test: consolidate the 7.14.3 and 7.15 host suites onto one head

The same four test changes were cherry-picked onto two branches, and the two
copies of test_protected_ping_preserves_message_presence_after_debug_read and
the ripple get_address debug-capture assertion drifted apart: each copy was
gated at whatever release its branch was cut for (7.14.2, 7.14.3, 7.15.0), so
the gate recorded which branch the test lived on rather than which firmware
carries the fix.

Both fixes are present on all three products. fsm_msgPing is byte-identical
between the 7.14.2 and 7.14.3 candidates, and the ripple response-arena fix is
in fsm_msg_ripple.h on the 7.14.2 candidate as well. The floor is therefore
7.14.2 on both, which is what the 7.14.2 line already used before the gate was
ratcheted up on each later branch.

The reset-dice and storage-CRC copies are byte-identical and dedupe on merge.
The two ripple sign_tx commits are complementary, not duplicated: one asserts
memo rejection below 7.15 and self-skips above it, the other un-skips the
THORChain memo test at 7.15.0.

Also drops the claim that older release backports are separate. They are not
separate: 1ce4d3961 on 7.14.3 and 885609fbe on 7.15 reach the same end state.

Author: BitHighlander

scripts/generate-test-report.py

@@ -2025,7 +2025,7 @@ def _arg_shown(a):
          # lookup table cannot be resolved on-device, so today the device signs
          # accounts it never showed. These four are the additive invariant
          # (section F) restated for Solana, and R-4.1 of SRS-7.15. The
-         # protocol work first ships in firmware 7.16.
+         # canonical 7.15 product includes this protocol work.
          ('S26', 'test_msg_solana_lut_attestation',
           'test_attested_accounts_are_shown_and_blind_sign_still_follows',
           'Attested lookup-table accounts are shown, and the blind-sign warning survives',
@@ -3293,7 +3293,7 @@ def screenshot_test_list(fw_version):
     # R-4.1. Gated on requires_message('LoadClearsignSigner'), so if provider
     # loading regressed, all four would skip and the report would certify a
     # feature it never exercised.
-    'test_msg_solana_lut_attestation': '7.16.0',
+    'test_msg_solana_lut_attestation': '7.15.0',
 }
 
 # These modules are mandatory only on the multi-chain product. Their handlers

tests/test_msg_ethereum_clear_signing.py

@@ -1100,11 +1100,8 @@ def test_replay_rejected_when_digest_differs(self):
     def test_advanced_mode_gate(self):
         """AdvancedMode OFF + unknown contract + no metadata → hard reject;
         ON → raw-data confirm path signs; recognized ERC-20 transfer unaffected."""
-        # RC18 predates the rule that loading a runtime signer itself requires
-        # AdvancedMode. The first released firmware line carrying that complete
-        # gate is 7.16; the older blind-transaction gate remains covered by
-        # test_msg_ethereum_signtx on RC18.
-        self.requires_firmware("7.16.0")
+        # Canonical 7.15 requires AdvancedMode before runtime signer loading.
+        self.requires_firmware("7.15.0")
         n = parse_path(DEVICE_PATH)
         data = aave_supply_calldata(1000000000000000000)
 

tests/test_msg_ethereum_clearsign_additive.py

@@ -87,10 +87,9 @@
 # METADATA_MAX_KEYS in include/keepkey/firmware/signed_metadata.h.
 METADATA_MAX_KEYS = 4
 
-# RC18 verifies runtime metadata, but the successful-decode path did not yet
-# guarantee that the ordinary raw review survived byte-for-byte. That security
-# invariant landed after RC18 and first ships on the 7.16 line.
-ADDITIVE_REVIEW_FIRMWARE = "7.16.0"
+# The canonical 7.15 product requires additive runtime provider review.
+# Do not inherit the earlier RC18 candidate's capability assumptions.
+ADDITIVE_REVIEW_FIRMWARE = "7.15.0"
 
 # The Aave V3 supply() transaction every additive test signs. Real ABI
 # calldata (selector + 4 x 32-byte words), so the metadata below binds a

tests/test_msg_ethereum_erc20_uniswap_liquidity.py

@@ -29,52 +29,45 @@ class TestMsgEthereumUniswaptxERC20(common.KeepKeyTest):
 
     def setUp(self):
         super(TestMsgEthereumUniswaptxERC20, self).setUp()
-        # Every test in this file approves or spends against the ETH/FOX pool,
-        # whose contract is NOT in the token table. Approving an unknown token
-        # contract does not complete on the emulator: the device never returns,
-        # so these tests HANG instead of failing, and CI kills the whole run on
-        # its no-output timeout -- taking every later test with it.
-        #
-        # This is a firmware-side limitation, not a gap in the tests. It is
-        # gated here rather than deleted so the coverage returns automatically
-        # once the firmware completes this path. Known-token approves
-        # (test_msg_ethereum_erc20_approve) run here and pass; on real hardware
-        # this path is exercised by the app.
-        if self.client.features.firmware_variant[0:8] == "Emulator":
-            self.skipTest(
-                "Uniswap liquidity against an unknown token contract does not "
-                "complete on the emulator")
-    
+        # Canonical 7.15 routes unknown token contracts through explicitly
+        # authorized raw review. Exercise that path instead of an emulator skip.
+        self.requires_firmware("7.15.0")
+
     def test_sign_uni_approve_liquidity_ETH(self):
         self.requires_fullFeature()
         self.requires_firmware("7.1.0")
         self.setup_mnemonic_nopin_nopassphrase()
+        self.client.apply_policy("AdvancedMode", 1)
 
-        # Approval tx for the ETH/FOX pool
-        sig_v, sig_r, sig_s = self.client.ethereum_sign_tx(
-            n=[2147483692,2147483708,2147483648,0,0],
-            nonce=0xf,
-            gas_price=0x2980872680,
-            gas_limit=0xbd0e,
-            value=0x0,
-            to=binascii.unhexlify('470e8de2ebaef52014a47cb5e6af86884947f08c'),     # fox pool
-            address_type=0,
-            chain_id=1,
-            # The data below is generally broken into 32-byte chunks except for the function selector (4 bytes_ and 
-            # keccak signatures (4 bytes)
-            data=binascii.unhexlify('095ea7b3' +                                      # approve
-                '0000000000000000000000007a250d5630b4cf539739df2c5dacb4c659f2488d' +  # uniswap v2: router 2 contract address
-                'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff')   # approve amount
+        # Unlimited approval is deliberately disabled on canonical 7.15.
+        # This legacy vector must be refused, not skipped or signed.
+        with self.assertRaises(CallException) as caught:
+            self.client.ethereum_sign_tx(
+                n=[2147483692,2147483708,2147483648,0,0],
+                nonce=0xf,
+                gas_price=0x2980872680,
+                gas_limit=0xbd0e,
+                value=0x0,
+                to=binascii.unhexlify('470e8de2ebaef52014a47cb5e6af86884947f08c'),     # fox pool
+                address_type=0,
+                chain_id=1,
+                # The data below is generally broken into 32-byte chunks except for the function selector (4 bytes_ and
+                # keccak signatures (4 bytes)
+                data=binascii.unhexlify('095ea7b3' +                                      # approve
+                    '0000000000000000000000007a250d5630b4cf539739df2c5dacb4c659f2488d' +  # uniswap v2: router 2 contract address
+                    'ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff')   # approve amount
+
+            )
+        self.assertEqual(caught.exception.args[0],
+                         proto_types.Failure_ActionCancelled)
+        self.assertIn("Unlimited ERC20 approval is disabled",
+                      str(caught.exception))
 
-        )        
-        self.assertEqual(sig_v, 38)
-        self.assertEqual(binascii.hexlify(sig_r), '7f7a5ce501371a01ead394d2186385742d5fbdc3d85da98249d2a05043ac6d5a')
-        self.assertEqual(binascii.hexlify(sig_s), '329954b284ed1df9a6242820e793b9719c0c6c21cae5f90190ce61c7f73c731e')
-                 
     def test_sign_uni_add_liquidity_ETH(self):
         self.requires_fullFeature()
         self.requires_firmware("7.1.0")
         self.setup_mnemonic_nopin_nopassphrase()
+        self.client.apply_policy("AdvancedMode", 1)
 
         # Add liquidity to ETH/FOX pool
         sig_v, sig_r, sig_s = self.client.ethereum_sign_tx(
@@ -86,7 +79,7 @@ def test_sign_uni_add_liquidity_ETH(self):
             to=binascii.unhexlify('7a250d5630B4cF539739dF2C5dAcb4c659F2488D'),     # UNISWAP router
             address_type=0,
             chain_id=1,
-            # The data below is generally broken into 32-byte chunks except for the function selector (4 bytes_ and 
+            # The data below is generally broken into 32-byte chunks except for the function selector (4 bytes_ and
             # keccak signatures (4 bytes)
             data=binascii.unhexlify('f305d719' +                                      # addLiquidityETH
                 '000000000000000000000000c770eefad204b5180df6a14ee197d99d808ee52d' +  # FOX token
@@ -95,15 +88,16 @@ def test_sign_uni_add_liquidity_ETH(self):
                 '0000000000000000000000000000000000000000000000000000fb98b65aba40' +  # min amount of eth token
                 '0000000000000000000000003f2329C9ADFbcCd9A84f52c906E936A42dA18CB8' +  # eth address (self)
                 '00000000000000000000000000000000000000000000000000000178a9380e5f')   # deadline
-        )        
+        )
         self.assertEqual(sig_v, 37)
-        self.assertEqual(binascii.hexlify(sig_r), '8547542bc74c0dcc6ca8b02a79e0dccd336856d8c48376289a2a697d864a5892')
-        self.assertEqual(binascii.hexlify(sig_s), '0a8eec6856aef8caa234240b06862976f8e238e8b24f5c989279507dd7e51ccd')
+        self.assertEqual(binascii.hexlify(sig_r).decode("ascii"), '8547542bc74c0dcc6ca8b02a79e0dccd336856d8c48376289a2a697d864a5892')
+        self.assertEqual(binascii.hexlify(sig_s).decode("ascii"), '0a8eec6856aef8caa234240b06862976f8e238e8b24f5c989279507dd7e51ccd')
 
     def test_sign_uni_remove_liquidity_ETH(self):
         self.requires_fullFeature()
         self.requires_firmware("7.1.0")
         self.setup_mnemonic_nopin_nopassphrase()
+        self.client.apply_policy("AdvancedMode", 1)
 
         # remove liquidity from the ETH/FOX pool
         sig_v, sig_r, sig_s = self.client.ethereum_sign_tx(
@@ -115,7 +109,7 @@ def test_sign_uni_remove_liquidity_ETH(self):
             to=binascii.unhexlify('7a250d5630B4cF539739dF2C5dAcb4c659F2488D'),     # UNISWAP router
             address_type=0,
             chain_id=1,
-            # The data below is generally broken into 32-byte chunks except for the function selector (4 bytes_ and 
+            # The data below is generally broken into 32-byte chunks except for the function selector (4 bytes_ and
             # keccak signatures (4 bytes)
             data=binascii.unhexlify('02751cec' +                                      # addLiquidityETH
                 '000000000000000000000000c770eefad204b5180df6a14ee197d99d808ee52d' +  # FOX token
@@ -124,10 +118,10 @@ def test_sign_uni_remove_liquidity_ETH(self):
                 '0000000000000000000000000000000000000000000000000000fb04c77f3e94' +  # min amount of eth token
                 '0000000000000000000000005028d647b74f12903e6d5f3969f8f624e6a9a93d' +  # to address (not self)
                 '00000000000000000000000000000000000000000000000000000178b2062f3d')   # deadline
-        )        
+        )
         self.assertEqual(sig_v, 37)
-        self.assertEqual(binascii.hexlify(sig_r), '7143f0d8e5505a8cfb1df55e9c5d7433eba33a61959137c08cc5c088ec12ab5d')
-        self.assertEqual(binascii.hexlify(sig_s), '20b456d6c13295f5abb6109d7ade2c5d5fc395963b1e45d92e6dc8c33749c517')
+        self.assertEqual(binascii.hexlify(sig_r).decode("ascii"), '7143f0d8e5505a8cfb1df55e9c5d7433eba33a61959137c08cc5c088ec12ab5d')
+        self.assertEqual(binascii.hexlify(sig_s).decode("ascii"), '20b456d6c13295f5abb6109d7ade2c5d5fc395963b1e45d92e6dc8c33749c517')
 
 if __name__ == '__main__':
     unittest.main()

tests/test_msg_ethereum_signtx.py

@@ -442,9 +442,8 @@ def test_ethereum_signtx_omitted_chain_id_rejected(self):
         sibling tests in this file all now pass chain_id explicitly so they
         keep exercising their own subject rather than this one.
         """
-        # Explicit zero was already rejected on RC18, but an omitted field was
-        # not. The absent-field fix landed after RC18 and first ships in 7.16.
-        self.requires_firmware("7.16.0")
+        # Canonical 7.15 rejects omitted chain IDs as well as explicit zero.
+        self.requires_firmware("7.15.0")
         self.requires_fullFeature()
         self.setup_mnemonic_nopin_nopassphrase()
         self.client.apply_policy("AdvancedMode", 1)

tests/test_msg_getentropy.py

@@ -30,10 +30,9 @@
 
 class TestMsgGetentropy(common.KeepKeyTest):
 
-    @unittest.skipUnless(
-        os.getenv('KK_EXPECT_ENTROPY_BUDGET') == '1',
-        'requires the RC23 entropy audit budget policy')
     def test_entropy(self):
+        if os.getenv("KK_EXPECT_ENTROPY_BUDGET") != "1":
+            self.requires_firmware("7.15.0")
         chunk_size = 8192
         chunk_count = 8
 

tests/test_msg_ping.py

@@ -28,7 +28,7 @@
 class TestPing(common.KeepKeyTest):
 
     def test_protected_ping_preserves_message_presence_after_debug_read(self):
-        self.requires_firmware("7.14.3")
+        self.requires_firmware("7.14.2")
         for message in (None, '', 'ping response'):
             with self.subTest(message=message):
                 request = proto.Ping(button_protection=True)

tests/test_msg_recoverydevice_cipher.py

@@ -180,9 +180,9 @@ def test_invalid_bip39_word_rejected(self):
 
         With enforce_wordlist=True, completing a word that isn't in the
         BIP-39 wordlist must return Failure immediately.
-        Requires firmware 7.15.1+ (per-word validation).
+        The canonical 7.15 product includes per-word validation.
         """
-        self.requires_firmware("7.15.1")
+        self.requires_firmware("7.15.0")
         ret = self.client.call_raw(proto.RecoveryDevice(word_count=12,
                                    passphrase_protection=False,
                                    pin_protection=False,

tests/test_msg_ripple_get_address.py

@@ -41,7 +41,10 @@ def test_ripple_show_address(self):
         self.setup_mnemonic_allallall()
         address = self.client.ripple_get_address(
             parse_path("m/44'/144'/0'/0/0"), show_display=True)
-        if self.firmware_at_least("7.14.3"):
+        # 7.14.2 and later preserve the response across DebugLinkGetState
+        # requests made during screenshot capture; the same fix is on all three
+        # products, so the floor is the release the fix first shipped in.
+        if self.firmware_at_least("7.14.2"):
             self.assertEqual(address, "rNaqKtKrMSwpwZSzRckPf7S96DkimjkF4H")
 
     def test_ripple_get_address_other(self):

tests/test_msg_ripple_sign_tx.py

@@ -100,23 +100,9 @@ def test_sign(self):
         )
 
 
-    @unittest.skip(
-        "XRP memo is not a supported feature yet. A THORChain memo cannot "
-        "traverse hdwallet -> RippleSignTx: the protobuf has no memo field "
-        "(RippleSignTx carries 1-6, RipplePayment carries "
-        "amount/destination/destination_tag), and hdwallet's rippleSignTx "
-        "never reads tx.value.memo. The firmware therefore never receives it "
-        "and cannot serialize it. Tracked as keepkey/keepkey-vault#422.\n"
-        "\n"
-        "This assertion is CORRECT and is deliberately left intact: it "
-        "describes the behaviour the product needs. Do NOT make it pass by "
-        "asserting the memo is absent -- that would encode the bug as the "
-        "contract. Re-enable only when the signed serialization actually "
-        "preserves the memo."
-    )
     def test_sign_with_thorchain_memo(self):
         self.requires_fullFeature()
-        self.requires_firmware("7.14.2")
+        self.requires_firmware("7.15.0")
 
         self.setup_mnemonic_allallall()