feat(solana): KKSOLSW1 lookup-table account attestation tests - #37
Merged
Conversation
Four tests for the transaction-bound attestation that upgrades an ALT
transaction from a blind sign to a described one.
The positive test asserts the SCREEN COUNT, not just that signing succeeded,
and that is the whole reason it was worth writing: it caught a real firmware
bug on first run. nanopb hands each repeated `bytes` element back as a
{size, bytes[32]} struct, and the firmware was casting the array to
(uint8_t(*)[32]) -- hashing the size word plus 28 bytes of the first key. The
signature never verified. A test that only checked "did it sign" would have
passed, because the fallback path signs perfectly well.
test_attested_accounts_are_shown_and_blind_sign_still_follows
base flow + 1 identity screen + 1 per account, and the baseline codes
still present at the TAIL -- the additive invariant, restated for Solana
test_bad_signature_degrades_to_todays_flow
an unverifiable attestation adds nothing and refuses nothing
test_attestation_does_not_replay_onto_another_transaction
the same signature against a perturbed tx describes nothing
test_no_signer_loaded_means_no_extra_screens
trust is opt-in per session; without a provider the payload is inert
Note for whoever extends these: the three negative cases pass trivially if the
signer is not loaded, because "no extra screens" is also what a broken positive
path produces. Only the count assertion in the first test distinguishes them.
That is why it exists, and why it should not be relaxed into "signature is 64
bytes".
messages_solana_pb2.py regenerated for the new tags. It must be generated with
a protoc whose output the pinned protobuf==3.20.3 runtime accepts -- the system
protoc emits code importing google.protobuf.runtime_version, which 3.20 does
not have. grpcio-tools==1.48.2 produces compatible output.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Four tests for the transaction-bound attestation that upgrades an ALT transaction from a blind sign to a described one.
The positive test asserts the screen count, not just that signing succeeded — and that is the whole reason it was worth writing: it caught a real firmware bug on first run. nanopb hands each repeated
byteselement back as a{size, bytes[32]}struct, and the firmware was casting the array to(uint8_t(*)[32])— hashing the size word plus 28 bytes of the first key. The signature never verified. A test that only checked "did it sign" would have passed, because the fallback path signs perfectly well...._shown_and_blind_sign_still_follows..._bad_signature_degrades_to_todays_flow..._does_not_replay_onto_another_transaction..._no_signer_loaded_means_no_extra_screensNote for whoever extends these: the three negative cases pass trivially if the signer is not loaded, because "no extra screens" is also what a broken positive path produces. Only the count assertion distinguishes them. That is why it exists and why it should not be relaxed into "signature is 64 bytes".
messages_solana_pb2.pyregenerated — must use a protoc whose outputprotobuf==3.20.3accepts; system protoc emitsgoogle.protobuf.runtime_versionimports that 3.20 lacks.grpcio-tools==1.48.2works.