release candidate: stage 7.16 after 7.15

.github/workflows/ci.yml

@@ -48,9 +48,11 @@ env:
   BASE_IMAGE: kktech/firmware@sha256:7438e53933d47d53157ed6d96d864cb208597e62dce26235ace09d1063427fa2
   EMU_IMAGE: kkemu-ci
 
-# Least-privilege default. Jobs in this workflow only need repository reads;
-# publishing uses DockerHub credentials and does not need a write-capable
-# GITHUB_TOKEN.
+# Least-privilege default: every job gets a read-only GITHUB_TOKEN unless it
+# declares its own `permissions:` override (publish-emulator-libs does, for
+# the `gh release` calls it needs `contents: write` for). Without this,
+# every job -- including ones that just checkout/build/test -- inherited
+# whatever the repo's default token scope was, with no explicit floor. #424.
 permissions:
   contents: read
 
@@ -103,37 +105,32 @@ jobs:
           fetch-depth: 0
 
       - name: Install gitleaks
-        # Pin and verify the only scanner binary that is installed/executed.
-        # Bumps require an independently recorded digest and ruleset review.
+        # PINNED + checksum-verified. Tracking releases/latest means a new
+        # upstream ruleset can turn this gate red with no change to this
+        # repository -- which is exactly what happened: a newer
+        # generic-api-key rule began flagging published BIP32 test vectors
+        # in 2014/2018 history, and because every build job declares
+        # `needs: [.., secret-scan]`, the whole build and test graph was
+        # SKIPPED rather than failed. Bump deliberately, with the scan
+        # re-verified and a fresh sha256 recorded below. See #424.
+        #
+        # This used to install this checksummed build and then immediately
+        # overwrite it with a second, unverified `curl | tar` of a different
+        # (older) version -- so the binary actually executed was never the
+        # one the checksum covered, defeating the point of pinning at all.
+        # See #586.
         run: |
-          # PINNED to 8.30.0, deliberately, and VERIFIED.
-          #
-          # Two things this block has to get right at once, and a clean merge of
-          # two parents previously got exactly one of them:
-          #
-          #  - the VERSION is pinned because tracking releases/latest lets a new
-          #    upstream ruleset turn this gate red with no change to this
-          #    repository. That happened: a newer generic-api-key rule began
-          #    flagging published BIP32 test vectors in 2014/2018 history, and
-          #    because every build job declares `needs: [.., secret-scan]`, the
-          #    whole build and test graph was SKIPPED rather than failed (#424).
-          #  - the BINARY is checksummed, because a scan is only worth what the
-          #    executable running it is.
-          #
-          # The merged version downloaded 8.30.1 with a verified checksum and then
-          # overwrote it with an unverified 8.30.0 through `curl | tar`, so the
-          # checksum proved nothing about the binary that actually ran. One
-          # version, one archive, one verified digest. Bump deliberately, with the
-          # scan re-verified.
-          GITLEAKS_VERSION=8.30.0
-          GITLEAKS_SHA256=79a3ab579b53f71efd634f3aaf7e04a0fa0cf206b7ed434638d1547a2470a66e
+          GITLEAKS_VERSION=8.30.1
+          GITLEAKS_SHA256=551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
           GITLEAKS_ARCHIVE="${RUNNER_TEMP}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
           curl -sSfL --retry 3 --retry-all-errors \
             "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
             -o "${GITLEAKS_ARCHIVE}"
           echo "${GITLEAKS_SHA256}  ${GITLEAKS_ARCHIVE}" | sha256sum --check --strict
           tar -xzf "${GITLEAKS_ARCHIVE}" -C /usr/local/bin gitleaks
-          gitleaks version
+          INSTALLED_VERSION=$(gitleaks version)
+          echo "gitleaks ${INSTALLED_VERSION}"
+          test "${INSTALLED_VERSION}" = "${GITLEAKS_VERSION}"
 
       - name: Run gitleaks
         env:
@@ -144,18 +141,22 @@ jobs:
         run: |
           set -euo pipefail
 
-          # fetch-depth: 0 makes every fork ref available. An unscoped scan
-          # therefore walks disconnected keepkey-stack histories that are not
-          # ancestors of this firmware change (#544). Scan only the revisions
-          # introduced by the triggering event.
+          # actions/checkout fetch-depth: 0 makes every fork branch available.
+          # An unscoped gitleaks run therefore scans unrelated branch histories;
+          # one keepkey-stack branch in this fork made every firmware build and
+          # test skip even though its commits are not ancestors of this change.
+          # Scan exactly the commits introduced by the event instead.
           if [ "$EVENT_NAME" = "pull_request" ]; then
             LOG_OPTS="${PR_BASE_SHA}..${PR_HEAD_SHA}"
           elif [ "$EVENT_NAME" = "push" ] &&
                [[ ! "$PUSH_BEFORE_SHA" =~ ^0+$ ]]; then
             LOG_OPTS="${PUSH_BEFORE_SHA}..${GITHUB_SHA}"
           elif [ "$EVENT_NAME" = "push" ]; then
+            # New branch: scan only the history reachable from its head, not
+            # every fetched ref in the repository.
             LOG_OPTS="${GITHUB_SHA}"
           else
+            # A manual run has no before/base pair. Scan the checked-out tree.
             gitleaks detect --source . --no-git --verbose --redact
             exit 0
           fi
@@ -165,7 +166,11 @@ jobs:
 
   static-analysis:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    # Was 15. cppcheck alone has been observed running right up to (and past)
+    # that ceiling under normal runner load with an unchanged, clean diff --
+    # two consecutive PR #591 runs hit 15m10s and 14m59s, one of them killed
+    # mid-scan, forcing a manual rerun of an otherwise-passing check. #592.
+    timeout-minutes: 25
     steps:
       - name: Checkout
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -462,7 +467,7 @@ jobs:
           - variant: full
             label: ""
             suffix: ""
-            cmake_flags: ""
+            cmake_flags: "-DKK_CLEARSIGN_ALPHA_ROOT=ON"
           - variant: bitcoin-only
             label: " (bitcoin-only)"
             suffix: "-bitcoin-only"
@@ -522,6 +527,10 @@ jobs:
               python3 /root/keepkey-firmware/tools/check_pallas_ct_disassembly.py \
                 --elf bin/firmware.keepkey.elf \
                 --variant '${{ matrix.variant }}' && \
+              python3 /root/keepkey-firmware/tools/check_bitcoin_only_identity.py \
+                --artifact bin/firmware.keepkey.bin \
+                --elf bin/firmware.keepkey.elf \
+                --variant '${{ matrix.variant }}' && \
               mkdir -p /root/keepkey-firmware/bin && \
               cp bin/*.bin /root/keepkey-firmware/bin/ && \
               cp bin/*.elf /root/keepkey-firmware/bin/ && \
@@ -530,6 +539,28 @@ jobs:
               find . -name '*.su' -print0 | tar czf /root/keepkey-firmware/bin/stack-usage.tgz --null -T - && \
               chmod -R a+rw /root/keepkey-firmware/bin"
 
+      - name: Assert alpha ClearSign root product boundary
+        run: |
+          # Full alpha must carry the hardware-held root that issued Vault's
+          # alpha certificates. Bitcoin-only excludes all non-Bitcoin signing
+          # code and must not carry it. Assert both sides using the CURRENT key;
+          # the prior gate still searched for the superseded 02be... root and
+          # could not detect the 02de... key this source actually compiled.
+          python3 - <<'EOF'
+          import sys
+          ALPHA_ROOT = bytes.fromhex(
+              "02de9231b2094433235532fb1932e324a2c7304195e12e610c675cccbbd606dae7")
+          blob = open("bin/firmware.keepkey.bin", "rb").read()
+          expected = "${{ matrix.variant }}" == "full"
+          present = ALPHA_ROOT in blob
+          if present != expected:
+              sys.exit("::error::alpha ClearSign root presence mismatch: "
+                       "variant=${{ matrix.variant }}, expected=%s, present=%s"
+                       % (expected, present))
+          print("Alpha root boundary verified: variant=${{ matrix.variant }}, "
+                "present=%s" % present)
+          EOF
+
       # SRAM budget gate — RC7's privacy-enabled build hard-faulted on boot
       # because static SRAM left an 11.2 KB gap while msg_write() carried a
       # 12.4 KB stack frame. keepkey.ld now ASSERTs a 16 KiB reserve at link
@@ -638,6 +669,7 @@ jobs:
           retention-days: 30
 
   python-integration-tests:
+    name: python-integration-tests${{ matrix.label }}
     needs: [lint-format, static-analysis, check-submodules, secret-scan, crypto-tests]
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -646,10 +678,14 @@ jobs:
       matrix:
         include:
           - variant: full
+            label: ""
+            cmake_flags: ""
             project: kkci-full
             python_artifact: python-test-results
             oled_artifact: oled-screenshots
           - variant: bitcoin-only
+            label: " (bitcoin-only)"
+            cmake_flags: "-DKK_BITCOIN_ONLY=ON"
             project: kkci-bitcoin-only
             python_artifact: python-test-results-bitcoin-only
             oled_artifact: oled-screenshots-bitcoin-only
@@ -670,6 +706,9 @@ jobs:
 
       - name: Build and run tests (docker compose)
         working-directory: scripts/emulator
+        env:
+          COINSUPPORT: ${{ matrix.cmake_flags }}
+          KK_TEST_BUILD_VARIANT: ${{ matrix.variant }}
         run: |
           # Run each test container — capture exit codes, always extract reports
           #
@@ -995,6 +1034,10 @@ jobs:
         env:
           KK_TRANSPORT: dylib
           KK_DYLIB: ${{ env.DYLIB_PATH }}
+          # PR jobs expose a synthetic merge SHA as GITHUB_SHA, while Checkout
+          # above intentionally builds the head SHA. Bind the assertion to the
+          # exact source revision that produced this dylib.
+          KK_EXPECTED_FIRMWARE_REVISION: ${{ github.event.pull_request.head.sha || github.sha }}
         run: |
           # `keepkeylib/` on PYTHONPATH so the package's relative-style
           # imports inside generated *_pb2.py files resolve.
@@ -1142,7 +1185,7 @@ jobs:
           NOT_SUCCESS=$(echo "$NEEDS_JSON" \
             | jq -r 'to_entries[] | select(.value.result != "success") | .key')
           if [ -n "$NOT_SUCCESS" ]; then
-            echo "::error::Required jobs did not succeed: $(echo $NOT_SUCCESS | tr '\n' ' ')"
+            echo "::error::Required jobs did not succeed: $(printf '%s\n' "$NOT_SUCCESS" | tr '\n' ' ')"
             echo "A skipped or cancelled required job is NOT a pass. If a gate-stage"
             echo "job failed, everything downstream was skipped and produced no signal."
             exit 1

.github/workflows/release.yml

@@ -82,22 +82,21 @@ jobs:
   build-firmware:
     needs: validate
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
         include:
-          # 'suffix' names the published files; 'variant' is the internal build
-          # selector. The default build takes an EMPTY suffix so its assets keep
-          # the names every previous release used (v7.14.x shipped
-          # firmware.keepkey.bin). Only bitcoin-only is qualified, because it is
-          # the unusual one.
+          # 'suffix' names the published files; 'variant' stays the internal build
+          # selector. The default build takes an EMPTY suffix so its assets keep the
+          # names every previous release used (v7.14.x shipped firmware.keepkey.bin).
+          # Only the bitcoin-only build is qualified, because it is the unusual one.
           - variant: full
             suffix: ""
             cmake_flags: ""
           - variant: bitcoin-only
             suffix: "-bitcoin-only"
             cmake_flags: "-DKK_BITCOIN_ONLY=ON"
-    timeout-minutes: 20
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
@@ -138,6 +137,10 @@ jobs:
                 -DCMAKE_COLOR_MAKEFILE=ON \
                 ${{ matrix.cmake_flags }} && \
               make && \
+              python3 /root/keepkey-firmware/tools/check_bitcoin_only_identity.py \
+                --artifact bin/firmware.keepkey.bin \
+                --elf bin/firmware.keepkey.elf \
+                --variant '${{ matrix.variant }}' && \
               mkdir -p /root/keepkey-firmware/release && \
               cp bin/firmware.keepkey.bin /root/keepkey-firmware/release/ && \
               cp bin/firmware.keepkey.elf /root/keepkey-firmware/release/ && \
@@ -154,6 +157,28 @@ jobs:
             --su-tar release/stack-usage.tgz \
             --budgets tools/sram-budgets.json \
             --variant "${{ matrix.variant }}"
+          echo "# KeepKey Firmware v${{ needs.validate.outputs.fw_version }} — Hash Manifest" > HASHES.txt
+          echo "" >> HASHES.txt
+          # Provenance: name the exact toolchain these bytes came out of. BASE_IMAGE
+          # is a sha256 manifest digest, not a tag, so this identifies one immutable
+          # image rather than whatever the tag pointed at on the day. Without it a
+          # green CI build and a locally reproduced binary cannot be shown to be the
+          # same toolchain product. See GH #425.
+          echo "builder image    ${BASE_IMAGE}" >> HASHES.txt
+          echo "source commit    ${GITHUB_SHA}" >> HASHES.txt
+          echo "" >> HASHES.txt
+          for f in *.bin; do
+            [ -f "$f" ] || continue
+            FULL_HASH=$(sha256sum "$f" | awk '{print $1}')
+            echo "sha256 (full)    $f  $FULL_HASH" >> HASHES.txt
+            FILE_SIZE=$(stat -c%s "$f")
+            if [ "$FILE_SIZE" -gt 256 ]; then
+              PAYLOAD_HASH=$(tail -c +257 "$f" | sha256sum | awk '{print $1}')
+              echo "sha256 (payload) $f  $PAYLOAD_HASH" >> HASHES.txt
+            fi
+            echo "" >> HASHES.txt
+          done
+          cat HASHES.txt
 
       # A RELEASE PUBLISHES FIRMWARE ONLY -- never a bootloader.
       #
@@ -209,8 +234,6 @@ jobs:
       - name: Upload release artifacts
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
-          # Per-variant, because upload-artifact v4+ makes names immutable: two
-          # matrix legs writing one name is a hard failure, not a merge.
           name: release-firmware-${{ matrix.variant }}
           path: release/*
           retention-days: 90

.gitmodules

@@ -4,7 +4,8 @@ path = deps/device-protocol
 branch = up/release-protocol
 [submodule "deps/trezor-firmware"]
 path = deps/crypto/trezor-firmware
-url = https://github.com/BitHighlander/trezor-firmware.git
+url = https://github.com/keepkey/trezor-firmware.git
+branch = keepkey
 [submodule "googletest"]
 path = deps/googletest
 url = https://github.com/google/googletest.git
@@ -13,8 +14,8 @@ path = code-signing-keys
 url = https://github.com/keepkey/code-signing-keys.git
 [submodule "deps/python-keepkey"]
 path = deps/python-keepkey
-url = https://github.com/keepkey/python-keepkey.git
-branch = reconcile/upstream-sync
+url = https://github.com/BitHighlander/python-keepkey.git
+branch = develop
 [submodule "deps/qrenc/QR-Code-generator"]
 path = deps/qrenc/QR-Code-generator
 url = https://github.com/keepkey/QR-Code-generator.git

CMakeLists.txt

@@ -9,7 +9,7 @@ endif()
 
 project(
   KeepKeyFirmware
-  VERSION 7.15.0
+  VERSION 7.16.0
   LANGUAGES C CXX ASM)
 
 set(BOOTLOADER_MAJOR_VERSION 2)
@@ -20,8 +20,7 @@ option(KK_EMULATOR "Build the emulator" OFF)
 option(KK_BUILD_DYLIB "Build libkkemu shared library (.dylib/.so)" OFF)
 option(KK_DEBUG_LINK "Build with debug-link enabled" OFF)
 option(KK_BUILD_FUZZERS "Build the fuzzers?" OFF)
-option(KK_BITCOIN_ONLY "Build Bitcoin-only firmware (strip all non-BTC coins)"
-       OFF)
+option(KK_BITCOIN_ONLY "Build Bitcoin-only firmware (strip all non-BTC coins)" OFF)
 # Zcash shielded/Orchard support is part of the regular firmware. It is an
 # internal compile selection, not a third release variant: bitcoin-only strips
 # the Zcash coin and privacy engine; every regular device/emulator build ships
@@ -117,9 +116,9 @@ add_definitions(-DED25519_FORCE_32BIT=1)
 add_definitions(-DUSE_PRECOMPUTED_CP=0)
 
 if(${KK_BITCOIN_ONLY})
-  # Strip the coin-specific trezor-crypto primitives whose only callers
-  # (ethereum.c / nano.c) are themselves compiled out of this image. KECCAK
-  # stays on: it is a generic hash, and the saving is not worth the risk.
+  # Bitcoin-only: strip the coin-specific trezor-crypto primitives whose only
+  # callers (ethereum.c / nano.c) are compiled out below. KECCAK stays on --
+  # marginal size win, and it is a generic hash we don't want to risk.
   add_definitions(-DUSE_ETHEREUM=0)
   add_definitions(-DUSE_NANO=0)
 else()
@@ -171,11 +170,8 @@ else()
   add_definitions(-DDEBUG_LINK=0)
 endif()
 
-# Value macros: always defined, 0 or 1, and always tested with `#if FLAG`.
-# Device builds compile with -Wundef -Werror, so an undefined identifier inside
-# `#if` is a hard error rather than a silent zero -- which is what we want,
-# because a silently-zero guard would ship the coin engines into the stripped
-# image.
+# Value macros (always defined 0/1) -- device builds use -Wundef -Werror, so an
+# undefined identifier in `#if` is a hard error. Guard code with `#if FLAG`.
 if(${KK_BITCOIN_ONLY})
   add_definitions(-DBITCOIN_ONLY=1)
 else()