test(hive): vendored SLIP-0048 multi-key + account-op device tests#21
Merged
Conversation
Covers the full Hive message surface (all 5 firmware handlers) using the standard 12-word seed (mnemonic12, "alcohol ... aisle"): - HiveGetPublicKey — active-role key format + 33-byte raw - HiveGetPublicKeys — 4 distinct STM role keys; single/bulk agreement - HiveSignTx — transfer (op 2), signature recovers to active key - HiveSignAccountCreate — account_create (op 9), recovers to owner key + binds the 4 device keys and account name into the signed bytes - HiveSignAccountUpdate — account_update (op 10), recovers to owner key Account-op tests are self-validating: they recover the signer from the 65-byte device signature over SHA256(chain_id || serialized_tx) and assert it equals the device-derived key — exercising the device and validating the attestation digest (keepkey-vault docs/HIVE-ATTESTATION-DIGEST-SPEC.md). No golden vector required; recovery is an independent check. Hive was the one alpha-firmware feature with full firmware+client support and zero test coverage.
Addresses review: substring-presence was too weak — a role swap (both keys present), a creator rewrite, or an amount change could still pass. Add a cursor-based Graphene reader matching the firmware append_* layout exactly (incl. account_update's 0x01 optional-present flags, asset symbol padding, and the no-wrapper memo_key) and rewrite all three signing tests to parse and assert each field at its expected position + assert_end() for no trailing bytes: - transfer: from / to / amount / precision / symbol / memo - account_create: fee / creator / name / owner|active|posting authority slots / memo_key - account_update: account / each replacement key in its slot / memo_key Recovery assertions retained. Parser validated offline against hand-built firmware-format bytes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the missing Hive device-test coverage. Hive was the one alpha-firmware feature with full firmware + proto + python-client support and zero tests (90-file suite, none for Hive).
tests/test_msg_hive.pycovers all 5 firmware Hive handlers using the standard 12-word seed (mnemonic12, "alcohol … aisle") viasetup_mnemonic_nopin_nopassphrase():get_public_key(active)get_public_keyssign_transfersign_account_createsign_account_updateWhy recovery-based
The account-op tests are self-validating and non-circular: they recompute
SHA256(chain_id ‖ serialized_tx), recover the signer from the 65-byte device signature (recid = sig[0]-31), and assert it equals the device-derived key. This exercises the device and validates the sponsor-side attestation contract (keepkey-vaultdocs/HIVE-ATTESTATION-DIGEST-SPEC.md) — no precomputed golden vector needed.The recovery helper was validated offline against a self-generated firmware-format signature (header byte
27+recid+4) before use.Notes
{signature, serialized_tx}vector can be pinned later from an emulator run (spec §8); the recovery assertions already validate correctness without it.