@trezor/connect 9.1.4 → 9.1.6

package/lib/api/{ethereumGetPublicKey.js → ethereum/api/ethereumGetPublicKey.js}

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const AbstractMethod_1 = require("../core/AbstractMethod");
-const paramsValidator_1 = require("./common/paramsValidator");
-const pathUtils_1 = require("../utils/pathUtils");
-const ethereumUtils_1 = require("../utils/ethereumUtils");
-const coinInfo_1 = require("../data/coinInfo");
-const events_1 = require("../events");
+const AbstractMethod_1 = require("../../../core/AbstractMethod");
+const paramsValidator_1 = require("../../common/paramsValidator");
+const pathUtils_1 = require("../../../utils/pathUtils");
+const ethereumUtils_1 = require("../../../utils/ethereumUtils");
+const coinInfo_1 = require("../../../data/coinInfo");
+const events_1 = require("../../../events");
 class EthereumGetPublicKey extends AbstractMethod_1.AbstractMethod {
     init() {
         this.requiredPermissions = ['read'];

package/lib/api/{ethereumSignMessage.d.ts → ethereum/api/ethereumSignMessage.d.ts}

@@ -1,6 +1,6 @@
-import { AbstractMethod } from '../core/AbstractMethod';
-import type { PROTO } from '../constants';
-import type { EthereumNetworkInfo } from '../types';
+import { AbstractMethod } from '../../../core/AbstractMethod';
+import type { PROTO } from '../../../constants';
+import type { EthereumNetworkInfo } from '../../../types';
 import type { EthereumDefinitions } from '@trezor/protobuf/lib/messages';
 type Params = PROTO.EthereumSignMessage & {
     network?: EthereumNetworkInfo;

package/lib/api/{ethereumSignMessage.js → ethereum/api/ethereumSignMessage.js}

@@ -1,12 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const AbstractMethod_1 = require("../core/AbstractMethod");
-const paramsValidator_1 = require("./common/paramsValidator");
-const pathUtils_1 = require("../utils/pathUtils");
-const coinInfo_1 = require("../data/coinInfo");
-const ethereumUtils_1 = require("../utils/ethereumUtils");
-const formatUtils_1 = require("../utils/formatUtils");
-const ethereumDefinitions_1 = require("./ethereum/ethereumDefinitions");
+const AbstractMethod_1 = require("../../../core/AbstractMethod");
+const paramsValidator_1 = require("../../common/paramsValidator");
+const pathUtils_1 = require("../../../utils/pathUtils");
+const coinInfo_1 = require("../../../data/coinInfo");
+const ethereumUtils_1 = require("../../../utils/ethereumUtils");
+const formatUtils_1 = require("../../../utils/formatUtils");
+const ethereumDefinitions_1 = require("../ethereumDefinitions");
 class EthereumSignMessage extends AbstractMethod_1.AbstractMethod {
     init() {
         this.requiredPermissions = ['read', 'write'];

package/lib/api/{ethereumSignTransaction.d.ts → ethereum/api/ethereumSignTransaction.d.ts}

@@ -1,22 +1,24 @@
-import { AbstractMethod } from '../core/AbstractMethod';
-import type { EthereumTransaction, EthereumTransactionEIP1559 } from '../types/api/ethereum';
-import type { EthereumNetworkInfo } from '../types';
+import { AbstractMethod } from '../../../core/AbstractMethod';
+import type { EthereumTransaction, EthereumTransactionEIP1559 } from '../../../types/api/ethereum';
+import type { EthereumNetworkInfo } from '../../../types';
 import type { EthereumDefinitions } from '@trezor/protobuf/lib/messages';
 type Params = {
     path: number[];
-    tx: ({
-        type: 'legacy';
-    } & EthereumTransaction) | ({
-        type: 'eip1559';
-    } & EthereumTransactionEIP1559);
     network?: EthereumNetworkInfo;
     definitions?: EthereumDefinitions;
-};
+} & ({
+    type: 'legacy';
+    tx: EthereumTransaction;
+} | {
+    type: 'eip1559';
+    tx: EthereumTransactionEIP1559;
+});
 export default class EthereumSignTransaction extends AbstractMethod<'ethereumSignTransaction', Params> {
     init(): void;
     initAsync(): Promise<void>;
     get info(): string;
     run(): Promise<{
+        serializedTx: string;
         v: string;
         r: string;
         s: string;

package/lib/api/{ethereumSignTransaction.js → ethereum/api/ethereumSignTransaction.js}

@@ -1,30 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
-const AbstractMethod_1 = require("../core/AbstractMethod");
-const paramsValidator_1 = require("./common/paramsValidator");
-const pathUtils_1 = require("../utils/pathUtils");
-const coinInfo_1 = require("../data/coinInfo");
-const ethereumUtils_1 = require("../utils/ethereumUtils");
-const formatUtils_1 = require("../utils/formatUtils");
-const helper = tslib_1.__importStar(require("./ethereum/ethereumSignTx"));
-const ethereumDefinitions_1 = require("./ethereum/ethereumDefinitions");
-const strip = value => {
-    if (typeof value === 'string') {
-        let stripped = (0, formatUtils_1.stripHexPrefix)(value);
-        if (stripped.length % 2 !== 0) {
-            stripped = `0${stripped}`;
-        }
-        return stripped;
-    }
-    if (Array.isArray(value)) {
-        return value.map(strip);
-    }
-    if (typeof value === 'object') {
-        return Object.entries(value).reduce((acc, [k, v]) => ({ ...acc, [k]: strip(v) }), {});
+const AbstractMethod_1 = require("../../../core/AbstractMethod");
+const paramsValidator_1 = require("../../common/paramsValidator");
+const pathUtils_1 = require("../../../utils/pathUtils");
+const coinInfo_1 = require("../../../data/coinInfo");
+const ethereumUtils_1 = require("../../../utils/ethereumUtils");
+const formatUtils_1 = require("../../../utils/formatUtils");
+const helper = tslib_1.__importStar(require("../ethereumSignTx"));
+const ethereumDefinitions_1 = require("../ethereumDefinitions");
+const strip = (0, formatUtils_1.deepTransform)(value => {
+    let stripped = (0, formatUtils_1.stripHexPrefix)(value);
+    if (stripped.length % 2 !== 0) {
+        stripped = `0${stripped}`;
     }
-    return value;
-};
+    return stripped;
+});
 class EthereumSignTransaction extends AbstractMethod_1.AbstractMethod {
     init() {
         this.requiredPermissions = ['read', 'write'];
@@ -36,10 +27,10 @@ class EthereumSignTransaction extends AbstractMethod_1.AbstractMethod {
         const path = (0, pathUtils_1.validatePath)(payload.path, 3);
         const network = (0, coinInfo_1.getEthereumNetwork)(path);
         const tx = payload.transaction;
-        const isEIP1559 = tx.maxFeePerGas && tx.maxPriorityFeePerGas;
+        const isEIP1559 = typeof tx.maxFeePerGas === 'string' && typeof tx.maxPriorityFeePerGas === 'string';
         this.firmwareRange = (0, paramsValidator_1.getFirmwareRange)(isEIP1559 ? 'eip1559' : this.name, network, this.firmwareRange);
-        const schema = isEIP1559
-            ? [
+        if (isEIP1559) {
+            (0, paramsValidator_1.validateParams)(tx, [
                 { name: 'to', type: 'string', required: true },
                 { name: 'value', type: 'string', required: true },
                 { name: 'gasLimit', type: 'string', required: true },
@@ -48,8 +39,11 @@ class EthereumSignTransaction extends AbstractMethod_1.AbstractMethod {
                 { name: 'nonce', type: 'string', required: true },
                 { name: 'data', type: 'string' },
                 { name: 'chainId', type: 'number', required: true },
-            ]
-            : [
+            ]);
+            this.params = { path, network, type: 'eip1559', tx: strip(tx) };
+        }
+        else {
+            (0, paramsValidator_1.validateParams)(tx, [
                 { name: 'to', type: 'string', required: true },
                 { name: 'value', type: 'string', required: true },
                 { name: 'gasLimit', type: 'string', required: true },
@@ -58,19 +52,12 @@ class EthereumSignTransaction extends AbstractMethod_1.AbstractMethod {
                 { name: 'data', type: 'string' },
                 { name: 'chainId', type: 'number' },
                 { name: 'txType', type: 'number' },
-            ];
-        (0, paramsValidator_1.validateParams)(tx, schema);
+            ]);
+            this.params = { path, network, type: 'legacy', tx: strip(tx) };
+        }
         if (typeof tx.chainId !== 'number') {
             console.warn('TrezorConnect.ethereumSignTransaction: Missing chainId parameter!');
         }
-        this.params = {
-            path,
-            tx: {
-                type: isEIP1559 ? 'eip1559' : 'legacy',
-                ...strip(tx),
-            },
-            network,
-        };
     }
     async initAsync() {
         if (this.params.tx.chainId === 1 && !this.params.tx.data) {
@@ -91,11 +78,17 @@ class EthereumSignTransaction extends AbstractMethod_1.AbstractMethod {
     get info() {
         return (0, ethereumUtils_1.getNetworkLabel)('Sign #NETWORK transaction', this.params.network);
     }
-    run() {
-        const { tx, definitions } = this.params;
-        return tx.type === 'eip1559'
-            ? helper.ethereumSignTxEIP1559(this.device.getCommands().typedCall.bind(this.device.getCommands()), this.params.path, tx.to, tx.value, tx.gasLimit, tx.maxFeePerGas, tx.maxPriorityFeePerGas, tx.nonce, tx.chainId, tx.data, tx.accessList, definitions)
-            : helper.ethereumSignTx(this.device.getCommands().typedCall.bind(this.device.getCommands()), this.params.path, tx.to, tx.value, tx.gasLimit, tx.gasPrice, tx.nonce, tx.chainId, tx.data, tx.txType, definitions);
+    async run() {
+        const { type, tx, definitions } = this.params;
+        const signature = type === 'eip1559'
+            ? await helper.ethereumSignTxEIP1559(this.device.getCommands().typedCall.bind(this.device.getCommands()), this.params.path, tx.to, tx.value, tx.gasLimit, tx.maxFeePerGas, tx.maxPriorityFeePerGas, tx.nonce, tx.chainId, tx.data, tx.accessList, definitions)
+            : await helper.ethereumSignTx(this.device.getCommands().typedCall.bind(this.device.getCommands()), this.params.path, tx.to, tx.value, tx.gasLimit, tx.gasPrice, tx.nonce, tx.chainId, tx.data, tx.txType, definitions);
+        const serializedTx = helper.serializeEthereumTx({
+            ...tx,
+            ...signature,
+            type: type === 'legacy' ? 0 : 2,
+        }, tx.chainId);
+        return { ...signature, serializedTx };
     }
 }
 exports.default = EthereumSignTransaction;

package/lib/api/{ethereumSignTypedData.d.ts → ethereum/api/ethereumSignTypedData.d.ts}

@@ -1,6 +1,6 @@
-import { AbstractMethod } from '../core/AbstractMethod';
-import type { EthereumSignTypedDataTypes, EthereumSignTypedData as EthereumSignTypedDataParams, EthereumSignTypedHash as EthereumSignTypedHashParams } from '../types/api/ethereum';
-import type { EthereumNetworkInfo } from '../types';
+import { AbstractMethod } from '../../../core/AbstractMethod';
+import type { EthereumSignTypedDataTypes, EthereumSignTypedData as EthereumSignTypedDataParams, EthereumSignTypedHash as EthereumSignTypedHashParams } from '../../../types/api/ethereum';
+import type { EthereumNetworkInfo } from '../../../types';
 import type { EthereumDefinitions } from '@trezor/protobuf/lib/messages';
 type Params = (Omit<EthereumSignTypedDataParams<EthereumSignTypedDataTypes>, 'path'> | Omit<EthereumSignTypedHashParams<EthereumSignTypedDataTypes>, 'path'>) & {
     address_n: number[];

package/lib/api/{ethereumSignTypedData.js → ethereum/api/ethereumSignTypedData.js}

@@ -1,15 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const AbstractMethod_1 = require("../core/AbstractMethod");
-const paramsValidator_1 = require("./common/paramsValidator");
-const pathUtils_1 = require("../utils/pathUtils");
-const coinInfo_1 = require("../data/coinInfo");
-const ethereumUtils_1 = require("../utils/ethereumUtils");
-const constants_1 = require("../constants");
-const ethereumSignTypedData_1 = require("./ethereum/ethereumSignTypedData");
-const formatUtils_1 = require("../utils/formatUtils");
-const ethereumDefinitions_1 = require("./ethereum/ethereumDefinitions");
-const types_1 = require("../types");
+const AbstractMethod_1 = require("../../../core/AbstractMethod");
+const paramsValidator_1 = require("../../common/paramsValidator");
+const pathUtils_1 = require("../../../utils/pathUtils");
+const coinInfo_1 = require("../../../data/coinInfo");
+const ethereumUtils_1 = require("../../../utils/ethereumUtils");
+const constants_1 = require("../../../constants");
+const ethereumSignTypedData_1 = require("../ethereumSignTypedData");
+const formatUtils_1 = require("../../../utils/formatUtils");
+const ethereumDefinitions_1 = require("../ethereumDefinitions");
+const types_1 = require("../../../types");
 class EthereumSignTypedData extends AbstractMethod_1.AbstractMethod {
     init() {
         this.requiredPermissions = ['read', 'write'];

package/lib/api/{ethereumVerifyMessage.d.ts → ethereum/api/ethereumVerifyMessage.d.ts}

@@ -1,5 +1,5 @@
-import { AbstractMethod } from '../core/AbstractMethod';
-import type { PROTO } from '../constants';
+import { AbstractMethod } from '../../../core/AbstractMethod';
+import type { PROTO } from '../../../constants';
 export default class EthereumVerifyMessage extends AbstractMethod<'ethereumVerifyMessage', PROTO.EthereumVerifyMessage> {
     init(): void;
     get info(): string;

package/lib/api/{ethereumVerifyMessage.js → ethereum/api/ethereumVerifyMessage.js}

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const AbstractMethod_1 = require("../core/AbstractMethod");
-const paramsValidator_1 = require("./common/paramsValidator");
-const formatUtils_1 = require("../utils/formatUtils");
+const AbstractMethod_1 = require("../../../core/AbstractMethod");
+const paramsValidator_1 = require("../../common/paramsValidator");
+const formatUtils_1 = require("../../../utils/formatUtils");
 class EthereumVerifyMessage extends AbstractMethod_1.AbstractMethod {
     init() {
         this.requiredPermissions = ['read', 'write'];

package/lib/api/ethereum/api/index.d.ts

@@ -0,0 +1,7 @@
+export { default as ethereumGetAddress } from './ethereumGetAddress';
+export { default as ethereumGetPublicKey } from './ethereumGetPublicKey';
+export { default as ethereumSignMessage } from './ethereumSignMessage';
+export { default as ethereumSignTransaction } from './ethereumSignTransaction';
+export { default as ethereumSignTypedData } from './ethereumSignTypedData';
+export { default as ethereumVerifyMessage } from './ethereumVerifyMessage';
+//# sourceMappingURL=index.d.ts.map

package/lib/api/ethereum/api/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ethereumVerifyMessage = exports.ethereumSignTypedData = exports.ethereumSignTransaction = exports.ethereumSignMessage = exports.ethereumGetPublicKey = exports.ethereumGetAddress = void 0;
+var ethereumGetAddress_1 = require("./ethereumGetAddress");
+Object.defineProperty(exports, "ethereumGetAddress", { enumerable: true, get: function () { return __importDefault(ethereumGetAddress_1).default; } });
+var ethereumGetPublicKey_1 = require("./ethereumGetPublicKey");
+Object.defineProperty(exports, "ethereumGetPublicKey", { enumerable: true, get: function () { return __importDefault(ethereumGetPublicKey_1).default; } });
+var ethereumSignMessage_1 = require("./ethereumSignMessage");
+Object.defineProperty(exports, "ethereumSignMessage", { enumerable: true, get: function () { return __importDefault(ethereumSignMessage_1).default; } });
+var ethereumSignTransaction_1 = require("./ethereumSignTransaction");
+Object.defineProperty(exports, "ethereumSignTransaction", { enumerable: true, get: function () { return __importDefault(ethereumSignTransaction_1).default; } });
+var ethereumSignTypedData_1 = require("./ethereumSignTypedData");
+Object.defineProperty(exports, "ethereumSignTypedData", { enumerable: true, get: function () { return __importDefault(ethereumSignTypedData_1).default; } });
+var ethereumVerifyMessage_1 = require("./ethereumVerifyMessage");
+Object.defineProperty(exports, "ethereumVerifyMessage", { enumerable: true, get: function () { return __importDefault(ethereumVerifyMessage_1).default; } });
+//# sourceMappingURL=index.js.map

package/lib/api/ethereum/ethereumDefinitions.js

@@ -93,8 +93,9 @@ const ethereumNetworkInfoFromDefinition = (definition) => ({
     shortcut: definition.symbol,
     support: {
         connect: true,
-        trezor1: '1.6.2',
-        trezor2: '2.0.7',
+        T1B1: '1.6.2',
+        T2T1: '2.0.7',
+        T2B1: '2.6.1',
     },
     blockchainLink: undefined,
 });

package/lib/api/ethereum/ethereumSignTx.d.ts

@@ -1,6 +1,8 @@
+import { TxData, FeeMarketEIP1559TxData } from '@ethereumjs/tx';
 import { EthereumDefinitions } from '@trezor/protobuf/lib/messages';
 import type { TypedCall } from '../../device/DeviceCommands';
 import type { EthereumAccessList } from '../../types/api/ethereum';
+export declare const serializeEthereumTx: (txData: TxData | FeeMarketEIP1559TxData, chainId: number) => string;
 export declare const ethereumSignTx: (typedCall: TypedCall, address_n: number[], to: string, value: string, gas_limit: string, gas_price: string, nonce: string, chain_id: number, data?: string, tx_type?: number, definitions?: EthereumDefinitions) => Promise<{
     v: string;
     r: string;

package/lib/api/ethereum/ethereumSignTx.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ethereumSignTxEIP1559 = exports.ethereumSignTx = void 0;
+exports.ethereumSignTxEIP1559 = exports.ethereumSignTx = exports.serializeEthereumTx = void 0;
+const common_1 = require("@ethereumjs/common");
+const tx_1 = require("@ethereumjs/tx");
 const constants_1 = require("../../constants");
+const formatUtils_1 = require("../../utils/formatUtils");
 const splitString = (str, len) => {
     if (str == null) {
         return ['', ''];
@@ -31,6 +34,17 @@ const processTxRequest = async (typedCall, request, data, chain_id) => {
     const response = await typedCall('EthereumTxAck', 'EthereumTxRequest', { data_chunk: first });
     return processTxRequest(typedCall, response.message, rest, chain_id);
 };
+const deepHexPrefix = (0, formatUtils_1.deepTransform)(formatUtils_1.addHexPrefix);
+const serializeEthereumTx = (txData, chainId) => {
+    const txOptions = chainId === 61
+        ? {
+            common: common_1.Common.custom({ name: 'ethereum-classic', networkId: 1, chainId: 61 }, { baseChain: common_1.Chain.Mainnet, hardfork: common_1.Hardfork.Petersburg }),
+        }
+        : { chain: chainId };
+    const ethTx = tx_1.TransactionFactory.fromTxData(deepHexPrefix(txData), txOptions);
+    return `0x${Buffer.from(ethTx.serialize()).toString('hex')}`;
+};
+exports.serializeEthereumTx = serializeEthereumTx;
 const stripLeadingZeroes = (str) => {
     while (/^00/.test(str)) {
         str = str.slice(2);

package/lib/api/firmware/getBinary.js

@@ -10,7 +10,7 @@ const getBinary = ({ features, releases, baseUrl, version, btcOnly, intermediary
         throw new Error('Features of unexpected shape provided');
     }
     if (intermediaryVersion) {
-        return (0, assets_1.httpRequest)(`${baseUrl}/firmware/1/trezor-inter-v${intermediaryVersion}.bin`, 'binary');
+        return (0, assets_1.httpRequest)(`${baseUrl}/firmware/t1b1/trezor-t1b1-inter-v${intermediaryVersion}.bin`, 'binary');
     }
     const infoByBootloader = (0, firmwareInfo_1.getInfo)({ features, releases });
     const releaseByFirmware = releases.find(r => version &&

package/lib/api/firmware/verifyAuthenticityProof.d.ts

@@ -0,0 +1,14 @@
+/// <reference types="node" />
+import { PROTO } from '../../constants';
+import { DeviceAuthenticityConfig } from '../../data/deviceAuthenticityConfig';
+import { AuthenticateDeviceResult } from '../../types/api/authenticateDevice';
+interface AuthenticityProofData extends PROTO.AuthenticityProof {
+    challenge: Buffer;
+    config: DeviceAuthenticityConfig;
+    allowDebugKeys?: boolean;
+    deviceModel: keyof typeof PROTO.DeviceModelInternal;
+}
+export declare const getRandomChallenge: () => Buffer;
+export declare const verifyAuthenticityProof: ({ certificates, signature, challenge, config, allowDebugKeys, deviceModel, }: AuthenticityProofData) => Promise<AuthenticateDeviceResult>;
+export {};
+//# sourceMappingURL=verifyAuthenticityProof.d.ts.map

package/lib/api/firmware/verifyAuthenticityProof.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyAuthenticityProof = exports.getRandomChallenge = void 0;
+const tslib_1 = require("tslib");
+const crypto = tslib_1.__importStar(require("crypto"));
+const utils_1 = require("@trezor/utils");
+const x509certificate_1 = require("./x509certificate");
+const verifySignature = async (rawKey, data, signature) => {
+    const signer = crypto.createVerify('sha256');
+    signer.update(Buffer.from(data));
+    const SubtleCrypto = typeof window !== 'undefined' ? window.crypto.subtle : crypto.subtle;
+    if (!SubtleCrypto) {
+        throw new Error('SubtleCrypto not supported');
+    }
+    const ecPubKey = await SubtleCrypto.importKey('raw', rawKey, { name: 'ECDSA', namedCurve: 'P-256' }, true, ['verify']);
+    const spkiPubKey = await SubtleCrypto.exportKey('spki', ecPubKey);
+    const key = `-----BEGIN PUBLIC KEY-----\n${Buffer.from(spkiPubKey).toString('base64')}\n-----END PUBLIC KEY-----`;
+    return signer.verify({ key }, Buffer.from(signature));
+};
+const getRandomChallenge = () => crypto.randomBytes(32);
+exports.getRandomChallenge = getRandomChallenge;
+const verifyAuthenticityProof = async ({ certificates, signature, challenge, config, allowDebugKeys, deviceModel, }) => {
+    const modelConfig = config[deviceModel];
+    if (!modelConfig) {
+        throw new Error(`Pubkeys for ${deviceModel} not found in config`);
+    }
+    const { caPubKeys, debug } = modelConfig;
+    const caCert = (0, x509certificate_1.parseCertificate)(new Uint8Array(Buffer.from(certificates[1], 'hex')));
+    const caPubKey = Buffer.from(caCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes).toString('hex');
+    const deviceCert = (0, x509certificate_1.parseCertificate)(new Uint8Array(Buffer.from(certificates[0], 'hex')));
+    const rootPubKeys = allowDebugKeys
+        ? modelConfig.rootPubKeys.concat((debug === null || debug === void 0 ? void 0 : debug.rootPubKeys) || [])
+        : modelConfig.rootPubKeys;
+    const isCertSignedByRootPubkey = await Promise.all(rootPubKeys.map(rootPubKey => verifySignature(Buffer.from(rootPubKey, 'hex'), caCert.tbsCertificate.asn1.raw, caCert.signatureValue.bits.bytes)));
+    const rootPubKeyIndex = isCertSignedByRootPubkey.findIndex(valid => !!valid);
+    const rootPubKey = rootPubKeys[rootPubKeyIndex];
+    const isDebugRootPubKey = debug === null || debug === void 0 ? void 0 : debug.rootPubKeys.includes(rootPubKey);
+    const caCertValidityFrom = caCert.tbsCertificate.validity.from.getTime();
+    if (caCertValidityFrom > new Date().getTime()) {
+        throw new Error(`CA validity from ${caCertValidityFrom} cant't be in the future!`);
+    }
+    if (!rootPubKey) {
+        const configExpired = new Date(config.timestamp).getTime() < caCertValidityFrom;
+        return {
+            valid: false,
+            configExpired,
+            caPubKey,
+            error: 'ROOT_PUBKEY_NOT_FOUND',
+        };
+    }
+    const [subject] = deviceCert.tbsCertificate.subject;
+    if (!subject.parameters || subject.algorithm !== '2.5.4.3') {
+        throw new Error('Missing certificate subject');
+    }
+    const subjectValue = Buffer.from(subject.parameters.asn1.contents.subarray(0, 4)).toString();
+    if (subjectValue !== deviceModel) {
+        return {
+            valid: false,
+            caPubKey,
+            error: 'INVALID_DEVICE_MODEL',
+        };
+    }
+    const isDeviceCertValid = await verifySignature(Buffer.from(caCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes), deviceCert.tbsCertificate.asn1.raw, deviceCert.signatureValue.bits.bytes);
+    const challengePrefix = Buffer.from('AuthenticateDevice:');
+    const prefixedChallenge = Buffer.concat([
+        utils_1.bufferUtils.getChunkSize(challengePrefix.length),
+        challengePrefix,
+        utils_1.bufferUtils.getChunkSize(challenge.length),
+        challenge,
+    ]);
+    const isSignatureValid = await verifySignature(Buffer.from(deviceCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes), prefixedChallenge, (0, x509certificate_1.fixSignature)(Buffer.from(signature, 'hex')));
+    if (rootPubKey && isDeviceCertValid && isSignatureValid) {
+        if ((!isDebugRootPubKey && !caPubKeys.includes(caPubKey)) ||
+            (isDebugRootPubKey && !(debug === null || debug === void 0 ? void 0 : debug.caPubKeys.includes(caPubKey)))) {
+            const configExpired = new Date(config.timestamp).getTime() < caCertValidityFrom;
+            return {
+                valid: false,
+                configExpired,
+                caPubKey,
+                error: 'CA_PUBKEY_NOT_FOUND',
+            };
+        }
+        return {
+            valid: true,
+            caPubKey,
+            debugKey: isDebugRootPubKey,
+        };
+    }
+    if (!isDeviceCertValid) {
+        return {
+            valid: false,
+            caPubKey,
+            error: 'INVALID_DEVICE_CERTIFICATE',
+        };
+    }
+    return {
+        valid: false,
+        caPubKey,
+        error: 'INVALID_DEVICE_SIGNATURE',
+    };
+};
+exports.verifyAuthenticityProof = verifyAuthenticityProof;
+//# sourceMappingURL=verifyAuthenticityProof.js.map

package/lib/api/firmware/x509certificate.d.ts

@@ -0,0 +1,74 @@
+interface Asn1 {
+    cls: number;
+    tag: number;
+    structured: boolean;
+    byteLength: number;
+    contents: Uint8Array;
+    raw: Uint8Array;
+}
+export declare const fixSignature: (byteArray: Uint8Array) => Uint8Array;
+export declare const parseName: (asn1: Asn1) => {
+    asn1: Asn1;
+    algorithm: string;
+    parameters: {
+        asn1: Asn1;
+    } | null;
+}[];
+export declare const parseCertificate: (byteArray: Uint8Array) => {
+    asn1: Asn1;
+    tbsCertificate: {
+        asn1: Asn1;
+        version: Asn1;
+        serialNumber: Asn1;
+        signature: {
+            asn1: Asn1;
+            algorithm: string;
+            parameters: {
+                asn1: Asn1;
+            } | null;
+        };
+        issuer: Asn1;
+        validity: {
+            from: Date;
+            to: Date;
+        };
+        subject: {
+            asn1: Asn1;
+            algorithm: string;
+            parameters: {
+                asn1: Asn1;
+            } | null;
+        }[];
+        subjectPublicKeyInfo: {
+            asn1: Asn1;
+            algorithm: {
+                asn1: Asn1;
+                algorithm: string;
+                parameters: {
+                    asn1: Asn1;
+                } | null;
+            };
+            bits: {
+                unusedBits: number;
+                bytes: Uint8Array;
+            };
+        };
+        extensions: Asn1;
+    };
+    signatureAlgorithm: {
+        asn1: Asn1;
+        algorithm: string;
+        parameters: {
+            asn1: Asn1;
+        } | null;
+    };
+    signatureValue: {
+        asn1: Asn1;
+        bits: {
+            unusedBits: number;
+            bytes: Uint8Array;
+        };
+    };
+};
+export {};
+//# sourceMappingURL=x509certificate.d.ts.map