Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create SECURITY.md #135

Open
wants to merge 171 commits into
base: ci_compliance
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
171 commits
Select commit Hold shift + click to select a range
6b85fcc
Bug exception WrongDataRange with high timelock value
grydz Sep 21, 2020
c749daf
Fix integer overflow when decoding varint
grydz Sep 21, 2020
a6c7010
Merge pull request #81 from LedgerHQ/fix-timelock-overflow
grydz Sep 28, 2020
8718161
Add CLSAG signature
grydz Aug 10, 2020
d4278ef
Bump version to 1.7.0
grydz Aug 10, 2020
eaf4ba1
Fix bad function call in monero_apdu_clsag_prepare()
grydz Aug 13, 2020
de38f6a
Add INS_CLSAG to dispatcher
grydz Aug 13, 2020
c80b4eb
Fix INS_MLSAG must be compatible with protocol v4
grydz Aug 24, 2020
f7b2d8a
Fix scalar z is not encrypted in the Monero client
grydz Aug 24, 2020
feb5dab
Fix wrong parameter order for monero_ecmul_k()
grydz Aug 24, 2020
f55e71c
Fix tx_sig_mode is not expected by the Monero client
grydz Aug 24, 2020
f6f9805
Fix temporarly just check if is scalars are not 0
grydz Aug 24, 2020
4233e1d
Fix 'a - mu_P' instead of 'a + mu_P'
grydz Aug 24, 2020
ddd939f
Add more comments
grydz Aug 24, 2020
a8f881e
Fix wrong call to ge_fromfe_frombytes(H, H)
grydz Aug 26, 2020
725b10a
Fix check prefix hash with protocol v4
grydz Sep 1, 2020
c1ec34d
Update INS_GET_TX_PROOF to InProofv2
grydz Sep 1, 2020
9e2f8eb
Add next minimum version for Monero client
grydz Sep 2, 2020
6878abc
Update unit tests with new versions
grydz Sep 2, 2020
c608430
Fix wrong type parameter, need to be cast
grydz Sep 23, 2020
c3bbd77
Fix wrong first 32 bytes input in clsag_hash()
grydz Sep 24, 2020
a7ffd0c
Update CHANGELOG
grydz Sep 24, 2020
7f65248
Bump version to 1.7.1
grydz Sep 24, 2020
6a0e31c
Fix unit tests to only check major and minor version
grydz Sep 24, 2020
788e0c7
Fix mlsag_prehash() do not output hash without DEBUG_HWDEVICE
grydz Oct 2, 2020
d6765d6
Bump version to 1.7.2
grydz Oct 2, 2020
363ef96
Merge pull request #80 from LedgerHQ/clsag-integration
grydz Oct 6, 2020
9553396
Fix bad display of base58 address
grydz Oct 6, 2020
ae64ce1
Merge pull request #86 from LedgerHQ/fix-addr-display
grydz Oct 6, 2020
7261848
Bump version to 1.7.3
grydz Oct 6, 2020
6ce4d0d
Support of Monero client 0.17.1.*
grydz Oct 13, 2020
c752d9d
Merge pull request #88 from LedgerHQ/update-client-version
grydz Oct 13, 2020
b7a2108
Update CHANGELOG
grydz Oct 13, 2020
d9b11ff
Bump version to 1.7.4
grydz Oct 13, 2020
2129576
Add support of new CX API
grydz Nov 16, 2020
05c9cd5
Bump version to 1.7.5
grydz Nov 16, 2020
4976be0
Support of Monero client 0.17.2.*
bigspider Mar 30, 2021
11df374
Bump version to 1.7.6
bigspider Mar 30, 2021
77b75b2
Update CHANGELOG.md
bigspider Mar 30, 2021
9502b22
Fixing string typos like 'Amout'.
jonathancross Apr 26, 2021
f756b20
add cx and ux missing includes
Sep 1, 2020
f4a7e35
CX_APILEVEL >= 9 compatibility
Nov 30, 2020
cab0794
remove useless algo assignment
Feb 26, 2021
a9a5156
Merge pull request #94 from jonathancross/typo-amout
bigspider Jun 1, 2021
add4170
Bump version to 1.7.7
bigspider Jun 1, 2021
eb44689
Merge branch 'add-missing-includes'
bigspider Jun 1, 2021
8ac57d5
remove unused ble include
Jun 30, 2021
cd666d6
Update CI docker image
TamtamHero Jul 13, 2021
ed0113b
Update Speculos image
TamtamHero Jul 13, 2021
f2e7fe0
monero client 0.17.3.* support
selsta Oct 28, 2021
48da5fd
Bump version 1.7.8
TamtamHero Nov 18, 2021
54b9147
Merge pull request #100 from selsta/v0.17.3.0
TamtamHero Nov 24, 2021
440ed25
fix: build for lns+
Feb 4, 2022
c1a6eb8
support for hf 15 (view tags)
j-berman Jun 21, 2022
eb7fee3
Lint
fbeutin-ledger Jul 13, 2022
2ec65d6
Bump version
fbeutin-ledger Jul 18, 2022
dfafbb7
Fix signature test when no view_tag is required
fbeutin-ledger Jul 19, 2022
fd54917
Add complete test for view_tags
fbeutin-ledger Jul 19, 2022
62fdc28
Fix view tag derivation test by sending encrypted derivation
fbeutin-ledger Jul 19, 2022
4fe19ac
Review from Selsta
fbeutin-ledger Jul 22, 2022
c5b95f1
Rationalize Lint CI run
fbeutin-ledger Jul 22, 2022
1c7bb4b
Following suggestion from Selsta, support client v0.18. instead of v0…
fbeutin-ledger Jul 22, 2022
1629a48
Add an explicit mechanism for the Monero app to refuse some client ve…
fbeutin-ledger Jul 25, 2022
163e5d2
Separate function for version checking
fbeutin-ledger Jul 26, 2022
31772fd
Merge pull request #110 from LedgerHQ/j-berman-hf-v15
fbeutin-ledger Jul 27, 2022
3f2eadf
src: rename account to wallet
selsta Jul 14, 2021
fc0dc8e
Merge pull request #112 from LedgerHQ/merge-wallet-rename
fbeutin-ledger Jul 27, 2022
4ab384f
seed conversion tool: replace relative import to support pyinstaller
secinthenet May 15, 2021
c89985a
Merge pull request #113 from LedgerHQ/secinthenet-fix-pyinstaller
fbeutin-ledger Jul 27, 2022
fd30313
Properly escape underscores in documentation
jibeee Aug 3, 2022
183a145
Better prototype for monero_derive_view_tag
jibeee Aug 3, 2022
0744625
Remove extra arguments passed to monero_abort_tx
jibeee Aug 3, 2022
510ad26
Replace deprecated functions by newer ones
jibeee Aug 4, 2022
c95fa33
Fix wrong check on protocol version when handling MLSAG
jibeee Aug 4, 2022
8c0d3b1
Fix last compilation warnings
jibeee Aug 4, 2022
b635807
Add noreturn attribute to monero_lock_and_throw
jibeee Aug 4, 2022
33a50f0
Fix last defects identified by Clang Static Analyzer
jibeee Aug 4, 2022
81e79bc
Enable Clang Static Analyzer in CI
jibeee Aug 4, 2022
cfe1c85
Add CodeQL workflow
jibeee Aug 4, 2022
b84dea1
Fix code scanning alert #19
jibeee Aug 4, 2022
3ea7572
Fix code scanning alert #11
jibeee Aug 4, 2022
d6901ab
Remove commented-out code
jibeee Aug 4, 2022
3d7d991
Remove old-style function declarations
jibeee Aug 4, 2022
4e47e6b
Make checks on memcmp return values more readable
jibeee Aug 10, 2022
1d96de2
Merge pull request #114 from LedgerHQ/pr110-review
jibeee Aug 10, 2022
06fca3f
Do not allow short functions on a single line
jibeee Aug 10, 2022
07021e1
Merge branch 'develop' into static-analysis
jibeee Sep 26, 2022
5d247eb
Merge pull request #117 from LedgerHQ/monero_1.8.0
fbeutin-ledger Sep 27, 2022
a9a428e
Merge pull request #115 from LedgerHQ/static-analysis
fbeutin-ledger Dec 15, 2022
446d7b0
Bump version
fbeutin-ledger Dec 15, 2022
c5dbf50
Bump version
sgliner-ledger Jan 27, 2023
5014233
Tests: adapt for Ragger
sgliner-ledger May 4, 2023
6062dc6
Tests: tweaks and improvements
sgliner-ledger May 4, 2023
6eee7c0
tests: add snapshots
sgliner-ledger May 4, 2023
664db2d
codeql: remove deprecated workflow
sgliner-ledger May 11, 2023
37fc964
CI: update workflows
sgliner-ledger May 4, 2023
3e2662c
ui_menu_main_display: remove useless parameter
sgliner-ledger Apr 27, 2023
4ca06a6
misc: clear warnings
sgliner-ledger Apr 27, 2023
efd649f
main.c: add missing CLOSE_TRY
sgliner-ledger Apr 27, 2023
b73c2ca
cleanup: remove deprecated BLUE related code
sgliner-ledger Jan 17, 2023
eea258d
Stax: add new glyphs
sgliner-ledger Jan 17, 2023
01e55df
main: change bluetooth conditional flag
sgliner-ledger Jan 17, 2023
1fda328
ux: add transaction_start and transaction_signed functions that will …
sgliner-ledger Jan 26, 2023
ae75a01
monero_ux_nano: fix typo
sgliner-ledger Jan 18, 2023
205ac37
Stax: add support for nbgl
sgliner-ledger Jan 17, 2023
d3553b7
Stax: add snapshots
sgliner-ledger May 11, 2023
8246736
ui: info_display functions are now internal to nano
sgliner-ledger May 30, 2023
ae09e67
Merge pull request #119 from LedgerHQ/stax
sgliner-ledger May 31, 2023
240c706
QR code source path is now used explicitly
apaillier-ledger Aug 3, 2023
5cf1310
Merge pull request #120 from LedgerHQ/fix/apa/explicit_qrcode_source_…
sgliner-ledger Aug 7, 2023
a035933
Merge branch 'master' into merge_1.8.1_on_master
fbeutin-ledger Aug 11, 2023
30e0665
Merge pull request #121 from LedgerHQ/merge_1.8.1_on_master
fbeutin-ledger Aug 11, 2023
b4425e1
Merge branch 'master' into develop
fbeutin-ledger Aug 11, 2023
e433f12
crypto: clean deprecated crypto calls
sgliner-ledger Oct 19, 2023
6fd5092
use standard Makefile and standard files
sgliner-ledger Oct 19, 2023
86d528f
monero_io: use dedicated function for offset increase
sgliner-ledger Oct 19, 2023
2ea70ca
monero_crypto: sanitize input
sgliner-ledger Oct 19, 2023
883e7f6
monero_io: remove dead code
sgliner-ledger Oct 19, 2023
5305c0d
monero_crypto: use define for PXY_SIZE value
sgliner-ledger Oct 19, 2023
23d2b68
monero_io_fetch_decrypt_key: add buffer size as parameter
sgliner-ledger Oct 19, 2023
7dd7d59
monero_types: change MONERO_APDU_LENGTH
sgliner-ledger Oct 19, 2023
0d68462
monero_io: explicit cast
sgliner-ledger Oct 19, 2023
3017fbb
monero_io: explicit void parameter
sgliner-ledger Oct 19, 2023
5447842
nanos: use same ui as other nanos
sgliner-ledger Oct 24, 2023
fc87148
tests: update snapshots
sgliner-ledger Oct 20, 2023
b7faa0d
icons: rename and relocate glyphs
sgliner-ledger Oct 24, 2023
8775fa6
clean: Add size as parameter in function call
sgliner-ledger Oct 20, 2023
988ad2d
clean: remove THROWs
sgliner-ledger Oct 23, 2023
548a1e2
clean: remove unused lock instruction
sgliner-ledger Oct 23, 2023
ab0c15f
clean: replace last Throw by app exit
sgliner-ledger Oct 24, 2023
19f96a4
Lint: Apply formatting
sgliner-ledger Oct 24, 2023
1f947eb
some more error mgmt
sgliner-ledger Nov 13, 2023
22911a2
Makefile: Bump version
sgliner-ledger Nov 21, 2023
e081b2d
Makefile: Remove useless UI_NANO_SX define
sgliner-ledger Nov 21, 2023
faf0356
ui: remove HAVE_UX_FLOW macros
sgliner-ledger Nov 23, 2023
eb1b852
Clean: remove useless functions
sgliner-ledger Nov 23, 2023
d47c109
monero_io: use functions from the SDK
sgliner-ledger Nov 23, 2023
c49a608
ui: better error handling for ui_menu_any_pubaddr_display
sgliner-ledger Nov 23, 2023
268ee17
misc: minor cleanings
sgliner-ledger Nov 23, 2023
151c6f9
ux: remove useless wrapper
sgliner-ledger Nov 24, 2023
9678153
Merge pull request #122 from LedgerHQ/clean-app
sgliner-ledger Nov 24, 2023
bd1f9da
[auto]: add PR template
sgliner-ledger Nov 29, 2023
47cae00
tests: move snapshots folder
sgliner-ledger Jan 10, 2024
e50e68c
ledger_app.toml: add manifest
sgliner-ledger Jan 10, 2024
ec63f7b
Merge pull request #123 from LedgerHQ/move_snapshots
sgliner-ledger Jan 10, 2024
0a45f65
[auto] Update screenshot
Jan 10, 2024
c8cb50a
Merge pull request #124 from LedgerHQ/auto-update-screenshots
sgliner-ledger Jan 11, 2024
af4ab9e
[auto] Update screenshot
Feb 21, 2024
5489201
Merge pull request #126 from LedgerHQ/auto-update-screenshots
sgliner-ledger Feb 21, 2024
f853cc3
tests: snapshots: Remove unused snapshots
Feb 27, 2024
0f71b19
tests: Fix some race conditions
Feb 27, 2024
8e38482
Merge pull request #127 from LedgerHQ/xch/remove-unused-snapshots
xchapron-ledger Feb 27, 2024
8a7d32f
[auto] Update screenshot
sgliner-ledger Feb 27, 2024
09ca3c4
Fix: use explicit_bzero to clear private data from the stack
sgliner-ledger Feb 20, 2024
71d8f4b
Fix: replace memset with explicit_bzero
sgliner-ledger Feb 20, 2024
bedba9d
Clean: remove dead code
sgliner-ledger Feb 20, 2024
839fdb0
Fix: replace memcpy with strncpy
sgliner-ledger Feb 20, 2024
2fb8476
Clean: remove outdated comment and unify return type
sgliner-ledger Feb 20, 2024
2b50786
Clean: replace magic values with define
sgliner-ledger Feb 21, 2024
7089bcd
Merge pull request #125 from LedgerHQ/sgl/audit
sgliner-ledger Mar 4, 2024
d1bfbed
[auto] Update screenshot
Apr 8, 2024
55ff724
Merge pull request #128 from LedgerHQ/auto-update-screenshots
sgliner-ledger Apr 9, 2024
0f1b148
Tests: fix waiting for processing call
sgliner-ledger Apr 23, 2024
759d80f
Merge pull request #129 from LedgerHQ/fix-tests
sgliner-ledger Apr 23, 2024
0d71169
tests: set screen_change_after_last_instruction to False for validate…
sgliner-ledger Apr 30, 2024
6dd470c
Merge pull request #130 from LedgerHQ/fix-tests
sgliner-ledger Apr 30, 2024
e31e709
flex porting
tdejoigny-ledger May 1, 2024
49c1dda
add ticker and change wordings
tdejoigny-ledger May 24, 2024
ee1500f
fix PR review remarks
tdejoigny-ledger May 30, 2024
3318347
Merge pull request #131 from LedgerHQ/tdj/flex_porting
tdejoigny-ledger May 31, 2024
d5249ea
Create SECURITY.md
MegoyTambayan Oct 10, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .clang-format
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,7 @@ Language: Cpp
ColumnLimit: 100
PointerAlignment: Right
AlignAfterOpenBracket: Align
AllowShortFunctionsOnASingleLine: None
AlignConsecutiveMacros: true
AllowAllParametersOfDeclarationOnNextLine: false
SortIncludes: false
Expand Down
8 changes: 8 additions & 0 deletions .github/PULL_REQUEST_TEMPLATE.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# Checklist
<!-- Put an `x` in each box when you have completed the items. -->
- [ ] App update process has been followed <!-- See comment below -->
- [ ] Target branch is `develop` <!-- unless you have a very good reason -->
- [ ] Application version has been bumped <!-- required if your changes are to be deployed -->

<!-- Make sure you followed the process described in https://developers.ledger.com/docs/device-app/deliver/maintenance before opening your Pull Request.
Don't hesitate to contact us directly on Discord if you have any questions ! https://developers.ledger.com/discord -->
33 changes: 33 additions & 0 deletions .github/workflows/build_and_functional_tests.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
name: Build and run functional tests using ragger through reusable workflow

# This workflow will build the app and then run functional tests using the Ragger framework upon Speculos emulation.
# It calls a reusable workflow developed by Ledger's internal developer team to build the application and upload the
# resulting binaries.
# It then calls another reusable workflow to run the Ragger tests on the compiled application binary.
#
# While this workflow is optional, having functional testing on your application is mandatory and this workflow and
# tooling environment is meant to be easy to use and adapt after forking your application

on:
workflow_dispatch:
push:
branches:
- master
- main
- develop
pull_request:

jobs:
build_application:
name: Build application using the reusable workflow
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_build.yml@v1
with:
upload_app_binaries_artifact: "compiled_app_binaries"
flags: "DEBUG=1"

ragger_tests:
name: Run ragger tests using the reusable workflow
needs: build_application
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_ragger_tests.yml@v1
with:
download_app_binaries_artifact: "compiled_app_binaries"
71 changes: 0 additions & 71 deletions .github/workflows/ci-workflow.yml

This file was deleted.

23 changes: 23 additions & 0 deletions .github/workflows/guidelines_enforcer.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,23 @@
name: Ensure compliance with Ledger guidelines

# This workflow is mandatory in all applications
# It calls a reusable workflow guidelines_enforcer developed by Ledger's internal developer team.
# The successful completion of the reusable workflow is a mandatory step for an app to be available on the Ledger
# application store.
#
# More information on the guidelines can be found in the repository:
# LedgerHQ/ledger-app-workflows/

on:
workflow_dispatch:
push:
branches:
- master
- main
- develop
pull_request:

jobs:
guidelines_enforcer:
name: Call Ledger guidelines_enforcer
uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_guidelines_enforcer.yml@v1
10 changes: 9 additions & 1 deletion .github/workflows/lint-workflow.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,14 @@
name: Code style check

on: [push, pull_request]
on:
push:
branches:
- master
- develop
pull_request:
branches:
- master
- develop

jobs:
job_lint:
Expand Down
13 changes: 12 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,6 @@ debug/
dep/
obj/


# Editors
.vscode/
.idea/
Expand All @@ -18,3 +17,15 @@ __pycache__/
*.egg-info/
.eggs/
.python-version

# Pyinstaller
build/
dist/
*.manifest
*.spec

# Temporary directory with snapshots taken during test runs
tests/snapshots-tmp/

# Virtual env for sideload (macOS and Windows)
ledger/
34 changes: 34 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,40 @@

All notable changes to this project will be documented in this file.

## 2.0.0 - 2024-05-01

- Support of Flex device

## 1.7.6 - 2021-03-30

- Support of Monero client version `0.17.2.*`

## 1.7.5 - 2020-11-16

- Support of firmware 1.2.4-5

## 1.7.4 - 2020-10-13

- Support of Monero client version `0.17.1.*`

## 1.7.3 - 2020-10-06

- Fix garbage when displaying destination address on Nano

## 1.7.2 - 2020-10-02

- Fix behavior without `DEBUG_HWDEVICE` flag


## 1.7.1 - 2020-09-24

- Fix `clsag_hash()` behavior which is different than MLSAG

## 1.7.0 - 2020-09-13

- Update to protocol v4 to support both MLSAG and CLSAG
- Add CLSAG signature algorithm with `INS_CLSAG`
- Update InProofv1 to InProofv2

## 1.6.0 - 2020-06-04

Expand Down
Loading