Merge pull request #151 from Zondax/stax

Stax

.github/workflows/check_version.yml

@@ -1,10 +1,11 @@
-name: "Verify PRs to main"
+name: Verify PRs to main
 
 on:
   workflow_dispatch:
   pull_request:
     branches:
       - main
+      - develop
 
 jobs:
   configure:
@@ -50,4 +51,3 @@ jobs:
       - name: Tag exists
         if: ${{ steps.checkTag.outputs.exists == 'true' }}
         run: exit 1
-

.github/workflows/codeql.yml

@@ -0,0 +1,36 @@
+name: "CodeQL"
+
+on:
+  workflow_dispatch:
+  push:
+  pull_request:
+    branches:
+      - main
+      - develop
+
+jobs:
+  analyse:
+    name: Analyse
+    strategy:
+      matrix:
+        sdk: ["$NANOS_SDK", "$NANOX_SDK", "$NANOSP_SDK", "$STAX_SDK"]
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder-legacy:latest
+
+    steps:
+      - name: Clone
+        uses: actions/checkout@v3
+        with:
+          submodules: recursive
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: cpp
+          queries: security-and-quality
+
+      - name: Build
+        run: make -j BOLOS_SDK=${{ matrix.sdk }}
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

.github/workflows/guidelines_enforcer.yml

@@ -0,0 +1,25 @@
+name: Ensure compliance with Ledger guidelines
+
+# This workflow is mandatory in all applications
+# It calls a reusable workflow guidelines_enforcer developed by Ledger's internal developer team.
+# The successful completion of the reusable workflow is a mandatory step for an app to be available on the Ledger
+# application store.
+#
+# More information on the guidelines can be found in the repository:
+# LedgerHQ/ledger-app-workflows/
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+      - main
+      - develop
+  pull_request:
+
+jobs:
+  guidelines_enforcer:
+    name: Call Ledger guidelines_enforcer
+    uses: LedgerHQ/ledger-app-workflows/.github/workflows/reusable_guidelines_enforcer.yml@v1
+    with:
+      relative_app_directory: 'app'

.github/workflows/main.yml

@@ -16,43 +16,19 @@ jobs:
       - id: get-user
         run: echo "uid_gid=$(id -u):$(id -g)" >> $GITHUB_OUTPUT
 
-  build:
+  rust_test:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v3
+      - name: Install rust
+        uses: actions-rs/toolchain@v1
         with:
-          submodules: true
-      - name: Install deps
-        run: |
-          sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 10
-          make deps
-
-  build_only_rust:
-    runs-on: ubuntu-latest
-    steps:
+          toolchain: stable
       - name: Checkout
         uses: actions/checkout@v3
         with:
           submodules: true
-      - name: Install rust
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
-      - name: rustfmt
-        run: |
-          cd ./app/rust
-          cargo fmt --version
-          cargo fmt -- --check
-      - name: clippy
-        run: |
-          cd ./app/rust
-          cargo clippy --version
-          cargo clippy --all-features --all-targets || true
-      - name: run tests
-        run: |
-          cd ./app/rust
-          cargo test
+      - name: Rust tests
+        run: make rust_test
 
   build_ledger:
     needs: configure
@@ -87,6 +63,7 @@ jobs:
           [ ${{needs.build_ledger.outputs.size}} -le $NANOS_LIMIT_SIZE ]
 
   test_zemu:
+    timeout-minutes: 25
     runs-on: ubuntu-latest
     steps:
       - name: Test
@@ -99,28 +76,29 @@ jobs:
         with:
           submodules: true
       - run: sudo apt-get update -y && sudo apt-get install -y libusb-1.0.0 libudev-dev
-      - name: Install rust
-        uses: actions-rs/toolchain@v1
-        with:
-          toolchain: stable
       - name: Install node
         uses: actions/setup-node@v3
       - name: Install yarn
         run: |
-          npm install -g yarn ts-node
-      - name: Build and run zemu tests
-        run: |
-          make test_all
+          npm install -g yarn
+      - name: Build Ledger app
+        run: make test_all
+      - name: Upload Snapshots (only failure)
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: snapshots-tmp
+          path: tests_zemu/snapshots-tmp/
 
   build_package_nanos:
-    needs: [configure, build, build_ledger, test_zemu]
+    needs: [configure, rust_test, build_ledger, test_zemu]
     if: ${{ github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-latest
     container:
       image: zondax/ledger-app-builder:latest
       options: --user ${{ needs.configure.outputs.uid_gid }}
-    env:
-      BOLOS_SDK: /opt/nanos-secure-sdk
+      env:
+        BOLOS_SDK: /opt/nanos-secure-sdk
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -149,7 +127,7 @@ jobs:
           prerelease: false
 
   build_package_nanosp:
-    needs: [configure, build, build_ledger, test_zemu]
+    needs: [configure, rust_test, build_ledger, test_zemu]
     if: ${{ github.ref == 'refs/heads/main' }}
     runs-on: ubuntu-latest
     container:

.gitignore

@@ -78,6 +78,7 @@ cmake-build-fuzz/
 /app/obj/
 /app/output/app*.*
 app/hfuzz-parser/hfuzz_*
+app/build/*
 
 \deps/*
 !/deps/sha512

.gitmodules

@@ -1,15 +1,9 @@
 [submodule "deps/BLAKE2"]
 	path = deps/BLAKE2
 	url = https://github.com/BLAKE2/BLAKE2
-[submodule "deps/nanos-secure-sdk"]
-	path = deps/nanos-secure-sdk
-	url = https://github.com/LedgerHQ/nanos-secure-sdk.git
-[submodule "deps/nanox-secure-sdk"]
-	path = deps/nanox-secure-sdk
-	url = https://github.com/LedgerHQ/ledger-secure-sdk.git 
-[submodule "deps/nanosplus-secure-sdk"]
-	path = deps/nanosplus-secure-sdk
-	url = https://github.com/LedgerHQ/ledger-secure-sdk.git
 [submodule "deps/ledger-zxlib"]
 	path = deps/ledger-zxlib
 	url = https://github.com/Zondax/ledger-zxlib.git
+[submodule "deps/ledger-secure-sdk"]
+	path = deps/ledger-secure-sdk
+	url = https://github.com/LedgerHQ/ledger-secure-sdk

Makefile

@@ -1,5 +1,5 @@
 #*******************************************************************************
-#*   (c) 2019 Zondax GmbH
+#*   (c) 2019 - 2023 Zondax AG
 #*
 #*  Licensed under the Apache License, Version 2.0 (the "License");
 #*  you may not use this file except in compliance with the License.
@@ -14,15 +14,21 @@
 #*  limitations under the License.
 #********************************************************************************
 
-# We use BOLOS_SDK to determine the develoment environment that is being used
+# We use BOLOS_SDK to determine the development environment that is being used
 # BOLOS_SDK IS  DEFINED	 	We use the plain Makefile for Ledger
 # BOLOS_SDK NOT DEFINED		We use a containerized build approach
 
 TESTS_JS_PACKAGE = "@zondax/ledger-stacks"
 TESTS_JS_DIR = $(CURDIR)/js
 
 ifeq ($(BOLOS_SDK),)
-	include $(CURDIR)/deps/ledger-zxlib/dockerized_build.mk
+# In this case, there is not predefined SDK and we run dockerized
+# When not using the SDK, we override and build the XL complete app
+
+ZXLIB_COMPILE_STAX ?= 1
+SUBSTRATE_PARSER_FULL ?= 1
+include $(CURDIR)/deps/ledger-zxlib/dockerized_build.mk
+
 else
 default:
 	$(MAKE) -C app