reconcile: carry upstream presign and reproducibility work into alpha - #611
Merged
Conversation
Third-party verifiers keep failing KeepKey reproducibility checks by hashing the freshly built binary (zeroed signature slots in its 256-byte KPKY header) against the signed release's payload hash — an apples-to-oranges comparison that can never match (#433, and the same confusion in 2021's #283). scripts/build/verify-repro.sh makes the correct comparison a single command: clean clone at the tag, official Docker build, download of the signed release asset, and payload-hash (tail -c +257) comparison on both sides, printing all four hashes and PASS/FAIL. docs/ReproducibleBuilds.md documents the header layout, why full-file hashes never match by construction, the manual steps, and the on-device cross-checks (Features.revision, Features.firmware_hash).
…s-check - error out on unrecognized/mistyped flags (e.g. --local=x) instead of silently ignoring them and falling through to the download-and-compare path, which could print a false PASS for a binary that was never read - docs: Features.firmware_hash covers the full signed file (header + payload, per memory_firmware_hash()), not the payload alone — the doc previously implied it matched the payload hash, which never matches
This was referenced Aug 26, 2026
Owner
Author
|
Readiness update: this feature line is included in the coherent alpha roll-up #625 rather than being merged independently with a stale companion gitlink. #625 contains this PR’s firmware commits and pins the unified companion #63 line that covers both Solana disclosure and EIP-712. Keep this PR open until #625’s exact-head matrices finish; if #625 merges, this PR should be closed as subsumed, not separately merged. |
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope\n\nSelective reconciliation of reviewed upstream/develop work into the BitHighlander alpha line.\n\n- Restores exact-byte review for Solana raw messages, off-chain messages, and memos.\n- Binds raw/off-chain signing to the displayed version, format, and domain.\n- Wires the existing overflow-safe compute-budget calculation into signing UI, showing fee payer and maximum priority fee in SOL.\n- Adds the native memo exact-byte regression.\n- Imports the reproducible-build verification script and hardens its argument and device-hash checks.\n- Pins BitHighlander/python-keepkey PR #63 exact head 4ab0d91be737bbaa0630274a15876ac0456f83c5.\n- Retains device-protocol exact pin f54f0a7dabb2d38c6f423bf6b6a68e8f979b1b53.\n\n## Verification\n\n- Docker image digest: sha256:caef12386b1000130257ca220a754df5eb51bd2f66b2fe7aaeb4f45a8de52762\n- Native xunit: 584 passed (firmware 539, board 21, crypto 18, Pallas constant-time 6).\n- Focused exact-emulator integration: 5 passed, including all four disclosure differentials and compute-budget priority-fee signing.\n- 27 OLED PNGs captured in the focused run.\n- Shell syntax, changed-line formatting, and git diff checks pass.\n\n## Merge gate\n\nDo not merge this PR before BitHighlander/python-keepkey#63. After #63 merges, repin this PR to the durable develop merge commit and rerun the complete exact-head firmware gate. This PR intentionally does not alter the report generator because that remediation is being handled separately.