test(7.15): hive signing suites (1614–1617) + clearsign v2 harness + chain test updates

.gitmodules

@@ -1,7 +1,7 @@
 [submodule "device-protocol"]
 path = device-protocol
-url = https://github.com/BitHighlander/device-protocol.git
-branch = master
+url = https://github.com/keepkey/device-protocol.git
+branch = up/release-protocol
 [submodule "keepkeylib/eth/ethereum-lists"]
 path = keepkeylib/eth/ethereum-lists
 url = https://github.com/keepkey/ethereum-lists.git

keepkeylib/clearsign_catalog.py

@@ -954,10 +954,14 @@ def _bytes_tail(b):
         [{'name': 'sender', 'format': ARG_FORMAT_ADDRESS, 'value': addr('0x9406Cc6185a346906296840746125a0E44976454')},
          {'name': 'nonce', 'format': ARG_FORMAT_STRING, 'value': b'UserOperation nonce: 12'},
          {'name': 'beneficiary', 'format': ARG_FORMAT_ADDRESS, 'value': addr('0x' + '43' * 20)},
-         {'name': 'innerCall', 'format': ARG_FORMAT_STRING, 'value': b'decoded separately, not raw'}],
+         {'name': 'innerCall', 'format': ARG_FORMAT_STRING, 'value': b'empty (representative)'}],
         why='A bundler-submitted meta-tx: the EntryPoint singleton validates and executes a batch of '
-            'smart-account operations; the inner callData (what the smart account will actually do) '
-            'must be decoded and shown, never left as an opaque blob one layer inside another.',
+            'smart-account operations. KNOWN GAP, disclosed: this representative UserOp carries an '
+            'EMPTY inner callData (the array-of-dynamic-tuples nesting is beyond the current static '
+            'ABI encoder), so this flow proves sender/nonce/beneficiary are decoded but does NOT '
+            'prove the inner callData — what the smart account will actually do — is decoded. A real '
+            'UserOp with non-empty callData would need it decoded and shown, never left as an opaque '
+            'blob one layer inside another; that inner-decode capability is future work.',
         source='https://etherscan.io/address/0x0000000071727De22E5E9d8BAf0edAc6f37da032 (EntryPoint v0.7)',
     ),
 )

keepkeylib/client.py

@@ -711,16 +711,57 @@ def ethereum_send_tx_metadata(self, signed_payload, metadata_version, key_id):
         return self.call(msg)
 
     @expect(proto.Success)
-    def load_clearsign_signer(self, key_id, pubkey, alias):
-        """Load a runtime clearsign signer (compressed pubkey + alias) into a
-        key slot. Triggers a mandatory on-device confirmation; RAM-only, the
-        signer is gone on reboot. Metadata verified by a loaded signer shows
-        a warning screen naming the alias before every clearsign page."""
+    def load_clearsign_signer(self, key_id, pubkey, alias, icon=None,
+                              icon_width=None, icon_height=None, persist=None):
+        """Load a clearsign signer (compressed pubkey + alias) into a key slot.
+        Triggers a mandatory on-device confirmation. Metadata verified by a
+        loaded signer shows a warning screen naming the alias before every
+        clearsign page.
+
+        icon (optional, <= 384 bytes) is an identity logo shown on the trust
+        screen. It is RUN-LENGTH ENCODED with byte-valued pixels, NOT a packed
+        bitmap: draw_bitmap_mono_rle() in keepkey-firmware lib/board/draw.c is
+        the decoder of record, and it is what every bundled image already uses.
+
+        Grammar -- read n = int8(data[i++]):
+          n in [1, 127]    RUN     : one value byte follows; emit it n times.
+          n in [-127, -1]  LITERAL : (-n) value bytes follow; emit each once.
+          n == 0                   : invalid.
+          n == -128 (0x80)         : INVALID -- the device's run counter is
+                                     int8_t and cannot represent 128. Split a
+                                     128-byte literal into two packets.
+        The stream must decode EXACTLY: no run may straddle the end of the
+        image, exactly icon_width*icon_height pixels are emitted (row-major),
+        and the whole input must be consumed -- trailing packets are rejected.
+        The device validates this before showing or storing the icon. See
+        LoadClearsignSigner.icon in messages-ethereum.proto for the grammar and
+        a golden vector.
+
+        icon_width and icon_height are required with icon.
+          icon_width  : 1..40  -- the confirm screen's icon column
+                        (LEFT_MARGIN_WITH_ICON). Text begins at x=40 and the
+                        icon is drawn after it, so a wider icon would paint over
+                        the alias, fingerprint and the "NOT verified by KeepKey"
+                        warning. Capped, not clipped.
+          icon_height : 1..64  -- the icon column is 64px tall.
+        Omit all three for a text-only identity.
+
+        persist=True also writes the identity to flash, so it survives reboot
+        and is reloaded automatically. The default is RAM-only (gone on
+        reboot)."""
         msg = eth_proto.LoadClearsignSigner(
             key_id=key_id,
             pubkey=pubkey,
             alias=alias,
         )
+        if icon is not None:
+            msg.icon = icon
+        if icon_width is not None:
+            msg.icon_width = icon_width
+        if icon_height is not None:
+            msg.icon_height = icon_height
+        if persist is not None:
+            msg.persist = persist
         return self.call(msg)
 
     @session

keepkeylib/hive.py

@@ -32,6 +32,24 @@ def sign_tx(client, address_n, chain_id, ref_block_num, ref_block_prefix,
     }))
 
 
+def sign_message(client, address_n, message):
+    """Keychain signBuffer contract: sig over SHA256(raw message bytes) only —
+    no chain_id prepend, no message prefix."""
+    if isinstance(message, str):
+        message = message.encode('utf-8')
+    return client.call(proto.HiveSignMessage(address_n=address_n, message=message))
+
+
+def sign_operations(client, address_n, serialized_tx, chain_id=None):
+    """Sign a host-serialized Graphene transaction (HiveSignOperations).
+    Firmware parses the bytes and clear-signs the phase-1 op table
+    (vote, comment, custom_json); digest = SHA256(chain_id || tx)."""
+    kwargs = dict(address_n=address_n, serialized_tx=serialized_tx)
+    if chain_id is not None:
+        kwargs['chain_id'] = chain_id
+    return client.call(proto.HiveSignOperations(**kwargs))
+
+
 def sign_account_create(client, address_n, chain_id, ref_block_num, ref_block_prefix,
                         expiration, creator, new_account_name, fee_amount=3000,
                         owner_key='', active_key='', posting_key='', memo_key=''):

keepkeylib/mapping.py

@@ -114,6 +114,11 @@ def check_missing():
     1607: ('HiveSignedAccountCreate', hive_proto),
     1608: ('HiveSignAccountUpdate',   hive_proto),
     1609: ('HiveSignedAccountUpdate', hive_proto),
+    # 1610-1613 reserved: NEAR
+    1614: ('HiveSignMessage',         hive_proto),
+    1615: ('HiveSignedMessage',       hive_proto),
+    1616: ('HiveSignOperations',      hive_proto),
+    1617: ('HiveSignedOperations',    hive_proto),
 }
 for wire_id, (msg_name, mod) in _hive_wire_ids.items():
     msg_class = getattr(mod, msg_name, None)