Merge pull request #60 from BitHighlander/feat/certified-solana-lut-alpha

test(solana): bind certified ClearSign envelopes

Author: BitHighlander

device-protocol

@@ -75,6 +75,11 @@ def test_features_round_trip(self):
         self.client.init_device()
         f = self.client.features
         self.assertGreaterEqual(f.major_version, 7)
+        revision = f.revision.decode("ascii")
+        self.assertRegex(revision, r"^[0-9a-f]{40}$")
+        expected_revision = os.environ.get("GITHUB_SHA")
+        if expected_revision:
+            self.assertEqual(revision, expected_revision)
 
     @unittest.skip(
         "Pending firmware fix — confirm_helper busy-loops on a ButtonAck "

keepkeylib/messages_solana_pb2.py

@@ -32,6 +32,30 @@ def test_solana_recipient_owner_hint_is_additive_field_12(self):
         decoded = solana_proto.SolanaSignTx.FromString(encoded)
         self.assertEqual(list(decoded.token_recipient_owner), [owner])
 
+    def test_solana_clearsign_certificate_is_additive_field_13(self):
+        field = solana_proto.SolanaSignTx.DESCRIPTOR.fields_by_name[
+            'clearsign_certificate'
+        ]
+        self.assertEqual(field.number, 13)
+        if hasattr(field, 'label'):
+            self.assertEqual(field.label, field.LABEL_OPTIONAL)
+        else:
+            self.assertFalse(field.is_repeated)
+        self.assertEqual(field.type, field.TYPE_BYTES)
+
+        certificate = bytes(range(139))
+        encoded = solana_proto.SolanaSignTx(
+            address_n=[0x8000002c, 0x800001f5, 0x80000000, 0x80000000],
+            raw_tx=b'\x80relay',
+            schema_payload=b'\x01schema',
+            schema_signature=bytes(range(64)),
+            schema_signer_key_id=0x80,
+            clearsign_certificate=certificate,
+        ).SerializeToString()
+        decoded = solana_proto.SolanaSignTx.FromString(encoded)
+        self.assertEqual(decoded.clearsign_certificate, certificate)
+        self.assertEqual(decoded.schema_signer_key_id, 0x80)
+
     def test_solana_offchain_messages_are_mapped(self):
         self.assertEqual(proto.MessageType_SolanaSignOffchainMessage, 756)
         self.assertEqual(proto.MessageType_SolanaOffchainMessageSignature, 757)

tests/test_dylib_confirm_flow.py

@@ -919,6 +919,55 @@ def test_solana_sign_versioned_v0_static_verified(self):
         self.assertEqual(len(resp.signature), 64)
         self.assertFalse(all(b == 0 for b in resp.signature))
 
+    def test_relay_certified_v0_no_lookup_proof_reaches_signer_check(self):
+        """The exact public Relay proof used by Vault must enter ClearSign.
+
+        The captured transaction belongs to the operator, not this test's
+        mnemonic, so the final signer check must reject it.  That later,
+        specific rejection is intentional: it proves the certificate and
+        schema survived protobuf decoding and passed the production FSM proof
+        gate without requiring an operator secret or approving a transaction.
+        """
+        self.requires_firmware("7.16.0")
+        self.requires_fullFeature()
+        self.setup_mnemonic_allallall()
+
+        raw_tx = binascii.unhexlify(
+            "8001000305ec3979a4dc6b401bd045171a189f26856fab9eab75560214f972b2"
+            "edc164300f66963b37e581dc14a0f573eeede8e54a257d83d082c54ab208cbff"
+            "d1dc2a70ca792689378ecd51d80406eb0caa3b62795beb10b6c5dc96bc2e0df0"
+            "3cbfee1abfbe3e6d285d2ee963351b6deeb0a1e96c881435ccd450b2645f24cc"
+            "27960bee47000000000000000000000000000000000000000000000000000000"
+            "0000000000d96db9f622f840ffda97430208ddbc7950d2c1ea45ecc9c2933151"
+            "c02963f3860102050300000104300d9e0ddf5fd51c06f075633b000000000370"
+            "4dea2a5eb9cf98e2f625a96080df1f0c5c24ccec3a6d8827b3ab25c0b11800")
+        schema_payload = binascii.unhexlify(
+            "4b4b534f4c53433101792689378ecd51d80406eb0caa3b62795beb10b6c5dc96"
+            "bc2e0df03cbfee1abf080d9e0ddf5fd51c060c52656c6179204272696467650d"
+            "6465706f7369744e6174697665020506416d6f756e7404054f72646572010305"
+            "5661756c74")
+        schema_signature = binascii.unhexlify(
+            "801b309d284ae89287a21a6acbd5c63f999515f3ff6bf71d72a256485321b892"
+            "7b7ebc3a26ace3df5551b85a68df8e9f1ef8eac220d85f4bfaa33d43b5349061")
+        certificate = binascii.unhexlify(
+            "0101000001f56c68c8804b6565704b6579205661756c74000000000000000000"
+            "000000000000000000000342f5f9704494b3f9bd72295eecaf29d783d23ea02"
+            "b2dc9f48abcd2e46d4850cfa2753fac6068a45747a32a4a39f249af72b55370f"
+            "3491913b7fb9a80207d619b3b4fca6750fc1fdc790da5562b42a351e12cde3c"
+            "0f084056a24ca8d1bf2c36b5")
+
+        self.client.apply_policy('AdvancedMode', False)
+        with pytest.raises(CallException) as exc:
+            self.client.call(messages.SolanaSignTx(
+                address_n=parse_path("m/44'/501'/0'/0'"),
+                raw_tx=raw_tx,
+                schema_payload=schema_payload,
+                schema_signature=schema_signature,
+                schema_signer_key_id=128,
+                clearsign_certificate=certificate,
+            ))
+        self.assertIn("Derived key is not a signer for this tx", str(exc.value))
+
     def test_solana_sign_x402_zero_lut_usdc_payment(self):
         """Official x402 SVM shape clear-signs without blind signing.