ci(rc18): gate post-candidate firmware behavior

Author: BitHighlander

.github/workflows/ci.yml

@@ -21,6 +21,11 @@ on:
   pull_request:
     branches: [master, develop, reconcile/upstream-sync]
 
+# Every job only checks out source and emits runner-native annotations. Keep
+# the workflow token read-only even when the repository default is broader.
+permissions:
+  contents: read
+
 # One run per ref: a new push supersedes the old instead of both burning a
 # runner to completion.
 concurrency:

tests/test_msg_ethereum_clear_signing.py

@@ -1089,6 +1089,11 @@ def test_replay_rejected_when_digest_differs(self):
     def test_advanced_mode_gate(self):
         """AdvancedMode OFF + unknown contract + no metadata → hard reject;
         ON → raw-data confirm path signs; recognized ERC-20 transfer unaffected."""
+        # RC18 predates the rule that loading a runtime signer itself requires
+        # AdvancedMode. The first released firmware line carrying that complete
+        # gate is 7.16; the older blind-transaction gate remains covered by
+        # test_msg_ethereum_signtx on RC18.
+        self.requires_firmware("7.16.0")
         n = parse_path(DEVICE_PATH)
         data = aave_supply_calldata(1000000000000000000)
 
@@ -1108,8 +1113,11 @@ def test_advanced_mode_gate(self):
                 to=AAVE_V3_POOL, value=0, data=data, chain_id=1)
             self.fail("Expected Failure — blind signing disabled")
         except CallException as e:
-            self.assertIn("Arbitrary contract data signing disabled by policy",
-                          str(e))
+            message = str(e)
+            self.assertTrue(
+                "Arbitrary contract data signing disabled by policy" in message
+                or "Blind signing disabled by policy" in message,
+                "unexpected blind-sign refusal: %s" % message)
 
         # ON → raw-data confirm path → signs
         self.client.apply_policy("AdvancedMode", 1)
@@ -1163,8 +1171,11 @@ def test_cancel_clears_metadata_not_reused(self):
                 to=AAVE_V3_POOL, value=0, data=data, chain_id=chain_id)
             self.fail("Expected Failure — stale metadata must not be reused")
         except CallException as e:
-            self.assertIn("Arbitrary contract data signing disabled by policy",
-                          str(e))
+            message = str(e)
+            self.assertTrue(
+                "Arbitrary contract data signing disabled by policy" in message
+                or "Blind signing disabled by policy" in message,
+                "unexpected blind-sign refusal: %s" % message)
 
 
     # ── LoadClearsignSigner — the phase-1 trust path ───────────────────

tests/test_msg_ethereum_clearsign_additive.py

@@ -87,6 +87,11 @@
 # METADATA_MAX_KEYS in include/keepkey/firmware/signed_metadata.h.
 METADATA_MAX_KEYS = 4
 
+# RC18 verifies runtime metadata, but the successful-decode path did not yet
+# guarantee that the ordinary raw review survived byte-for-byte. That security
+# invariant landed after RC18 and first ships on the 7.16 line.
+ADDITIVE_REVIEW_FIRMWARE = "7.16.0"
+
 # The Aave V3 supply() transaction every additive test signs. Real ABI
 # calldata (selector + 4 x 32-byte words), so the metadata below binds a
 # genuine transaction rather than a toy payload.
@@ -220,6 +225,7 @@ def test_successful_decode_still_runs_the_raw_review(self):
         byte-for-byte. 3 + num_args is the structural minimum from
         signed_metadata_confirm_screens(); pagination can only raise it.
         """
+        self.requires_firmware(ADDITIVE_REVIEW_FIRMWARE)
         self._load_signer()
         self._drop_setup_screenshots()
 
@@ -277,6 +283,7 @@ def test_no_runtime_slot_can_reach_the_suppression_branch(self):
         at runtime and each one still shows the full baseline review after its
         decode. A slot that suppressed would be caught as a missing tail frame.
         """
+        self.requires_firmware(ADDITIVE_REVIEW_FIRMWARE)
         for key_id in range(METADATA_MAX_KEYS):
             self._load_signer(key_id=key_id, alias='CI Slot %d' % key_id)
         self._drop_setup_screenshots()
@@ -329,6 +336,7 @@ def test_v2_schema_decode_still_runs_the_raw_review(self):
         screen in its own baseline (the token path already skips it), so it
         could not show that the raw review survives.
         """
+        self.requires_firmware(ADDITIVE_REVIEW_FIRMWARE)
         self._load_signer()
         self._drop_setup_screenshots()
 

tests/test_msg_ethereum_signtx.py

@@ -124,8 +124,11 @@ def test_ethereum_blind_sign_blocked(self):
             )
             self.fail("Expected Failure -- blind signing should be blocked")
         except CallException as e:
-            self.assertIn("Arbitrary contract data signing disabled by policy",
-                          str(e))
+            message = str(e)
+            self.assertTrue(
+                "Arbitrary contract data signing disabled by policy" in message
+                or "Blind signing disabled by policy" in message,
+                "unexpected blind-sign refusal: %s" % message)
 
     def test_ethereum_blind_sign_allowed(self):
         """AdvancedMode ON + contract data = device shows BLIND SIGNATURE warning (7.15+).
@@ -270,7 +273,7 @@ def test_ethereum_sanity_checks(self):
     def test_ethereum_signtx_omitted_chain_id_rejected(self):
         """An omitted chain_id must be refused, not silently signed pre-EIP-155.
 
-        Before 7.14.2 the `chain_id < 1` bounds check lived inside
+        Before the post-RC18 hardening the `chain_id < 1` bounds check lived inside
         `if (msg->has_chain_id)`, so a host that simply left the field out
         reached chain_id == 0 without tripping it. Two things followed:
 
@@ -286,7 +289,9 @@ def test_ethereum_signtx_omitted_chain_id_rejected(self):
         sibling tests in this file all now pass chain_id explicitly so they
         keep exercising their own subject rather than this one.
         """
-        self.requires_firmware("7.14.2")
+        # Explicit zero was already rejected on RC18, but an omitted field was
+        # not. The absent-field fix landed after RC18 and first ships in 7.16.
+        self.requires_firmware("7.16.0")
         self.requires_fullFeature()
         self.setup_mnemonic_nopin_nopassphrase()
         self.client.apply_policy("AdvancedMode", 1)

tests/test_msg_resetdevice.py

@@ -56,6 +56,8 @@ def generate_entropy(strength, internal_entropy, external_entropy):
     return entropy_stripped
 
 class TestDeviceReset(common.KeepKeyTest):
+    POST_RC18_SETUP_FIRMWARE = "7.16.0"
+
     def test_reset_device(self):
         # No PIN, no passphrase
         external_entropy = b'zlutoucky kun upel divoke ody' * 2
@@ -112,7 +114,9 @@ def test_reset_device(self):
         self.assertIsInstance(resp, proto.Success)
 
     def test_reset_device_dice(self):
-        self.requires_firmware("7.15.0")
+        # On-device dice entry landed after the RC18 candidate. RC18 accepts
+        # the forward-compatible field but follows the ordinary entropy flow.
+        self.requires_firmware(self.POST_RC18_SETUP_FIRMWARE)
 
         external_entropy = b'zlutoucky kun upel divoke ody' * 2
         strength = 256  # 99 rolls
@@ -200,15 +204,17 @@ def test_reset_reentry_disarms_entropy_ack(self):
         int_entropy, so a following EntropyAck derived the seed from
         sha256(0*32 || host_bytes) -- entirely host-chosen.
 
-        7.15 closes it EARLIER and more strongly than the original fix did.
+        The post-RC18 setup hardening closes it EARLIER and more strongly than
+        the original fix did.
         #429 replaced the separate awaiting_entropy flag with a single armed
         (kind) ceremony, and setup_stage() now REFUSES to open a second
         ceremony on top of an armed one. So the re-entry this test used to
         perform is rejected outright rather than being allowed and then
         disarmed -- there is no second ceremony to leave armed. Both halves are
         asserted below: the refusal, and then the original property.
         """
-        self.requires_firmware("7.15.0")
+        # The single armed-ceremony guard is the post-RC18 #429 behavior.
+        self.requires_firmware(self.POST_RC18_SETUP_FIRMWARE)
         self.client.wipe_device()
 
         # Arm a reset and walk away without acking the entropy request.
@@ -258,17 +264,18 @@ def test_reset_device_pin(self):
                                                label='test'))
 
         # display_random=True above is deliberate: the field stays in the wire
-        # schema for host compatibility. Firmware 7.15.0 (fw 320f0eb5, "no
-        # entropy display") stopped honouring it -- internal entropy is seed
+        # schema for host compatibility. The post-RC18 setup hardening (fw
+        # 320f0eb5, "no entropy display"), first shipped on 7.16, stopped
+        # honouring it -- internal entropy is seed
         # pre-image material, and a host that sets the flag and reads that
         # screen once can compute SHA256(shown || ext) and derive the seed.
         #
         # Branch on the version rather than skipping the test: everything below
         # (PIN entry, EntropyRequest/Ack, mnemonic derivation) is version-
         # independent and must keep running on older firmware.
         f = self.client.features
-        if (f.major_version, f.minor_version, f.patch_version) < (7, 15, 0):
-            # Pre-7.15: the Internal Entropy screen legitimately still exists.
+        if (f.major_version, f.minor_version, f.patch_version) < (7, 16, 0):
+            # RC18 and older: the Internal Entropy screen still exists.
             self.assertIsInstance(ret, proto.ButtonRequest)
             self.client.debug.press_yes()
             ret = self.client.call_raw(proto.ButtonAck())
@@ -342,17 +349,18 @@ def test_failed_pin(self):
                                                label='test'))
 
         # display_random=True above is deliberate: the field stays in the wire
-        # schema for host compatibility. Firmware 7.15.0 (fw 320f0eb5, "no
-        # entropy display") stopped honouring it -- internal entropy is seed
+        # schema for host compatibility. The post-RC18 setup hardening (fw
+        # 320f0eb5, "no entropy display"), first shipped on 7.16, stopped
+        # honouring it -- internal entropy is seed
         # pre-image material, and a host that sets the flag and reads that
         # screen once can compute SHA256(shown || ext) and derive the seed.
         #
         # Branch on the version rather than skipping the test: everything below
         # (PIN entry, EntropyRequest/Ack, mnemonic derivation) is version-
         # independent and must keep running on older firmware.
         f = self.client.features
-        if (f.major_version, f.minor_version, f.patch_version) < (7, 15, 0):
-            # Pre-7.15: the Internal Entropy screen legitimately still exists.
+        if (f.major_version, f.minor_version, f.patch_version) < (7, 16, 0):
+            # RC18 and older: the Internal Entropy screen still exists.
             self.assertIsInstance(ret, proto.ButtonRequest)
             self.client.debug.press_yes()
             ret = self.client.call_raw(proto.ButtonAck())

tests/test_msg_session_trust_lifetime.py

@@ -1,7 +1,7 @@
 """
 Session and Trust Lifetime — provider trust must die on its own.
 
-Two claims in the 7.15 clear-sign design have never been tested end to end:
+Two post-RC18 clear-sign lifetime claims have never been tested end to end:
 
   1. AdvancedMode is SESSION state, never a flash bit.  storage.c writes bit 12
      of the storage flags word as zero and ignores it on read (four sites:
@@ -198,7 +198,9 @@ def _resolve_executable(pid, comm, cwd):
 
 class TestSessionTrustLifetime(common.KeepKeyTest):
 
-    MIN_FIRMWARE = "7.15.0"
+    # RC18 still persisted AdvancedMode and retained runtime signers across
+    # session teardown. The session-lifetime fixes first ship in 7.16.
+    MIN_FIRMWARE = "7.16.0"
 
     def setUp(self):
         super(TestSessionTrustLifetime, self).setUp()

tests/test_msg_solana_lut_attestation.py

@@ -39,7 +39,10 @@ class TestSolanaLutAttestation(common.KeepKeyTest):
 
     def setUp(self):
         super(TestSolanaLutAttestation, self).setUp()
-        self.requires_firmware("7.15.0")
+        # KKSOLSW1 landed after the RC18 candidate and first ships in 7.16.
+        # RC18 ignores the forward-compatible attestation fields, which makes
+        # all negative-path tests pass vacuously unless the whole class gates.
+        self.requires_firmware("7.16.0")
         self.requires_fullFeature()
         self.requires_message("LoadClearsignSigner")
         self.setup_mnemonic_allallall()

tests/test_msg_zcash_sign_pczt_device.py

@@ -234,6 +234,10 @@ def test_shielded_output_review_is_two_screens(self):
         matters: one screen cannot hold both, and collapsing them back into one
         reintroduces exactly the defect.
         """
+        # RC18 has the Orchard flow but predates the repair that separates the
+        # amount and 106-character unified address. That UI fix first ships in
+        # 7.16, so do not mislabel it as an RC18 regression in this host suite.
+        self.requires_firmware("7.16.0")
         actions = [note_action(CMX_ORCHARD)]
         screens = self._capture_button_screens()
 

tests/test_sign_typed_data.py

@@ -36,7 +36,9 @@ def test_ethereum_sign_x402_eip3009(self):
         recipient and value embedded in the signed EIP-712 message.
         """
         self.requires_fullFeature()
-        self.requires_firmware("7.15.0")
+        # RC18 still exposes the legacy JSON endpoint. Its fail-closed
+        # retirement and the replacement streamed implementation land on 7.16.
+        self.requires_firmware("7.16.0")
         self.requires_message("Ethereum712TypesValues")
         self.setup_mnemonic_allallall()
 
@@ -75,7 +77,8 @@ def test_ethereum_sign_x402_eip3009(self):
             },
         }
 
-        # 7.14.2 DISABLED structured EIP-712 outright, pending canonical
+        # Hardened firmware disables legacy structured EIP-712 outright,
+        # pending canonical
         # display hardening: the device could not prove that what it rendered
         # was what it hashed. This vector is the x402 EIP-3009
         # TransferWithAuthorization payment flow, and it is currently REFUSED
@@ -129,8 +132,11 @@ def sign(test):
             sign(txtests['tests'][0])
         # The firmware names the remedy rather than just the refusal:
         # "Enable AdvancedMode to blind-sign typed hashes".
-        self.assertIn('Enable AdvancedMode to blind-sign typed hashes',
-                      str(ctx.exception))
+        message = str(ctx.exception)
+        self.assertTrue(
+            'Enable AdvancedMode to blind-sign typed hashes' in message
+            or 'Typed-hash signing disabled by policy' in message,
+            'unexpected typed-hash refusal: %s' % message)
 
         self.client.apply_policy('AdvancedMode', True)
         try:

tests/test_verify_typed_data.py

@@ -30,7 +30,7 @@
 class TestMsgE712Verify(common.KeepKeyTest):
 
     def test_structured_eip712_is_refused(self):
-        """7.14.2 disables structured EIP-712 outright.
+        """Post-RC18 firmware disables legacy structured EIP-712 outright.
 
         ethereum_structured_eip712_enabled() returns false
         (lib/firmware/ethereum.c), so fsm_msgEthereum712TypesValues fails closed
@@ -44,7 +44,7 @@ def test_structured_eip712_is_refused(self):
         replaced by test_verify below, not simply deleted.
         """
         self.requires_fullFeature()
-        self.requires_firmware("7.14.2")
+        self.requires_firmware("7.16.0")
         self.setup_mnemonic_allallall()
 
         try:
@@ -55,7 +55,7 @@ def test_structured_eip712_is_refused(self):
                 value_prop='{"domain": {}}',
                 typevals=1,
             )
-            self.fail("Expected Failure -- structured EIP-712 is disabled in 7.14.2")
+            self.fail("Expected Failure -- legacy structured EIP-712 is disabled")
         except CallException as e:
             self.assertIn("Structured EIP-712 disabled", str(e))