test(7.15): Stack 07 audit remediation for ERC-7730 and streamed EIP-712

.circleci/config.yml

@@ -0,0 +1,27 @@
+version: 2.1
+
+# The authoritative multi-release emulator matrix lives in GitHub Actions.
+# Keep this smoke job while the legacy CircleCI project remains connected so
+# its required status verifies the checkout instead of failing at config load.
+jobs:
+  canonical-smoke:
+    docker:
+      - image: cimg/python:3.11
+    steps:
+      - run:
+          name: Checkout current branch over HTTPS
+          command: |
+            git clone --depth 1 -b "$CIRCLE_BRANCH" \
+              https://github.com/keepkey/python-keepkey.git .
+            git submodule update --init --recursive
+      - run:
+          name: Validate canonical Python and EOS vector contracts
+          command: |
+            python -m py_compile keepkeylib/*.py tests/test_msg_solana_signtx.py
+            python -m pip install --quiet pytest requests
+            python -m pytest -q tests/unit/test_eos_updateauth_vector.py
+
+workflows:
+  canonical:
+    jobs:
+      - canonical-smoke

.github/workflows/ci.yml

@@ -119,24 +119,15 @@ jobs:
           submodules: recursive
           path: python-keepkey
 
-      # Immutable fork 7.15 candidate. Once canonical Python merges, the
-      # firmware branch is repinned to that one upstream commit and rerun.
+      # Immutable firmware 7.15 code head validated by the release stack.
       - name: Checkout firmware
         uses: actions/checkout@v4
         with:
           repository: BitHighlander/keepkey-firmware
-          # PINNED, not `alpha`. A moving branch means a firmware push can
-          # change this PR's result with no Python commit, which makes a green
-          # run unciteable. This SHA is alpha at the time of pinning.
-          #
-          # NOTE: this is the exact staged 7.16.0 candidate, NOT
-          # 7.15.0/RC18. The suite needs firmware
-          # that only exists after RC18 -- variant_getName() returning
-          # "EmulatorBTC" (required by requires_bitcoinOnly, so by the whole
-          # integration-btc job) and the Ironwood known-answer vectors. So this
-          # job validates 7.16.0; it does not validate the RC18 dependency
-          # graph. Bump deliberately, and re-read that claim when you do.
-          ref: 651f2a462b8e71ffb37995094dbe1e9298bc802f
+          # PINNED, not a moving branch, so a green result remains citeable.
+          # This is the code/workflow head beneath the handoff-only commit on
+          # firmware PR #843.
+          ref: a6effd7205b480c4fb314a1714831ffd863e2a48
           path: keepkey-firmware
 
       # NOT `submodules: recursive`. trezor-firmware carries a micropython
@@ -564,7 +555,7 @@ jobs:
             firmware_ref: 4125e1c7409b1cb7b08ba595bc408e3128fc24ca
             min_fw: "7.14.3"
           - release: "7.15"
-            firmware_ref: d33f1711c3b2b205f64c5dc35fdec02926a6dc63
+            firmware_ref: a6effd7205b480c4fb314a1714831ffd863e2a48
             min_fw: "7.15.0"
 
     # KK_BITCOIN_ONLY=ON is a second shipping product, not a build flavour:
@@ -590,18 +581,10 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: BitHighlander/keepkey-firmware
-          # PINNED, not `alpha`. A moving branch means a firmware push can
-          # change this PR's result with no Python commit, which makes a green
-          # run unciteable. This SHA is alpha at the time of pinning.
-          #
-          # NOTE: this is the exact staged 7.16.0 candidate, NOT
-          # 7.15.0/RC18. The suite needs firmware
-          # that only exists after RC18 -- variant_getName() returning
-          # "EmulatorBTC" (required by requires_bitcoinOnly, so by the whole
-          # integration-btc job) and the Ironwood known-answer vectors. So this
-          # job validates 7.16.0; it does not validate the RC18 dependency
-          # graph. Bump deliberately, and re-read that claim when you do.
-          ref: 651f2a462b8e71ffb37995094dbe1e9298bc802f
+          # Each matrix row is an immutable shipping candidate. Do not replace
+          # this with a common alpha SHA: that would make both labels test the
+          # same firmware and silently discard cross-release compatibility.
+          ref: ${{ matrix.firmware_ref }}
           path: keepkey-firmware
 
       # Same non-recursive init as the regular job: trezor-firmware's

keepkeylib/erc7730_compiler.py

@@ -670,6 +670,11 @@ def intern_path(steps):
                         "threshold", "message", "chainId", "chainIdPath")):
                     raise ValueError(
                         "unknown token amount cannot use token metadata parameters")
+                else:
+                    # No token is named, so the device can only show the raw
+                    # integer. Its verifier refuses a tokenAmount without a
+                    # token argument, so compile the raw formatter it runs.
+                    kind = 1
                 if "threshold" in params:
                     threshold = descriptor_value(params["threshold"])
                     if isinstance(threshold, str) and threshold.startswith("0x"):
@@ -847,6 +852,11 @@ def depth(node):
             return 1 + (max(depth(child) for child in node.children)
                         if node.children else 0)
         max_depth = depth(root)
+        # The device's ABI verifier counts the root as depth 1, as depth()
+        # does, and refuses a node deeper than ERC7730_ABI_MAX_DEPTH (8).
+        if max_depth > 8:
+            raise ValueError(
+                "ERC-7730 ABI nests deeper than the device supports")
         for node, first, count in flat:
             array_length = node.array_length if node.kind == 9 else 0
             payload += bytes([node.kind]) + _u16(node.size) + _u16(first) + _u16(count) + _u16(array_length or 0)
@@ -859,6 +869,16 @@ def depth(node):
             if steps and steps[0][0] == "container":
                 payload += bytes([2, 0]) + _u16(steps[0][1])
                 continue
+            # Device captures descend one ABI level per step and refuse
+            # ERC7730_ABI_MAX_DEPTH (8) or more steps.
+            if len(steps) >= 8:
+                raise ValueError(
+                    "ERC-7730 path nests deeper than the device supports")
+            # The device iterates at most one array per path ("[]" step).
+            if sum(1 for step in steps if step[0] == 2) > 1:
+                raise ValueError(
+                    "ERC-7730 path iterates more than one array; the device "
+                    "supports one")
             payload += bytes([1, len(steps)]) + _u16(ABSENT)
             for step in steps:
                 if step[0] == 1: