Prevent Broken ledger live for celo users #7622

aaronmgdr · 2024-08-19T14:37:11Z

✅ Checklist

npx changeset was attached.
Covered by automatic tests. => dependency update no function change
Impact of the changes:
- celo specific features. such as voting for validators, and staking

📝 Description

It is necessary to upgrade celo dependencies for ledger live to continue working with Celo once the Celo transition to Layer 2 happens. This is because early versions of celo blockchain used a custom transaction type and older versions of celo sdks only build transictions using this deprecated transaction format. However cel2 will not support this transaction format.

❓ Context

closes #7551

🧐 Checklist for the PR Reviewers

The code aligns with the requirements described in the linked JIRA or GitHub issue.
The PR description clearly documents the changes made and explains any technical trade-offs or design decisions.
There are no undocumented trade-offs, technical debt, or maintainability issues.
The PR has been tested thoroughly, and any potential edge cases have been considered and handled.
Any new dependencies have been justified and documented.
Performance considerations have been taken into account. (changes have been profiled or benchmarked if necessary)

vercel · 2024-08-19T14:37:38Z

@aaronmgdr is attempting to deploy a commit to the LedgerHQ Team on Vercel.

A member of the Team first needs to authorize it.

vercel · 2024-08-19T14:37:40Z

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
web-tools	❌ Failed (Inspect)			Oct 24, 2024 2:59pm

3 Skipped Deployments

Name	Status	Preview	Updated (UTC)
ledger-live-docs	⬜️ Ignored (Inspect)	Visit Preview	Oct 24, 2024 2:59pm
native-ui-storybook	⬜️ Ignored (Inspect)	Visit Preview	Oct 24, 2024 2:59pm
react-ui-storybook	⬜️ Ignored (Inspect)	Visit Preview	Oct 24, 2024 2:59pm

socket-security · 2024-08-19T14:39:18Z

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/@celo/[email protected]	Transitive: environment, eval, filesystem, network	`+158`	23.4 MB	app-tooling
npm/@celo/[email protected]	filesystem, network Transitive: environment, eval, shell	`+267`	44.7 MB	app-tooling
npm/@celo/[email protected]	Transitive: environment, network	`+38`	9.11 MB	app-tooling
npm/@celo/[email protected]	Transitive: environment, eval, filesystem, network, shell	`+263`	36.7 MB	app-tooling
npm/@celo/[email protected]	None	`+20`	2.81 MB	app-tooling

🚮 Removed packages: npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected], npm/@celo/[email protected]

View full report↗︎

socket-security · 2024-08-19T14:39:21Z

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	Source	CI
Git dependency	npm/@celo/[email protected]	Dependency: @ledgerhq/hw-app-eth @git+https://github.com:celo-org/ledgerjs-hw-app-eth.git Location: Package overview	`libs/ledger-live-common/package.json` `pnpm-lock.yaml`	⚠︎

View full report↗︎

Next steps

What are git dependencies?

Contains a dependency which resolves to a remote git URL. Dependencies fetched from git URLs are not immutable can be used to inject untrusted code or reduce the likelihood of a reproducible install.

Publish the git dependency to npm or a private package repository and consume it from there.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

@SocketSecurity ignore npm/@celo/[email protected]

aaronmgdr · 2024-08-20T09:30:14Z

.pnpmfile.cjs

@@ -62,20 +62,6 @@ function readPackage(pkg, context) {
      addPeerDependencies("@storybook/addon-react-native-web", {
        webpack: "*",
      }),
-      /* @celo/* packages */
-      addDependencies(/@celo\/(?!base)+/, { "@celo/base": `^${pkg.version}` }),


this is no longer necessary and in fact breaks install as celo deps no longer locked together their versions

aaronmgdr · 2024-08-22T11:34:35Z

perplexed as to why in the ledger live environment calling toChecksumAddress results in eventually the @noble/hash library asserting that the Buffer of the address is a Uint8Array and (this is the crucial part) it gives false. whereas i can trace the same code path in a different environment and it will return true. I made an empty electron repo with just ContractKit as I thought it could be the differenc but received no issue.

aaronmgdr · 2024-08-28T14:19:58Z

This fails because in JSDom Buffer does not inherit from Uint8Array. this causes a cascade of failures starting in @noble/hashes and bubbling up to web3.js new Contract() which is called from newKit (from contractkit)

Its a bit of a bummer. And im not sure of the best approach to fix it.

As an alternative I played around with removing contractkit completely. But that too requires a bit more to get it working, and will change a substantial amount of files. So i wont do more on that just yet.

aaronmgdr · 2024-08-28T14:21:05Z

@Wozacosta id love to talk more about how we can get this working.

github-actions · 2024-09-13T04:26:16Z

There as been no activity on this PR for the last 14 days. Please consider closing this PR.

aaronmgdr · 2024-09-13T07:50:25Z

do not close this pr

qperrot · 2024-09-27T13:38:10Z

Hello @aaronmgdr,
I am trying your PR* locally, and have issues when trying to do any actions using my Celo accounts (sending, withdrawing rewards).
Did you face the same issue on your side ?
Here a screen shot of the error:

Also, the @celo packages that are being updated have this error message: Versions less than 5.1 are deprecated and will no longer be able to submit transactions to celo in a future hardfork
Do you have a timeline or a date that we should have in mind to judge of the urgency.

aaronmgdr · 2024-09-27T13:52:42Z

Hello @aaronmgdr, I am trying your PR* locally, and have issues when trying to do any actions using my Celo accounts (sending, withdrawing rewards). Did you face the same issue on your side ? Here a screen shot of the error:

Also, the @celo packages that are being updated have this error message: Versions less than 5.1 are deprecated and will no longer be able to submit transactions to celo in a future hardfork Do you have a timeline or a date that we should have in mind to judge of the urgency.

@qperrot thanks for getting back. to be honest i had trouble understanding how to get the ledger system running. Hoping we can work together on this. It was tricky upgrade so far.

As for the timeline mentioned. It is the same as the celo transition to L2. The Testnet was just upgraded today and the plan for celo mainnet is by end of year

aaronmgdr · 2024-10-03T15:10:43Z

note probably https://github.com/LedgerHQ/ledger-live/blob/develop/libs/ledger-live-common/src/families/celo/hw-app-celo.ts needs to be updated.

apps/ledger-live-desktop/jest.config.js

libs/ledger-live-common/src/families/celo/hw-app-celo.ts

libs/ledger-live-common/src/families/celo/signOperation.ts

using the one from parent class the v from sig gets messed up

aaronmgdr · 2024-10-29T16:48:14Z

same as #8240

github-actions bot assigned aaronmgdr Aug 19, 2024

live-github-bot bot added common Has changes in live-common fork Pull request base branch comes from a fork. labels Aug 19, 2024

vercel bot had a problem deploying to Preview – web-tools August 19, 2024 14:41 Failure

aaronmgdr commented Aug 20, 2024

View reviewed changes

aaronmgdr force-pushed the chore/celo-upgrade branch from ba61f82 to ef17b49 Compare August 22, 2024 11:41

vercel bot had a problem deploying to Preview – web-tools August 22, 2024 11:45 Failure

github-actions bot added the Stale label Sep 13, 2024

aaronmgdr changed the title ~~Upgrade Celo Dependencies~~ Prevent Broken ledger live for celo users Sep 13, 2024

github-actions bot removed the Stale label Sep 14, 2024

live-github-bot bot added the desktop Has changes in LLD label Sep 17, 2024

vercel bot had a problem deploying to Preview – web-tools September 17, 2024 11:21 Failure

aaronmgdr force-pushed the chore/celo-upgrade branch from 89b4ac0 to 6b46353 Compare September 17, 2024 11:34

vercel bot deployed to Preview – web-tools September 17, 2024 11:39 View deployment

vercel bot deployed to Preview – web-tools October 8, 2024 10:19 View deployment

aaronmgdr commented Oct 8, 2024

View reviewed changes

apps/ledger-live-desktop/jest.config.js Outdated Show resolved Hide resolved

aaronmgdr mentioned this pull request Oct 14, 2024

Feature - Adding support to Flex device LedgerHQ/app-celo-spender#22

Merged

3 tasks

aaronmgdr force-pushed the chore/celo-upgrade branch from 54baece to 8b6f015 Compare October 14, 2024 14:31

aaronmgdr commented Oct 24, 2024

View reviewed changes

libs/ledger-live-common/src/families/celo/hw-app-celo.ts Outdated Show resolved Hide resolved

aaronmgdr commented Oct 24, 2024

View reviewed changes

libs/ledger-live-common/src/families/celo/hw-app-celo.ts Outdated Show resolved Hide resolved

aaronmgdr commented Oct 24, 2024

View reviewed changes

vercel bot had a problem deploying to Preview – web-tools October 24, 2024 09:50 Failure

vercel bot had a problem deploying to Preview – web-tools October 24, 2024 10:01 Failure

aaronmgdr and others added 22 commits October 24, 2024 16:57

chore: upgrade celo dependencies (closes LedgerHQ#7551)

b113076

did this fix the web3 buffer error?

8e7c784

feat: upgrade celo/signOperation to use hw-app-eth

148b662

ensure web3

5b48629

upgrade versions

0307943

allow both ledgers to work

749bb4f

feat: handle both legacy and newer versions of celo-spender-app

e692aa9

fix: getAppConfig lock

8ae34d6

WIP

d6ad498

revert signTransaction

0efc6b4

using the one from parent class the v from sig gets messed up

minimize diff

98c498c

dont modify v for modern txns

76f28f5

fix: for modern

0f1fbd5

refactor: cleanup console logs

c96c91d

fix: buffer polyfill

e401256

add back cosmo

4aa7405

Apply suggestions from code review

dfb0d5b

Update libs/ledger-live-common/src/families/celo/hw-app-celo.ts

1147194

Update libs/ledger-live-common/src/families/celo/signOperation.ts

7acf7bf

Update libs/ledger-live-common/src/families/celo/signOperation.ts

2bc9392

Update libs/ledger-live-common/src/families/celo/signOperation.ts

c9dae39

clean code

62aeb68

aaronmgdr force-pushed the chore/celo-upgrade branch from 5014717 to 62aeb68 Compare October 24, 2024 14:58

vercel bot had a problem deploying to Preview – web-tools October 24, 2024 14:59 Failure

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Prevent Broken ledger live for celo users #7622

Prevent Broken ledger live for celo users #7622

aaronmgdr commented Aug 19, 2024 •

edited

Loading

vercel bot commented Aug 19, 2024

vercel bot commented Aug 19, 2024 •

edited

Loading

socket-security bot commented Aug 19, 2024 •

edited

Loading

socket-security bot commented Aug 19, 2024 •

edited

Loading

aaronmgdr Aug 20, 2024 •

edited

Loading

aaronmgdr commented Aug 22, 2024

aaronmgdr commented Aug 28, 2024

aaronmgdr commented Aug 28, 2024

github-actions bot commented Sep 13, 2024

aaronmgdr commented Sep 13, 2024

qperrot commented Sep 27, 2024

aaronmgdr commented Sep 27, 2024

aaronmgdr commented Oct 3, 2024

aaronmgdr commented Oct 29, 2024

Prevent Broken ledger live for celo users #7622

Are you sure you want to change the base?

Prevent Broken ledger live for celo users #7622

Conversation

aaronmgdr commented Aug 19, 2024 • edited Loading

✅ Checklist

📝 Description

❓ Context

🧐 Checklist for the PR Reviewers

vercel bot commented Aug 19, 2024

vercel bot commented Aug 19, 2024 • edited Loading

socket-security bot commented Aug 19, 2024 • edited Loading

socket-security bot commented Aug 19, 2024 • edited Loading

Next steps

aaronmgdr Aug 20, 2024 • edited Loading

Choose a reason for hiding this comment

aaronmgdr commented Aug 22, 2024

aaronmgdr commented Aug 28, 2024

aaronmgdr commented Aug 28, 2024

github-actions bot commented Sep 13, 2024

aaronmgdr commented Sep 13, 2024

qperrot commented Sep 27, 2024

aaronmgdr commented Sep 27, 2024

aaronmgdr commented Oct 3, 2024

aaronmgdr commented Oct 29, 2024

aaronmgdr commented Aug 19, 2024 •

edited

Loading

vercel bot commented Aug 19, 2024 •

edited

Loading

socket-security bot commented Aug 19, 2024 •

edited

Loading

socket-security bot commented Aug 19, 2024 •

edited

Loading

aaronmgdr Aug 20, 2024 •

edited

Loading