@trezor/connect 9.3.0 → 9.3.1-beta.2

package/CHANGELOG.md

@@ -1,15 +1,128 @@
-|             Package              | Stable | Canary |
-| :------------------------------: | :----: | :----: |
-|       npm @trezor/connect        | 9.3.0  |   -    |
-|     npm @trezor/connect-web      | 9.3.0  |   -    |
-| npm @trezor/connect-webextension | 9.3.0  |   -    |
+|             Package              | Stable |    Canary    |
+| :------------------------------: | :----: | :----------: |
+|       npm @trezor/connect        | 9.3.0  | 9.3.1-beta.2 |
+|     npm @trezor/connect-web      | 9.3.0  | 9.3.1-beta.2 |
+| npm @trezor/connect-webextension | 9.3.0  | 9.3.1-beta.2 |
 
-|     Deployment     | Stable | Canary |
-| :----------------: | :----: | :----: |
-| connect.trezor.io/ | 9.3.0  |   -    |
+|     Deployment     | Stable |    Canary    |
+| :----------------: | :----: | :----------: |
+| connect.trezor.io/ | 9.3.0  | 9.3.1-beta.2 |
 
 Use the persistent link [connect.trezor.io/9](https://connect.trezor.io/9/) to access the latest stable version of Connect Explorer.
 
+# 9.3.1-beta.2
+
+-   refactor(connect): removed initDeviceList, move transportReconnect inside DeviceList, make DeviceList reusable, device list constructor not throwing, singleton-like DeviceList, separate onTransportUpdate, pendingTransportEvent improved, improve DeviceList init flow (f4b3694, 02215de, b53259b, e8c6c25, e395dc8, 6509e5c, 3e30d64, d173966, 50cbbea, 1a81d89, 4780c51, 75bfe75, 83c0cb3, 73261c8, f2167bf, bb7dfee)
+-   fix(connect): correctly wait for device selection in case of overriding (0c7a3bd)
+-   fix(connect): Fork old PassphraseTypeCard to connect (155afda)
+-   fix(connect): longer timeout for getFeatures due to suite-native performance issue (0910ab7)
+-   fix(connect): handle malformed EIP-712 data (d111006)
+-   fix(connect): remove superfluous space from error message (81be584)
+-   fix(connect): correctly await transport.receive (31c8519)
+-   fix(connect): proper pendingTransportEvent waiting (baa4144)
+-   chore(connect): add a comment to legacy code (a23a365)
+
+## connect-web
+
+-   don't fallback to core in popup with no webusb (7120e83)
+-   clean up in popupmanager when useUi=false (9bc2ea9)
+
+## connect-popup
+
+-   add missing device icons (9fdd1d7)
+
+## connect-webextension
+
+-   Allow multiple content script extension conflicts (348b32a)
+
+## connect-explorer
+
+-   wrong default coreMode in settings (3a81f14)
+-   don't validate connectSrc in webextension (8737d47)
+-   add link to new webextension example (86a13b1)
+
+## Dependencies update
+
+-   bump react-intl from 6.6.2 to 6.6.8
+-   bump @types/chrome from 0.0.260 to 0.0.269
+-   bump playwright from 1.41.2 to 1.45.3
+-   bump webpack-merge from 5.10.0 to 6.0.1
+-   bump webpack-dev-server from 4.15.1 to 5.0.4
+-   bump @babel/preset-typescript from 7.23.3 to 7.24.7
+-   bump @babel/preset-react from 7.23.3 to 7.24.7
+-   bump webpack from 5.90.1 to 5.93.0
+-   bump rimraf from 5.0.5 to 6.0.1
+-   bump txs from 4.7.0 to 4.16.2
+
+-   npm-prerelease: @trezor/blockchain-link 2.2.1-beta.2
+-   npm-prerelease: @trezor/blockchain-link-utils 1.1.1-beta.2
+-   npm-prerelease: @trezor/blockchain-link-types 1.1.1-beta.2
+-   npm-prerelease: @trezor/analytics 1.1.1-beta.1
+-   npm-prerelease: @trezor/connect-common 0.1.1-beta.2
+-   npm-prerelease: @trezor/env-utils 1.1.1-beta.1
+-   npm-prerelease: @trezor/transport 1.2.1-beta.2
+-   npm-prerelease: @trezor/protobuf 1.1.1-beta.2
+-   npm-prerelease: @trezor/schema-utils 1.1.1-beta.1
+-   npm-prerelease: @trezor/protocol 1.1.1-beta.1
+-   npm-prerelease: @trezor/utxo-lib 2.1.1-beta.1
+-   npm-prerelease: @trezor/utils 9.1.1-beta.2
+-   npm-release: @trezor/connect 9.3.1-beta.2
+
+# 9.3.1-beta.1
+
+We introduce a new init option `coreMode`, which allows websites to interact either using the existing `iframe` mode or the new `popup` mode. The `popup` mode is allows to use WebUSB even on third-party websites, which is not possible with the `iframe` mode. By default, the `coreMode` is set to `auto`, which means that the library will automatically choose the best mode based on the environment. More information can be found in [init method documentation](https://connect.trezor.io/9.3.1-beta.1/methods/other/init/).
+
+Remove support for legacy passphrase, users with Firmware version smaller than 1.0.9 and 2.3.0 will be requested to update in order to use @trezor/connect (7bb57cf)
+
+AuthenticateDevice verify CA cert extensions (4ba4445)
+
+Add support for T3B1 (f7f1705)
+
+-   chore(connect): Add Ambire Browser Extension to knownHosts (cbe81ab)
+-   chore(connect): remove ethereum-cryptography (18851d1)
+-   chore(connect): split public and internal settings type (3aab4ea)
+-   chore(connect): remove useCoreInPopup from explorer and tests (fee60c1)
+-   chore(connect): add new CA pubkeys and update timestamp (48ec951)
+-   chore(connect): refactoring of the CheckFirmwareAuthenticity to support local binary (and wont download it from web, when its available in the suite) (82ab513)
+-   docs(connect): describe coreMode (a5238d6)
+-   fix(connect): disallow interaction-less fw update when switching fw type (4936939)
+-   fix(connect): validate x509 asn1 component (bc13fe2)
+-   fix(connect): handle missing language binary (954dbb9)
+-   fix(connect): proceed with fw install even when language data fails to download (b40d1b7)
+-   test(connect): x509 extensions parser (163c82c)
+-   test(connect): update to min version fw 1.0.9 and 2.3.0 (544c311)
+
+## connect-ui
+
+-   remove bridge references, deeplink to suite desktop (98e98a4)
+
+## connect-plugin-stellar
+
+-   update stellar sdk (89cf20e)
+-   update trends libs (70b9c11)
+
+## connect-web
+
+-   default coreMode to auto (e45d47e)
+-   automatic fallback to core in popup (e4e1fcc)
+
+## connect-webextension
+
+-   link changelog to the one in connect (a02ec72)
+
+## connect-explorer
+
+-   applySettings optional values (0bcd83a)
+-   hide extra headings from toc in homepage (14f89c4)
+-   show success message in settings (0ca7c0c)
+-   remove MTT for firmwareUpdate (ebbe96c)
+-   bad styled-components prop (e2b7fc7)
+
+## connect-common
+
+-   add new fw 2.8.0 (314052b)
+-   fw version 1.9.0 and 2.3.0 required (ee623e4)
+
 # 9.3.0
 
 Improved reliability of popup handshake mechanism.

package/README.md

@@ -1,6 +1,6 @@
 # @trezor/connect
 
-API version 9.3.0
+API version 9.3.1-beta.2
 
 [![Build Status](https://github.com/trezor/trezor-suite/actions/workflows/test-connect.yml/badge.svg)](https://github.com/trezor/trezor-suite/actions/workflows/test-connect.yml)
 [![NPM](https://img.shields.io/npm/v/@trezor/connect.svg)](https://www.npmjs.org/package/@trezor/connect)

package/lib/api/checkFirmwareAuthenticity.d.ts

@@ -1,5 +1,6 @@
 import { AbstractMethod } from '../core/AbstractMethod';
-export default class CheckFirmwareAuthenticity extends AbstractMethod<'checkFirmwareAuthenticity'> {
+import { CheckFirmwareAuthenticityParams } from '../types/api/checkFirmwareAuthenticity';
+export default class CheckFirmwareAuthenticity extends AbstractMethod<'checkFirmwareAuthenticity', CheckFirmwareAuthenticityParams> {
     init(): void;
     run(): Promise<{
         expectedFirmwareHash: string;

package/lib/api/checkFirmwareAuthenticity.js

@@ -5,43 +5,51 @@ const AbstractMethod_1 = require("../core/AbstractMethod");
 const firmware_1 = require("./firmware");
 const firmwareInfo_1 = require("../data/firmwareInfo");
 const constants_1 = require("../constants");
-const assets_1 = require("../utils/assets");
 const types_1 = require("../types");
+const paramsValidator_1 = require("./common/paramsValidator");
 class CheckFirmwareAuthenticity extends AbstractMethod_1.AbstractMethod {
     init() {
         this.useEmptyPassphrase = true;
         this.requiredPermissions = ['management'];
         this.useDeviceState = false;
+        const { payload } = this;
+        (0, paramsValidator_1.validateParams)(payload, [{ name: 'baseUrl', type: 'string' }]);
+        this.params = { baseUrl: payload.baseUrl };
     }
     async run() {
-        var _a;
+        var _a, _b;
         const { device } = this;
-        const firmwareVersion = `${device.features.major_version}.${device.features.minor_version}.${device.features.patch_version}`;
-        const releases = (0, firmwareInfo_1.getReleases)((_a = device.features) === null || _a === void 0 ? void 0 : _a.internal_model);
-        const release = releases.find(release => release.version.join('.') === firmwareVersion);
-        if (!release) {
-            throw constants_1.ERRORS.TypedError('Runtime', 'checkFirmwareAuthenticity: No release found for device firmware');
+        if (!device.firmwareRelease) {
+            throw constants_1.ERRORS.TypedError('Runtime', 'device.firmwareRelease is not set');
         }
-        const deviceModelPath = `${device.features.internal_model}`.toLowerCase();
-        const baseUrl = `https://data.trezor.io/firmware/${deviceModelPath}`;
-        const fwUrl = `${baseUrl}/trezor-${deviceModelPath}-${firmwareVersion}${device.firmwareType === types_1.FirmwareType.BitcoinOnly ? '-bitcoinonly.bin' : '.bin'}`;
-        const fw = await (0, assets_1.httpRequest)(fwUrl, 'binary');
-        if (!fw) {
-            throw constants_1.ERRORS.TypedError('Runtime', 'checkFirmwareAuthenticity: firmware binary not found');
+        const btcOnly = device.firmwareType === types_1.FirmwareType.BitcoinOnly;
+        try {
+            const fw = await (0, firmware_1.getBinary)({
+                releases: (0, firmwareInfo_1.getReleases)((_a = device.features) === null || _a === void 0 ? void 0 : _a.internal_model),
+                baseUrl: (_b = this.params.baseUrl) !== null && _b !== void 0 ? _b : 'https://data.trezor.io',
+                version: device.getVersion(),
+                btcOnly,
+            });
+            if (!fw) {
+                throw constants_1.ERRORS.TypedError('Runtime', 'checkFirmwareAuthenticity: firmware binary not found');
+            }
+            const { hash: expectedFirmwareHash, challenge } = (0, firmware_1.calculateFirmwareHash)(device.features.major_version, (0, firmware_1.stripFwHeaders)(fw), (0, crypto_1.randomBytes)(32));
+            const result = await this.device
+                .getCommands()
+                .typedCall('GetFirmwareHash', 'FirmwareHash', {
+                challenge,
+            });
+            const { message } = result;
+            const { hash: actualFirmwareHash } = message;
+            return {
+                expectedFirmwareHash,
+                actualFirmwareHash,
+                valid: actualFirmwareHash === expectedFirmwareHash,
+            };
+        }
+        catch (e) {
+            throw constants_1.ERRORS.TypedError('Runtime', `${e}`);
         }
-        const { hash: expectedFirmwareHash, challenge } = (0, firmware_1.calculateFirmwareHash)(device.features.major_version, (0, firmware_1.stripFwHeaders)(fw), (0, crypto_1.randomBytes)(32));
-        const result = await this.device
-            .getCommands()
-            .typedCall('GetFirmwareHash', 'FirmwareHash', {
-            challenge,
-        });
-        const { message } = result;
-        const { hash: actualFirmwareHash } = message;
-        return {
-            expectedFirmwareHash,
-            actualFirmwareHash,
-            valid: actualFirmwareHash === expectedFirmwareHash,
-        };
     }
 }
 exports.default = CheckFirmwareAuthenticity;

package/lib/api/ethereum/api/ethereumSignTypedData.d.ts

@@ -60,6 +60,7 @@ declare const Params: import("@sinclair/typebox").TIntersect<[import("@sinclair/
             T1B1: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TLiteral<false>]>;
             T2T1: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TLiteral<false>]>;
             T2B1: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TLiteral<false>]>;
+            T3B1: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TLiteral<false>]>;
             T3T1: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TLiteral<false>]>;
             connect: import("@sinclair/typebox").TBoolean;
         }>;

package/lib/api/ethereum/api/ethereumSignTypedData.js

@@ -150,7 +150,9 @@ class EthereumSignTypedData extends AbstractMethod_1.AbstractMethod {
                     memberTypeName = memberTypeDefinition.type;
                     memberData = memberData[memberTypeDefinition.name];
                 }
-                else {
+                if (memberData === null || memberData === undefined) {
+                    cmd.typedCall('Cancel', 'Success');
+                    throw constants_1.ERRORS.TypedError('Runtime', `Value from member path ${member_path} is missing in the data object`);
                 }
             }
             let encodedData;

package/lib/api/ethereum/ethereumDefinitions.js

@@ -102,6 +102,7 @@ const ethereumNetworkInfoFromDefinition = (definition) => ({
         T1B1: '1.6.2',
         T2T1: '2.0.7',
         T2B1: '2.6.1',
+        T3B1: '2.8.1',
         T3T1: '2.7.1',
     },
     blockchainLink: undefined,

package/lib/api/firmware/getBinary.d.ts

@@ -1,11 +1,11 @@
-import { GetInfoProps } from '../../data/firmwareInfo';
-import { IntermediaryVersion } from '../../types';
-interface GetBinaryProps extends GetInfoProps {
+import { FirmwareRelease, IntermediaryVersion } from '../../types';
+interface GetBinaryProps {
     baseUrl: string;
     btcOnly?: boolean;
     version?: number[];
     intermediaryVersion?: IntermediaryVersion;
+    releases: FirmwareRelease[];
 }
-export declare const getBinary: ({ features, releases, baseUrl, version, btcOnly, intermediaryVersion, }: GetBinaryProps) => Promise<ArrayBuffer>;
+export declare const getBinary: ({ releases, baseUrl, version, btcOnly, intermediaryVersion, }: GetBinaryProps) => Promise<ArrayBuffer>;
 export {};
 //# sourceMappingURL=getBinary.d.ts.map

package/lib/api/firmware/getBinary.js

@@ -3,30 +3,19 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.getBinary = void 0;
 const utils_1 = require("@trezor/utils");
 const assets_1 = require("../../utils/assets");
-const firmwareUtils_1 = require("../../utils/firmwareUtils");
-const firmwareInfo_1 = require("../../data/firmwareInfo");
-const getBinary = ({ features, releases, baseUrl, version, btcOnly, intermediaryVersion, }) => {
-    if (!(0, firmwareUtils_1.isStrictFeatures)(features)) {
-        throw new Error('Features of unexpected shape provided');
-    }
+const getBinary = ({ releases, baseUrl, version, btcOnly, intermediaryVersion, }) => {
     if (intermediaryVersion) {
         return (0, assets_1.httpRequest)(`${baseUrl}/firmware/t1b1/trezor-t1b1-inter-v${intermediaryVersion}.bin`, 'binary');
     }
-    const infoByBootloader = (0, firmwareInfo_1.getInfo)({ features, releases });
     const releaseByFirmware = releases.find(r => version &&
         utils_1.versionUtils.isVersionArray(version) &&
         utils_1.versionUtils.isEqual(r.version, version));
-    if (!infoByBootloader || !releaseByFirmware) {
+    if (releaseByFirmware === undefined) {
         throw new Error('no firmware found for this device');
     }
-    if (btcOnly && !releaseByFirmware.url_bitcoinonly) {
-        throw new Error(`firmware version ${version} does not exist in btc only variant`);
-    }
-    if (!utils_1.versionUtils.isEqual(releaseByFirmware.version, infoByBootloader.release.version)) {
-        throw new Error('version provided as param does not match firmware version found by features in bootloader');
-    }
     const fwUrl = releaseByFirmware[btcOnly ? 'url_bitcoinonly' : 'url'];
-    return (0, assets_1.httpRequest)(`${baseUrl}/${fwUrl}`, 'binary');
+    const url = `${baseUrl}/${fwUrl}`;
+    return (0, assets_1.httpRequest)(url, 'binary');
 };
 exports.getBinary = getBinary;
 //# sourceMappingURL=getBinary.js.map

package/lib/api/firmware/getBinaryForFirmwareUpgrade.d.ts

@@ -0,0 +1,11 @@
+import { GetInfoProps } from '../../data/firmwareInfo';
+import { IntermediaryVersion } from '../../types';
+interface GetBinaryForFirmwareUpgradeProps extends GetInfoProps {
+    baseUrl: string;
+    btcOnly?: boolean;
+    version?: number[];
+    intermediaryVersion?: IntermediaryVersion;
+}
+export declare const getBinaryForFirmwareUpgrade: ({ features, releases, baseUrl, version, btcOnly, intermediaryVersion, }: GetBinaryForFirmwareUpgradeProps) => Promise<ArrayBuffer>;
+export {};
+//# sourceMappingURL=getBinaryForFirmwareUpgrade.d.ts.map

package/lib/api/firmware/getBinaryForFirmwareUpgrade.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getBinaryForFirmwareUpgrade = void 0;
+const utils_1 = require("@trezor/utils");
+const assets_1 = require("../../utils/assets");
+const firmwareUtils_1 = require("../../utils/firmwareUtils");
+const firmwareInfo_1 = require("../../data/firmwareInfo");
+const getBinary_1 = require("./getBinary");
+const getBinaryForFirmwareUpgrade = ({ features, releases, baseUrl, version, btcOnly, intermediaryVersion, }) => {
+    if (!(0, firmwareUtils_1.isStrictFeatures)(features)) {
+        throw new Error('Features of unexpected shape provided');
+    }
+    if (intermediaryVersion) {
+        return (0, assets_1.httpRequest)(`${baseUrl}/firmware/t1b1/trezor-t1b1-inter-v${intermediaryVersion}.bin`, 'binary');
+    }
+    const infoByBootloader = (0, firmwareInfo_1.getInfo)({ features, releases });
+    const releaseByFirmware = releases.find(r => version &&
+        utils_1.versionUtils.isVersionArray(version) &&
+        utils_1.versionUtils.isEqual(r.version, version));
+    if (!infoByBootloader || !releaseByFirmware) {
+        throw new Error('no firmware found for this device');
+    }
+    if (btcOnly && !releaseByFirmware.url_bitcoinonly) {
+        throw new Error(`firmware version ${version} does not exist in btc only variant`);
+    }
+    if (!utils_1.versionUtils.isEqual(releaseByFirmware.version, infoByBootloader.release.version)) {
+        throw new Error(`version provided as param (${releaseByFirmware.version}) does not match firmware version found by features in bootloader (${infoByBootloader.release.version})`);
+    }
+    return (0, getBinary_1.getBinary)({ releases, baseUrl, version, btcOnly, intermediaryVersion });
+};
+exports.getBinaryForFirmwareUpgrade = getBinaryForFirmwareUpgrade;
+//# sourceMappingURL=getBinaryForFirmwareUpgrade.js.map

package/lib/api/firmware/index.d.ts

@@ -1,3 +1,4 @@
+export { getBinaryForFirmwareUpgrade } from './getBinaryForFirmwareUpgrade';
 export { getBinary } from './getBinary';
 export { getLanguage } from '../../data/getLanguage';
 export { shouldStripFwHeaders, stripFwHeaders } from './modifyFirmware';

package/lib/api/firmware/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseFirmwareHeaders = exports.calculateFirmwareHash = exports.uploadFirmware = exports.stripFwHeaders = exports.shouldStripFwHeaders = exports.getLanguage = exports.getBinary = void 0;
+exports.parseFirmwareHeaders = exports.calculateFirmwareHash = exports.uploadFirmware = exports.stripFwHeaders = exports.shouldStripFwHeaders = exports.getLanguage = exports.getBinary = exports.getBinaryForFirmwareUpgrade = void 0;
+var getBinaryForFirmwareUpgrade_1 = require("./getBinaryForFirmwareUpgrade");
+Object.defineProperty(exports, "getBinaryForFirmwareUpgrade", { enumerable: true, get: function () { return getBinaryForFirmwareUpgrade_1.getBinaryForFirmwareUpgrade; } });
 var getBinary_1 = require("./getBinary");
 Object.defineProperty(exports, "getBinary", { enumerable: true, get: function () { return getBinary_1.getBinary; } });
 var getLanguage_1 = require("../../data/getLanguage");

package/lib/api/firmware/verifyAuthenticityProof.d.ts

@@ -1,7 +1,7 @@
 /// <reference types="node" />
 import { PROTO } from '../../constants';
-import { DeviceAuthenticityConfig } from '../../data/deviceAuthenticityConfig';
 import { AuthenticateDeviceResult } from '../../types/api/authenticateDevice';
+import { DeviceAuthenticityConfig } from '../../data/deviceAuthenticityConfigTypes';
 interface AuthenticityProofData extends PROTO.AuthenticityProof {
     challenge: Buffer;
     config: DeviceAuthenticityConfig;

package/lib/api/firmware/verifyAuthenticityProof.js

@@ -19,15 +19,50 @@ const verifySignature = async (rawKey, data, signature) => {
 };
 const getRandomChallenge = () => crypto.randomBytes(32);
 exports.getRandomChallenge = getRandomChallenge;
+const validateCaCertExtensions = (cert, pathLen) => {
+    let hasKeyUsage, hasBasicConstraints = false;
+    cert.tbsCertificate.extensions.forEach(ext => {
+        if (ext.key === 'keyUsage') {
+            if (ext.keyCertSign !== '1') {
+                throw new Error(`CA keyCertSign not set`);
+            }
+            hasKeyUsage = true;
+        }
+        else if (ext.key === 'basicConstraints') {
+            if (!ext.cA) {
+                throw new Error(`CA basicConstraints.cA not set`);
+            }
+            if (typeof ext.pathLenConstraint != 'number') {
+                throw new Error('CA basicConstraints.pathLenConstraint not set');
+            }
+            if (ext.pathLenConstraint < pathLen) {
+                throw new Error('Issuer was not permitted to issue certificate');
+            }
+            hasBasicConstraints = true;
+        }
+        else if (ext.critical) {
+            throw new Error(`Unknown critical extension ${ext.key} in CA certificate`);
+        }
+    });
+    if (!hasKeyUsage || !hasBasicConstraints) {
+        throw new Error(`CA missing extensions keyUsage: ${hasKeyUsage}, basicConstraints: ${hasBasicConstraints}`);
+    }
+};
 const verifyAuthenticityProof = async ({ certificates, signature, challenge, config, allowDebugKeys, deviceModel, }) => {
     const modelConfig = config[deviceModel];
     if (!modelConfig) {
         throw new Error(`Pubkeys for ${deviceModel} not found in config`);
     }
     const { caPubKeys, debug } = modelConfig;
-    const caCert = (0, x509certificate_1.parseCertificate)(new Uint8Array(Buffer.from(certificates[1], 'hex')));
+    const [deviceCert, caCert] = certificates.map((c, i) => {
+        const cert = (0, x509certificate_1.parseCertificate)(new Uint8Array(Buffer.from(c, 'hex')));
+        if (i === 0) {
+            return cert;
+        }
+        validateCaCertExtensions(cert, i - 1);
+        return cert;
+    });
     const caPubKey = Buffer.from(caCert.tbsCertificate.subjectPublicKeyInfo.bits.bytes).toString('hex');
-    const deviceCert = (0, x509certificate_1.parseCertificate)(new Uint8Array(Buffer.from(certificates[0], 'hex')));
     const rootPubKeys = allowDebugKeys
         ? modelConfig.rootPubKeys.concat((debug === null || debug === void 0 ? void 0 : debug.rootPubKeys) || [])
         : modelConfig.rootPubKeys;

package/lib/api/firmware/x509certificate.d.ts

@@ -6,10 +6,24 @@ interface Asn1 {
     contents: Uint8Array;
     raw: Uint8Array;
 }
+type Oid = `${number}.${number}.${number}.${number}`;
+type Extension = {
+    key: 'keyUsage';
+    critical?: boolean;
+    keyCertSign: '0' | '1';
+} | {
+    key: 'basicConstraints';
+    critical?: boolean;
+    cA: boolean;
+    pathLenConstraint?: number;
+} | (Asn1 & {
+    key: Oid;
+    critical?: boolean;
+});
 export declare const fixSignature: (byteArray: Uint8Array) => Uint8Array;
 export declare const parseName: (asn1: Asn1) => {
     asn1: Asn1;
-    algorithm: string;
+    algorithm: `${number}.${number}.${number}.${number}`;
     parameters: {
         asn1: Asn1;
     } | null;
@@ -22,7 +36,7 @@ export declare const parseCertificate: (byteArray: Uint8Array) => {
         serialNumber: Asn1;
         signature: {
             asn1: Asn1;
-            algorithm: string;
+            algorithm: `${number}.${number}.${number}.${number}`;
             parameters: {
                 asn1: Asn1;
             } | null;
@@ -34,7 +48,7 @@ export declare const parseCertificate: (byteArray: Uint8Array) => {
         };
         subject: {
             asn1: Asn1;
-            algorithm: string;
+            algorithm: `${number}.${number}.${number}.${number}`;
             parameters: {
                 asn1: Asn1;
             } | null;
@@ -43,7 +57,7 @@ export declare const parseCertificate: (byteArray: Uint8Array) => {
             asn1: Asn1;
             algorithm: {
                 asn1: Asn1;
-                algorithm: string;
+                algorithm: `${number}.${number}.${number}.${number}`;
                 parameters: {
                     asn1: Asn1;
                 } | null;
@@ -53,11 +67,11 @@ export declare const parseCertificate: (byteArray: Uint8Array) => {
                 bytes: Uint8Array;
             };
         };
-        extensions: Asn1;
+        extensions: Extension[];
     };
     signatureAlgorithm: {
         asn1: Asn1;
-        algorithm: string;
+        algorithm: `${number}.${number}.${number}.${number}`;
         parameters: {
             asn1: Asn1;
         } | null;

package/lib/api/firmware/x509certificate.js

@@ -37,21 +37,14 @@ const derToAsn1 = (byteArray) => {
     const cls = (byteArray[0] & 0xc0) / 64;
     const structured = (byteArray[0] & 0x20) === 0x20;
     const tag = getTag();
+    if (byteArray[position] === 0x80) {
+        throw new Error('Unsupported length encoding');
+    }
     let length = getLength();
     let byteLength;
     let contents;
-    if (length === 0x80) {
-        length = 0;
-        while (byteArray[position + length] !== 0 || byteArray[position + length + 1] !== 0) {
-            length += 1;
-        }
-        byteLength = position + length + 2;
-        contents = byteArray.subarray(position, position + length);
-    }
-    else {
-        byteLength = position + length;
-        contents = byteArray.subarray(position, byteLength);
-    }
+    byteLength = position + length;
+    contents = byteArray.subarray(position, byteLength);
     const raw = byteArray.subarray(0, byteLength);
     return {
         cls,
@@ -195,6 +188,82 @@ const parseValidity = (asn1) => {
         to: parseUtcTime(to),
     };
 };
+const parseExtensions = (data) => {
+    const asn1 = derToAsn1(data.contents);
+    if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
+        throw new Error("This can't be a Extension. Wrong data type.");
+    }
+    const readBoolean = (value) => {
+        if (!value)
+            return false;
+        if (value.cls !== 0 || value.tag !== 1 || value.contents.length !== 1 || value.structured) {
+            throw new Error("This can't be a boolean. Wrong data type.");
+        }
+        if (![0x00, 0xff].includes(value.contents[0])) {
+            throw new Error('Invalid boolean value.');
+        }
+        return value.contents[0] === 0xff;
+    };
+    const readBitString = (uint8Array) => {
+        const buffer = Buffer.from(uint8Array);
+        const tag = buffer.readUInt8(0);
+        if (tag !== 3) {
+            throw new Error("This can't be a bit string. Wrong data type.");
+        }
+        const length = buffer.readUInt8(1);
+        const unusedBits = buffer.readUInt8(2);
+        const bitStringBytes = buffer.subarray(3, 3 + length - 1);
+        const bitString = bitStringBytes.reduce((str, byte) => str + byte.toString(2).padStart(8, '0'), '');
+        return bitString.slice(0, bitString.length - unusedBits);
+    };
+    const readInteger = (value) => {
+        if (!value)
+            return undefined;
+        if (value.cls !== 0 || value.tag !== 2 || value.contents.length !== 1 || value.structured) {
+            throw new Error("This can't be a integer. Wrong data type.");
+        }
+        return Buffer.from(value.contents).readInt8();
+    };
+    const extensions = [];
+    derToAsn1List(asn1.contents).forEach(item => {
+        const [id, ...pieces] = derToAsn1List(item.contents);
+        if (id.cls !== 0 || id.tag !== 6 || id.structured) {
+            throw new Error('Bad extension. Does not begin with an OBJECT IDENTIFIER.');
+        }
+        const algorithm = derObjectIdentifierValue(id.contents);
+        const critical = pieces.length > 1 ? readBoolean(pieces[0]) : false;
+        const extnValue = pieces.length > 1 ? pieces[1] : pieces[0];
+        if (extnValue.cls !== 0 || extnValue.tag !== 4 || extnValue.structured) {
+            throw new Error("This can't be a octet string. Wrong data type.");
+        }
+        if (algorithm === '2.5.29.15') {
+            extensions.push({
+                key: 'keyUsage',
+                critical,
+                keyCertSign: readBitString(extnValue.contents)[5],
+            });
+        }
+        else if (algorithm === '2.5.29.19') {
+            const fields = derToAsn1List(derToAsn1(extnValue.contents).contents);
+            const ca = fields.length > 0 && fields[0].tag === 1 ? fields[0] : undefined;
+            const len = fields.length > 0 && fields[0].tag === 2 ? fields[0] : fields[1];
+            extensions.push({
+                key: 'basicConstraints',
+                critical,
+                cA: readBoolean(ca),
+                pathLenConstraint: readInteger(len),
+            });
+        }
+        else {
+            extensions.push({
+                key: algorithm,
+                critical,
+                ...item,
+            });
+        }
+    });
+    return extensions;
+};
 const parseTBSCertificate = (asn1) => {
     if (asn1.cls !== 0 || asn1.tag !== 16 || !asn1.structured) {
         throw new Error("This can't be a TBSCertificate. Wrong data type.");
@@ -212,7 +281,7 @@ const parseTBSCertificate = (asn1) => {
         validity: parseValidity(pieces[4]),
         subject: (0, exports.parseName)(pieces[5]),
         subjectPublicKeyInfo: parseSubjectPublicKeyInfo(pieces[6]),
-        extensions: pieces[7],
+        extensions: parseExtensions(pieces[7]),
     };
 };
 const parseCertificate = (byteArray) => {

package/lib/api/getCoinInfo.d.ts

@@ -21,6 +21,7 @@ export default class GetCoinInfo extends AbstractMethod<'getCoinInfo', Params> {
             T1B1: string | false;
             T2T1: string | false;
             T2B1: string | false;
+            T3B1: string | false;
             T3T1: string | false;
             connect: boolean;
         };
@@ -77,6 +78,7 @@ export default class GetCoinInfo extends AbstractMethod<'getCoinInfo', Params> {
             T1B1: string | false;
             T2T1: string | false;
             T2B1: string | false;
+            T3B1: string | false;
             T3T1: string | false;
             connect: boolean;
         };
@@ -108,6 +110,7 @@ export default class GetCoinInfo extends AbstractMethod<'getCoinInfo', Params> {
             T1B1: string | false;
             T2T1: string | false;
             T2B1: string | false;
+            T3B1: string | false;
             T3T1: string | false;
             connect: boolean;
         };