@trezor/connect 9.1.3 → 9.1.5

package/CHANGELOG.md

@@ -1,3 +1,39 @@
+# 9.1.5
+
+-   feat(suite): T2B1 replace Model R name by official Trezor Safe 3 name (7460372ed1)
+-   feat(connect): add authenticateDevice method (45b99c0813, af907a296d, 249ddc358a)
+-   feat(connect): btg, dash, dgb, nmc, vrc no support for T2B1 (0819ff6fc1)
+-   feat(suite): support t2b1 firmware installation (9ef2bf627a)
+-   fix(connect): get firmware status and release after ensuring internal model (dca3333c2d)
+-   fix(connect-popup): webusb in popup if iframe is on same origin as host (e571971586)
+-   feat(connect-web): trust-issues query string param (b1b6e3f287)
+-   feat(connect-plugin-stellar): Update stellar-sdk and stellar-base (ee7e67db04)
+-   chore(connect): t1 emulator with pin (33c6ca58bf)
+-   fix(connect-popup): allow decimal custom fee entry (bf20f23f05, 8a8d93b5e8)
+-   feat(connect-explorer): add rebootToBootloader method (9996676358)
+-   fix(connect): wrong version format in discovery (19b13d1d4c)
+-   feat(connect-popup): logger in sharedworker collecting from all environments (732bc7d, 2521c7c, 6501dfa4fd)
+-   chore(connect): do not lowercase device color (7229b88c20)
+
+# 9.1.4
+
+-   feat(connect-popup): add metamask extension id to known third party (f137b3e4d6)
+-   test(connect): composeTransaction fix doge fee (69a92483c6)
+-   refactor(connect): remove doge fee branch (c79f3f25d8)
+-   feat(transport): udp support for transport methods (65e617195c)
+-   fix(connect): accept signTransaction inputs/outputs with `address_n: string` (82910e0766)
+-   fix(connect-explorer, connect-popup): add favicon (cafb574ada, c6071123f3)
+-   feat(connect-popup): use trezor icons with display off from suite-data (1c806519a7)
+-   feat(connect): trezor color in device object (31535e2b0f)
+-   feat(connect): trezor name in device object (a0ecb66390)
+-   feat(connect-common): copy models.json from submodules (6d80197523)
+-   fix(connect-iframe): device event not propagating to host (d35e37863a)
+-   feat(connect, suite): unify no backup warning button text (375f3fa1a1)
+-   feat(connect): add suppressBackupWarning param to getPublicKey and getAccountInfo (2c2698d8af)
+-   fix(type-check): connect-web includes connect-iframe package.json (f9f576ab66)
+-   fix(connect-iframe): method.initAsync method superfluous call (37ace99a5d)
+-   fix(connect-iframe): define plugin in build to support analytics (c793ce358c)
+
 # 9.1.3
 
 -   fix(connect): correct import of internal connect dependency (https://github.com/trezor/trezor-suite/issues/9389)

package/README.md

@@ -1,6 +1,6 @@
 # @trezor/connect
 
-API version 9.1.3
+API version 9.1.5
 
 [![Build Status](https://github.com/trezor/trezor-suite/actions/workflows/connect-test.yml/badge.svg)](https://github.com/trezor/trezor-suite/actions/workflows/connect-test.yml)
 [![NPM](https://img.shields.io/npm/v/@trezor/connect.svg)](https://www.npmjs.org/package/@trezor/connect)
@@ -47,6 +47,8 @@ Version 9 is available as `@trezor/connect` and `@trezor/connect-web` npm packag
 
 New major version is released when there are breaking changes on API level. Previous major version will be maintained for 12 months and after this period it can be taken down without notice.
 
+Current major version 9 is being developed on top of `develop` branch. When there is a new major version a new branch should be created (`v-<major-version>`) and mantained separately.
+
 ### Minor version
 
 Minor versions are released when there are:

package/lib/api/authenticateDevice.d.ts

@@ -0,0 +1,7 @@
+import { AbstractMethod } from '../core/AbstractMethod';
+import { AuthenticateDeviceParams } from '../types/api/authenticateDevice';
+export default class AuthenticateDevice extends AbstractMethod<'authenticateDevice', AuthenticateDeviceParams> {
+    init(): void;
+    run(): Promise<import("../types/api/authenticateDevice").AuthenticateDeviceResult>;
+}
+//# sourceMappingURL=authenticateDevice.d.ts.map

package/lib/api/authenticateDevice.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const AbstractMethod_1 = require("../core/AbstractMethod");
+const events_1 = require("../events");
+const paramsValidator_1 = require("./common/paramsValidator");
+const deviceAuthenticityConfig_1 = require("../data/deviceAuthenticityConfig");
+const verifyAuthenticityProof_1 = require("./firmware/verifyAuthenticityProof");
+class AuthenticateDevice extends AbstractMethod_1.AbstractMethod {
+    init() {
+        this.useEmptyPassphrase = true;
+        this.allowDeviceMode = [events_1.UI.INITIALIZE, events_1.UI.SEEDLESS];
+        this.requiredPermissions = ['management'];
+        this.useDeviceState = false;
+        this.firmwareRange = (0, paramsValidator_1.getFirmwareRange)(this.name, null, this.firmwareRange);
+        const { payload } = this;
+        (0, paramsValidator_1.validateParams)(payload, [
+            { name: 'config', type: 'object' },
+            { name: 'allowDebugKeys', type: 'boolean' },
+        ]);
+        if (payload.config) {
+            (0, paramsValidator_1.validateParams)(payload.config, [{ name: 'timestamp', type: 'string', required: true }]);
+            (0, paramsValidator_1.validateParams)(payload.config.T2B1, [
+                { name: 'rootPubKeys', type: 'array', required: true },
+                { name: 'caPubKeys', type: 'array', required: true },
+            ]);
+        }
+        this.params = {
+            config: payload.config,
+            allowDebugKeys: payload.allowDebugKeys,
+        };
+    }
+    async run() {
+        const challenge = (0, verifyAuthenticityProof_1.getRandomChallenge)();
+        const { message } = await this.device
+            .getCommands()
+            .typedCall('AuthenticateDevice', 'AuthenticityProof', {
+            challenge: challenge.toString('hex'),
+        });
+        const config = this.params.config || deviceAuthenticityConfig_1.deviceAuthenticityConfig;
+        const valid = await (0, verifyAuthenticityProof_1.verifyAuthenticityProof)({
+            ...message,
+            challenge,
+            config,
+            allowDebugKeys: this.params.allowDebugKeys,
+            deviceModel: this.device.features.internal_model,
+        });
+        return valid;
+    }
+}
+exports.default = AuthenticateDevice;
+//# sourceMappingURL=authenticateDevice.js.map

package/lib/api/bitcoin/TransactionComposer.js

@@ -121,14 +121,6 @@ class TransactionComposer {
         const changeAddress = addresses.change.find(a => !a.transfers) ||
             addresses.change[addresses.change.length - 1];
         const changeId = (0, pathUtils_1.getHDPath)(changeAddress.path).slice(-1)[0];
-        const enhancement = {
-            baseFee,
-            floorBaseFee: false,
-            dustOutputFee: 0,
-        };
-        if (coinInfo.shortcut === 'DOGE') {
-            enhancement.dustOutputFee = 1000000;
-        }
         return (0, utxo_lib_1.composeTx)({
             txType: account.type,
             utxos: this.utxos,
@@ -142,7 +134,7 @@ class TransactionComposer {
             changeId,
             changeAddress: changeAddress.address,
             dustThreshold: coinInfo.dustLimit,
-            ...enhancement,
+            baseFee,
         });
     }
     dispose() {

package/lib/api/bitcoin/inputs.d.ts

@@ -1,8 +1,8 @@
 import type { ComposedTxInput } from '@trezor/utxo-lib';
 import type { TypedRawTransaction } from '@trezor/blockchain-link';
-import type { BitcoinNetworkInfo } from '../../types';
+import type { BitcoinNetworkInfo, ProtoWithDerivationPath } from '../../types';
 import type { PROTO } from '../../constants';
-export declare const validateTrezorInputs: (inputs: PROTO.TxInputType[], coinInfo: BitcoinNetworkInfo) => PROTO.TxInputType[];
+export declare const validateTrezorInputs: (inputs: ProtoWithDerivationPath<PROTO.TxInputType>[], coinInfo: BitcoinNetworkInfo) => PROTO.TxInputType[];
 export declare const enhanceTrezorInputs: (inputs: PROTO.TxInputType[], rawTxs: TypedRawTransaction[]) => void;
 export declare const inputToTrezor: (input: ComposedTxInput, sequence: number) => PROTO.TxInputType;
 //# sourceMappingURL=inputs.d.ts.map

package/lib/api/bitcoin/outputs.d.ts

@@ -1,8 +1,8 @@
 import type { ComposeOutput as UtxoLibOutput, ComposedTxOutput } from '@trezor/utxo-lib';
 import { PROTO } from '../../constants';
-import type { BitcoinNetworkInfo } from '../../types';
+import type { BitcoinNetworkInfo, ProtoWithDerivationPath } from '../../types';
 import type { ComposeOutput } from '../../types/api/composeTransaction';
-export declare const validateTrezorOutputs: (outputs: PROTO.TxOutputType[], coinInfo: BitcoinNetworkInfo) => PROTO.TxOutputType[];
+export declare const validateTrezorOutputs: (outputs: ProtoWithDerivationPath<PROTO.TxOutputType>[], coinInfo: BitcoinNetworkInfo) => PROTO.TxOutputType[];
 export declare const validateHDOutput: (output: ComposeOutput, coinInfo: BitcoinNetworkInfo) => UtxoLibOutput;
 export declare const outputToTrezor: (output: ComposedTxOutput, _coinInfo: BitcoinNetworkInfo) => PROTO.TxOutputType;
 //# sourceMappingURL=outputs.d.ts.map

package/lib/api/cardanoGetPublicKey.d.ts

@@ -1,12 +1,16 @@
 import { PROTO } from '../constants';
 import { AbstractMethod } from '../core/AbstractMethod';
-export default class CardanoGetPublicKey extends AbstractMethod<'cardanoGetPublicKey', PROTO.CardanoGetPublicKey[]> {
+interface Params extends PROTO.CardanoGetPublicKey {
+    suppressBackupWarning?: boolean;
+}
+export default class CardanoGetPublicKey extends AbstractMethod<'cardanoGetPublicKey', Params[]> {
     hasBundle?: boolean;
     confirmed?: boolean;
     init(): void;
     get info(): string;
     confirmation(): Promise<boolean>;
-    noBackupConfirmation(): Promise<boolean>;
+    noBackupConfirmation(allowSuppression?: boolean): Promise<boolean>;
     run(): Promise<import("..").CardanoPublicKey | import("..").CardanoPublicKey[]>;
 }
+export {};
 //# sourceMappingURL=cardanoGetPublicKey.d.ts.map

package/lib/api/cardanoGetPublicKey.js

@@ -20,6 +20,7 @@ class CardanoGetPublicKey extends AbstractMethod_1.AbstractMethod {
                 { name: 'path', required: true },
                 { name: 'derivationType', type: 'number' },
                 { name: 'showOnTrezor', type: 'boolean' },
+                { name: 'suppressBackupWarning', type: 'boolean' },
             ]);
             const path = (0, pathUtils_1.validatePath)(batch.path, 3);
             return {
@@ -28,6 +29,7 @@ class CardanoGetPublicKey extends AbstractMethod_1.AbstractMethod {
                     ? batch.derivationType
                     : constants_1.PROTO.CardanoDerivationType.ICARUS_TREZOR,
                 show_display: typeof batch.showOnTrezor === 'boolean' ? batch.showOnTrezor : false,
+                suppress_backup_warning: batch.suppressBackupWarning,
             };
         });
     }
@@ -54,7 +56,11 @@ class CardanoGetPublicKey extends AbstractMethod_1.AbstractMethod {
         this.confirmed = uiResp.payload;
         return this.confirmed;
     }
-    async noBackupConfirmation() {
+    async noBackupConfirmation(allowSuppression) {
+        if (allowSuppression &&
+            this.params.every(batch => batch.suppressBackupWarning || !batch.show_display)) {
+            return true;
+        }
         await this.getPopupPromise().promise;
         const uiPromise = this.createUiPromise(events_1.UI.RECEIVE_CONFIRMATION);
         this.postMessage((0, events_1.createUiMessage)(events_1.UI.REQUEST_CONFIRMATION, {

package/lib/api/checkFirmwareAuthenticity.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const tslib_1 = require("tslib");
-const randombytes_1 = tslib_1.__importDefault(require("randombytes"));
+const crypto_1 = require("crypto");
 const AbstractMethod_1 = require("../core/AbstractMethod");
 const firmware_1 = require("./firmware");
 const firmwareInfo_1 = require("../data/firmwareInfo");
@@ -15,20 +14,22 @@ class CheckFirmwareAuthenticity extends AbstractMethod_1.AbstractMethod {
         this.useDeviceState = false;
     }
     async run() {
+        var _a;
         const { device } = this;
-        const deviceVersion = `${device.features.major_version}.${device.features.minor_version}.${device.features.patch_version}`;
-        const releases = (0, firmwareInfo_1.getReleases)(device.features.major_version);
-        const release = releases.find(release => release.version.join('.') === deviceVersion);
+        const firmwareVersion = `${device.features.major_version}.${device.features.minor_version}.${device.features.patch_version}`;
+        const releases = (0, firmwareInfo_1.getReleases)((_a = device.features) === null || _a === void 0 ? void 0 : _a.internal_model);
+        const release = releases.find(release => release.version.join('.') === firmwareVersion);
         if (!release) {
             throw constants_1.ERRORS.TypedError('Runtime', 'checkFirmwareAuthenticity: No release found for device firmware');
         }
-        const baseUrl = `https://data.trezor.io/firmware/${device.features.major_version}`;
-        const fwUrl = `${baseUrl}/trezor-${deviceVersion}${device.firmwareType === types_1.FirmwareType.BitcoinOnly ? '-bitcoinonly.bin' : '.bin'}`;
+        const deviceModelPath = `${device.features.internal_model}`.toLowerCase();
+        const baseUrl = `https://data.trezor.io/firmware/${deviceModelPath}`;
+        const fwUrl = `${baseUrl}/trezor-${deviceModelPath}-${firmwareVersion}${device.firmwareType === types_1.FirmwareType.BitcoinOnly ? '-bitcoinonly.bin' : '.bin'}`;
         const fw = await (0, assets_1.httpRequest)(fwUrl, 'binary');
         if (!fw) {
             throw constants_1.ERRORS.TypedError('Runtime', 'checkFirmwareAuthenticity: firmware binary not found');
         }
-        const { hash: expectedFirmwareHash, challenge } = (0, firmware_1.calculateFirmwareHash)(device.features.major_version, (0, firmware_1.stripFwHeaders)(fw), (0, randombytes_1.default)(32));
+        const { hash: expectedFirmwareHash, challenge } = (0, firmware_1.calculateFirmwareHash)(device.features.major_version, (0, firmware_1.stripFwHeaders)(fw), (0, crypto_1.randomBytes)(32));
         const result = await this.device
             .getCommands()
             .typedCall('GetFirmwareHash', 'FirmwareHash', {

package/lib/api/common/paramsValidator.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getFirmwareRange = exports.validateCoinPath = exports.validateParams = void 0;
+const utils_1 = require("@trezor/utils");
 const constants_1 = require("../../constants");
 const pathUtils_1 = require("../../utils/pathUtils");
-const versionUtils_1 = require("../../utils/versionUtils");
 const config_1 = require("../../data/config");
 const invalidParameter = (message) => constants_1.ERRORS.TypedError('Method_InvalidParameter', message);
 function validateParams(params, schema) {
@@ -68,25 +68,22 @@ const validateCoinPath = (path, coinInfo) => {
 };
 exports.validateCoinPath = validateCoinPath;
 const getFirmwareRange = (method, coinInfo, currentRange) => {
-    const current = JSON.parse(JSON.stringify(currentRange));
+    const range = JSON.parse(JSON.stringify(currentRange));
+    const models = Object.keys(range);
     if (coinInfo) {
-        if (!coinInfo.support || typeof coinInfo.support.trezor1 !== 'string') {
-            current['1'].min = '0';
-        }
-        else if ((0, versionUtils_1.versionCompare)(coinInfo.support.trezor1, current['1'].min) > 0) {
-            current['1'].min = coinInfo.support.trezor1;
-        }
-        if (!coinInfo.support || typeof coinInfo.support.trezor2 !== 'string') {
-            current['2'].min = '0';
-        }
-        else if ((0, versionUtils_1.versionCompare)(coinInfo.support.trezor2, current['2'].min) > 0) {
-            current['2'].min = coinInfo.support.trezor2;
-        }
+        models.forEach(model => {
+            if (!coinInfo.support || typeof coinInfo.support[model] !== 'string') {
+                range[model].min = '0';
+            }
+            else if (range[model].min !== '0' &&
+                utils_1.versionUtils.isNewer(coinInfo.support[model], range[model].min)) {
+                range[model].min = coinInfo.support[model];
+            }
+        });
     }
-    const coinType = coinInfo ? coinInfo.type : null;
-    const shortcut = coinInfo ? coinInfo.shortcut.toLowerCase() : null;
-    const { supportedFirmware } = config_1.config;
-    const ranges = supportedFirmware
+    const coinType = coinInfo === null || coinInfo === void 0 ? void 0 : coinInfo.type;
+    const shortcut = coinInfo === null || coinInfo === void 0 ? void 0 : coinInfo.shortcut.toLowerCase();
+    const configRules = config_1.config.supportedFirmware
         .filter(rule => {
         if (rule.methods) {
             return rule.methods.includes(method);
@@ -96,45 +93,42 @@ const getFirmwareRange = (method, coinInfo, currentRange) => {
         }
         return true;
     })
-        .filter(c => {
-        if (c.coinType) {
-            return c.coinType === coinType;
+        .filter(rule => {
+        if (rule.coinType) {
+            return rule.coinType === coinType;
         }
-        if (c.coin) {
-            return (typeof c.coin === 'string' ? [c.coin] : c.coin).includes(shortcut);
+        if (rule.coin) {
+            return (typeof rule.coin === 'string' ? [rule.coin] : rule.coin).includes(shortcut);
         }
-        return c.methods || c.capabilities;
+        return rule.methods || rule.capabilities;
     });
-    ranges.forEach(range => {
-        const { min, max } = range;
-        if (min) {
-            const [t1, t2] = min;
-            if (t1 === '0' ||
-                current['1'].min === '0' ||
-                (0, versionUtils_1.versionCompare)(current['1'].min, t1) < 0) {
-                current['1'].min = t1;
-            }
-            if (t2 === '0' ||
-                current['2'].min === '0' ||
-                (0, versionUtils_1.versionCompare)(current['2'].min, t2) < 0) {
-                current['2'].min = t2;
-            }
-        }
-        if (max) {
-            const [t1, t2] = max;
-            if (t1 === '0' ||
-                current['1'].max === '0' ||
-                (0, versionUtils_1.versionCompare)(current['1'].max, t1) < 0) {
-                current['1'].max = t1;
-            }
-            if (t2 === '0' ||
-                current['2'].max === '0' ||
-                (0, versionUtils_1.versionCompare)(current['2'].max, t2) < 0) {
-                current['2'].max = t2;
-            }
+    configRules.forEach(rule => {
+        if (rule.min) {
+            models.forEach(model => {
+                const modelMin = rule.min[model];
+                if (modelMin) {
+                    if (modelMin === '0' ||
+                        range[model].min === '0' ||
+                        !utils_1.versionUtils.isNewerOrEqual(range[model].min, modelMin)) {
+                        range[model].min = modelMin;
+                    }
+                }
+            });
+        }
+        if (rule.max) {
+            models.forEach(model => {
+                const modelMax = rule.max[model];
+                if (modelMax) {
+                    if (modelMax === '0' ||
+                        range[model].max === '0' ||
+                        !utils_1.versionUtils.isNewerOrEqual(range[model].max, modelMax)) {
+                        range[model].max = modelMax;
+                    }
+                }
+            });
         }
     });
-    return current;
+    return range;
 };
 exports.getFirmwareRange = getFirmwareRange;
 //# sourceMappingURL=paramsValidator.js.map

package/lib/api/eos/eosSignTx.js

@@ -102,7 +102,7 @@ const parseAuth = (a) => {
         const key = Buffer.from(bs58.decode(pk.substring(len)));
         return {
             type: 0,
-            key: key.slice(0, key.length - 4).toString('hex'),
+            key: key.subarray(0, key.length - 4).toString('hex'),
         };
     };
     return {

package/lib/api/ethereum/ethereumDefinitions.js

@@ -93,8 +93,9 @@ const ethereumNetworkInfoFromDefinition = (definition) => ({
     shortcut: definition.symbol,
     support: {
         connect: true,
-        trezor1: '1.6.2',
-        trezor2: '2.0.7',
+        T1B1: '1.6.2',
+        T2T1: '2.0.7',
+        T2B1: '2.6.1',
     },
     blockchainLink: undefined,
 });

package/lib/api/firmware/getBinary.js

@@ -10,7 +10,7 @@ const getBinary = ({ features, releases, baseUrl, version, btcOnly, intermediary
         throw new Error('Features of unexpected shape provided');
     }
     if (intermediaryVersion) {
-        return (0, assets_1.httpRequest)(`${baseUrl}/firmware/1/trezor-inter-v${intermediaryVersion}.bin`, 'binary');
+        return (0, assets_1.httpRequest)(`${baseUrl}/firmware/t1b1/trezor-t1b1-inter-v${intermediaryVersion}.bin`, 'binary');
     }
     const infoByBootloader = (0, firmwareInfo_1.getInfo)({ features, releases });
     const releaseByFirmware = releases.find(r => version &&

package/lib/api/firmware/verifyAuthenticityProof.d.ts

@@ -0,0 +1,14 @@
+/// <reference types="node" />
+import { PROTO } from '../../constants';
+import { DeviceAuthenticityConfig } from '../../data/deviceAuthenticityConfig';
+import { AuthenticateDeviceResult } from '../../types/api/authenticateDevice';
+interface AuthenticityProofData extends PROTO.AuthenticityProof {
+    challenge: Buffer;
+    config: DeviceAuthenticityConfig;
+    allowDebugKeys?: boolean;
+    deviceModel: keyof typeof PROTO.DeviceModelInternal;
+}
+export declare const getRandomChallenge: () => Buffer;
+export declare const verifyAuthenticityProof: ({ certificates, signature, challenge, config, allowDebugKeys, deviceModel, }: AuthenticityProofData) => Promise<AuthenticateDeviceResult>;
+export {};
+//# sourceMappingURL=verifyAuthenticityProof.d.ts.map

package/lib/api/firmware/verifyAuthenticityProof.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAuthenticityProof = exports.getRandomChallenge = void 0;
+const tslib_1 = require("tslib");
+const crypto = tslib_1.__importStar(require("crypto"));
+const utils_1 = require("@trezor/utils");
+const x509certificate_1 = require("./x509certificate");
+const verifySignature = async (rawKey, data, signature) => {
+    const signer = crypto.createVerify('sha256');
+    signer.update(Buffer.from(data));
+    const SubtleCrypto = typeof window !== 'undefined' ? window.crypto.subtle : crypto.subtle;
+    if (!SubtleCrypto) {
+        throw new Error('SubtleCrypto not supported');
+    }
+    const ecPubKey = await SubtleCrypto.importKey('raw', rawKey, { name: 'ECDSA', namedCurve: 'P-256' }, true, ['verify']);
+    const spkiPubKey = await SubtleCrypto.exportKey('spki', ecPubKey);
+    const key = `-----BEGIN PUBLIC KEY-----\n${Buffer.from(spkiPubKey).toString('base64')}\n-----END PUBLIC KEY-----`;
+    return signer.verify({ key }, Buffer.from(signature));
+};
+const getRandomChallenge = () => crypto.randomBytes(32);
+exports.getRandomChallenge = getRandomChallenge;
+const verifyAuthenticityProof = async ({ certificates, signature, challenge, config, allowDebugKeys, deviceModel, }) => {
+    const modelConfig = config[deviceModel];
+    if (!modelConfig) {
+        throw new Error(`Pubkeys for ${deviceModel} not found in config`);
+    }
+    const { caPubKeys, debug } = modelConfig;
+    const caCert = (0, x509certificate_1.parseCertificate)(new Uint8Array(Buffer.from(certificates[1], 'hex')));
+    const caPubKey = Buffer.from(caCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes).toString('hex');
+    const deviceCert = (0, x509certificate_1.parseCertificate)(new Uint8Array(Buffer.from(certificates[0], 'hex')));
+    const rootPubKeys = allowDebugKeys
+        ? modelConfig.rootPubKeys.concat((debug === null || debug === void 0 ? void 0 : debug.rootPubKeys) || [])
+        : modelConfig.rootPubKeys;
+    const isCertSignedByRootPubkey = await Promise.all(rootPubKeys.map(rootPubKey => verifySignature(Buffer.from(rootPubKey, 'hex'), caCert.tbsCertificate.asn1.raw, caCert.signatureValue.bits.bytes)));
+    const rootPubKeyIndex = isCertSignedByRootPubkey.findIndex(valid => !!valid);
+    const rootPubKey = rootPubKeys[rootPubKeyIndex];
+    const isDebugRootPubKey = debug === null || debug === void 0 ? void 0 : debug.rootPubKeys.includes(rootPubKey);
+    const caCertValidityFrom = caCert.tbsCertificate.validity.from.getTime();
+    if (caCertValidityFrom > new Date().getTime()) {
+        throw new Error(`CA validity from ${caCertValidityFrom} cant't be in the future!`);
+    }
+    if (!rootPubKey) {
+        const configExpired = new Date(config.timestamp).getTime() < caCertValidityFrom;
+        return {
+            valid: false,
+            configExpired,
+            caPubKey,
+            error: 'ROOT_PUBKEY_NOT_FOUND',
+        };
+    }
+    const [subject] = deviceCert.tbsCertificate.subject;
+    if (!subject.parameters || subject.algorithm !== '2.5.4.3') {
+        throw new Error('Missing certificate subject');
+    }
+    const subjectValue = Buffer.from(subject.parameters.asn1.contents.subarray(0, 4)).toString();
+    if (subjectValue !== deviceModel) {
+        return {
+            valid: false,
+            caPubKey,
+            error: 'INVALID_DEVICE_MODEL',
+        };
+    }
+    const isDeviceCertValid = await verifySignature(Buffer.from(caCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes), deviceCert.tbsCertificate.asn1.raw, deviceCert.signatureValue.bits.bytes);
+    const challengePrefix = Buffer.from('AuthenticateDevice:');
+    const prefixedChallenge = Buffer.concat([
+        utils_1.bufferUtils.getChunkSize(challengePrefix.length),
+        challengePrefix,
+        utils_1.bufferUtils.getChunkSize(challenge.length),
+        challenge,
+    ]);
+    const isSignatureValid = await verifySignature(Buffer.from(deviceCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes), prefixedChallenge, Buffer.from(signature, 'hex'));
+    if (rootPubKey && isDeviceCertValid && isSignatureValid) {
+        if ((!isDebugRootPubKey && !caPubKeys.includes(caPubKey)) ||
+            (isDebugRootPubKey && !(debug === null || debug === void 0 ? void 0 : debug.caPubKeys.includes(caPubKey)))) {
+            const configExpired = new Date(config.timestamp).getTime() < caCertValidityFrom;
+            return {
+                valid: false,
+                configExpired,
+                caPubKey,
+                error: 'CA_PUBKEY_NOT_FOUND',
+            };
+        }
+        return {
+            valid: true,
+            caPubKey,
+            debugKey: isDebugRootPubKey,
+        };
+    }
+    if (!isDeviceCertValid) {
+        return {
+            valid: false,
+            caPubKey,
+            error: 'INVALID_DEVICE_CERTIFICATE',
+        };
+    }
+    return {
+        valid: false,
+        caPubKey,
+        error: 'INVALID_DEVICE_SIGNATURE',
+    };
+};
+exports.verifyAuthenticityProof = verifyAuthenticityProof;
+//# sourceMappingURL=verifyAuthenticityProof.js.map

package/lib/api/firmware/x509certificate.d.ts

@@ -0,0 +1,73 @@
+interface Asn1 {
+    cls: number;
+    tag: number;
+    structured: boolean;
+    byteLength: number;
+    contents: Uint8Array;
+    raw: Uint8Array;
+}
+export declare const parseName: (asn1: Asn1) => {
+    asn1: Asn1;
+    algorithm: string;
+    parameters: {
+        asn1: Asn1;
+    } | null;
+}[];
+export declare const parseCertificate: (byteArray: Uint8Array) => {
+    asn1: Asn1;
+    tbsCertificate: {
+        asn1: Asn1;
+        version: Asn1;
+        serialNumber: Asn1;
+        signature: {
+            asn1: Asn1;
+            algorithm: string;
+            parameters: {
+                asn1: Asn1;
+            } | null;
+        };
+        issuer: Asn1;
+        validity: {
+            from: Date;
+            to: Date;
+        };
+        subject: {
+            asn1: Asn1;
+            algorithm: string;
+            parameters: {
+                asn1: Asn1;
+            } | null;
+        }[];
+        subjectPublicKeyInfo: {
+            asn1: Asn1;
+            algorithm: {
+                asn1: Asn1;
+                algorithm: string;
+                parameters: {
+                    asn1: Asn1;
+                } | null;
+            };
+            bits: {
+                unusedBits: number;
+                bytes: Uint8Array;
+            };
+        };
+        extensions: Asn1;
+    };
+    signatureAlgorithm: {
+        asn1: Asn1;
+        algorithm: string;
+        parameters: {
+            asn1: Asn1;
+        } | null;
+    };
+    signatureValue: {
+        asn1: Asn1;
+        bits: {
+            unusedBits: number;
+            bytes: Uint8Array;
+        };
+    };
+};
+export {};
+//# sourceMappingURL=x509certificate.d.ts.map