release: review 7.15 after current 7.14.3

.gitignore

@@ -3,3 +3,4 @@ build
 .DS_Store
 .vscode/
 
+build-btconly-check/

.gitleaks.toml

@@ -1,22 +1,135 @@
-title = "KeepKey firmware gitleaks configuration"
+title = "KeepKey firmware Gitleaks configuration"
 
 [extend]
 useDefault = true
 
-# Published U2F attestation material and historical vendored test vectors.
 [[allowlists]]
-description = "Public device material and third-party historical fixtures"
+description = "Published AES test vectors in current and historical trezor-crypto layouts"
+targetRules = ["generic-api-key"]
+condition = "AND"
+regexTarget = "line"
 paths = [
-  '''include/keepkey/firmware/u2f/trezordevkey\.pem''',
-  '''include/keepkey/firmware/u2f/u2f_keys\.h''',
-  '''^deps/''',
-  '''^tests/''',
+  '''^deps/crypto/trezor-firmware/crypto/aes/aestst\.c$''',
+  '''^deps/crypto/trezor-crypto/aes/aestst\.c$''',
+]
+regexes = ['''(?i)^[[:space:]]*//[[:space:]]*key[[:space:]]*=[[:space:]]*[0-9a-f]+[[:space:]]*$''']
+
+[[allowlists]]
+description = "Ed25519 C type names in current and historical trezor-crypto layouts"
+targetRules = ["generic-api-key"]
+condition = "AND"
+regexTarget = "line"
+paths = [
+  '''^deps/crypto/trezor-firmware/crypto/ed25519-donna/ed25519-(blake2b|keccak|sha3)\.h$''',
+  '''^deps/crypto/trezor-firmware/crypto/ed25519-donna/ed25519\.[ch]$''',
+  '''^deps/crypto/trezor-crypto/ed25519-donna/ed25519-(blake2b|keccak|sha3)\.h$''',
+  '''^deps/crypto/trezor-crypto/ed25519-donna/ed25519\.[ch]$''',
 ]
+regexes = ['''ed25519.*secret_key.*signature''']
 
 [[allowlists]]
-description = "Documented python-keepkey commit pins"
+description = "RC21 release provenance names an exact public python-keepkey git commit"
 targetRules = ["generic-api-key"]
 condition = "AND"
-paths = ['''^docs/''']
-regexes = ['''python-keepkey[^\n]{0,16}`[0-9a-f]{40}`''']
-regexTarget = "match"
+regexTarget = "line"
+paths = ['''^docs/security/7\.15\.0-rc21-clearsign-release-control\.md$''']
+regexes = ['''^[[:space:]]*-[[:space:]]*python-keepkey:[[:space:]]*`c406a1ba9120da410c356dbff7f4d4bd1e1758fa`\.[[:space:]]*$''']
+
+# Converted from the deprecated singular [allowlist] to a fourth [[allowlists]]
+# entry. gitleaks refuses to load a config containing both forms ("[allowlist] is
+# deprecated, it cannot be used alongside [[allowlists]]"), which is what the
+# alpha<-develop merge produced: alpha carried three [[allowlists]] and develop
+# carried this one [allowlist]. The merge kept both and the scan died at config
+# load, taking the whole build graph with it. Content is unchanged.
+[[allowlists]]
+description = """
+Two U2F attestation artifacts are public by design and must not fail the scan.
+
+1. include/keepkey/firmware/u2f/u2f_keys.h — U2F_ATT_PRIV_KEY[]
+
+   This is the FIDO U2F batch attestation key. The standard deliberately shares one
+   attestation key across a whole batch of devices, so that an attestation
+   certificate identifies a model rather than an individual unit. The key therefore
+   has to be present in every device: it is compiled into every firmware image and
+   is extractable from any public release binary. It authenticates nothing, protects
+   no user funds or data, and is not a wallet key or a code-signing key.
+
+   The certificate it accompanies is self-signed as CN=KeepKey U2F and expires
+   2028-10-01.
+
+2. include/keepkey/firmware/u2f/trezordevkey.pem
+
+   An orphaned key file that corresponds to nothing the firmware ships. Its private
+   scalar does not match U2F_ATT_PRIV_KEY[], and its public key does not match the
+   public key in the compiled attestation certificate — verified by decoding both.
+   It is neither the attestation key nor the key that signed the attestation cert.
+
+   It is allowlisted rather than merely deleted because CI scans with fetch-depth 0,
+   so gitleaks reads full history and this file has been present since commit
+   fe3e5e001 (2019-04-27). Deleting it from the working tree would not clear the
+   historical finding, and rewriting published history to remove a key that secures
+   nothing is not a trade worth making.
+
+   Removing the dead file and correcting genkeys.sh — which regenerates the
+   certificate as CN="Trezor U2F" and would also swap in this non-shipping key — is
+   tracked separately.
+
+3. deps/ — third-party and submodule content
+
+   CI checks out without submodules, but it scans with fetch-depth 0, and crypto
+   dependencies were vendored directly into this repository before they became
+   submodules. Every finding under deps/ is the generic-api-key rule firing on
+   high-entropy constants and test vectors in that vendored crypto — for example
+   the ed25519-donna headers and the AES self-test tables. None is a credential,
+   and none of it is KeepKey-authored code.
+
+4. docs/ — prose and recorded submodule pins
+
+   The security documentation records exact submodule pins, and gitleaks scores a
+   40-character git commit SHA at entropy ~3.8 and reports it as a generic API key
+   (for example the python-keepkey pin in
+   docs/security/7.15.0-rc21-clearsign-release-control.md).
+
+   This is scoped by PATH rather than by a regex on the secret. An earlier version
+   of this file allowlisted the pattern \\b[0-9a-f]{40}\\b globally, which was
+   rightly flagged in review: that suppressed every 40-character lowercase hex
+   finding anywhere in the tree, including in source, not merely documented commit
+   hashes. Path scoping keeps the exemption where the false positives actually are.
+
+   Anything under docs/ is prose intended for publication. A credential must never
+   be committed there in the first place, and this exemption is not a licence to do
+   so — it is an acknowledgement that git SHAs in prose are not secrets.
+
+5. tests/ — historical, pre-submodule test vectors
+
+   This path does not exist in the working tree. The python test suite lived at the
+   repository root before it became the deps/python-keepkey submodule, and CI scans
+   with fetch-depth 0, so gitleaks still reads those commits.
+
+   Every finding here is the generic-api-key rule firing on published BIP32 test
+   vectors — the flagged lines are WIF private keys printed next to their own address
+   and public key as documentation, e.g. tests/test_ecies.py (2014, inherited from
+   Trezor) and tests/test_msg_eos_signtx.py (2018). They are upstream test fixtures,
+   published for a decade, and secure nothing.
+
+   Scoped by path for the same reason as deps/: the secrets are real key material by
+   format, so a regex exemption would be dangerous, whereas the path is provably dead.
+
+   The cost of a path exemption, stated plainly: a genuine secret committed under
+   tests/ would NOT be caught. That is acceptable only while the directory does not
+   exist. If a tests/ tree is ever reintroduced at the repository root, remove this
+   exemption in the same commit — verified by negative control, a real EC private key
+   planted under tests/ is ignored, while the same key under lib/firmware/ is still
+   detected.
+
+Scope note: every exemption is scoped by path and the default ruleset is otherwise
+intact, so a genuine secret committed in source still fails the scan. Verified by
+negative control: a planted EC private key under lib/firmware/ is still detected.
+"""
+paths = [
+  '''include/keepkey/firmware/u2f/trezordevkey\.pem''',
+  '''include/keepkey/firmware/u2f/u2f_keys\.h''',
+  '''^deps/''',
+  '''^docs/''',
+  '''^tests/''',
+]

.gitmodules

@@ -1,10 +1,10 @@
 [submodule "deps/device-protocol"]
 path = deps/device-protocol
-url = https://github.com/keepkey/device-protocol.git
-branch = master
+	url = https://github.com/keepkey/device-protocol.git
+branch = up/release-protocol
 [submodule "deps/trezor-firmware"]
 path = deps/crypto/trezor-firmware
-url = https://github.com/keepkey/trezor-firmware.git
+url = https://github.com/BitHighlander/trezor-firmware.git
 [submodule "googletest"]
 path = deps/googletest
 url = https://github.com/google/googletest.git
@@ -14,7 +14,7 @@ url = https://github.com/keepkey/code-signing-keys.git
 [submodule "deps/python-keepkey"]
 path = deps/python-keepkey
 url = https://github.com/keepkey/python-keepkey.git
-branch = master
+branch = reconcile/upstream-sync
 [submodule "deps/qrenc/QR-Code-generator"]
 path = deps/qrenc/QR-Code-generator
 url = https://github.com/keepkey/QR-Code-generator.git

CMakeLists.txt

@@ -9,7 +9,7 @@ endif()
 
 project(
   KeepKeyFirmware
-  VERSION 7.14.3
+  VERSION 7.15.0
   LANGUAGES C CXX ASM)
 
 set(BOOTLOADER_MAJOR_VERSION 2)
@@ -22,6 +22,16 @@ option(KK_DEBUG_LINK "Build with debug-link enabled" OFF)
 option(KK_BUILD_FUZZERS "Build the fuzzers?" OFF)
 option(KK_BITCOIN_ONLY "Build Bitcoin-only firmware (strip all non-BTC coins)"
        OFF)
+# Zcash shielded/Orchard support is part of the regular firmware. It is an
+# internal compile selection, not a third release variant: bitcoin-only strips
+# the Zcash coin and privacy engine; every regular device/emulator build ships
+# both. The open constant-time Pallas audit finding remains a release gate for
+# RC18, but it must not silently change the product being audited.
+if(KK_BITCOIN_ONLY)
+  set(KK_ZCASH_PRIVACY OFF)
+else()
+  set(KK_ZCASH_PRIVACY ON)
+endif()
 
 # When building the dylib, every static lib it links (kkfirmware, kkboard,
 # trezorcrypto, kkrand, kktransport, qrcodegenerator, SecAESSTM32, ...) must
@@ -64,7 +74,7 @@ endif()
 if(NOT EXISTS ${CMAKE_SOURCE_DIR}/deps/crypto/trezor-firmware/crypto/Makefile)
   message(
     FATAL_ERROR
-      " trezor-crypto missing. Need to 'git submodule update --init --recursive"
+      "trezor-crypto fork missing. Run 'git submodule update --init deps/crypto/trezor-firmware'"
   )
 endif()
 
@@ -86,6 +96,13 @@ endif()
 if(${KK_EMULATOR})
   add_definitions(-DEMULATOR)
   add_definitions(-DCONFIDENTIAL=)
+  # macOS/BSD declare strlcpy/strlcat in <string.h>; glibc (Linux) and MinGW
+  # (Windows) do not. Force-include the prototypes so the ~20 call sites build
+  # without -Werror=implicit-function-declaration (definitions come from
+  # lib/board/strlcpy.c + strlcat.c). Apple already has them in <string.h>.
+  if(NOT APPLE)
+    add_compile_options(-include ${CMAKE_SOURCE_DIR}/include/keepkey/board/bsd_compat.h)
+  endif()
 else()
   add_definitions(-DCONFIDENTIAL=__attribute__\(\(section\("confidential"\)\)\))
 endif()
@@ -115,6 +132,13 @@ add_definitions(-DUSE_CARDANO=0)
 add_definitions(-DUSE_MONERO=0)
 add_definitions(-DUSE_NEM=0)
 
+# NOT a USE_* style on/off toggle despite sitting next to them: trezor-crypto's
+# rand.c tests this macro with #ifndef, so only its *definedness* matters. The
+# old -D...=0 spelling read as "off" while actually meaning "on", and the
+# insecure LCG random32() stayed out of the build purely by that double
+# negation. Define it bare, matching upstream trezor-core's SConscript.firmware,
+# so a future cleanup of an apparent "=0 means unused" define cannot silently
+# compile in the LCG. lib/rand/rng.c #errors if this ever goes missing.
 # trezor-crypto's rand.c tests only whether this macro is defined.  A value of
 # zero therefore did not disable anything; it excluded the library's insecure
 # test LCG by definedness.  Use the upstream spelling so that intent is clear,
@@ -137,22 +161,37 @@ add_definitions(-DBIP39_WORDLIST_PADDED=1)
 
 add_definitions(-DAES_128=1)
 
+# NOTE: AES table size is selected per release product below. The regular
+# image includes Zcash and its Pallas curve arithmetic, so it uses the smaller
+# AES tables to preserve flash headroom. Bitcoin-only keeps FOUR_TABLES AES.
+
 if(${KK_DEBUG_LINK})
   add_definitions(-DDEBUG_LINK=1)
 else()
   add_definitions(-DDEBUG_LINK=0)
 endif()
 
-# Always defined, 0 or 1, and always tested with `#if BITCOIN_ONLY`. Device
-# builds compile with -Wundef -Werror, so an undefined identifier inside `#if`
-# is a hard error rather than a silent zero -- which is what we want, because
-# a silently-zero guard would ship the coin engines into the stripped image.
+# Value macros: always defined, 0 or 1, and always tested with `#if FLAG`.
+# Device builds compile with -Wundef -Werror, so an undefined identifier inside
+# `#if` is a hard error rather than a silent zero -- which is what we want,
+# because a silently-zero guard would ship the coin engines into the stripped
+# image.
 if(${KK_BITCOIN_ONLY})
   add_definitions(-DBITCOIN_ONLY=1)
 else()
   add_definitions(-DBITCOIN_ONLY=0)
 endif()
 
+if(${KK_ZCASH_PRIVACY})
+  add_definitions(-DZCASH_PRIVACY=1)
+  # The Orchard engine leaves the regular image tightest on flash; shrink the
+  # Gladman AES lookup tables from 4KB to 1KB each (-15,360 bytes ROM,
+  # slightly slower AES). Bitcoin-only keeps the fast FOUR_TABLES.
+  add_definitions(-DAES_SMALL_TABLES)
+else()
+  add_definitions(-DZCASH_PRIVACY=0)
+endif()
+
 if("${CMAKE_BUILD_TYPE}" STREQUAL "Debug")
   add_definitions(-DDEBUG_ON)
   add_definitions(-DMEMORY_PROTECT=0)
@@ -185,6 +224,12 @@ if(NOT ${KK_EMULATOR})
   link_directories(${LIBOPENCM3_PATH}/lib)
   include_directories(${LIBOPENCM3_PATH}/include)
 
+  # Emit per-function stack-frame sizes (.su files) on device builds. CI's
+  # SRAM budget gate (tools/check_sram_budget.py) reports the largest frames
+  # and fails when the linker-asserted stack reserve minus the largest frame
+  # leaves less than the configured margin. See tools/firmware/keepkey.ld.
+  add_compile_options(-fstack-usage)
+
   # Dummy empty libraries for stack smashing protection support, since we
   # implement __stack_chk_guard and __stack_chk_fail ourselves.
   file(WRITE ${CMAKE_BINARY_DIR}/ssp.c "")
@@ -213,6 +258,10 @@ if(${KK_EMULATOR})
   add_test(test-firmware ${CMAKE_BINARY_DIR}/bin/firmware-unit)
   add_test(test-board ${CMAKE_BINARY_DIR}/bin/board-unit)
   add_test(test-crypto ${CMAKE_BINARY_DIR}/bin/crypto-unit)
+  if(${KK_ZCASH_PRIVACY})
+    add_test(test-pallas-ct ${CMAKE_BINARY_DIR}/bin/pallas-ct-unit)
+    add_test(test-zcash-crypto ${CMAKE_BINARY_DIR}/bin/zcash-crypto-unit)
+  endif()
 
   add_custom_target(
     xunit
@@ -223,4 +272,10 @@ if(${KK_EMULATOR})
     COMMAND ${CMAKE_BINARY_DIR}/bin/crypto-unit
             --gtest_output=xml:${CMAKE_BINARY_DIR}/unittests/crypto.xml)
 
+  if(${KK_ZCASH_PRIVACY})
+    add_custom_command(TARGET xunit POST_BUILD
+      COMMAND ${CMAKE_BINARY_DIR}/bin/pallas-ct-unit
+              --gtest_output=xml:${CMAKE_BINARY_DIR}/unittests/pallas-ct.xml)
+  endif()
+
 endif()

Makefile

@@ -0,0 +1,42 @@
+# Convenience targets — mirrors CI jobs so failures are caught locally.
+#
+# CI pins clang-format-20. Use that version if available, otherwise fall back.
+# To install: brew install llvm@20  or  apt-get install clang-format-20
+CLANG_FORMAT ?= $(shell command -v clang-format-20 2>/dev/null || echo clang-format)
+
+# Directories and exclusions must match .github/workflows/ci.yml lint-format job.
+LINT_DIRS := include/keepkey lib/firmware lib/board lib/transport/src
+LINT_SOURCES := $(shell find $(LINT_DIRS) -name '*.c' -o -name '*.h' 2>/dev/null \
+                | grep -v generated | grep -v '\.pb\.')
+
+.PHONY: lint format help
+
+## lint: Check formatting (same rules as CI). Exits non-zero on any violation.
+lint:
+	@echo "clang-format version: $$($(CLANG_FORMAT) --version)"
+	@FAILED=0; \
+	for f in $(LINT_SOURCES); do \
+	  if ! $(CLANG_FORMAT) --style=file --dry-run --Werror "$$f" 2>/dev/null; then \
+	    echo "  NEEDS FORMAT: $$f"; \
+	    FAILED=1; \
+	  fi; \
+	done; \
+	if [ "$$FAILED" = "1" ]; then \
+	  echo ""; \
+	  echo "Run 'make format' to fix all files."; \
+	  exit 1; \
+	else \
+	  echo "All files pass clang-format check."; \
+	fi
+
+## format: Auto-fix formatting in-place for all source files.
+format:
+	@echo "Formatting $(LINT_DIRS)..."
+	@for f in $(LINT_SOURCES); do \
+	  $(CLANG_FORMAT) --style=file -i "$$f"; \
+	done
+	@echo "Done. Review changes with: git diff"
+
+## help: List available targets.
+help:
+	@grep -E '^## ' $(MAKEFILE_LIST) | sed 's/^## /  make /'

cmake/caches/device.cmake

@@ -45,7 +45,14 @@ set(WARN_FLAGS
     -Werror")
 
 
-set(KK_C_FLAGS "${ARCH_FLAGS} -std=gnu99 ${WARN_FLAGS}" CACHE STRING "")
+# Newlib's snprintf unconditionally links the float engine (_svfprintf_r,
+# _dtoa_r, soft-double libgcc, malloc) — ~22 KB of ROM with zero %f users in
+# the firmware. Route all callers to the integer-only siprintf family instead.
+# %lld/%llu still work (this toolchain's libc.a compiles the integer engine
+# with long-long support). Device builds only; host/emulator keep libc printf.
+set(PRINTF_FLAGS "-Dsnprintf=sniprintf -Dvsnprintf=vsniprintf")
+
+set(KK_C_FLAGS "${ARCH_FLAGS} -std=gnu99 ${WARN_FLAGS} ${PRINTF_FLAGS}" CACHE STRING "")
 set(KK_CXX_FLAGS "${ARCH_FLAGS} -std=gnu++11 ${WARN_FLAGS} \
     -fno-exceptions \
     -fno-rtti \