From 64139ebdb7368745fd8a907cf62bfdfa4ee3d1e3 Mon Sep 17 00:00:00 2001 From: al-munazzim Date: Mon, 11 May 2026 21:22:50 +0200 Subject: [PATCH 01/24] ci: harden elements GPG key import in install_noded.sh (#2621) Co-authored-by: Nazim --- tests/install_noded.sh | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/tests/install_noded.sh b/tests/install_noded.sh index 99b909ffb..3eb2dd37a 100755 --- a/tests/install_noded.sh +++ b/tests/install_noded.sh @@ -317,14 +317,18 @@ function gpg_verify_sums { fi local imported=0 for fpr in "${keys[@]}"; do - # Try keys.openpgp.org first, then keyserver.ubuntu.com. - if curl -fsSL "https://keys.openpgp.org/vks/v1/by-fingerprint/${fpr}" 2>/dev/null \ - | gpg --import 2>/dev/null; then - imported=$((imported + 1)) - continue - fi - if curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${fpr}&options=mr" 2>/dev/null \ - | gpg --import 2>/dev/null; then + # Import from both sources. Some keyservers may return partial key + # material for old signatures (e.g. missing signing subkeys). + # Importing from both increases robustness while keeping the same + # pinned trust anchors for verification. + curl -fsSL "https://keys.openpgp.org/vks/v1/by-fingerprint/${fpr}" 2>/dev/null \ + | gpg --import 2>/dev/null || true + curl -fsSL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x${fpr}&options=mr" 2>/dev/null \ + | gpg --import 2>/dev/null || true + + # Count this key as imported if it exists in the keyring after the + # multi-source import attempts. + if gpg --list-keys --with-colons "$fpr" 2>/dev/null | grep -q '^pub:'; then imported=$((imported + 1)) fi done From a1a82082ddd3a42ff2e01a77479590fa66d5083b Mon Sep 17 00:00:00 2001 From: Oren <115847146+oren-z0@users.noreply.github.com> Date: Sun, 17 May 2026 22:15:57 +0300 Subject: [PATCH 02/24] Update specterext-timelockrecovery to v0.2.3 (#2620) --- requirements.in | 2 +- requirements.txt | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements.in b/requirements.in index b598a3184..86990f404 100644 --- a/requirements.in +++ b/requirements.in @@ -35,7 +35,7 @@ specterext-exfund==0.1.7 specterext-faucet==0.1.2 cryptoadvance.spectrum==0.7.0 specterext-stacktrack==0.3.0 -specterext-timelockrecovery==0.2.1 +specterext-timelockrecovery==0.2.3 # workarounds diff --git a/requirements.txt b/requirements.txt index 00ab63955..704474bb5 100644 --- a/requirements.txt +++ b/requirements.txt @@ -824,9 +824,9 @@ specterext-stacktrack==0.3.0 \ --hash=sha256:14f96f1f552f57ba017b8bc642f07343edbb1abafe09e03bbaae179d78d7ce23 \ --hash=sha256:9e2946185730aab377951e83a27d8791a34e0f031e44f15991212b6b85722ca0 # via -r requirements.in -specterext-timelockrecovery==0.2.1 \ - --hash=sha256:2fc2a3eec045377b54926ff41dab9c5f5a6f46074150aec1ff67cb1456fef911 \ - --hash=sha256:35e181971b5b69ca6706496169c4581f2fa20706c88ba24760e56e153ec51939 +specterext-timelockrecovery==0.2.3 \ + --hash=sha256:a0b22c4e010061055da4ea6ea4e08bbc38d1f7c2ec58327970caa0ce987cba95 \ + --hash=sha256:5df3deb6245a22d48f75bbb62fd87dc141a9f60407011ce9fbb0a7bcc40fe4cc # via -r requirements.in sqlalchemy==1.4.52 \ --hash=sha256:1296f2cdd6db09b98ceb3c93025f0da4835303b8ac46c15c2136e27ee4d18d94 \ From 314a8579a09c097f8691056d3de452e55e5aea27 Mon Sep 17 00:00:00 2001 From: k9ert <117085+k9ert@users.noreply.github.com> Date: Fri, 22 May 2026 09:08:28 +0200 Subject: [PATCH 03/24] deps: bump hwi 2.4.0 -> 3.1.0 (drops Python 3.7/3.8) (#2616) --- docs/development.md | 31 ++++++ pyproject.toml | 5 +- requirements.in | 2 +- requirements.txt | 9 +- tests/conftest.py | 15 +++ tests/fixtures/jade_hardware.psbt | 1 + tests/fixtures/jade_seedqr_abandon.png | Bin 0 -> 354 bytes tests/fixtures/jade_seedqr_abandon.txt | 15 +++ tests/test_jade_hardware.py | 140 +++++++++++++++++++++++++ 9 files changed, 211 insertions(+), 7 deletions(-) create mode 100644 tests/fixtures/jade_hardware.psbt create mode 100644 tests/fixtures/jade_seedqr_abandon.png create mode 100644 tests/fixtures/jade_seedqr_abandon.txt create mode 100644 tests/test_jade_hardware.py diff --git a/docs/development.md b/docs/development.md index 251ee8f64..bb0fcc955 100644 --- a/docs/development.md +++ b/docs/development.md @@ -14,6 +14,7 @@ - [Set up virtualenv](#set-up-virtualenv) - [If `pip install` fails on `cryptography==3.4.x`](#if-pip-install-fails-on-cryptography34x) - [How to run the tests](#how-to-run-the-tests) + - [Hardware-attended Jade tests](#hardware-attended-jade-tests) - [Code-Style](#code-style) - [Developing on tests](#developing-on-tests) - [bitcoin-specific stuff](#bitcoin-specific-stuff) @@ -209,6 +210,36 @@ Print the logging output live to the terminal: pytest --capture=no --log-cli-level=DEBUG ``` +### Hardware-attended Jade tests + +`tests/test_jade_hardware.py` exercises Specter's HWI integration end-to-end against a physical Blockstream Jade. It is gated by `--run-jade-hardware` and skipped by default, so GitHub Actions ignore it without any workflow change. + +Run with `-s` so operator prompts reach the terminal: +``` +pytest --run-jade-hardware tests/test_jade_hardware.py -s +``` + +Three tests, increasing operator effort: + +| Test | What it does | Operator action | +|---|---|---| +| `test_jade_enumerate_via_specter` | `HWIBridge.enumerate()` finds the Jade and returns a fingerprint | Connect Jade, unlock | +| `test_jade_extract_xpub_via_specter` | Pulls xpub at `m/84h/0h/0h` (mainnet) | Confirm xpub export on device | +| `test_jade_sign_psbt_via_specter` | Signs a canned testnet PSBT through Specter's sign path | Boot Jade in Temporary Signer mode, scan SeedQR, confirm tx | + +The signing test uses the public **BIP-39 abandon vector** (`abandon abandon ... about`) so the PSBT fixture matches anyone's Jade once they load that seed. Setup procedure: + +1. Power-cycle the Jade so it shows the boot menu. +2. Choose **Temporary Signer** -> **Scan SeedQR**. +3. Display `tests/fixtures/jade_seedqr_abandon.png` (or `cat tests/fixtures/jade_seedqr_abandon.txt` for the ASCII version) and scan it with the Jade camera. +4. When Jade asks for the network, select **TESTNET**. +5. Press Enter at the test prompt. +6. Confirm the transaction on the Jade screen when it pops up (~99,500 sats to a testnet bech32 output, ~99,500 change auto-validated, 1,000 fee). + +Temporary Signer state is held in RAM only and wiped on power-cycle/USB-unplug — your real seed is not affected. Expected master fingerprint for the abandon vector is `73c5da0a`; the test fails fast with a clear hint if the loaded seed is wrong. + +The fixture PSBT (`tests/fixtures/jade_hardware.psbt`) was generated with embit against m/84'/1'/0'/0/0 of the abandon vector, including a synthetic `non_witness_utxo` so Jade can verify the input amount per the SegWit fee-spoof mitigation. + Get the log-output of bitcoind side by side with the test-output. For sure you will only see the logs if the test fails. ``` pytest --bitcoind-log-stdout diff --git a/pyproject.toml b/pyproject.toml index c822bb7db..df8c7953d 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -26,7 +26,7 @@ readme = "README.md" license = {file = "LICENSE"} -requires-python = ">=3.7,<4.0" +requires-python = ">=3.9,<3.13" dynamic = ["dependencies", "version"] @@ -52,7 +52,8 @@ markers = [ "slow: mark test as slow.", "elm: mark test as elementsd dependent", "bottleneck: mark a test as so ressource intensive that it can create a bottleneck where the test just fails due to a lack of ressources", - "threading: test needs threading to work" + "threading: test needs threading to work", + "jade_hardware: requires a real Jade attached and an operator; opt-in only via --run-jade-hardware" ] filterwarnings = [ diff --git a/requirements.in b/requirements.in index 86990f404..35282fa9e 100644 --- a/requirements.in +++ b/requirements.in @@ -6,7 +6,7 @@ Flask-Cors==6.0.0 Flask-Login==0.6.3 Flask-RESTful==0.3.10 Flask-HTTPAuth==4.8.0 -hwi==2.4.0 +hwi==3.1.0 python-dotenv==0.21.1 requests==2.31.0 pysocks==1.7.1 diff --git a/requirements.txt b/requirements.txt index 704474bb5..3d622e9b6 100644 --- a/requirements.txt +++ b/requirements.txt @@ -432,9 +432,9 @@ hidapi==0.14.0 \ --hash=sha256:fb4e94e45f6dddb20d59501187721e5d3b02e6cc8a59d261dd5cac739008582a \ --hash=sha256:fc9ec2321bf3b0b4953910aa87c0c8ab5f93b1f113a9d3d4f18845ce54708d13 # via hwi -hwi==2.4.0 \ - --hash=sha256:3eaa7593f1ab360569eacdd9507dab75532bb58e8cd991d8ad72f5c4fcb67997 \ - --hash=sha256:7cb7ef2a4db4bc434815374d9bad43c6425491f77828314a2d2898d3e86d3f04 +hwi==3.1.0 \ + --hash=sha256:21ba92bb06e2f805e2806c686f2c50d02db6826a363b01e44052415755504d6f \ + --hash=sha256:42e875cbb616a91638fb90679cad93edb5075bf375e92fc1709be9b2a3dfd59c # via -r requirements.in idna==3.7 \ --hash=sha256:028ff3aadf0609c1fd278d8ea3089299412a7a8b9bd005dd08b9f8285bcb5cfc \ @@ -921,5 +921,6 @@ wtforms==3.1.2 \ # via flask-wtf # WARNING: The following packages were not pinned, but pip requires them to be -# pinned when the requirements file includes hashes. Consider using the --allow-unsafe flag. +# pinned when the requirements file includes hashes and the requirement is not +# satisfied by a package already installed. Consider using the --allow-unsafe flag. # setuptools diff --git a/tests/conftest.py b/tests/conftest.py index a7368138a..6be08fab0 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -89,9 +89,24 @@ def pytest_addoption(parser): default="master", help="Version of elementsd (something which works with git checkout ...)", ) + parser.addoption( + "--run-jade-hardware", + action="store_true", + default=False, + help="Run tests marked jade_hardware (real Jade attached + operator).", + ) listen() +def pytest_collection_modifyitems(config, items): + if config.getoption("--run-jade-hardware"): + return + skip = pytest.mark.skip(reason="opt-in via --run-jade-hardware") + for item in items: + if item.get_closest_marker("jade_hardware") is not None: + item.add_marker(skip) + + def pytest_generate_tests(metafunc): # ToDo: use custom compiled version of bitcoind # E.g. test again bitcoind version [currentRelease] + master-branch diff --git a/tests/fixtures/jade_hardware.psbt b/tests/fixtures/jade_hardware.psbt new file mode 100644 index 000000000..3a68aa829 --- /dev/null +++ b/tests/fixtures/jade_hardware.psbt @@ -0,0 +1 @@ +cHNidP8BAHECAAAAAYz9aGwGnHSzsZXBuDlKg9hNl6KeLvo8czy6WHaPTGwGAAAAAAD/////AqyEAQAAAAAAFgAUb6AWUAo8anN+uyYOLdyni6kjRVishAEAAAAAABYAFC80qhzwClOwVaKRoDp9RfCmmItSAAAAAAABAFMCAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/////wFR/////wFADQMAAAAAABYAFNDEo+8J6Ze26Z45flGP4+QaEYyhAAAAAAEBH0ANAwAAAAAAFgAU0MSj7wnpl7bpnjl+UY/j5BoRjKEiBgLnqyU3tdSelwMJquBunknzbOHJ/rvUTsjg0cygtPnDGRhzxdoKVAAAgAEAAIAAAACAAAAAAAAAAAAAACICA11J7M1U0AmeQ2did8em1GJdYR2oil30m/lReneRp3elGHPF2gpUAACAAQAAgAAAAIABAAAAAAAAAAA= diff --git a/tests/fixtures/jade_seedqr_abandon.png b/tests/fixtures/jade_seedqr_abandon.png new file mode 100644 index 0000000000000000000000000000000000000000..9ec31d505b9853c4cfeee5ef2fa10a7b45f29fc0 GIT binary patch literal 354 zcmV-o0iFJdP)-v^hyX>cot}JQToH_Y=1x(Y$2F+JyGFN=RewZflNQxie{->TR=jh1c-XRMh} zO`FFC%5_@l3f=ttQkjY1Y%QRtbd|Mv?4ly12y8#UV$iN^^9HJ!eQEU-*Q{*wmR`vV zNq9whkgdLY#ZOhKEIK@}oARYEn9{ZAHjQV^N2e^@F`maE86ncq9sFxU*#Y~9rvBwu zeFaZUvGnzC44v*cbc6d1Dl|I#q^A8KgEKvdMGtJ&wRv2F%6w~;bF}?Mtok2HuPK|? z&%>7Njo=>6?5qCw8#t ``Scan SeedQR``. + 3. Scan ``tests/fixtures/jade_seedqr_abandon.png`` (or display + ``tests/fixtures/jade_seedqr_abandon.txt`` and scan from screen). + 4. Confirm the **testnet** network on Jade. + 5. The PSBT at ``tests/fixtures/jade_hardware.psbt`` is fabricated by + Coldcard's psbt_faker against this exact seed. + +Temporary Signer state lives in RAM only; it's wiped on power-cycle. Your +real seed is not affected. +""" + +from pathlib import Path + +import pytest + +from cryptoadvance.specter.hwi_rpc import HWIBridge + + +FIXTURE_DIR = Path(__file__).parent / "fixtures" +PSBT_FIXTURE = FIXTURE_DIR / "jade_hardware.psbt" +SEEDQR_PNG = FIXTURE_DIR / "jade_seedqr_abandon.png" +SEEDQR_TXT = FIXTURE_DIR / "jade_seedqr_abandon.txt" + +ABANDON_FINGERPRINT = "73c5da0a" + + +def _enumerate_jade(bridge: HWIBridge, chain: str = "main"): + # HWIBridge.enumerate defaults chain="" which Chain.argparse passes + # through unchanged; Jade's enumerate then fails with + # "Unhandled network: ". Pass an explicit chain. + devs = bridge.enumerate(chain=chain) + return [d for d in devs if d.get("type") == "jade"] + + +def _prompt(msg: str) -> None: + print(f"\n>>> {msg}") + try: + input(">>> Press Enter when ready... ") + except EOFError: + pass + + +@pytest.mark.jade_hardware +def test_jade_enumerate_via_specter(): + """Jade is detected by Specter's HWIBridge and reports a fingerprint.""" + _prompt("Connect and unlock the Jade.") + bridge = HWIBridge(skip_hwi_initialisation=True) + jades = _enumerate_jade(bridge) + assert jades, "no Jade detected — connect, unlock, and rerun" + jade = jades[0] + assert jade.get("fingerprint"), f"Jade enumerated without fingerprint: {jade}" + assert jade.get("path"), f"Jade enumerated without path: {jade}" + + +@pytest.mark.jade_hardware +def test_jade_extract_xpub_via_specter(): + """Specter can pull an xpub at a known derivation from Jade.""" + _prompt("Unlock the Jade. You may be asked to confirm the xpub export.") + bridge = HWIBridge(skip_hwi_initialisation=True) + jades = _enumerate_jade(bridge) + assert jades, "no Jade detected" + fingerprint = jades[0].get("fingerprint") + assert fingerprint, f"Jade enumerated without fingerprint: {jades[0]}" + + # chain must be passed explicitly: HWIBridge.extract_xpub default is + # chain="" which Specter's JadeClient.__init__ rejects via _network() + # before extract_xpub's post-init override can apply. + xpub_line = bridge.extract_xpub( + derivation="m/84h/0h/0h", + device_type="jade", + fingerprint=fingerprint, + chain="main", + ) + assert xpub_line, "extract_xpub returned empty" + assert xpub_line.startswith("["), f"unexpected format: {xpub_line!r}" + assert "]" in xpub_line, f"unexpected format: {xpub_line!r}" + body = xpub_line.split("]", 1)[1].strip() + assert body.startswith(("xpub", "zpub", "ypub")), f"unexpected xpub: {body[:8]}" + + +@pytest.mark.jade_hardware +def test_jade_sign_psbt_via_specter(): + """End-to-end: Specter signs the canned abandon-vector PSBT through Jade. + + Requires Jade in Temporary Signer mode with the abandon-vector seed + (see module docstring). The fixture PSBT was generated by Coldcard's + psbt_faker against m/84'/1'/0' on testnet; xfp is 73c5da0a. + """ + assert PSBT_FIXTURE.exists(), f"missing fixture: {PSBT_FIXTURE}" + + seedqr_hint = ( + f"\n PNG: {SEEDQR_PNG}\n" + f" ASCII: cat {SEEDQR_TXT}" + ) + _prompt( + "Put Jade in Temporary Signer mode -> Scan SeedQR -> select TESTNET." + f"\n SeedQR for the BIP-39 abandon-vector lives at:{seedqr_hint}\n" + " Then confirm the transaction on device when prompted." + ) + + psbt_b64 = PSBT_FIXTURE.read_text().strip() + + bridge = HWIBridge(skip_hwi_initialisation=True) + jades = _enumerate_jade(bridge, chain="test") + assert jades, "no Jade detected" + fingerprint = jades[0].get("fingerprint") + assert fingerprint, f"Jade enumerated without fingerprint: {jades[0]}" + assert fingerprint.lower() == ABANDON_FINGERPRINT, ( + f"connected Jade fingerprint is {fingerprint}; " + f"expected {ABANDON_FINGERPRINT} (abandon-vector). " + "Are you in Temporary Signer mode with the right SeedQR?" + ) + + signed = bridge.sign_tx( + psbt=psbt_b64, + device_type="jade", + fingerprint=fingerprint, + chain="test", + ) + assert signed, "sign_tx returned empty" + assert signed != psbt_b64, "PSBT was returned unsigned" From febcf619d98a6fd1d97c15050150fd77f80d7b8c Mon Sep 17 00:00:00 2001 From: k9ert <117085+k9ert@users.noreply.github.com> Date: Mon, 29 Jun 2026 14:35:14 +0200 Subject: [PATCH 04/24] Bump Spectrum to 0.8.0 (#2641) --- requirements.in | 2 +- requirements.txt | 15 +++++++-------- 2 files changed, 8 insertions(+), 9 deletions(-) diff --git a/requirements.in b/requirements.in index 35282fa9e..e4a6f7802 100644 --- a/requirements.in +++ b/requirements.in @@ -33,7 +33,7 @@ aioitertools==0.11.0 cryptoadvance-liquidissuer==0.2.4 specterext-exfund==0.1.7 specterext-faucet==0.1.2 -cryptoadvance.spectrum==0.7.0 +cryptoadvance.spectrum==0.8.0 specterext-stacktrack==0.3.0 specterext-timelockrecovery==0.2.3 diff --git a/requirements.txt b/requirements.txt index 3d622e9b6..1124d940f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -2,7 +2,7 @@ # This file is autogenerated by pip-compile with Python 3.10 # by the following command: # -# pip-compile --generate-hashes requirements.in +# pip-compile --cert=None --client-cert=None --generate-hashes --index-url=None --pip-args=None requirements.in # aioitertools==0.11.0 \ --hash=sha256:04b95e3dab25b449def24d7df809411c10e62aab0cbe31a50ca4e68748c43394 \ @@ -174,9 +174,9 @@ cryptoadvance-liquidissuer==0.2.4 \ --hash=sha256:5a2c531801854c5a4a46daf184877e22f731cdb42d2cfb840785bda7371ba6fb \ --hash=sha256:9e468f3e35ecc566b3f74a2263677cf26632548abb194521dba15ad37acd1e9b # via -r requirements.in -cryptoadvance-spectrum==0.7.0 \ - --hash=sha256:40b31d38ad40c85438bc44d9243edb9ddbaf331c4468a48ebc0f40a109b43a62 \ - --hash=sha256:6cd8858fa07668536345ecab08b4143e28055d7524c9b27b8c885c5b98730879 +cryptoadvance-spectrum==0.8.0 \ + --hash=sha256:cc91eef05f6417898e735b793b91135ddd989fe223ff51aeaa4bc278eb15c3ed \ + --hash=sha256:d3a53b21ca13d8e6a014ff2c0b0e68f8d4eef2c1efbe6383ae018c15409c67c1 # via -r requirements.in cryptography==46.0.6 \ --hash=sha256:02fad249cb0e090b574e30b276a3da6a149e04ee2f049725b1f69e7b8351ec70 \ @@ -825,8 +825,8 @@ specterext-stacktrack==0.3.0 \ --hash=sha256:9e2946185730aab377951e83a27d8791a34e0f031e44f15991212b6b85722ca0 # via -r requirements.in specterext-timelockrecovery==0.2.3 \ - --hash=sha256:a0b22c4e010061055da4ea6ea4e08bbc38d1f7c2ec58327970caa0ce987cba95 \ - --hash=sha256:5df3deb6245a22d48f75bbb62fd87dc141a9f60407011ce9fbb0a7bcc40fe4cc + --hash=sha256:5df3deb6245a22d48f75bbb62fd87dc141a9f60407011ce9fbb0a7bcc40fe4cc \ + --hash=sha256:a0b22c4e010061055da4ea6ea4e08bbc38d1f7c2ec58327970caa0ce987cba95 # via -r requirements.in sqlalchemy==1.4.52 \ --hash=sha256:1296f2cdd6db09b98ceb3c93025f0da4835303b8ac46c15c2136e27ee4d18d94 \ @@ -921,6 +921,5 @@ wtforms==3.1.2 \ # via flask-wtf # WARNING: The following packages were not pinned, but pip requires them to be -# pinned when the requirements file includes hashes and the requirement is not -# satisfied by a package already installed. Consider using the --allow-unsafe flag. +# pinned when the requirements file includes hashes. Consider using the --allow-unsafe flag. # setuptools From 44c5fdeaadf06b3bfe2d4b717bf688a94f953c01 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 28 Jul 2026 21:13:02 +0200 Subject: [PATCH 05/24] Chore(deps): Bump jinja2 from 3.1.4 to 3.1.6 (#2670) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements.txt | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/requirements.txt b/requirements.txt index 1124d940f..0f6dbab6c 100644 --- a/requirements.txt +++ b/requirements.txt @@ -352,7 +352,9 @@ greenlet==2.0.2 \ --hash=sha256:eff4eb9b7eb3e4d0cae3d28c283dc16d9bed6b193c2e1ace3ed86ce48ea8df19 \ --hash=sha256:f82d4d717d8ef19188687aa32b8363e96062911e63ba22a0cff7802a8e58e5f1 \ --hash=sha256:fc3a569657468b6f3fb60587e48356fe512c1754ca05a564f11366ac9e306526 - # via -r requirements.in + # via + # -r requirements.in + # sqlalchemy gunicorn==23.0.0 \ --hash=sha256:ec400d38950de4dfd418cff8328b2c8faed0edb0d517d3394e457c317908ca4d \ --hash=sha256:f014447a0101dc57e294f6c18ca6b40227a4c90e9bdb586042628030cba004ec @@ -446,9 +448,9 @@ itsdangerous==2.2.0 \ # via # flask # flask-wtf -jinja2==3.1.4 \ - --hash=sha256:4a3aee7acbbe7303aede8e9648d13b8bf88a429282aa6122a993f0ac800cb369 \ - --hash=sha256:bc5dd2abb727a5319567b7a813e6a2e7318c39f4f487cfe6c89c6f9c7d25197d +jinja2==3.1.6 \ + --hash=sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d \ + --hash=sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67 # via # flask # flask-babel @@ -921,5 +923,6 @@ wtforms==3.1.2 \ # via flask-wtf # WARNING: The following packages were not pinned, but pip requires them to be -# pinned when the requirements file includes hashes. Consider using the --allow-unsafe flag. +# pinned when the requirements file includes hashes and the requirement is not +# satisfied by a package already installed. Consider using the --allow-unsafe flag. # setuptools From 54b3616b405e6ddd5ccfb24f8437f0f4cef0ef20 Mon Sep 17 00:00:00 2001 From: al-munazzim Date: Tue, 4 Aug 2026 16:56:52 +0200 Subject: [PATCH 06/24] fix: restore Ledger udev hidraw fallback (#2633) Co-authored-by: Nazim Co-authored-by: k9ert <117085+k9ert@users.noreply.github.com> --- udev/20-hw1.rules | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/udev/20-hw1.rules b/udev/20-hw1.rules index 02d630bd6..99f386b88 100644 --- a/udev/20-hw1.rules +++ b/udev/20-hw1.rules @@ -1,12 +1,8 @@ -# HW.1 / Nano +# HW.1, Nano SUBSYSTEMS=="usb", ATTRS{idVendor}=="2581", ATTRS{idProduct}=="1b7c|2b7c|3b7c|4b7c", TAG+="uaccess", TAG+="udev-acl" -# Blue -SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="0000|0000|0001|0002|0003|0004|0005|0006|0007|0008|0009|000a|000b|000c|000d|000e|000f|0010|0011|0012|0013|0014|0015|0016|0017|0018|0019|001a|001b|001c|001d|001e|001f", TAG+="uaccess", TAG+="udev-acl" -# Nano S -SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="0001|1000|1001|1002|1003|1004|1005|1006|1007|1008|1009|100a|100b|100c|100d|100e|100f|1010|1011|1012|1013|1014|1015|1016|1017|1018|1019|101a|101b|101c|101d|101e|101f", TAG+="uaccess", TAG+="udev-acl" -# Aramis -SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="0002|2000|2001|2002|2003|2004|2005|2006|2007|2008|2009|200a|200b|200c|200d|200e|200f|2010|2011|2012|2013|2014|2015|2016|2017|2018|2019|201a|201b|201c|201d|201e|201f", TAG+="uaccess", TAG+="udev-acl" -# HW2 -SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="0003|3000|3001|3002|3003|3004|3005|3006|3007|3008|3009|300a|300b|300c|300d|300e|300f|3010|3011|3012|3013|3014|3015|3016|3017|3018|3019|301a|301b|301c|301d|301e|301f", TAG+="uaccess", TAG+="udev-acl" -# Nano X -SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", ATTRS{idProduct}=="0004|4000|4001|4002|4003|4004|4005|4006|4007|4008|4009|400a|400b|400c|400d|400e|400f|4010|4011|4012|4013|4014|4015|4016|4017|4018|4019|401a|401b|401c|401d|401e|401f", TAG+="uaccess", TAG+="udev-acl" \ No newline at end of file + +# Blue, NanoS, Aramis, HW.2, Nano X, NanoSP, Stax, Ledger Test, +SUBSYSTEMS=="usb", ATTRS{idVendor}=="2c97", TAG+="uaccess", TAG+="udev-acl" + +# Same, but with hidraw-based library (instead of libusb) +KERNEL=="hidraw*", ATTRS{idVendor}=="2c97", MODE="0666" From fe232048d42179c4eae405da01baa19c616870db Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 7 Aug 2026 10:57:20 +0200 Subject: [PATCH 07/24] Chore(deps-dev): Bump electron from 39.8.5 to 39.8.10 in /pyinstaller/electron (#2680) Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- pyinstaller/electron/package-lock.json | 14 +++++++------- pyinstaller/electron/package.json | 2 +- pyinstaller/electron/yarn.lock | 8 ++++---- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/pyinstaller/electron/package-lock.json b/pyinstaller/electron/package-lock.json index c5840c0ec..9bd574d00 100644 --- a/pyinstaller/electron/package-lock.json +++ b/pyinstaller/electron/package-lock.json @@ -19,7 +19,7 @@ "winston": "^3.13.0" }, "devDependencies": { - "electron": "^39.8.5", + "electron": "^39.8.10", "electron-builder": "^26.8.1" } }, @@ -2010,9 +2010,9 @@ } }, "node_modules/electron": { - "version": "39.8.5", - "resolved": "https://registry.npmjs.org/electron/-/electron-39.8.5.tgz", - "integrity": "sha512-q6+LiQIcTadSyvtPgLDQkCtVA9jQJXQVMrQcctfOJILh6OFMN+UJJLRkuUTy8CZDYeCIBn1ZycqsL1dAXugxZA==", + "version": "39.8.10", + "resolved": "https://registry.npmjs.org/electron/-/electron-39.8.10.tgz", + "integrity": "sha512-zbYtGPYUI7PzqLAzkk21Rk6j67WN0hxn0Mq/njErZo1d0HSf33is4f8ICI5fMLy5vYe0JtCtM5sYunNOaochSQ==", "dev": true, "hasInstallScript": true, "dependencies": { @@ -6605,9 +6605,9 @@ } }, "electron": { - "version": "39.8.5", - "resolved": "https://registry.npmjs.org/electron/-/electron-39.8.5.tgz", - "integrity": "sha512-q6+LiQIcTadSyvtPgLDQkCtVA9jQJXQVMrQcctfOJILh6OFMN+UJJLRkuUTy8CZDYeCIBn1ZycqsL1dAXugxZA==", + "version": "39.8.10", + "resolved": "https://registry.npmjs.org/electron/-/electron-39.8.10.tgz", + "integrity": "sha512-zbYtGPYUI7PzqLAzkk21Rk6j67WN0hxn0Mq/njErZo1d0HSf33is4f8ICI5fMLy5vYe0JtCtM5sYunNOaochSQ==", "dev": true, "requires": { "@electron/get": "^2.0.0", diff --git a/pyinstaller/electron/package.json b/pyinstaller/electron/package.json index a7f55e486..8a1af0c7a 100644 --- a/pyinstaller/electron/package.json +++ b/pyinstaller/electron/package.json @@ -20,7 +20,7 @@ "author": "Specter", "license": "MIT", "devDependencies": { - "electron": "^39.8.5", + "electron": "^39.8.10", "electron-builder": "^26.8.1" }, "build": { diff --git a/pyinstaller/electron/yarn.lock b/pyinstaller/electron/yarn.lock index 0fb9bf104..915d63a2f 100644 --- a/pyinstaller/electron/yarn.lock +++ b/pyinstaller/electron/yarn.lock @@ -949,10 +949,10 @@ electron-publish@26.8.1: lazy-val "^1.0.5" mime "^2.5.2" -electron@^39.8.5: - version "39.8.5" - resolved "https://registry.yarnpkg.com/electron/-/electron-39.8.5.tgz#422d42318d993a77a960ea1a9b4bfb4822221388" - integrity sha512-q6+LiQIcTadSyvtPgLDQkCtVA9jQJXQVMrQcctfOJILh6OFMN+UJJLRkuUTy8CZDYeCIBn1ZycqsL1dAXugxZA== +electron@^39.8.10: + version "39.8.10" + resolved "https://registry.yarnpkg.com/electron/-/electron-39.8.10.tgz#998d9c5b9e7601debb70bd7355e8d4dfd6d70f43" + integrity sha512-zbYtGPYUI7PzqLAzkk21Rk6j67WN0hxn0Mq/njErZo1d0HSf33is4f8ICI5fMLy5vYe0JtCtM5sYunNOaochSQ== dependencies: "@electron/get" "^2.0.0" "@types/node" "^22.7.7" From 0b027f49fdf7d649cf782bf585d5ff30610cd756 Mon Sep 17 00:00:00 2001 From: k9ert <117085+k9ert@users.noreply.github.com> Date: Sat, 8 Aug 2026 14:12:46 +0200 Subject: [PATCH 08/24] fix: dev-server crash in the specter-desktop repo after the project-rename (#2686) Co-authored-by: Claude Opus 5 --- .github/workflows/test.yml | 25 ++++++++++ src/cryptoadvance/specter/util/reflection.py | 52 ++++++++++++-------- tests/test_util_reflection.py | 51 +++++++++++++++++-- tests/test_util_shell.py | 15 +++++- 4 files changed, 116 insertions(+), 27 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 58f6a44c5..6611f4827 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -196,6 +196,31 @@ jobs: pip3 install -r requirements.txt --require-hashes pip3 install -e ".[test]" + - name: Dev-server smoketest (from the repo-root) + # No job used to start the dev-server from the repo-root the way + # docs/development.md describes it. That's why #2526 (renaming the + # project to cryptoadvance_specter) could break it unnoticed. + run: | + source ./.env/bin/activate + export SPECTER_DATA_FOLDER=$(mktemp -d) + # --debug enables the werkzeug-reloader which forks a child-process, so + # start a new process-group we can kill as a whole further down + setsid python3 -m cryptoadvance.specter server --config DevelopmentConfig --debug > specterd.log 2>&1 & + specterd_pid=$! + started="" + for i in $(seq 1 30); do + if curl -sf http://127.0.0.1:25441/ > /dev/null; then started="yes"; break; fi + sleep 2 + done + kill -- -$specterd_pid || true + # the next step needs port 25441, so make sure it's free again + for i in $(seq 1 10); do + curl -sf http://127.0.0.1:25441/ > /dev/null || break + sleep 1 + done + cat specterd.log + if [ -z "$started" ]; then echo "The dev-server did not come up!"; exit 1; fi + - name: Extension smoketest run: | git config --global user.name "CI CD" diff --git a/src/cryptoadvance/specter/util/reflection.py b/src/cryptoadvance/specter/util/reflection.py index 708730c28..70cfca46f 100644 --- a/src/cryptoadvance/specter/util/reflection.py +++ b/src/cryptoadvance/specter/util/reflection.py @@ -5,11 +5,11 @@ import os from pathlib import Path import pkgutil from pkgutil import iter_modules +import re import sys from typing import List from .common import camelcase2snake_case from ..specter_error import SpecterError, SpecterInternalException -from .shell import grep from .reflection_fs import detect_extension_style_in_cwd, search_dirs_in_path @@ -130,6 +130,29 @@ def get_classlist_of_type_clazz_from_modulelist(clazz, modulelist, skip_missing= return class_list +def is_specter_desktop_project(cwd=".") -> bool: + """Whether cwd is the specter-desktop project itself rather than an + extension-project. Detected via the project-name in the pyproject.toml. + Hmm, a bit hackish but we don't want to depend on toml-parsing libs. + """ + try: + with open(Path(cwd, "pyproject.toml")) as pyproject_file: + for line in pyproject_file: + line = line.strip().replace(" ", "").replace("'", "").replace('"', "") + if not line.startswith("name="): + continue + # PEP 503: ".", "-" and "_" are equivalent in project-names, so + # "cryptoadvance.specter" and "cryptoadvance_specter" are the same + name = re.sub(r"[-_.]+", "-", line[len("name=") :]).lower() + if name == "cryptoadvance-specter": + return True + except FileNotFoundError: + # Expected for adhoc-style extension-projects: those have no + # pyproject.toml at all and are therefore not specter-desktop + pass + return False + + def get_subclasses_for_clazz_in_cwd(clazz, cwd=".") -> List[type]: """Returns all subclasses of class clazz located in the CWD if the cwd is not a specter-desktop dev-env-kind-of-dir or contains any .py-file @@ -140,37 +163,26 @@ def get_subclasses_for_clazz_in_cwd(clazz, cwd=".") -> List[type]: return [] # if not testing but in a folder which looks like specter-desktop/src --> No dynamic extensions - if "PYTEST_CURRENT_TEST" not in os.environ: - # Hmm, a bit hackish but if the pyproject.toml specifies cryptoadvance.specter as a name and - # we don't need to depend on toml-parsing libs, that should be ok. - try: - found, line = grep("./pyproject.toml", 'name = "cryptoadvance.specter"') - if found: - return [] - if line: - line = line.replace(" ", "").replace("'", "").replace('"', "") - if line == "name=cryptoadvance.specter": - return [] - except FileNotFoundError: - pass + if "PYTEST_CURRENT_TEST" not in os.environ and is_specter_desktop_project(cwd): + return [] - # Depending on the style we either add "." or "./src" to the searchpath + # Depending on the style we either add cwd or cwd/src to the searchpath - extension_style = detect_extension_style_in_cwd() + extension_style = detect_extension_style_in_cwd(cwd) # raise Exception(extension_style) if extension_style == "adhoc": - package_dirs.append(Path(".")) + package_dirs.append(Path(cwd)) elif extension_style == "publish-ready": - package_dirs.extend(search_dirs_in_path(Path("./src"))) + package_dirs.extend(search_dirs_in_path(Path(cwd, "src"))) elif extension_style == "specter-desktop": if "PYTEST_CURRENT_TEST" in os.environ: # I admit, ugly hack logger.info("We're in testing mode. Adding CWD to searchpath") - package_dirs.append(Path("./src")) + package_dirs.append(Path(cwd, "src")) else: raise Exception( f""" - We checked before that we're not in the specter-desktop home + We checked before that we're not in the specter-desktop home directory but now the extension-style is 'specter-desktop' ?! This should not happen! """ diff --git a/tests/test_util_reflection.py b/tests/test_util_reflection.py index 6890a6039..fb737515e 100644 --- a/tests/test_util_reflection.py +++ b/tests/test_util_reflection.py @@ -11,6 +11,7 @@ from cryptoadvance.specter.util.reflection import ( get_subclasses_for_clazz, get_subclasses_for_clazz_in_cwd, get_classlist_of_type_clazz_from_modulelist, + is_specter_desktop_project, _get_module_from_class, get_package_dir_for_subclasses_of, search_dirs_in_path, @@ -119,13 +120,53 @@ def test_get_classlist_raises_on_missing_module_by_default(): get_classlist_of_type_clazz_from_modulelist(Service, modulelist) +repo_root = Path(__file__).parent.parent +xtestdata = repo_root / "tests" / "xtestdata_testextensions" + + +def test_is_specter_desktop_project(): + """The specter-desktop project detects itself via the name in its own + pyproject.toml. If that name changes (PEP 503 allows "." "-" and "_" to be + used interchangeably), the dev-server dies on startup, see #2526.""" + assert is_specter_desktop_project(repo_root) + assert not is_specter_desktop_project(xtestdata / "ext_root_fully_qualified_1") + assert not is_specter_desktop_project(xtestdata) + + +def test_is_specter_desktop_project_pep503_names(tmp_path): + for name in [ + "cryptoadvance.specter", + "cryptoadvance_specter", + "Cryptoadvance-Specter", + ]: + (tmp_path / "pyproject.toml").write_text( + f'[project]\nname = "{name}"\nversion = "1.2.3"\n' + ) + assert is_specter_desktop_project(tmp_path), f"{name} should be detected" + + (tmp_path / "pyproject.toml").write_text( + '[project]\nname = "boatacccorp.tretboot"\n' + ) + assert not is_specter_desktop_project(tmp_path) + + +def test_get_subclasses_for_clazz_in_cwd_in_specter_desktop_project(monkeypatch): + """No dynamic extension-discovery in the specter-desktop project itself. + Regression test: this used to raise "This should not happen!" when the + project got renamed to cryptoadvance_specter, breaking + `python3 -m cryptoadvance.specter server --config DevelopmentConfig`""" + # the production code takes a shortcut for tests, so pretend we're not testing + monkeypatch.delenv("PYTEST_CURRENT_TEST", raising=False) + assert get_subclasses_for_clazz_in_cwd(Service, cwd=repo_root) == [] + + def test_get_subclasses_for_clazz_in_cwd(caplog): caplog.set_level(logging.DEBUG) - classlist: List[type] = get_subclasses_for_clazz_in_cwd( - Service, cwd="./tests/xtestdata_testextensions" - ) - # damn, this is difficult to test - # assert len(classlist) == 3 + classlist: List[type] = get_subclasses_for_clazz_in_cwd(Service, cwd=xtestdata) + # That folder is a container of extension-projects, not an extension-project + # itself, so there is nothing importable in there + assert classlist == [] + assert "Detected Extension-style: adhoc" in caplog.text def test_get_subclasses_for_class(caplog): diff --git a/tests/test_util_shell.py b/tests/test_util_shell.py index 9b08b078e..73a7d9c30 100644 --- a/tests/test_util_shell.py +++ b/tests/test_util_shell.py @@ -23,7 +23,18 @@ def test_last_lines(caplog): assert lines[-2].startswith("OUT OF OR IN CONNECTION WITH THE SOFTWARE ") -def test_grep(): +def test_grep(tmp_path): + """grep returns a (found, line)-tuple. Asserting on the tuple itself is + always truthy, so always assert on the first element!""" from cryptoadvance.specter.util.shell import grep - assert grep("./pyproject.toml", 'name = "cryptoadvance.specter"') + some_file = tmp_path / "some_file.txt" + some_file.write_text('name = "cryptoadvance_specter"\nversion = "1.2.3"\n') + + found, line = grep(str(some_file), 'name = "cryptoadvance_specter"') + assert found + assert line.strip() == 'name = "cryptoadvance_specter"' + + found, line = grep(str(some_file), "does not exist") + assert not found + assert line is None From 48fea77b8aa5ac166df0263675204f529595fa7b Mon Sep 17 00:00:00 2001 From: k9ert <117085+k9ert@users.noreply.github.com> Date: Sat, 8 Aug 2026 14:57:14 +0200 Subject: [PATCH 09/24] fix: validate active API tokens (#2685) --- .gitignore | 4 + src/cryptoadvance/specter/api/security.py | 18 +++- src/cryptoadvance/specter/user.py | 8 +- tests/test_jwt.py | 101 ++++++++++++++++++++++ tests/test_rest.py | 23 +++-- 5 files changed, 137 insertions(+), 17 deletions(-) diff --git a/.gitignore b/.gitignore index ba0a6ec05..321fc7c9b 100644 --- a/.gitignore +++ b/.gitignore @@ -59,3 +59,7 @@ _bmad-output/ # Claude Code local workspace .claude/ + +# Local agent workspaces +/.agents/ +/.history/ diff --git a/src/cryptoadvance/specter/api/security.py b/src/cryptoadvance/specter/api/security.py index ea03e1c00..92d297e26 100644 --- a/src/cryptoadvance/specter/api/security.py +++ b/src/cryptoadvance/specter/api/security.py @@ -40,11 +40,21 @@ def verify_token(jwt_token): return abort(401) try: payload = jwt.decode(jwt_token, app.config["SECRET_KEY"], algorithms=["HS256"]) - username = payload["username"] - the_user = app.specter.user_manager.get_user_by_username(username) - if not the_user: + username = payload.get("username") + jwt_token_id = payload.get("jwt_token_id") + if ( + not isinstance(username, str) + or not username + or not isinstance(jwt_token_id, str) + or not jwt_token_id + ): return abort(401) - g.user = app.specter.user_manager.get_user_by_username(username) + the_user = app.specter.user_manager.get_user_by_username(username) + if not the_user or not the_user.verify_jwt_token_id_and_jwt_token( + jwt_token_id, jwt_token + ): + return abort(401) + g.user = the_user logger.info({"payload": payload}) logger.info(f"Rest-Request for user {username} PASSED JWT-test") return username diff --git a/src/cryptoadvance/specter/user.py b/src/cryptoadvance/specter/user.py index 28aef4d76..5462fa807 100644 --- a/src/cryptoadvance/specter/user.py +++ b/src/cryptoadvance/specter/user.py @@ -463,10 +463,10 @@ class User(UserMixin): def verify_jwt_token_id_and_jwt_token(self, jwt_token_id, jwt_token): # Verifying the JWT token ID and JWT token - if jwt_token_id in self.jwt_tokens: - if self.jwt_tokens[jwt_token_id]["jwt_token"] == jwt_token: - return True - return False + if not isinstance(self.jwt_tokens, dict) or not isinstance(jwt_token_id, str): + return False + token_info = self.jwt_tokens.get(jwt_token_id) + return isinstance(token_info, dict) and token_info.get("jwt_token") == jwt_token def get_jwt_token(self, jwt_token_id): # Getting a JWT token from the hashmap by ID diff --git a/tests/test_jwt.py b/tests/test_jwt.py index f8349fd48..fd3e1c51d 100644 --- a/tests/test_jwt.py +++ b/tests/test_jwt.py @@ -82,6 +82,99 @@ def test_token_endpoints(client, empty_data_folder, caplog): assert data["jwt_token_life"] == 360 jwt_token_id = data["jwt_token_id"] + jwt_token = data["jwt_token"] + + # API-created tokens remain registered after the user store is reloaded. + client.application.specter.user_manager.update() + + # An active, registered token authenticates successfully. The missing wallet + # is rejected by authorization after authentication has completed. + token_headers = {"Authorization": "Bearer " + jwt_token} + response = client.get( + "/api/v1alpha/wallets/missing/psbt", + follow_redirects=True, + headers=token_headers, + ) + assert response.status_code == 403 + + # A signed token must still be registered in the user's active token store. + unregistered_token = User.generate_jwt_token( + "someuser", User.generate_token_id(), "unregistered", 360 + ) + response = client.get( + "/api/v1alpha/wallets/missing/psbt", + follow_redirects=True, + headers={"Authorization": "Bearer " + unregistered_token}, + ) + assert response.status_code == 401 + + # Missing and non-string token identifiers fail closed. + expiry = datetime.datetime.utcnow() + datetime.timedelta(seconds=360) + invalid_payloads = [ + {"username": "someuser", "exp": expiry}, + {"username": "someuser", "jwt_token_id": ["invalid"], "exp": expiry}, + ] + for invalid_payload in invalid_payloads: + invalid_token = jwt.encode( + invalid_payload, + client.application.config["SECRET_KEY"], + algorithm="HS256", + ) + response = client.get( + "/api/v1alpha/wallets/missing/psbt", + follow_redirects=True, + headers={"Authorization": "Bearer " + invalid_token}, + ) + assert response.status_code == 401 + + # A different signed token cannot borrow an active token's identifier. + mismatched_token = User.generate_jwt_token( + "someuser", jwt_token_id, "mismatched", 360 + ) + response = client.get( + "/api/v1alpha/wallets/missing/psbt", + follow_redirects=True, + headers={"Authorization": "Bearer " + mismatched_token}, + ) + assert response.status_code == 401 + + # Malformed persisted records fail closed instead of raising an error. + user_details = client.application.specter.user_manager.get_user_by_username( + "someuser" + ) + stored_token_info = user_details.jwt_tokens[jwt_token_id] + user_details.jwt_tokens[jwt_token_id] = {} + user_details.save_info() + client.application.specter.user_manager.update() + response = client.get( + "/api/v1alpha/wallets/missing/psbt", + follow_redirects=True, + headers=token_headers, + ) + assert response.status_code == 401 + user_details = client.application.specter.user_manager.get_user_by_username( + "someuser" + ) + user_details.jwt_tokens[jwt_token_id] = stored_token_info + user_details.save_info() + + # A malformed persisted token container also fails closed after reload. + stored_tokens = user_details.jwt_tokens + user_details.jwt_tokens = [] + user_details.save_info() + client.application.specter.user_manager.update() + response = client.get( + "/api/v1alpha/wallets/missing/psbt", + follow_redirects=True, + headers=token_headers, + ) + assert response.status_code == 401 + user_details = client.application.specter.user_manager.get_user_by_username( + "someuser" + ) + user_details.jwt_tokens = stored_tokens + user_details.save_info() + client.application.specter.user_manager.update() # testing GET request response = client.get("/api/v1alpha/token", follow_redirects=True, headers=headers) @@ -133,6 +226,14 @@ def test_token_endpoints(client, empty_data_folder, caplog): data = json.loads(response.data) assert data["message"] == "Token deleted" + # Deletion immediately revokes the bearer token. + response = client.get( + "/api/v1alpha/wallets/missing/psbt", + follow_redirects=True, + headers=token_headers, + ) + assert response.status_code == 401 + # retry accessing a deleted token response = client.get( "/api/v1alpha/token/" + jwt_token_id, follow_redirects=True, headers=headers diff --git a/tests/test_rest.py b/tests/test_rest.py index 1f2ba2792..9dfb3ae84 100644 --- a/tests/test_rest.py +++ b/tests/test_rest.py @@ -17,6 +17,17 @@ from cryptoadvance.specter.user import User logger = logging.getLogger(__name__) +def create_registered_jwt_token(specter, username): + user = specter.user_manager.get_user_by_username(username) + jwt_token_id = User.generate_token_id() + jwt_token_life = 3600 + jwt_token = User.generate_jwt_token( + username, jwt_token_id, "test token", jwt_token_life + ) + user.add_jwt_token(jwt_token_id, jwt_token, "test token", jwt_token_life) + return jwt_token + + def almost_equal(a: Number, b: Number, precision: float = 0.01) -> bool: """ Checks if a and b are not very different. @@ -58,9 +69,7 @@ def test_rr_psbt_get(client, specter_regtest_configured, bitcoin_regtest, caplog # Admin but not authorized (admin is NOT allowed to read everything) headers = { "Authorization": "Bearer " - + User.generate_jwt_token( - "admin", "tokenid", "tokendescription", random.randrange(100, 200) - ) + + create_registered_jwt_token(specter_regtest_configured, "admin") } result = client.get( "/api/v1alpha/wallets/a_simple_wallet/psbt", @@ -76,9 +85,7 @@ def test_rr_psbt_get(client, specter_regtest_configured, bitcoin_regtest, caplog # Proper authorized (the wallet is owned by someuser) headers = { "Authorization": "Bearer " - + User.generate_jwt_token( - "someuser", "tokenid", "tokendescription", random.randrange(100, 200) - ) + + create_registered_jwt_token(specter_regtest_configured, "someuser") } result = client.get( "/api/v1alpha/wallets/a_simple_wallet/psbt", @@ -97,9 +104,7 @@ def test_rr_psbt_post(specter_regtest_configured, bitcoin_regtest, client, caplo headers = { "Authorization": "Bearer " - + User.generate_jwt_token( - "someuser", "tokenid", "tokendescription", random.randrange(100, 200) - ), + + create_registered_jwt_token(specter_regtest_configured, "someuser"), "Content-type": "application/json", } From 3d554fbc2ed13d94f5069282f19c3651c6384ef5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=B3bert=20Nagy?= Date: Sat, 8 Aug 2026 19:33:01 +0300 Subject: [PATCH 10/24] Warn on ColdCard Mk3 seed-entropy advisory at device setup (#2676) Co-authored-by: k9ert <117085+k9ert@users.noreply.github.com> --- src/cryptoadvance/specter/static/output.css | 4 ++++ .../templates/device/new_device/new_device_keys.jinja | 10 ++++++++++ .../specter/templates/device/new_device_manual.jinja | 2 +- 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/src/cryptoadvance/specter/static/output.css b/src/cryptoadvance/specter/static/output.css index b669522b6..427873a33 100644 --- a/src/cryptoadvance/specter/static/output.css +++ b/src/cryptoadvance/specter/static/output.css @@ -1100,6 +1100,10 @@ input[type="number"]::-webkit-outer-spin-button, z-index: 50; } +.z-20 { + z-index: 20; +} + .z-30 { z-index: 30; } diff --git a/src/cryptoadvance/specter/templates/device/new_device/new_device_keys.jinja b/src/cryptoadvance/specter/templates/device/new_device/new_device_keys.jinja index 6b5f35a79..e0a0661db 100644 --- a/src/cryptoadvance/specter/templates/device/new_device/new_device_keys.jinja +++ b/src/cryptoadvance/specter/templates/device/new_device/new_device_keys.jinja @@ -30,6 +30,16 @@ {% endif %} + +

{{ _("Connect your ColdCard to the computer via USB and unlock it or upload a wallet export file from micro SD card.") }}

diff --git a/src/cryptoadvance/specter/templates/device/new_device_manual.jinja b/src/cryptoadvance/specter/templates/device/new_device_manual.jinja index f0357c52b..3eb1a1558 100644 --- a/src/cryptoadvance/specter/templates/device/new_device_manual.jinja +++ b/src/cryptoadvance/specter/templates/device/new_device_manual.jinja @@ -49,7 +49,7 @@

{{ _("Specify account number (advanced)") }}

-
+
{{ _("Scan QR Code") }} From 693338d3afd1afd11604e8178dedc8280e26bbd9 Mon Sep 17 00:00:00 2001 From: Bunlong Heng Date: Sat, 8 Aug 2026 13:13:31 -0400 Subject: [PATCH 11/24] fix(swan): add timeout to remote HTTP requests to prevent hang (#2687) Co-authored-by: k9ert <117085+k9ert@users.noreply.github.com> Co-authored-by: Claude Opus 5 --- .../specter/services/extension_gen.py | 4 +- src/cryptoadvance/specterext/swan/client.py | 61 +++++++++++++----- tests/test_specterext_swan_client.py | 62 +++++++++++++++++++ 3 files changed, 109 insertions(+), 18 deletions(-) diff --git a/src/cryptoadvance/specter/services/extension_gen.py b/src/cryptoadvance/specter/services/extension_gen.py index a0304d49d..e47a1a6aa 100644 --- a/src/cryptoadvance/specter/services/extension_gen.py +++ b/src/cryptoadvance/specter/services/extension_gen.py @@ -152,7 +152,7 @@ class ExtGen: shutil.copy(sourcepath, targetpath) print(f" --> Created {targetpath} (copied)") else: - r = requests.get(self.env.loader.url_for_template(sourcepath)) + r = requests.get(self.env.loader.url_for_template(sourcepath), timeout=30) open(targetpath, "wb").write(r.content) print(f" --> Created {targetpath} (via Github)") @@ -233,7 +233,7 @@ class GithubUrlLoader(BaseLoader): def get_source(self, environment, template): url = self.url_for_template(template) for attempt in range(3): - r = requests.get(url) + r = requests.get(url, timeout=30) if r.status_code == 200: return r.text, url, None if r.status_code == 429 and attempt < 2: diff --git a/src/cryptoadvance/specterext/swan/client.py b/src/cryptoadvance/specterext/swan/client.py index 70b44bbfd..c9695fbcc 100644 --- a/src/cryptoadvance/specterext/swan/client.py +++ b/src/cryptoadvance/specterext/swan/client.py @@ -137,12 +137,25 @@ class SwanClient: ).decode() auth_header["Authorization"] = f"Basic {auth_hash}" - response = requests.post( - f"{self.api_url}/oidc/token", - data=payload, - headers=auth_header, - ) - resp = json.loads(response.text) + try: + response = requests.post( + f"{self.api_url}/oidc/token", + data=payload, + headers=auth_header, + timeout=30, + ) + except requests.exceptions.RequestException as e: + logger.exception(e) + raise SwanApiException( + f"Could not reach the Swan API ({self.api_url}/oidc/token): {e}" + ) from e + try: + resp = json.loads(response.text) + except ValueError as e: + logger.error(f"{response.status_code}: {response.text}") + raise SwanApiException( + f"Swan API returned no valid json ({response.status_code}): {response.text}" + ) from e """ { "access_token": "***************", @@ -184,27 +197,43 @@ class SwanClient: "User-Agent": "Specter Desktop", "Authorization": f"Bearer {access_token}", } + request_context = f"endpoint: {self.api_url}{endpoint} | method: {method} | payload: {json.dumps(json_payload, indent=4)}" + try: if method == "GET": - response = requests.get(self.api_url + endpoint, headers=auth_header) + response = requests.get( + self.api_url + endpoint, headers=auth_header, timeout=30 + ) elif method in ["POST", "PATCH", "PUT", "DELETE"]: response = requests.request( method=method, url=self.api_url + endpoint, headers=auth_header, json=json_payload, + timeout=30, ) - if response.status_code != 200: - raise SwanApiException(f"{response.status_code}: {response.text}") - return response.json() - except Exception as e: - # TODO: tighten up expected Exceptions + else: + raise SwanApiException(f"Unsupported method: {method}") + except requests.exceptions.RequestException as e: + # Timeouts, connection errors, ... : no response to report about logger.exception(e) - logger.error( - f"endpoint: {self.api_url}{endpoint} | method: {method} | payload: {json.dumps(json_payload, indent=4)}" - ) + logger.error(request_context) + raise SwanApiException(f"Could not reach the Swan API: {e}") from e + + if response.status_code != 200: + logger.error(request_context) logger.error(f"{response.status_code}: {response.text}") - raise e + raise SwanApiException(f"{response.status_code}: {response.text}") + + try: + return response.json() + except ValueError as e: + logger.exception(e) + logger.error(request_context) + logger.error(f"{response.status_code}: {response.text}") + raise SwanApiException( + f"Swan API returned no valid json ({response.status_code}): {response.text}" + ) from e def get_autowithdrawal_addresses(self, swan_wallet_id: str) -> dict: """ diff --git a/tests/test_specterext_swan_client.py b/tests/test_specterext_swan_client.py index c4475773e..6b9a41fbb 100644 --- a/tests/test_specterext_swan_client.py +++ b/tests/test_specterext_swan_client.py @@ -6,7 +6,10 @@ from unittest.mock import MagicMock import pytest import mock from mock import Mock, patch +import requests + from cryptoadvance.specterext.swan.client import ( + SwanApiException, SwanApiRefreshTokenException, SwanClient, ) @@ -106,6 +109,65 @@ def test_expired_access_token(): sc._get_access_token() +def construct_client_with_valid_token(): + """A client which won't need to fetch an access_token first""" + return SwanClient( + "a_hostname", "forever_valid_access_token", 5000000000, "a_refresh_token" + ) + + +def test_authenticated_request_get_timeout(app_no_node): + """A timeout must surface as SwanApiException, not as an UnboundLocalError""" + sc = construct_client_with_valid_token() + with app_no_node.app_context(): + with mock.patch( + "requests.get", side_effect=requests.exceptions.Timeout("simulated timeout") + ): + with pytest.raises(SwanApiException) as exc_info: + sc.authenticated_request("/some/endpoint") + assert "simulated timeout" in str(exc_info.value) + assert isinstance(exc_info.value.__cause__, requests.exceptions.Timeout) + + +def test_authenticated_request_post_timeout(app_no_node): + """Same for the methods going through requests.request""" + sc = construct_client_with_valid_token() + with app_no_node.app_context(): + with mock.patch( + "requests.request", + side_effect=requests.exceptions.ConnectTimeout("simulated timeout"), + ): + with pytest.raises(SwanApiException) as exc_info: + sc.authenticated_request( + "/some/endpoint", method="POST", json_payload={"muuh": "meeh"} + ) + assert isinstance(exc_info.value.__cause__, requests.exceptions.ConnectTimeout) + + +def test_authenticated_request_error_status_code(app_no_node): + sc = construct_client_with_valid_token() + fake_response = Mock() + fake_response.status_code = 500 + fake_response.text = "Internal Server Error" + with app_no_node.app_context(): + with mock.patch("requests.get", return_value=fake_response): + with pytest.raises(SwanApiException, match="500: Internal Server Error"): + sc.authenticated_request("/some/endpoint") + + +def test_get_access_token_timeout(app_no_node): + """The token-endpoint is used before authenticated_request can even start""" + sc = SwanClient("a_hostname", "an_expired_access_token", 1000, "a_refresh_token") + with app_no_node.app_context(): + with mock.patch( + "requests.post", + side_effect=requests.exceptions.Timeout("simulated timeout"), + ): + with pytest.raises(SwanApiException) as exc_info: + sc.authenticated_request("/some/endpoint") + assert isinstance(exc_info.value.__cause__, requests.exceptions.Timeout) + + @patch("requests.delete") @patch("requests.request") @patch("requests.patch") From 426ed39aacf7b695a4d7be516329fb2dd3c45b6a Mon Sep 17 00:00:00 2001 From: al-munazzim Date: Sat, 8 Aug 2026 19:48:20 +0200 Subject: [PATCH 12/24] Warn that Specter auth does not encrypt data folder (#2683) Co-authored-by: Nazim --- docs/faq.md | 7 +++++++ .../specter/templates/settings/auth_settings.jinja | 8 ++++++++ 2 files changed, 15 insertions(+) diff --git a/docs/faq.md b/docs/faq.md index 43211f3e9..819dce3e2 100644 --- a/docs/faq.md +++ b/docs/faq.md @@ -31,6 +31,7 @@ - [*Can this also work with external nodes like Casa, MyNode, and Raspilitz?*](#can-this-also-work-with-external-nodes-like-casa-mynode-and-raspilitz) - [*Can I use Tor?*](#can-i-use-tor) - [I forgot my password, how can I reset it?](#i-forgot-my-password-how-can-i-reset-it) + - [Does the Specter password encrypt my wallet data files?](#does-the-specter-password-encrypt-my-wallet-data-files) - [BACKING UP FUNDS](#backing-up-funds) - [*If something happens to the `~/.specter` folder, is it still possible to **restore** access to multisigs created there (assuming there is no backup of the `~/.specter` folder)?*](#if-something-happens-to-the-specter-folder-is-it-still-possible-to-restore-access-to-multisigs-created-there-assuming-there-is-no-backup-of-the-specter-folder) - [*To recover a multisig that was built on specter (eg: 2 of 3 with ColdCard), is having the seeds of all 3 signing wallets sufficient or do we need to backup more info?*](#to-recover-a-multisig-that-was-built-on-specter-eg-2-of-3-with-coldcard-is-having-the-seeds-of-all-3-signing-wallets-sufficient-or-do-we-need-to-backup-more-info) @@ -241,6 +242,12 @@ Depending on "what's written in `somethingInHere`: * If it's `usernamepassword`, you won't be able to recover the password but you can deactivate it by setting it to `none` and restart Specter. * If it's `none` (or you just set it to `none`) you can login without any password. So hurry up with setting it again within specter. +### Does the Specter password encrypt my wallet data files? + +No. Specter authentication protects access to the app/session, but it does not encrypt the whole Specter data folder at rest. The data folder contains wallet metadata files such as xpubs, addresses, wallet names, labels, and transaction metadata that may be readable by anyone or any process with filesystem access to that folder. + +If this is in your threat model, use OS-level disk encryption (for example FileVault on macOS), make sure backups and sync tools that include the Specter data folder are encrypted and access-controlled, and consider running Specter from a data folder located on an encrypted volume/container via `--specter-data-folder`. + ## BACKING UP FUNDS ### *If something happens to the `~/.specter` folder, is it still possible to **restore** access to multisigs created there (assuming there is no backup of the `~/.specter` folder)?* diff --git a/src/cryptoadvance/specter/templates/settings/auth_settings.jinja b/src/cryptoadvance/specter/templates/settings/auth_settings.jinja index 13b17784b..e9f5ffecb 100644 --- a/src/cryptoadvance/specter/templates/settings/auth_settings.jinja +++ b/src/cryptoadvance/specter/templates/settings/auth_settings.jinja @@ -22,6 +22,14 @@
{% endif %} + +