Feat/bip322#17
Open
qlrd wants to merge 10 commits into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR introduces a broad security- and UX-focused update across the firmware: adds BIP-322/BIP-137 message signing support, migrates UR handling to the uUR module (with simulator shims), hardens multiple parsing/storage paths against malformed or malicious inputs, and updates docs/tooling (uv migration, CSP hardening, pre-rendered math).
Changes:
- Add BIP-322 (PSBT-based) and BIP-137 message-signing helpers and related UI/test updates.
- Harden parsing and storage (PSBT sighash validation, settings.json size/type validation, QR part bounds, Deflate decompression limits, multisig quorum validation, traversal filtering, KEF backoff/corruption preservation).
- Docs/tooling refresh: migrate Python workflow to
uv, remove third-party doc CDNs via CSP + pre-rendered math, and add CONTRIBUTING/SECURITY policies.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| tests/test_wallet.py | Adds multisig quorum validation tests (m=0, m>n). |
| tests/test_touch.py | Updates touch mock to use orientation helper. |
| tests/test_themes.py | Adds contrast/accessibility assertions for theme palettes. |
| tests/test_settings.py | Adds settings.json corruption/size/shape hardening tests. |
| tests/test_qr.py | Adds QR parser boundary tests and UR sizing expectation change. |
| tests/test_psbt.py | Adds sighash validation tests, origin-less xpub tests, fee % edge test. |
| tests/test_key.py | Ensures BaseException signals propagate in fingerprint extraction. |
| tests/test_kef.py | Adds KEF iteration minimum + inflate size limit tests. |
| tests/test_display.py | Updates infobox background expectations across themes. |
| tests/test_bbqr.py | Adds BBQR inflate size-limit + part_total validation tests. |
| tests/shared_mocks.py | Adds DeflateIO max decompressed size enforcement in mocks. |
| tests/pages/test_stackbit.py | Expands Stackbit tests for standard/vertical layouts. |
| tests/pages/test_settings_page.py | Updates tests for new flash_success helper. |
| tests/pages/test_page.py | Adds flash_success and exception propagation tests. |
| tests/pages/test_login.py | Resets Settings singleton cache for patched defaults in tests. |
| tests/pages/test_file_manager.py | Adds traversal filtering test for directory entries. |
| tests/pages/test_encryption_ui.py | Adds corrupted-store preservation + backoff behavior tests. |
| tests/conftest.py | Makes simulator shim importable; injects uUR shim in tests. |
| src/krux/wallet.py | Adds multisig quorum checks; migrates UR parsing to uUR. |
| src/krux/translations/zh.py | Adds new UI string for raw-hash signing warning. |
| src/krux/translations/vi.py | Adds new UI string for raw-hash signing warning. |
| src/krux/translations/tr.py | Adds new UI string for raw-hash signing warning. |
| src/krux/translations/ru.py | Adds new UI string for raw-hash signing warning. |
| src/krux/translations/pt.py | Adds new UI string for raw-hash signing warning. |
| src/krux/translations/nl.py | Adds new UI string for raw-hash signing warning. |
| src/krux/translations/ko.py | Adds new UI string for raw-hash signing warning. |
| src/krux/translations/ja.py | Adds new UI string for raw-hash signing warning. |
| src/krux/translations/fr.py | Adds new UI string for raw-hash signing warning. |
| src/krux/translations/es.py | Adds new UI string for raw-hash signing warning. |
| src/krux/translations/de.py | Adds new UI string for raw-hash signing warning. |
| src/krux/translations/init.py | Updates compiled translations table checksum data. |
| src/krux/touch.py | Uses Settings orientation helper for coordinate flipping. |
| src/krux/themes.py | Adjusts palette constants for contrast improvements. |
| src/krux/settings.py | Adds settings.json size cap + defensive namespace traversal/repair. |
| src/krux/qr.py | Migrates UR encoder/decoder to uUR; tightens exception handling; adds pMofN bounds. |
| src/krux/psbt.py | Migrates UR PSBT handling to uUR; adds sighash enforcement; xpub origin-less guard; fee edge fix. |
| src/krux/pages/utils.py | Selects network colors based on light theme variants. |
| src/krux/pages/tiny_seed.py | Removes grid drawing for improved scan visibility. |
| src/krux/pages/stack_1248.py | Adds vertical compact/grouped Stackbit renderers. |
| src/krux/pages/settings_page.py | Switches success flashes to flash_success. |
| src/krux/pages/qr_view.py | Uses flash_success; restricts portrait label rendering to modes. |
| src/krux/pages/mnemonic_loader.py | Migrates BIP39 UR decoding to uUR. |
| src/krux/pages/login.py | Removes unused digit constants. |
| src/krux/pages/home_pages/wallet_descriptor.py | Switches to flash_success. |
| src/krux/pages/home_pages/mnemonic_xor.py | Switches to flash_success. |
| src/krux/pages/home_pages/mnemonic_backup.py | Adds Stackbit layout submenu and vertical modes. |
| src/krux/pages/home_pages/home.py | Switches to flash_success for SD save confirmation. |
| src/krux/pages/home_pages/bip85.py | Switches to flash_success. |
| src/krux/pages/home_pages/addresses.py | Switches to flash_success. |
| src/krux/pages/fill_flash.py | Switches to flash_success. |
| src/krux/pages/file_operations.py | Switches to flash_success. |
| src/krux/pages/file_manager.py | Filters traversal/path-separator entries from SD listings. |
| src/krux/pages/encryption_ui.py | Adds in-session KEF decrypt backoff; preserves corrupted store; shares counter. |
| src/krux/pages/datum_tool.py | Migrates UR extraction/encoding to uUR; minor syntax cleanup. |
| src/krux/pages/init.py | Adds flash_success; narrows exception handling in QR gen + SD checks. |
| src/krux/metadata.py | Bumps firmware version string. |
| src/krux/krux_settings.py | Adds Settings singleton caching; refactors orientation helper. |
| src/krux/key.py | Narrows exception handling to Exception in fingerprint extraction. |
| src/krux/kef.py | Enforces minimum PBKDF2 iterations; preserves ValueError from inflate. |
| src/krux/encryption.py | Adds corrupted-store preservation error; makes loads safer; validates store shape. |
| src/krux/display.py | Reduces repeated Settings lookups; uses orientation helper for rotations. |
| src/krux/bip322.py | Adds BIP-322 fake-tx signing/finalization + serializer workaround. |
| src/krux/bip137.py | Adds BIP-137 message commitment/header handling. |
| src/krux/bbqr.py | Adds BBQR part_total validation; preserves ValueError from inflate. |
| simulator/simulator.py | Imports uUR shim module for simulator environment. |
| simulator/sequences/home-options.txt | Adds screenshots/steps for new Stackbit menu/layouts. |
| simulator/kruxsim/mocks/uUR.py | Adds CPython shim matching firmware uUR surface. |
| simulator/kruxsim/mocks/deflate.py | Adds inflate size-limit enforcement in simulator deflate mock. |
| simulator/generate-device-screenshots.sh | Migrates simulator scripts from poetry to uv. |
| SECURITY.md | Adds security reporting policy. |
| render_docs_math.py | Adds tool to pre-render display equations to SVG. |
| README.md | Migrates developer setup/docs from poetry to uv; updates commands. |
| pyproject.toml | Migrates to PEP 621/uv config; pins dependency groups/extras. |
| overrides/main.html | Adds CSP meta hardening for docs theme. |
| mkdocs.yml | Removes MathJax/CDNs; enables custom overrides; updates latest version and nav. |
| i18n/translations/zh-CN.json | Adds new UI strings (raw hash warning, Stackbit labels). |
| i18n/translations/vi-VN.json | Adds new UI strings (raw hash warning, Stackbit labels). |
| i18n/translations/tr-TR.json | Adds new UI strings (raw hash warning, Stackbit labels). |
| i18n/translations/ru-RU.json | Adds new UI strings (raw hash warning, Stackbit labels). |
| i18n/translations/pt-BR.json | Adds new UI strings (raw hash warning, Stackbit labels). |
| i18n/translations/nl-NL.json | Adds new UI strings (raw hash warning, Stackbit labels). |
| i18n/translations/ko-KR.json | Adds new UI strings (raw hash warning, Stackbit labels). |
| i18n/translations/ja-JP.json | Adds new UI strings (raw hash warning, Stackbit labels). |
| i18n/translations/fr-FR.json | Adds new UI strings (raw hash warning, Stackbit labels). |
| i18n/translations/es-MX.json | Adds new UI strings (raw hash warning, Stackbit labels). |
| i18n/translations/de-DE.json | Adds new UI strings (raw hash warning, Stackbit labels). |
| i18n/README.md | Updates docs setup command for uv. |
| i18n/i18n.py | Removes auto-translation helpers; simplifies CLI actions. |
| firmware/font/README.md | Updates rebuild instructions to use uv. |
| docs/support.en.md | Updates emoji syntax to Material icon shortcode. |
| docs/parts.en.md | Updates icon shortcodes for MkDocs Material. |
| docs/getting-started/usage/navigating-the-main-menu.en.md | Adds vertical Stackbit docs/screenshot references. |
| docs/getting-started/usage/loading-a-mnemonic.en.md | Fixes templates link target after docs reorg. |
| docs/getting-started/templates/templates.en.md | Removes old templates page (replaced by index). |
| docs/getting-started/templates/index.en.md | Adds new templates index page with corrected links. |
| docs/getting-started/navigation.en.md | Removes embedded external mind-map iframes. |
| docs/getting-started/features/tamper-detection.en.md | Updates wording about confirmation flash before fill. |
| docs/getting-started/features/QR-transcript-tools.en.md | Updates templates link target after docs reorg. |
| docs/getting-started/features/img/math/eq-12.svg | Adds pre-rendered equation asset. |
| docs/getting-started/features/img/math/eq-11.svg | Adds pre-rendered equation asset. |
| docs/getting-started/features/img/math/eq-08.svg | Adds pre-rendered equation asset. |
| docs/getting-started/features/entropy.en.md | Rewrites math blocks to use pre-rendered SVGs + HTML. |
| docs/css/custom.css | Adds styling for pre-rendered display math; removes unused video CSS. |
| Dockerfile | Updates base image; removes vendor ur/urtypes copy steps. |
| CONTRIBUTING.md | Adds contribution workflow and project conventions. |
| CHANGELOG.md | Adds new release notes entries and security hardening summary. |
| .gitignore | Ignores mkdocs/public output, htmlcov, and local AI tooling artifacts. |
| .github/workflows/tests.yml | Migrates CI to uv; adds multi-version matrix for lint/tests. |
| .github/workflows/docs.yml | Migrates docs CI to uv and builds with frozen lock. |
Comments suppressed due to low confidence (1)
CHANGELOG.md:1
- The changelog header says "26.05.0" while this PR bumps the code/package/docs versions to 26.04.0 (e.g. src/krux/metadata.py, pyproject.toml, mkdocs.yml). These should be aligned so the release notes match the shipped version.
# Changelog 26.05.0 - May 2025
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+203
to
+206
| # Guard against (version=2) | ||
| if raw[pos : pos + 4] != b"\x02\x00\x00\x00": | ||
| raise ValueError("PSBT mismatch version: 0x2000000") | ||
| raw = raw[:pos] + b"\x00\x00\x00\x00" + raw[pos + 4 :] |
This commit add checks for signing message UI using recid following spec from BIP137.
Added unit tests agains BIP137 spec and apply lenient agains strict checks.
This commit add checks for signing message UI using recid following spec BIP137.
Added unit tests agains BIP137 spec and apply lenient agains strict checks.
This commit implements BIP322 for sign messages with singlesig segwit addresses (P2WPKH, P2TR) and using BIP137 as fallback for P2PKH and P2SH-P2PKH as legacy signed messages.
This commit implements BIP322 for sign messages with singlesig segwit addresses (P2WPKH, P2TR) and using BIP137 as fallback for P2PKH and P2SH-P2PKH as legacy signed messages.
Comment on lines
+428
to
+436
| try: | ||
| if isinstance(data, str): | ||
| return PSBT.from_base64(data) | ||
| try: | ||
| return PSBT.parse(data) | ||
| except (EmbitError, ValueError): | ||
| return PSBT.from_base64(data.decode("ascii")) | ||
| except (EmbitError, ValueError, TypeError): | ||
| return None |
Comment on lines
+62
to
+63
| # The numbers are defined in BIP137 and means and | ||
| # each one produces different check addresses: |
Comment on lines
+152
to
+154
| for i, case in enumerate(cases): | ||
| print("Case: %d", i) | ||
| for recid in range(4): |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is this PR for?
Changes made to:
Did you build the code and tested on device?
What is the purpose of this pull request?