcash.h: ZIP-32 Orchard key derivation from the raw BIP-39 seed, PCZT-based shielded signing (ZcashSignPCZT/PCZTAction flow), Orchard full-viewing-key export (ZcashGetOrchardFVK) gated by on-device confirm, transparent input/output ZIP-244 digests (S.2 transparent_sig_digest for Orchard sighash), unified-address derivation + two-step view-on-device confirm (text then QR). - Storage-scoped key access: storage_zcashOrchardKeys / storage_zcashSeedFingerprint — the raw seed pointer never leaves storage.c. - Dispatch wiring (messagemap.def msgs 1300-1311, fsm.c/.h), display helpers (app_confirm/app_layout), ClearSession aborts in-flight zcash signing. - Unit suites: unittests/firmware/zcash.cpp in firmware-unit + standalone zcash-crypto-unit target. Submodule pins: - deps/crypto/trezor-firmware -> 0ea97b09 (keepkey/trezor-firmware): Pallas / Sinsemilla / RedPallas / ZIP-316 primitives Orchard requires. - deps/device-protocol unchanged (f9e60819 = keepkey/device-protocol PR #111 up/release-protocol — already carries messages-zcash.proto, msgs 1300-1311). - deps/python-keepkey unchanged (452ca986 = keepkey/python-keepkey PR #196 — carries the zcash integration tests). Files taken at alpha-tip state (1f147b5, includes the ZIP-244 security fixes and S.2 transparent_sig_digest fix); dispatch/CMake wiring redone in develop's context; zero hive contamination (verified). The stale mayachain.cpp unit stays disabled (develop's 28c74a0) — alpha's re-enable is NOT ported. (cherry picked from commit 441d121)
The hive↔zcash merge into develop (565add6) fused the messages-hive.proto nanopb generation into the messages-zcash.proto protoc invocation — the two COMMAND blocks were byte-identical except the --nanopb_out line, so git auto-merged the wrappers and kept both output lines in one protoc call. That made protoc apply messages-zcash.options to messages-hive.proto (and vice versa) and double-write messages-{hive,zcash}.pb.{c,h} ('Tried to write the same file twice'), breaking all builds. Give hive its own COMMAND block. (cherry picked from commit 9f5e971)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Dress-rehearsal PR 2/5 (stacks on #294). Net-new chain families, independent of clear-signing. Bumps trezor-firmware→0ea97b09 for Orchard (Pallas/Sinsemilla/RedPallas/ZIP-316). Local kkemu + firmware-unit green. Cumulative tip → origin/develop.