release: 7.14.2 security line — the device shows what it signs

Every defect closed here is the same shape: the device signed bytes it never
displayed, or displayed text it could not vouch for.

EVM
  omitted chain_id no longer yields a pre-EIP-155 signature; it is refused
  before any screen is drawn
  arbitrary contract data requires AdvancedMode, and the check gates rather
  than warns
  0x clear-signing is bound to complete calldata and to both tokens resolving
  calldata beyond the initial chunk is no longer described from hardcoded
  ABI offsets

EIP-712
  the structured JSON path is withdrawn: it could not guarantee that a
  displayed value was the value being hashed, and one screen took its title
  from the attacker-supplied domain name
  EthereumSignTypedHash requires AdvancedMode and shows an explicit
  blind-sign screen first

Display
  message signing renders every byte, escaping non-printables, instead of
  stopping at the first NUL
  bodies too long for the screen are paged with n/m titles rather than
  silently clipped
  the fit measurement is draw_string()'s own walk with pixel writes off, so
  measuring and drawing cannot disagree

Altcoins
  THORChain and Maya memos keep their last character and refuse a declared
  length that misdescribes its own content; trailing memo fields are disclosed
  Osmosis prints the exact signed integer beside the exact denom
  Cosmos IBC shows the receiver instead of printing the sender twice
  Solana SPL amounts are scaled by the decimals in the signed instruction, and
  never render a nonzero transfer as zero
  Binance denom formatting no longer writes past its buffer

Setup and consent
  an injected RecoveryDevice cannot write settings mid-ceremony
  a cancelled passphrase confirmation is not cached
  cancelled authenticator and Uniswap operations do not complete

Reproduced on signed v7.14.1 before the fixes and verified on 7.14.2 silicon
after them. CI now captures the OLED for these paths; it previously captured
none of them, because the harness read the firmware version with grep -oP,
which BusyBox lacks, and silently fell back to 7.14.0.

Not claimed: independent re-exploitation and a final adversarial round are
incomplete, and the fit measurement covers layout_standard_notification only,
so custom-layout address and xpub bodies still clip without warning.

deps/python-keepkey pins keepkey/python-keepkey#216, which merges once this is
green.

Author: BitHighlander

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ on:
         default: false
 
 env:
-  BASE_IMAGE: kktech/firmware:v15
+  BASE_IMAGE: kktech/firmware@sha256:7438e53933d47d53157ed6d96d864cb208597e62dce26235ace09d1063427fa2
   EMU_IMAGE: kkemu-ci
 
 jobs:
@@ -88,8 +88,13 @@ jobs:
 
       - name: Install gitleaks
         run: |
-          GITLEAKS_VERSION=$(curl -sSf https://api.github.com/repos/gitleaks/gitleaks/releases/latest \
-            | grep -oP '"tag_name":\s*"v\K[^"]+')
+          # PINNED. Tracking releases/latest means a new upstream ruleset can turn
+          # this gate red with no change to this repository -- which is exactly what
+          # happened: a newer generic-api-key rule began flagging published BIP32 test
+          # vectors in 2014/2018 history, and because every build job declares
+          # `needs: [.., secret-scan]`, the whole build and test graph was SKIPPED
+          # rather than failed. Bump deliberately, with the scan re-verified. See #424.
+          GITLEAKS_VERSION=8.30.0
           curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
             | tar -xz -C /usr/local/bin gitleaks
           gitleaks version
@@ -207,6 +212,20 @@ jobs:
           done
           [ "$FAILED" = "0" ] || exit 1
 
+      - name: Enforce RNG source invariants
+        run: |
+          if grep -q 'RAND_PLATFORM_INDEPENDENT=0' CMakeLists.txt; then
+            echo "::error::RAND_PLATFORM_INDEPENDENT is a definedness switch, not a value toggle"
+            exit 1
+          fi
+          grep -q 'add_definitions(-DRAND_PLATFORM_INDEPENDENT)' CMakeLists.txt
+          grep -q '#ifndef RAND_PLATFORM_INDEPENDENT' lib/rand/rng.c
+          grep -q 'defined(EMULATOR) && defined(__arm__)' lib/rand/rng.c
+          if grep -En 'return[[:space:]]+random\(\)' lib/rand/rng.c; then
+            echo "::error::Emulator cryptography must not use libc random()"
+            exit 1
+          fi
+
   # ═══════════════════════════════════════════════════════════
   # STAGE 2: BUILD — compile only after gate passes
   # ═══════════════════════════════════════════════════════════
@@ -490,7 +509,12 @@ jobs:
   #     pb2 files expect; newer protoc generates Python that requires
   #     newer protobuf runtime, which breaks the python-keepkey suite).
   #   - protobuf 3.20.3 (Python runtime — strict pin).
-  #   - nanopb 0.3.9.4.post3 (the proto generator the firmware build uses).
+  #   - nanopb 0.3.9.4.post3 — NOTE: this is NOT the version the firmware
+  #     builder image uses. The pinned image builds nanopb-0.3.9.8 from source
+  #     (see Dockerfile). This job installs a different generator via pip, so
+  #     headers produced here are not byte-comparable with the firmware build's.
+  #     Tracked in GH #425; do not treat this job's output as provenance for
+  #     the firmware artifacts.
   #   - KK_DEBUG_LINK=ON (default OFF; without it,
   #     fsm_msgDebugLinkGetState is excluded from the build and any
   #     read_layout() call hangs the test).
@@ -726,6 +750,67 @@ jobs:
 
   # ═══════════════════════════════════════════════════════════
   # STAGE 4: PUBLISH — manual trigger only, all tests must pass
+
+  # ═══════════════════════════════════════════════════════════
+  # GATE: one authoritative answer for the whole graph
+  # ═══════════════════════════════════════════════════════════
+  #
+  # Every build and test job declares `needs: [lint-format, static-analysis,
+  # check-submodules, secret-scan]`. When one of those gate jobs fails, GitHub
+  # marks the whole downstream graph SKIPPED rather than failed -- and a skipped
+  # job is not a red check. The run summary then shows green ticks on whatever
+  # finished, which reads as healthy unless someone opens the job list.
+  #
+  # That has now happened three times on the 7.14.2 line: gitleaks failing on
+  # develop, lint-format timing out inside its apt.llvm.org install (#471), and
+  # gitleaks again after an unpinned upstream bump. Each time the ARM build,
+  # the unit tests and both python suites produced NOTHING while the run looked
+  # partially green.
+  #
+  # This job exists so that cannot happen quietly. It needs every required job,
+  # runs with `if: always()` so it executes even when they skip, and fails
+  # unless each one reports exactly `success`. failure, cancelled and skipped
+  # are all treated as not-success, because for a required job they are.
+  #
+  # publish-emulator is deliberately absent: it is workflow_dispatch-only and
+  # is legitimately skipped on every push and pull_request.
+  #
+  # Point branch protection at THIS job rather than the individual ones. It is
+  # the only check whose green means "the entire graph ran and passed".
+  ci-gate:
+    name: CI gate
+    if: always()
+    needs:
+      - lint-format
+      - secret-scan
+      - static-analysis
+      - check-submodules
+      - build-emulator
+      - build-arm-firmware
+      - unit-tests
+      - python-integration-tests
+      - python-dylib-tests
+      - generate-test-report
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Assert every required job succeeded
+        env:
+          NEEDS_JSON: ${{ toJSON(needs) }}
+        run: |
+          set -euo pipefail
+          echo "$NEEDS_JSON" | jq -r 'to_entries[] | "\(.value.result)\t\(.key)"' | sort
+          echo
+          NOT_SUCCESS=$(echo "$NEEDS_JSON" \
+            | jq -r 'to_entries[] | select(.value.result != "success") | .key')
+          if [ -n "$NOT_SUCCESS" ]; then
+            echo "::error::Required jobs did not succeed: $(echo $NOT_SUCCESS | tr '\n' ' ')"
+            echo "A skipped or cancelled required job is NOT a pass. If a gate-stage"
+            echo "job failed, everything downstream was skipped and produced no signal."
+            exit 1
+          fi
+          echo "All required jobs reported success."
+
   # ═══════════════════════════════════════════════════════════
 
   publish-emulator:

.github/workflows/release.yml

@@ -18,7 +18,7 @@ on:
       - 'v*'
 
 env:
-  BASE_IMAGE: kktech/firmware:v15
+  BASE_IMAGE: kktech/firmware@sha256:7438e53933d47d53157ed6d96d864cb208597e62dce26235ace09d1063427fa2
 
 permissions:
   contents: write
@@ -92,6 +92,14 @@ jobs:
         run: |
           echo "# KeepKey Firmware v${{ needs.validate.outputs.fw_version }} — Hash Manifest" > HASHES.txt
           echo "" >> HASHES.txt
+          # Provenance: name the exact toolchain these bytes came out of. BASE_IMAGE
+          # is a sha256 manifest digest, not a tag, so this identifies one immutable
+          # image rather than whatever the tag pointed at on the day. Without it a
+          # green CI build and a locally reproduced binary cannot be shown to be the
+          # same toolchain product. See GH #425.
+          echo "builder image    ${BASE_IMAGE}" >> HASHES.txt
+          echo "source commit    ${GITHUB_SHA}" >> HASHES.txt
+          echo "" >> HASHES.txt
           for f in *.bin; do
             [ -f "$f" ] || continue
             FULL_HASH=$(sha256sum "$f" | awk '{print $1}')

.gitleaks.toml

@@ -0,0 +1,98 @@
+title = "KeepKey firmware gitleaks configuration"
+
+# Start from the upstream ruleset and only narrow it, never widen it.
+[extend]
+useDefault = true
+
+[allowlist]
+description = """
+Two U2F attestation artifacts are public by design and must not fail the scan.
+
+1. include/keepkey/firmware/u2f/u2f_keys.h — U2F_ATT_PRIV_KEY[]
+
+   This is the FIDO U2F batch attestation key. The standard deliberately shares one
+   attestation key across a whole batch of devices, so that an attestation
+   certificate identifies a model rather than an individual unit. The key therefore
+   has to be present in every device: it is compiled into every firmware image and
+   is extractable from any public release binary. It authenticates nothing, protects
+   no user funds or data, and is not a wallet key or a code-signing key.
+
+   The certificate it accompanies is self-signed as CN=KeepKey U2F and expires
+   2028-10-01.
+
+2. include/keepkey/firmware/u2f/trezordevkey.pem
+
+   An orphaned key file that corresponds to nothing the firmware ships. Its private
+   scalar does not match U2F_ATT_PRIV_KEY[], and its public key does not match the
+   public key in the compiled attestation certificate — verified by decoding both.
+   It is neither the attestation key nor the key that signed the attestation cert.
+
+   It is allowlisted rather than merely deleted because CI scans with fetch-depth 0,
+   so gitleaks reads full history and this file has been present since commit
+   fe3e5e001 (2019-04-27). Deleting it from the working tree would not clear the
+   historical finding, and rewriting published history to remove a key that secures
+   nothing is not a trade worth making.
+
+   Removing the dead file and correcting genkeys.sh — which regenerates the
+   certificate as CN="Trezor U2F" and would also swap in this non-shipping key — is
+   tracked separately.
+
+3. deps/ — third-party and submodule content
+
+   CI checks out without submodules, but it scans with fetch-depth 0, and crypto
+   dependencies were vendored directly into this repository before they became
+   submodules. Every finding under deps/ is the generic-api-key rule firing on
+   high-entropy constants and test vectors in that vendored crypto — for example
+   the ed25519-donna headers and the AES self-test tables. None is a credential,
+   and none of it is KeepKey-authored code.
+
+4. docs/ — prose and recorded submodule pins
+
+   The security documentation records exact submodule pins, and gitleaks scores a
+   40-character git commit SHA at entropy ~3.8 and reports it as a generic API key
+   (for example the python-keepkey pin in
+   docs/security/7.15.0-rc21-clearsign-release-control.md).
+
+   This is scoped by PATH rather than by a regex on the secret. An earlier version
+   of this file allowlisted the pattern \\b[0-9a-f]{40}\\b globally, which was
+   rightly flagged in review: that suppressed every 40-character lowercase hex
+   finding anywhere in the tree, including in source, not merely documented commit
+   hashes. Path scoping keeps the exemption where the false positives actually are.
+
+   Anything under docs/ is prose intended for publication. A credential must never
+   be committed there in the first place, and this exemption is not a licence to do
+   so — it is an acknowledgement that git SHAs in prose are not secrets.
+
+5. tests/ — historical, pre-submodule test vectors
+
+   This path does not exist in the working tree. The python test suite lived at the
+   repository root before it became the deps/python-keepkey submodule, and CI scans
+   with fetch-depth 0, so gitleaks still reads those commits.
+
+   Every finding here is the generic-api-key rule firing on published BIP32 test
+   vectors — the flagged lines are WIF private keys printed next to their own address
+   and public key as documentation, e.g. tests/test_ecies.py (2014, inherited from
+   Trezor) and tests/test_msg_eos_signtx.py (2018). They are upstream test fixtures,
+   published for a decade, and secure nothing.
+
+   Scoped by path for the same reason as deps/: the secrets are real key material by
+   format, so a regex exemption would be dangerous, whereas the path is provably dead.
+
+   The cost of a path exemption, stated plainly: a genuine secret committed under
+   tests/ would NOT be caught. That is acceptable only while the directory does not
+   exist. If a tests/ tree is ever reintroduced at the repository root, remove this
+   exemption in the same commit — verified by negative control, a real EC private key
+   planted under tests/ is ignored, while the same key under lib/firmware/ is still
+   detected.
+
+Scope note: every exemption is scoped by path and the default ruleset is otherwise
+intact, so a genuine secret committed in source still fails the scan. Verified by
+negative control: a planted EC private key under lib/firmware/ is still detected.
+"""
+paths = [
+  '''include/keepkey/firmware/u2f/trezordevkey\.pem''',
+  '''include/keepkey/firmware/u2f/u2f_keys\.h''',
+  '''^deps/''',
+  '''^docs/''',
+  '''^tests/''',
+]

CMakeLists.txt

@@ -9,7 +9,7 @@ endif()
 
 project(
   KeepKeyFirmware
-  VERSION 7.14.1
+  VERSION 7.14.2
   LANGUAGES C CXX ASM)
 
 set(BOOTLOADER_MAJOR_VERSION 2)
@@ -105,7 +105,11 @@ add_definitions(-DUSE_MONERO=0)
 add_definitions(-DUSE_NEM=0)
 add_definitions(-DUSE_NANO=1)
 
-add_definitions(-DRAND_PLATFORM_INDEPENDENT=0)
+# trezor-crypto's rand.c tests only whether this macro is defined.  A value of
+# zero therefore did not disable anything; it excluded the library's insecure
+# test LCG by definedness.  Use the upstream spelling so that intent is clear,
+# and let lib/rand/rng.c fail the build if this provider contract is removed.
+add_definitions(-DRAND_PLATFORM_INDEPENDENT)
 
 add_definitions(-DPB_FIELD_16BIT=1)
 add_definitions(-DPB_NO_ERRMSG=1)

deps/device-protocol

@@ -1,9 +1,14 @@
 Prerequisites
 -------------
 
-Install nanopb-0.3.9.4 from:
+Install nanopb-0.3.9.8 from:
 
-`https://github.com/nanopb/nanopb/releases/tag/nanopb-0.3.9.4`
+`https://github.com/nanopb/nanopb/releases/tag/nanopb-0.3.9.8`
+
+This must match the version baked into the pinned builder image
+(`Dockerfile`, `git clone --branch nanopb-0.3.9.8`). Generated headers
+differ between nanopb majors, so a mismatch means a local build and a CI
+build are not the same product even from the same source. See GH #425.
 
 Install the python-protobuf dependency: