release: 7.15 audited candidate - #476
Open
BitHighlander wants to merge 1 commit into
Open
Conversation
Squash the 7.15 delta onto the finalized 7.14.3 candidate: core UI and transport work, chain signing and clear-sign metadata, Zcash Orchard support, storage and RNG hardening, dependency updates, tests, documentation, and release evidence gates. Keep every dependency on its canonical upstream URL.
Collaborator
Author
7.15 line audit — core, build, EVM and SolanaExact range: Checkbox rule: mark a file complete only after reviewing every listed base and candidate range, including removed/replaced base lines. Findings must cite the surface, path, range, and exact head. Generated files and tests are reviewable evidence, not substitutes for reviewing runtime code. Changed files represented in this checklist: 81. 715-BUILD — product composition, platform and memory layout
715-CORE — board, confirmation UI, transport and emulator
715-DEP — dependency identity, crypto and build integration
715-EVM — EVM and clear-sign metadata
715-SOL — Solana instruction and metadata disclosure
|
Collaborator
Author
7.15 line audit — signing, Zcash and state securityExact range: Checkbox rule: mark a file complete only after reviewing every listed base and candidate range, including removed/replaced base lines. Findings must cite the surface, path, range, and exact head. Generated files and tests are reviewable evidence, not substitutes for reviewing runtime code. Changed files represented in this checklist: 56. 715-CHAIN — other chain signing and disclosure
715-CHAIN — other chain signing and regression coverage
715-STATE — storage, RNG and secret/session lifecycle
715-ZEC — Zcash, Orchard, Pallas and RedPallas
|
Collaborator
Author
7.15 line audit — CI, release evidence and documentationExact range: Checkbox rule: mark a file complete only after reviewing every listed base and candidate range, including removed/replaced base lines. Findings must cite the surface, path, range, and exact head. Generated files and tests are reviewable evidence, not substitutes for reviewing runtime code. Changed files represented in this checklist: 44. 715-CI — CI, release evidence, manifests and static gates
715-DOC — shipping requirements, audit guidance and non-shipping designs
|
Collaborator
Author
7.15 line audit — trezor-crypto dependency deltaExact range: Checkbox rule: mark a file complete only after reviewing every listed base and candidate range, including removed/replaced base lines. Findings must cite the surface, path, range, and exact head. Generated files and tests are reviewable evidence, not substitutes for reviewing runtime code. Changed files represented in this checklist: 5. DEP-CRYPTO-ZEC — Pallas, RedPallas and Orchard primitives
|
Collaborator
Author
Audit index — 7.15 stacked deltaThis is the durable top-level ledger. Detailed checkboxes live in the commit-pinned line maps below. A checkbox means every listed base and candidate range in that file was reviewed; findings must cite the exact range and head. Immutable review identity
The 7.14.3 audit is inherited only for unchanged bytes. Any 7.15 hunk touching an inherited invariant is explicitly present in the line maps below. Canonical dependency identity
Every committed submodule URL is canonical upstream. The stale Line-addressable audit surfaces
The firmware maps cover all 181 changed files exactly once. Roadmaps and RFCs are audit inputs, not claims that their future mechanisms ship in 7.15. Gates
Head-change log
No merge, tag, signing, publishing, release, or physical-test claim is made by this upstream audit vehicle. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review identity
This is the canonical upstream stacked review of the exact fork-audited and exact-head-green 7.15 candidate.
release/7.14.3-bitcoin-only@abe29d1288638867dc64dfe04219b89f7a593133release/7.15@a56fb3e88d7dbbe31a321179c10a8fd2023d8f0cCanonical dependency pins
keepkey/trezor-firmware@ merged upstream PR #11, merge commit8a392f70a5d5575ece3dfb35f115d4a4b27f497ckeepkey/device-protocol@8545cd5b615f5832374afbf06387a3f28869285ekeepkey/python-keepkey@9c3982035664dbec44c6d1d60db6edb9fa59713cThe 7.14.3 audit is inherited only for unchanged bytes. Every 7.15 hunk touching an inherited invariant remains present in the line ledger.
Review gates
Do not merge, tag, sign, publish, or release from this PR until every applicable gate is closed.