test(solana): plain-text SignMessage signs without AdvancedMode - #106
Merged
Merged
Conversation
BitHighlander
force-pushed
the
fix/solana-text-message-no-advanced-mode
branch
from
September 18, 2026 02:56
6aab51a to
91ac8bf
Compare
BitHighlander
added a commit
to BitHighlander/keepkey-firmware
that referenced
this pull request
Sep 18, 2026
Raw SolanaSignMessage required AdvancedMode for every payload, so each dApp login (SIWS / solana:signMessage) switched on session-wide blind signing. A transaction signature only verifies when the signer's key is in the message's static account keys, so printable text that never contains the key cannot authorize a transaction. Such messages are now reviewed as text without AdvancedMode; everything else keeps the gate and the raw-bytes review. Pins python-keepkey 91ac8bf (BitHighlander/python-keepkey#106). Closes #816
31d8c27 regenerated messages_pb2.py and messages_ethereum_pb2.py with a host protoc (builder-style, needs protobuf >= 3.20) instead of docker_build_pb.sh. The firmware integration container runs Python 3.6.9 / protobuf 3.17.3, so every python-integration-tests job failed at import: "cannot import name 'builder'". Regenerated via build_pb.sh inside the CI-pinned firmware image (protoc 3.5.1). Serialized descriptors are byte-identical to the builder files (messages 14590 B, ethereum 3046 B, types 4686 B). test_erc7730_protocol_bindings + test_message_signing_protocol_bindings: 8 passed on protobuf 3.17.3 (py3.6, CI image) and 3.20.3. setup.py range narrowed to what was tested: protoc-3.5.1 code does not load on protobuf >= 4.21.
(cherry picked from commit 2771e17)
The authoritative-network guard allowed loopback only. In firmware CI the emulator is the compose service kkemu (KK_TRANSPORT_MAIN= kkemu:11044), so all 616 emulator tests failed with 'attempted external network access'. Allow exactly the KK_TRANSPORT_MAIN / KK_TRANSPORT_DEBUG endpoints (and their resolved addresses), as the audit line does; every other destination is still denied. test_tx_fixture_integrity: 5 passed.
BitHighlander
force-pushed
the
fix/solana-text-message-no-advanced-mode
branch
from
September 18, 2026 06:11
91ac8bf to
ef26cdf
Compare
BitHighlander
added a commit
to BitHighlander/keepkey-firmware
that referenced
this pull request
Sep 18, 2026
Raw SolanaSignMessage required AdvancedMode for every payload, so each dApp login (SIWS / solana:signMessage) switched on session-wide blind signing. A transaction signature only verifies when the signer's key is in the message's static account keys, so printable text that never contains the key cannot authorize a transaction. Such messages are now reviewed as text without AdvancedMode; everything else keeps the gate and the raw-bytes review. Pins python-keepkey ef26cdf (BitHighlander/python-keepkey#106). Closes #816
- conftest: port pytest_collection_modifyitems from the audit line. Firmware CI passes KEEPKEY_SCREENSHOT_TESTS (188 report selectors); pyk alpha ignored it, so the screenshot phase ran all ~758 tests and the full-variant job hit its 30-minute limit. - test_msg_zcash_transparent_shielding: bitcoin-only builds have no Zcash (KK_ZCASH_PRIVACY OFF) and answer "Unknown message"; skip the class there, closing the transport via addCleanup since skipTest in setUp bypasses tearDown.
Firmware alpha (6816915a3) replaced direct dice entry with a host-selected mode and an on-device consent screen, then shows the device's 24 words before any roll. That firmware pinned python-keepkey f00e62f; a later re-pin to b44f1b3 (this alpha line) dropped the matching test, so test_reset_device_dice acked the consent screen as roll input and the device answered "Reset cancelled". Rewrite the test body for consent -> device words -> rolls -> digest confirm, and check the mnemonic against the published MIXED formula (device words + rolls; EntropyAck bytes excluded). Seed helpers and the requires_dice_modes capability gate come from f00e62f. Same test name, same two captures the report declares.
Firmware refuses a 68-byte approve(spender, 2^256-1) with "Unlimited ERC20 approval is disabled" (release-line policy since 7.14.2). This alpha line still expected signatures, so three tests failed on every full-variant run. Take the audit-line versions (f00e62f) that assert the refusal: test_approve_all, test_sign_uni_approve_liquidity_ETH, and the erc20-approve-unlimited clear-sign flow. Adds common.firmware_at_least.
Firmware authenticates before showing the SignMessage confirm since 7.14.2; this alpha line still expected the old order. Take the audit-line version (f00e62f), which gates the order on firmware_at_least.
The blocked-without-AdvancedMode case now uses a binary payload, so it holds on every firmware. New 7.16.0 case: a SIWS-style text login signs with AdvancedMode off (BitHighlander/keepkey-firmware#816).
BitHighlander
force-pushed
the
fix/solana-text-message-no-advanced-mode
branch
from
September 19, 2026 02:56
ef26cdf to
bd69520
Compare
BitHighlander
added a commit
to BitHighlander/keepkey-firmware
that referenced
this pull request
Sep 19, 2026
Raw SolanaSignMessage required AdvancedMode for every payload, so each dApp login (SIWS / solana:signMessage) switched on session-wide blind signing. A transaction signature only verifies when the signer's key is in the message's static account keys, so printable text that never contains the key cannot authorize a transaction. Such messages are now reviewed as text without AdvancedMode; everything else keeps the gate and the raw-bytes review. Pins python-keepkey bd69520 (BitHighlander/python-keepkey#106). Closes #816
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Tests for BitHighlander/keepkey-firmware#816.
test_solana_sign_message_blocked_without_advanced_mode: the payload changes fromb"Hello Solana!"to a binary tx-message header. Text is now allowed, and binary stays blocked on every firmware.test_solana_sign_plain_text_message_without_advanced_mode(gated at 7.16.0): a SIWS-style login signs with AdvancedMode off.Branched from
f5268a1, the commit firmware alpha currently pins, so the firmware pin bump carries only this change.