release: review 7.14.3 Bitcoin-only on current 7.14.2 - #627
Open
BitHighlander wants to merge 1 commit into
Open
Conversation
There was a problem hiding this comment.
🔵 Needs a closer look
It changes multiple security-critical subsystems (RNG, seed ceremony, storage/versioning, signing/address semantics, and CI/release provenance) across many files, warranting final human review despite strong test coverage.
Pull request overview
This PR advances the 7.14.x release line to v7.14.3 and implements/locks down the “Bitcoin-only + Dice entropy” release delta while hardening seed-time RNG handling, Taproot/BIP-340/341/86 support, storage compatibility boundaries, and CI/release gating.
Changes:
- Add Bitcoin-only build variant (compile-time stripping of non-Bitcoin engines, message map entries, coin/token tables, and CI/release matrix coverage for both variants).
- Add/extend Bitcoin security features: Taproot address/script support, OP_RETURN disclosure hardening, multisig quorum validation, tx input digest reset helper, and new regression/unit tests.
- Add seed-time RNG health gate plus Dice entropy reset ceremony (with debug-link observability and extensive unit tests), plus CI hardening (gitleaks pin+scoping, aggregate “ci-gate”, nonzero propagation).
File summaries
| File | Description |
|---|---|
| unittests/firmware/transaction.cpp | New unit tests for taproot input weight, OP_RETURN/Omni disclosure paging, multisig quorum rejection. |
| unittests/firmware/test_board.cpp | One-time board bootstrap guard for unit test binaries to prevent hangs. |
| unittests/firmware/signing.cpp | New unit tests for change-path/script-type constraints, checksum encoding, multisig quorum validation, abort scrubbing. |
| unittests/firmware/setup_ceremony.cpp | Tests for abort wiping mnemonic + recovery fragments; recovery finalize disarm behavior. |
| unittests/firmware/rng_health.cpp | New unit tests for RNG health analysis, chunking equivalence, and fail-closed semantics. |
| unittests/firmware/fsm.cpp | Conditionally exclude non-Bitcoin FSM abort workflow tests from bitcoin-only builds. |
| unittests/firmware/dice.cpp | New tests for dice roll counts and deterministic mix vectors. |
| unittests/firmware/confirm_test_utils.cpp | New confirm auto-accept driver via emulator tiny UDP messages (ButtonAck + DebugLinkDecision). |
| unittests/firmware/CMakeLists.txt | Build manifest refactor + bitcoin-only conditional compilation of altcoin suites. |
| unittests/firmware/authenticator.cpp | New authenticator cache/authorization-boundary tests with confirm driver integration. |
| unittests/crypto/CMakeLists.txt | Add BIP340/BIP341 crypto test compilation. |
| unittests/crypto/bip340.cpp | Add verbatim BIP-340 vectors + BIP-86 address vectors + BIP-341 key-path witness checks. |
| scripts/verify-token-def.py | New generator guard: fail build if generated token defs have zero usable rows. |
| scripts/emulator/firmware-unit.sh | Preserve make xunit exit status and propagate it after copying reports. |
| scripts/emulator/docker-compose.bitcoin-only.yml | New compose overlay to build/run emulator+unit container with KK_BITCOIN_ONLY=ON. |
| scripts/emulator/capture-dice-flow.py | New evidence tool to drive/reset dice flow and capture OLED screenshots. |
| lib/rand/rng.c | Latch STM32 RNG seed/clock errors in software + emulator test seams + strong random_buffer for some linkers. |
| lib/rand/rng_health.c | New RNG source liveness check + SP800-90B RCT/APT + latched verdict + checked draw/continuous observe. |
| lib/rand/CMakeLists.txt | Add rng_health.c to kkrand library sources. |
| lib/firmware/u2f.c | Route U2F key-handle derivation path through checked RNG; fail registration on RNG self-test failure. |
| lib/firmware/txin_check.c | Add txin_dgst_reset_current() helper to preserve last-tx duplicate warning while resetting current digest. |
| lib/firmware/transaction.c | Taproot address encoding, scriptPubKey derivation helper, OP_RETURN confirm behavior for bitcoin-only, multisig quorum validation, taproot input weight. |
| lib/firmware/ton.c | Adjust Ed25519 signing call sites to updated signature (no explicit public-key pointer). |
| lib/firmware/storage.h | Add SUS_BitcoinOnlyLocked status for refusing incompatible storage without wiping. |
| lib/firmware/storage.c | Bitcoin-only storage band stamping/locking, RNG-gated key-material draws, stronger session-clear scrubbing, refuse commit when locked. |
| lib/firmware/solana.c | Adjust Ed25519 signing call sites to updated signature (no explicit public-key pointer). |
| lib/firmware/reset.c | Add dice-entropy reset flow, roll digest lifecycle, RNG health failure reporting, and broader abort scrubbing. |
| lib/firmware/recovery_cipher.c | Hoist/rename scratch buffers to make abort wiping reliable; add debug test seams for fragment wiping. |
| lib/firmware/messagemap.def | Exclude non-Bitcoin message handlers and outputs in bitcoin-only builds. |
| lib/firmware/fsm.c | Centralize derived-node scrub, bitcoin-only no-op abort hooks, and bitcoin-only “locked wallet” refusal in init flows. |
| lib/firmware/fsm_msg_solana.h | Adjust Ed25519 signing call site to updated signature. |
| lib/firmware/fsm_msg_debug.h | Expose dice digest via DebugLinkState. |
| lib/firmware/fsm_msg_common.h | Advertise taproot capability; set stable bitcoin-only variant strings; bound GetCoinTable to build variant; tighten wipe/session boundary. |
| lib/firmware/fsm_msg_coin.h | Enforce BIP86 (m/86’) path/script-type invariants for Taproot address requests. |
| lib/firmware/dice_input.c | New on-device dice entry UI/flow with debounce/hold classification and debug-link injection support. |
| lib/firmware/coins.c | Exclude tokens from coin table in bitcoin-only builds; add BIP86 path mismatch checks. |
| lib/firmware/CMakeLists.txt | Conditional compilation/linking of non-Bitcoin engines; add dice input; add token-table verification step. |
| lib/firmware/authenticator.c | Add cache wipe/test seams; harden OTP generation cleanup/zeroization paths. |
| lib/firmware/app_layout.c | Fix multi-line bech32 address rendering so displayed address doesn’t silently truncate. |
| lib/board/keepkey_flash.c | Gate OTP randomness-block programming on checked RNG draw; fail closed without locking bad entropy. |
| include/keepkey/transport/messages.options | Add dice_digest sizing; bound DebugLinkDecision.input to keep tiny-message decode within 64B; size clearsign fields. |
| include/keepkey/transport/messages-thorchain.options | Add ThorchainMsgSend.denom sizing. |
| include/keepkey/transport/messages-solana.options | Add Solana sizing entries for schema/LUT/signature fields and other buffers/counts. |
| include/keepkey/transport/messages-ripple.options | Add RippleSignTx.memo size limit. |
| include/keepkey/transport/messages-ethereum.options | Add LoadClearsignSigner size limits. |
| include/keepkey/rand/rng.h | Add seed/clock error latch API + emulator test seams; include stdbool. |
| include/keepkey/rand/rng_health.h | New public RNG health/checked-draw API and explicitly scoped coverage list. |
| include/keepkey/firmware/txin_check.h | Export txin_dgst_reset_current(). |
| include/keepkey/firmware/transaction.h | Export multisig quorum predicate + input scriptPubKey helper. |
| include/keepkey/firmware/storage.h | Define shipped version floor + bitcoin-only version band + locked-wallet query API. |
| include/keepkey/firmware/signing.h | Expose pure helpers for unit tests + debug seams for state wipe checks. |
| include/keepkey/firmware/reset.h | Extend reset_init signature to include dice_entropy; add dice digest accessor. |
| include/keepkey/firmware/recovery_cipher.h | Add debug test seams for recovery fragment wiping verification. |
| include/keepkey/firmware/fsm.h | Export derived-node scrub + debug test seams. |
| include/keepkey/firmware/dice_input.h | New dice-entropy API surface (roll collection + mix). |
| include/keepkey/firmware/coins.h | Exclude token indices from bitcoin-only builds. |
| include/keepkey/firmware/coins.def | Exclude non-Bitcoin coin definitions from bitcoin-only builds. |
| include/keepkey/firmware/authenticator.h | Add cache/test seam declarations and include stdbool. |
| docs/security/7.14.3-bitcoin-only-dice-audit-sop.md | New audit SOP defining line-review ledger, gates, and evidence expectations. |
| docs/DiceEntropy.md | New user-facing doc describing dice entropy flow, guarantees, and limitations. |
| deps/crypto/CMakeLists.txt | Add bip340.c to trezor-crypto build. |
| CMakeLists.txt | Bump version to 7.14.3; add KK_BITCOIN_ONLY option; ensure BITCOIN_ONLY define is always 0/1; disable unused coin crypto in bitcoin-only build. |
| .github/workflows/release.yml | Release matrix for full + bitcoin-only artifacts; per-variant hash manifests with provenance. |
| .github/workflows/ci.yml | Least-privilege permissions; pinned/scoped gitleaks; build/test matrix for both variants; compose overlays; per-variant artifacts; global ci-gate job. |
Review details
- Files reviewed: 68/68 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
BitHighlander
force-pushed
the
release/7.14.3-bitcoin-only
branch
from
August 27, 2026 20:02
6024f60 to
0f7903d
Compare
Owner
Author
Audit index — 7.14.3 Bitcoin-onlyThis is the durable top-level ledger. Detailed checkboxes live in the commit-pinned line maps below. A checkbox means every listed base and candidate range in that file was reviewed; findings must cite the exact range and head. Immutable review identity
Canonical dependency identity
The direct firmware DP pin intentionally remains Line-addressable audit surfaces
Gates
Head-change log
Copilot delivery status
No merge, tag, signing, publishing, release, upstream firmware PR, or physical-test claim is made by this fork audit vehicle. |
Squash the audited 7.14.3 delta onto the immutable 7.14.2 review base: Bitcoin-only product boundaries, Taproot signing, Dice entropy and RNG health, storage compatibility, disclosure and signing fixes, dependency pins, tests, and release evidence gates.
BitHighlander
force-pushed
the
release/7.14.3-bitcoin-only
branch
from
August 28, 2026 18:54
c636edf to
abe29d1
Compare
Owner
Author
7.14.3 line audit — firmware deltaExact range: Checkbox rule: mark a file complete only after reviewing every listed base and candidate range, including removed/replaced base lines. Findings must cite the surface, path, range, and exact head. Generated files and tests are reviewable evidence, not substitutes for reviewing runtime code. Changed files represented in this checklist: 117. 7143-BTC — Bitcoin, Taproot, signing and exact disclosure
7143-CI — CI, release provenance, artifacts and failure propagation
7143-DEP — dependency identity and build integration
7143-DOC — security contract and operator documentation
7143-ENT — Dice, RNG, setup, storage and secret lifecycle
7143-PROD — Bitcoin-only product boundary and link surface
7143-REG — cross-chain and regression validation
7143-REG — cross-chain, parser, UI and session hardening
|
Owner
Author
7.14.3 line audit — trezor-crypto dependencyExact range: Checkbox rule: mark a file complete only after reviewing every listed base and candidate range, including removed/replaced base lines. Findings must cite the surface, path, range, and exact head. Generated files and tests are reviewable evidence, not substitutes for reviewing runtime code. Changed files represented in this checklist: 57. DEP-CRYPTO-BTC — secp256k1, Schnorr and Taproot primitives
DEP-CRYPTO-CORE — shared hashes, encodings and build surface
DEP-CRYPTO-ED — Ed25519 API and callers
DEP-CRYPTO-TEST — dependency tests and vectors
DEP-CRYPTO-ZEC — Pallas, RedPallas and Orchard primitives
|
Owner
Author
7.14.3 line audit — device-protocol dependencyExact range: Checkbox rule: mark a file complete only after reviewing every listed base and candidate range, including removed/replaced base lines. Findings must cite the surface, path, range, and exact head. Generated files and tests are reviewable evidence, not substitutes for reviewing runtime code. Changed files represented in this checklist: 21. DEP-DP-BOUNDS — nanopb capacity and allocation bounds
DEP-DP-GEN — generators, documentation and repository wiring
DEP-DP-SCHEMA — protobuf message and wire-ID definitions
|
Owner
Author
7.14.3 line audit — Python companion dependencyExact range: Checkbox rule: mark a file complete only after reviewing every listed base and candidate range, including removed/replaced base lines. Findings must cite the surface, path, range, and exact head. Generated files and tests are reviewable evidence, not substitutes for reviewing runtime code. Changed files represented in this checklist: 81. DEP-PYK-CI — companion CI, catalogs and generation gates
DEP-PYK-DOC — packaging, fixtures and documentation
DEP-PYK-LIB — host API, protobuf bindings and transaction logic
DEP-PYK-TEST — device integration, vectors and report coverage
|
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review target
Fork-only audit PR for the squashed 7.14.3 Bitcoin-only release candidate.
review/7.14.2-pr458-current@3df4038f48a5c8d2656d71749e7f40a989f979c2release/7.14.3-bitcoin-only@abe29d1288638867dc64dfe04219b89f7a593133c636edfais preserved atpreserve/release-7.14.3-pre-upstream-squash-20260828The audit ledger links checkable, commit-pinned file/line maps for all 117 firmware files plus the internal trezor-crypto, device-protocol and Python companion deltas. Every dependency URL is canonical upstream.
Current gates
No merge, signing, tagging, publishing, release, upstream firmware PR, or upstream firmware comment is authorized by this fork review.