@trezor/connect 9.2.5-beta.2 → 9.3.1-beta.1

package/CHANGELOG.md

@@ -1,17 +1,87 @@
 |             Package              | Stable |    Canary    |
 | :------------------------------: | :----: | :----------: |
-|       npm @trezor/connect        | 9.2.4  | 9.2.5-beta.2 |
-|     npm @trezor/connect-web      | 9.2.4  | 9.2.5-beta.2 |
-| npm @trezor/connect-webextension | 9.2.4  | 9.2.5-beta.2 |
+|       npm @trezor/connect        | 9.3.0  | 9.3.1-beta.1 |
+|     npm @trezor/connect-web      | 9.3.0  | 9.3.1-beta.1 |
+| npm @trezor/connect-webextension | 9.3.0  | 9.3.1-beta.1 |
 
 |     Deployment     | Stable |    Canary    |
 | :----------------: | :----: | :----------: |
-| connect.trezor.io/ | 9.2.4  | 9.2.5-beta.2 |
+| connect.trezor.io/ | 9.3.0  | 9.3.1-beta.1 |
 
 Use the persistent link [connect.trezor.io/9](https://connect.trezor.io/9/) to access the latest stable version of Connect Explorer.
 
-# 9.2.5-beta.2
+# 9.3.1-beta.1
 
+We introduce a new init option `coreMode`, which allows websites to interact either using the existing `iframe` mode or the new `popup` mode. The `popup` mode is allows to use WebUSB even on third-party websites, which is not possible with the `iframe` mode. By default, the `coreMode` is set to `auto`, which means that the library will automatically choose the best mode based on the environment. More information can be found in [init method documentation](https://connect.trezor.io/9.3.1-beta.1/methods/other/init/).
+
+Remove support for legacy passphrase, users with Firmware version smaller than 1.0.9 and 2.3.0 will be requested to update in order to use @trezor/connect (7bb57cf)
+
+AuthenticateDevice verify CA cert extensions (4ba4445)
+
+Add support for T3B1 (f7f1705)
+
+    - chore(connect): Add Ambire Browser Extension to knownHosts (cbe81ab)
+    - chore(connect): remove ethereum-cryptography (18851d1)
+    - chore(connect): split public and internal settings type (3aab4ea)
+    - chore(connect): remove useCoreInPopup from explorer and tests (fee60c1)
+    - chore(connect): add new CA pubkeys and update timestamp (48ec951)
+    - chore(connect): refactoring of the CheckFirmwareAuthenticity to support local binary (and wont download it from web, when its available in the suite) (82ab513)
+    - docs(connect): describe coreMode (a5238d6)
+    - fix(connect): disallow interaction-less fw update when switching fw type (4936939)
+    - fix(connect): validate x509 asn1 component (bc13fe2)
+    - fix(connect): handle missing language binary (954dbb9)
+    - fix(connect): proceed with fw install even when language data fails to download (b40d1b7)
+    - test(connect): x509 extensions parser (163c82c)
+    - test(connect): update to min version fw 1.0.9 and 2.3.0 (544c311)
+
+## connect-ui
+
+    - remove bridge references, deeplink to suite desktop (98e98a4)
+
+## connect-plugin-stellar
+
+    - update stellar sdk (89cf20e)
+    - update trends libs (70b9c11)
+
+## connect-web
+
+    - default coreMode to auto (e45d47e)
+    - automatic fallback to core in popup (e4e1fcc)
+
+## connect-webextension
+
+    - link changelog to the one in connect (a02ec72)
+
+## connect-explorer
+
+    - applySettings optional values (0bcd83a)
+    - hide extra headings from toc in homepage (14f89c4)
+    - show success message in settings (0ca7c0c)
+    - remove MTT for firmwareUpdate (ebbe96c)
+    - bad styled-components prop (e2b7fc7)
+
+## connect-common
+
+    - add new fw 2.8.0 (314052b)
+    - fw version 1.9.0 and 2.3.0 required (ee623e4)
+
+# 9.3.0
+
+Improved reliability of popup handshake mechanism.
+Improved compatibility with webextensions using TrezorConnect inside offscreen (eg. Metamask).
+Cardano: support Conway certificates, increase minimum supported FW to 2.6.0 to clean up legacy code.
+Minor fixes in Connect Explorer and documentation.
+
+-   feat(connect): Add tag 258 support (90bf3a7)
+-   feat(connect): Conway certificates (ab003ce)
+-   feat(connect): applySettings - accept all validated params (65809d8)
+-   fix(connect): immediate switch from custom to default backend (b8348ca)
+-   fix(connect): remove getPublicKey coinInfo fallback (fb446f2)
+-   chore(connect): add new TS3 CA pubkeys and update timestamp (35486ba)
+-   chore(connect): update fw version number for cardano (d737d3c)
+-   chore(connect): center changelog version table (93fab15)
+-   chore(connect): change name in changelog table (bbc5499)
+-   chore(connect): remove canary from changelog
 -   fix(connect): race condition when closing and opening popup subsequently (e0e51c7)
 -   chore(connect): implement required descriptor.type (9ef657f)
 -   docs(connect): Explorer landing page update (7db29e9)
@@ -34,6 +104,7 @@ Use the persistent link [connect.trezor.io/9](https://connect.trezor.io/9/) to a
 -   some attributes were not passed trough the proxy (5cb6a26)
 -   MTT content max height (c8796b4)
 -   add links in changelog page (8dabb30)
+-   remove nextra reference from webextension, show amountUnit in signTransaction and fix favicon path
 
 ## connect-web
 
@@ -41,11 +112,17 @@ Use the persistent link [connect.trezor.io/9](https://connect.trezor.io/9/) to a
 -   refactor into classes (fc7a45b)
 -   core-in-popup mode (52891f3)
 -   passphrase missmatch resets the flow now (d55ff1c)
+-   close on popup cancellation, legacy mode for handshake
+-   check if chrome.tabs really available in webextension env
+
+## connect-iframe
+
+-   handshake handling issues
 
 ## connect-webextension
 
--   stop publishing Trezor connect webextension proxy since it is for Trezor internal testing with connect-explorer (5df3ae0)
--   use bundled build as package main (fff7eaf)
+-   stop publishing Trezor connect webextension proxy (5df3ae0)
+-   bundle content script to work properly with ES6 modules (fff7eaf)
 
 ## connect-examples
 
@@ -58,6 +135,10 @@ Use the persistent link [connect.trezor.io/9](https://connect.trezor.io/9/) to a
 -   update firmware binaries to 2.7.2 (6392328)
 -   T3T1 support (9d0adae)
 
+## connect-popup
+
+-   temporary workaround for CONTENT_SCRIPT_LOADED and handling of CONTENT_SCRIPT_LOADED
+
 ## connect-ui
 
 -   install bridge title align (19c5781)
@@ -66,65 +147,20 @@ Use the persistent link [connect.trezor.io/9](https://connect.trezor.io/9/) to a
 
 -   bump ws from 8.16.0 to 8.17.1 (bc5b787)
 
--   npm-release: @trezor/blockchain-link 2.1.31-beta.2
--   npm-release: @trezor/blockchain-link-utils 1.0.19-beta.1
--   npm-release: @trezor/blockchain-link-types 1.0.18-beta.2
--   npm-release: @trezor/type-utils 1.0.6-beta.1
--   npm-release: @trezor/connect-analytics 1.0.16-beta.1
--   npm-release: @trezor/analytics 1.0.18-beta.1
--   npm-release: @trezor/connect-common 0.0.34-beta.1
--   npm-release: @trezor/env-utils 1.0.18-beta.1
--   npm-release: @trezor/transport 1.1.30-beta.2
--   npm-release: @trezor/protobuf 1.0.14-beta.2
--   npm-release: @trezor/schema-utils 1.0.5-beta.1
--   npm-release: @trezor/protocol 1.0.10-beta.2
--   npm-release: @trezor/utxo-lib 2.0.11-beta.1
--   npm-release: @trezor/utils 9.0.25-beta.2
--   npm-release: @trezor/connect 9.2.5-beta.2
-
-# 9.2.5-beta.1
-
-Improved reliability of popup handshake mechanism.
-Improved compatibility with webextensions using TrezorConnect inside offscreen (eg. Metamask).
-Cardano: support Conway certificates, increase minimum supported FW to 2.6.0 to clean up legacy code.
-Minor fixes in Connect Explorer and documentation.
-
--   feat(connect): Add tag 258 support (90bf3a7)
--   feat(connect): Conway certificates (ab003ce)
--   feat(connect): applySettings - accept all validated params (65809d8)
--   fix(connect): immediate switch from custom to default backend (b8348ca)
--   fix(connect): remove getPublicKey coinInfo fallback (fb446f2)
--   chore(connect): add new TS3 CA pubkeys and update timestamp (35486ba)
--   chore(connect): update fw version number for cardano (d737d3c)
--   chore(connect): center changelog version table (93fab15)
--   chore(connect): change name in changelog table (bbc5499)
--   chore(connect): remove canary from changelog
-
-## connect-web
-
--   close on popup cancellation, legacy mode for handshake
--   check if chrome.tabs really available in webextension env
-
-## connect-iframe
-
--   handshake handling issues
-
-## connect-explorer
-
--   remove nextra reference from webextension, show amountUnit in signTransaction and fix favicon path
-
-## connect-popup
-
--   temporary workaround for CONTENT_SCRIPT_LOADED and handling of CONTENT_SCRIPT_LOADED
-
-## Dependencies update
-
--   npm-release: @trezor/blockchain-link 2.1.31-beta.1
--   npm-release: @trezor/blockchain-link-types 1.0.18-beta.1
--   npm-release: @trezor/transport 1.1.30-beta.1
--   npm-release: @trezor/protobuf 1.0.14-beta.1
--   npm-release: @trezor/protocol 1.0.10-beta.1
--   npm-release: @trezor/utils 9.0.25-beta.1
+-   npm-release: @trezor/blockchain-link 2.2.0
+-   npm-release: @trezor/blockchain-link-utils 1.1.0
+-   npm-release: @trezor/blockchain-link-types 1.1.0
+-   npm-release: @trezor/type-utils 1.1.0
+-   npm-release: @trezor/connect-analytics 1.1.0
+-   npm-release: @trezor/analytics 1.1.0
+-   npm-release: @trezor/connect-common 0.1.0
+-   npm-release: @trezor/env-utils 1.1.0
+-   npm-release: @trezor/transport 1.2.0
+-   npm-release: @trezor/protobuf 1.1.0
+-   npm-release: @trezor/schema-utils 1.1.0
+-   npm-release: @trezor/protocol 1.1.0
+-   npm-release: @trezor/utxo-lib 2.1.0
+-   npm-release: @trezor/utils 9.1.0
 
 # 9.2.4
 

package/README.md

@@ -1,6 +1,6 @@
 # @trezor/connect
 
-API version 9.2.5-beta.2
+API version 9.3.1-beta.1
 
 [![Build Status](https://github.com/trezor/trezor-suite/actions/workflows/test-connect.yml/badge.svg)](https://github.com/trezor/trezor-suite/actions/workflows/test-connect.yml)
 [![NPM](https://img.shields.io/npm/v/@trezor/connect.svg)](https://www.npmjs.org/package/@trezor/connect)

package/lib/api/checkFirmwareAuthenticity.d.ts

@@ -1,5 +1,6 @@
 import { AbstractMethod } from '../core/AbstractMethod';
-export default class CheckFirmwareAuthenticity extends AbstractMethod<'checkFirmwareAuthenticity'> {
+import { CheckFirmwareAuthenticityParams } from '../types/api/checkFirmwareAuthenticity';
+export default class CheckFirmwareAuthenticity extends AbstractMethod<'checkFirmwareAuthenticity', CheckFirmwareAuthenticityParams> {
     init(): void;
     run(): Promise<{
         expectedFirmwareHash: string;

package/lib/api/checkFirmwareAuthenticity.js

@@ -5,43 +5,51 @@ const AbstractMethod_1 = require("../core/AbstractMethod");
 const firmware_1 = require("./firmware");
 const firmwareInfo_1 = require("../data/firmwareInfo");
 const constants_1 = require("../constants");
-const assets_1 = require("../utils/assets");
 const types_1 = require("../types");
+const paramsValidator_1 = require("./common/paramsValidator");
 class CheckFirmwareAuthenticity extends AbstractMethod_1.AbstractMethod {
     init() {
         this.useEmptyPassphrase = true;
         this.requiredPermissions = ['management'];
         this.useDeviceState = false;
+        const { payload } = this;
+        (0, paramsValidator_1.validateParams)(payload, [{ name: 'baseUrl', type: 'string' }]);
+        this.params = { baseUrl: payload.baseUrl };
     }
     async run() {
-        var _a;
+        var _a, _b;
         const { device } = this;
-        const firmwareVersion = `${device.features.major_version}.${device.features.minor_version}.${device.features.patch_version}`;
-        const releases = (0, firmwareInfo_1.getReleases)((_a = device.features) === null || _a === void 0 ? void 0 : _a.internal_model);
-        const release = releases.find(release => release.version.join('.') === firmwareVersion);
-        if (!release) {
-            throw constants_1.ERRORS.TypedError('Runtime', 'checkFirmwareAuthenticity: No release found for device firmware');
+        if (!device.firmwareRelease) {
+            throw constants_1.ERRORS.TypedError('Runtime', 'device.firmwareRelease is not set');
         }
-        const deviceModelPath = `${device.features.internal_model}`.toLowerCase();
-        const baseUrl = `https://data.trezor.io/firmware/${deviceModelPath}`;
-        const fwUrl = `${baseUrl}/trezor-${deviceModelPath}-${firmwareVersion}${device.firmwareType === types_1.FirmwareType.BitcoinOnly ? '-bitcoinonly.bin' : '.bin'}`;
-        const fw = await (0, assets_1.httpRequest)(fwUrl, 'binary');
-        if (!fw) {
-            throw constants_1.ERRORS.TypedError('Runtime', 'checkFirmwareAuthenticity: firmware binary not found');
+        const btcOnly = device.firmwareType === types_1.FirmwareType.BitcoinOnly;
+        try {
+            const fw = await (0, firmware_1.getBinary)({
+                releases: (0, firmwareInfo_1.getReleases)((_a = device.features) === null || _a === void 0 ? void 0 : _a.internal_model),
+                baseUrl: (_b = this.params.baseUrl) !== null && _b !== void 0 ? _b : 'https://data.trezor.io',
+                version: device.getVersion(),
+                btcOnly,
+            });
+            if (!fw) {
+                throw constants_1.ERRORS.TypedError('Runtime', 'checkFirmwareAuthenticity: firmware binary not found');
+            }
+            const { hash: expectedFirmwareHash, challenge } = (0, firmware_1.calculateFirmwareHash)(device.features.major_version, (0, firmware_1.stripFwHeaders)(fw), (0, crypto_1.randomBytes)(32));
+            const result = await this.device
+                .getCommands()
+                .typedCall('GetFirmwareHash', 'FirmwareHash', {
+                challenge,
+            });
+            const { message } = result;
+            const { hash: actualFirmwareHash } = message;
+            return {
+                expectedFirmwareHash,
+                actualFirmwareHash,
+                valid: actualFirmwareHash === expectedFirmwareHash,
+            };
+        }
+        catch (e) {
+            throw constants_1.ERRORS.TypedError('Runtime', `${e}`);
         }
-        const { hash: expectedFirmwareHash, challenge } = (0, firmware_1.calculateFirmwareHash)(device.features.major_version, (0, firmware_1.stripFwHeaders)(fw), (0, crypto_1.randomBytes)(32));
-        const result = await this.device
-            .getCommands()
-            .typedCall('GetFirmwareHash', 'FirmwareHash', {
-            challenge,
-        });
-        const { message } = result;
-        const { hash: actualFirmwareHash } = message;
-        return {
-            expectedFirmwareHash,
-            actualFirmwareHash,
-            valid: actualFirmwareHash === expectedFirmwareHash,
-        };
     }
 }
 exports.default = CheckFirmwareAuthenticity;

package/lib/api/ethereum/api/ethereumSignTypedData.d.ts

@@ -60,6 +60,7 @@ declare const Params: import("@sinclair/typebox").TIntersect<[import("@sinclair/
             T1B1: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TLiteral<false>]>;
             T2T1: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TLiteral<false>]>;
             T2B1: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TLiteral<false>]>;
+            T3B1: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TLiteral<false>]>;
             T3T1: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TLiteral<false>]>;
             connect: import("@sinclair/typebox").TBoolean;
         }>;

package/lib/api/ethereum/ethereumDefinitions.js

@@ -102,6 +102,7 @@ const ethereumNetworkInfoFromDefinition = (definition) => ({
         T1B1: '1.6.2',
         T2T1: '2.0.7',
         T2B1: '2.6.1',
+        T3B1: '2.8.1',
         T3T1: '2.7.1',
     },
     blockchainLink: undefined,

package/lib/api/firmware/getBinary.d.ts

@@ -1,11 +1,11 @@
-import { GetInfoProps } from '../../data/firmwareInfo';
-import { IntermediaryVersion } from '../../types';
-interface GetBinaryProps extends GetInfoProps {
+import { FirmwareRelease, IntermediaryVersion } from '../../types';
+interface GetBinaryProps {
     baseUrl: string;
     btcOnly?: boolean;
     version?: number[];
     intermediaryVersion?: IntermediaryVersion;
+    releases: FirmwareRelease[];
 }
-export declare const getBinary: ({ features, releases, baseUrl, version, btcOnly, intermediaryVersion, }: GetBinaryProps) => Promise<ArrayBuffer>;
+export declare const getBinary: ({ releases, baseUrl, version, btcOnly, intermediaryVersion, }: GetBinaryProps) => Promise<ArrayBuffer>;
 export {};
 //# sourceMappingURL=getBinary.d.ts.map

package/lib/api/firmware/getBinary.js

@@ -3,30 +3,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getBinary = void 0;
 const utils_1 = require("@trezor/utils");
 const assets_1 = require("../../utils/assets");
-const firmwareUtils_1 = require("../../utils/firmwareUtils");
-const firmwareInfo_1 = require("../../data/firmwareInfo");
-const getBinary = ({ features, releases, baseUrl, version, btcOnly, intermediaryVersion, }) => {
-    if (!(0, firmwareUtils_1.isStrictFeatures)(features)) {
-        throw new Error('Features of unexpected shape provided');
-    }
+const getBinary = ({ releases, baseUrl, version, btcOnly, intermediaryVersion, }) => {
     if (intermediaryVersion) {
         return (0, assets_1.httpRequest)(`${baseUrl}/firmware/t1b1/trezor-t1b1-inter-v${intermediaryVersion}.bin`, 'binary');
     }
-    const infoByBootloader = (0, firmwareInfo_1.getInfo)({ features, releases });
     const releaseByFirmware = releases.find(r => version &&
         utils_1.versionUtils.isVersionArray(version) &&
         utils_1.versionUtils.isEqual(r.version, version));
-    if (!infoByBootloader || !releaseByFirmware) {
+    if (releaseByFirmware === undefined) {
         throw new Error('no firmware found for this device');
     }
-    if (btcOnly && !releaseByFirmware.url_bitcoinonly) {
-        throw new Error(`firmware version ${version} does not exist in btc only variant`);
-    }
-    if (!utils_1.versionUtils.isEqual(releaseByFirmware.version, infoByBootloader.release.version)) {
-        throw new Error('version provided as param does not match firmware version found by features in bootloader');
-    }
     const fwUrl = releaseByFirmware[btcOnly ? 'url_bitcoinonly' : 'url'];
-    return (0, assets_1.httpRequest)(`${baseUrl}/${fwUrl}`, 'binary');
+    const url = `${baseUrl}/${fwUrl}`;
+    return (0, assets_1.httpRequest)(url, 'binary');
 };
 exports.getBinary = getBinary;
 //# sourceMappingURL=getBinary.js.map

package/lib/api/firmware/getBinaryForFirmwareUpgrade.d.ts

@@ -0,0 +1,11 @@
+import { GetInfoProps } from '../../data/firmwareInfo';
+import { IntermediaryVersion } from '../../types';
+interface GetBinaryForFirmwareUpgradeProps extends GetInfoProps {
+    baseUrl: string;
+    btcOnly?: boolean;
+    version?: number[];
+    intermediaryVersion?: IntermediaryVersion;
+}
+export declare const getBinaryForFirmwareUpgrade: ({ features, releases, baseUrl, version, btcOnly, intermediaryVersion, }: GetBinaryForFirmwareUpgradeProps) => Promise<ArrayBuffer>;
+export {};
+//# sourceMappingURL=getBinaryForFirmwareUpgrade.d.ts.map

package/lib/api/firmware/getBinaryForFirmwareUpgrade.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBinaryForFirmwareUpgrade = void 0;
+const utils_1 = require("@trezor/utils");
+const assets_1 = require("../../utils/assets");
+const firmwareUtils_1 = require("../../utils/firmwareUtils");
+const firmwareInfo_1 = require("../../data/firmwareInfo");
+const getBinary_1 = require("./getBinary");
+const getBinaryForFirmwareUpgrade = ({ features, releases, baseUrl, version, btcOnly, intermediaryVersion, }) => {
+    if (!(0, firmwareUtils_1.isStrictFeatures)(features)) {
+        throw new Error('Features of unexpected shape provided');
+    }
+    if (intermediaryVersion) {
+        return (0, assets_1.httpRequest)(`${baseUrl}/firmware/t1b1/trezor-t1b1-inter-v${intermediaryVersion}.bin`, 'binary');
+    }
+    const infoByBootloader = (0, firmwareInfo_1.getInfo)({ features, releases });
+    const releaseByFirmware = releases.find(r => version &&
+        utils_1.versionUtils.isVersionArray(version) &&
+        utils_1.versionUtils.isEqual(r.version, version));
+    if (!infoByBootloader || !releaseByFirmware) {
+        throw new Error('no firmware found for this device');
+    }
+    if (btcOnly && !releaseByFirmware.url_bitcoinonly) {
+        throw new Error(`firmware version ${version} does not exist in btc only variant`);
+    }
+    if (!utils_1.versionUtils.isEqual(releaseByFirmware.version, infoByBootloader.release.version)) {
+        throw new Error(`version provided as param (${releaseByFirmware.version}) does not match firmware version found by features in bootloader (${infoByBootloader.release.version})`);
+    }
+    return (0, getBinary_1.getBinary)({ releases, baseUrl, version, btcOnly, intermediaryVersion });
+};
+exports.getBinaryForFirmwareUpgrade = getBinaryForFirmwareUpgrade;
+//# sourceMappingURL=getBinaryForFirmwareUpgrade.js.map

package/lib/api/firmware/index.d.ts

@@ -1,3 +1,4 @@
+export { getBinaryForFirmwareUpgrade } from './getBinaryForFirmwareUpgrade';
 export { getBinary } from './getBinary';
 export { getLanguage } from '../../data/getLanguage';
 export { shouldStripFwHeaders, stripFwHeaders } from './modifyFirmware';

package/lib/api/firmware/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseFirmwareHeaders = exports.calculateFirmwareHash = exports.uploadFirmware = exports.stripFwHeaders = exports.shouldStripFwHeaders = exports.getLanguage = exports.getBinary = void 0;
+exports.parseFirmwareHeaders = exports.calculateFirmwareHash = exports.uploadFirmware = exports.stripFwHeaders = exports.shouldStripFwHeaders = exports.getLanguage = exports.getBinary = exports.getBinaryForFirmwareUpgrade = void 0;
+var getBinaryForFirmwareUpgrade_1 = require("./getBinaryForFirmwareUpgrade");
+Object.defineProperty(exports, "getBinaryForFirmwareUpgrade", { enumerable: true, get: function () { return getBinaryForFirmwareUpgrade_1.getBinaryForFirmwareUpgrade; } });
 var getBinary_1 = require("./getBinary");
 Object.defineProperty(exports, "getBinary", { enumerable: true, get: function () { return getBinary_1.getBinary; } });
 var getLanguage_1 = require("../../data/getLanguage");

package/lib/api/firmware/verifyAuthenticityProof.d.ts

@@ -1,7 +1,7 @@
 /// <reference types="node" />
 import { PROTO } from '../../constants';
-import { DeviceAuthenticityConfig } from '../../data/deviceAuthenticityConfig';
 import { AuthenticateDeviceResult } from '../../types/api/authenticateDevice';
+import { DeviceAuthenticityConfig } from '../../data/deviceAuthenticityConfigTypes';
 interface AuthenticityProofData extends PROTO.AuthenticityProof {
     challenge: Buffer;
     config: DeviceAuthenticityConfig;

package/lib/api/firmware/verifyAuthenticityProof.js

@@ -19,15 +19,50 @@ const verifySignature = async (rawKey, data, signature) => {
 };
 const getRandomChallenge = () => crypto.randomBytes(32);
 exports.getRandomChallenge = getRandomChallenge;
+const validateCaCertExtensions = (cert, pathLen) => {
+    let hasKeyUsage, hasBasicConstraints = false;
+    cert.tbsCertificate.extensions.forEach(ext => {
+        if (ext.key === 'keyUsage') {
+            if (ext.keyCertSign !== '1') {
+                throw new Error(`CA keyCertSign not set`);
+            }
+            hasKeyUsage = true;
+        }
+        else if (ext.key === 'basicConstraints') {
+            if (!ext.cA) {
+                throw new Error(`CA basicConstraints.cA not set`);
+            }
+            if (typeof ext.pathLenConstraint != 'number') {
+                throw new Error('CA basicConstraints.pathLenConstraint not set');
+            }
+            if (ext.pathLenConstraint < pathLen) {
+                throw new Error('Issuer was not permitted to issue certificate');
+            }
+            hasBasicConstraints = true;
+        }
+        else if (ext.critical) {
+            throw new Error(`Unknown critical extension ${ext.key} in CA certificate`);
+        }
+    });
+    if (!hasKeyUsage || !hasBasicConstraints) {
+        throw new Error(`CA missing extensions keyUsage: ${hasKeyUsage}, basicConstraints: ${hasBasicConstraints}`);
+    }
+};
 const verifyAuthenticityProof = async ({ certificates, signature, challenge, config, allowDebugKeys, deviceModel, }) => {
     const modelConfig = config[deviceModel];
     if (!modelConfig) {
         throw new Error(`Pubkeys for ${deviceModel} not found in config`);
     }
     const { caPubKeys, debug } = modelConfig;
-    const caCert = (0, x509certificate_1.parseCertificate)(new Uint8Array(Buffer.from(certificates[1], 'hex')));
+    const [deviceCert, caCert] = certificates.map((c, i) => {
+        const cert = (0, x509certificate_1.parseCertificate)(new Uint8Array(Buffer.from(c, 'hex')));
+        if (i === 0) {
+            return cert;
+        }
+        validateCaCertExtensions(cert, i - 1);
+        return cert;
+    });
     const caPubKey = Buffer.from(caCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes).toString('hex');
-    const deviceCert = (0, x509certificate_1.parseCertificate)(new Uint8Array(Buffer.from(certificates[0], 'hex')));
     const rootPubKeys = allowDebugKeys
         ? modelConfig.rootPubKeys.concat((debug === null || debug === void 0 ? void 0 : debug.rootPubKeys) || [])
         : modelConfig.rootPubKeys;

package/lib/api/firmware/x509certificate.d.ts

@@ -6,10 +6,24 @@ interface Asn1 {
     contents: Uint8Array;
     raw: Uint8Array;
 }
+type Oid = `${number}.${number}.${number}.${number}`;
+type Extension = {
+    key: 'keyUsage';
+    critical?: boolean;
+    keyCertSign: '0' | '1';
+} | {
+    key: 'basicConstraints';
+    critical?: boolean;
+    cA: boolean;
+    pathLenConstraint?: number;
+} | (Asn1 & {
+    key: Oid;
+    critical?: boolean;
+});
 export declare const fixSignature: (byteArray: Uint8Array) => Uint8Array;
 export declare const parseName: (asn1: Asn1) => {
     asn1: Asn1;
-    algorithm: string;
+    algorithm: `${number}.${number}.${number}.${number}`;
     parameters: {
         asn1: Asn1;
     } | null;
@@ -22,7 +36,7 @@ export declare const parseCertificate: (byteArray: Uint8Array) => {
         serialNumber: Asn1;
         signature: {
             asn1: Asn1;
-            algorithm: string;
+            algorithm: `${number}.${number}.${number}.${number}`;
             parameters: {
                 asn1: Asn1;
             } | null;
@@ -34,7 +48,7 @@ export declare const parseCertificate: (byteArray: Uint8Array) => {
         };
         subject: {
             asn1: Asn1;
-            algorithm: string;
+            algorithm: `${number}.${number}.${number}.${number}`;
             parameters: {
                 asn1: Asn1;
             } | null;
@@ -43,7 +57,7 @@ export declare const parseCertificate: (byteArray: Uint8Array) => {
             asn1: Asn1;
             algorithm: {
                 asn1: Asn1;
-                algorithm: string;
+                algorithm: `${number}.${number}.${number}.${number}`;
                 parameters: {
                     asn1: Asn1;
                 } | null;
@@ -53,11 +67,11 @@ export declare const parseCertificate: (byteArray: Uint8Array) => {
                 bytes: Uint8Array;
             };
         };
-        extensions: Asn1;
+        extensions: Extension[];
     };
     signatureAlgorithm: {
         asn1: Asn1;
-        algorithm: string;
+        algorithm: `${number}.${number}.${number}.${number}`;
         parameters: {
             asn1: Asn1;
         } | null;