Handshake Ledger app

Hardware-wallet app for Handshake (HNS). Derives Handshake addresses and signs
Handshake transactions, including name-auction covenants, on Ledger Stax, Flex,
Nano S+, Nano X and Apex+.

The design premise is that the host computer is untrusted: every APDU byte is
attacker-controlled, and the device's job is to be correct when the host lies.
Two failures outrank all others, and the code is shaped around them.

Signing something other than what the user approved. Any field the signature
commits to and the host can vary has to appear on the review screen, and
anything the screen cannot represent honestly is refused rather than shown under
a label that does not describe it. So the device signs SIGHASH_ALL only,
checked per input rather than once for the session; it displays a TRANSFER
covenant's destination, which decides who ends up owning the name and appears
nowhere else in the output; it shows a covenant's name hash when the plaintext
name cannot be verified against it; and it refuses covenant kinds it cannot
name, outputs whose values exceed their inputs, and declared input totals that
would overflow the fee arithmetic.

Misusing key material. Derivation paths are constrained to
m/44'/{5353..5356}'/account'[/change/index] in the app itself, not only by the
install manifest, because BOLOS terminates the app on an out-of-whitelist path
instead of returning an error. One coin type per signing session, since the
review renders every address under a single HRP.

Panics count too: set_panic!(exiting_panic) means a panic kills the app and
strands the session, so nothing unwraps on host-derived data and the session
ceilings are sized to the configured heap.

Consensus follows shd, the Swift Handshake node, which is the reference for the
sighash preimage, covenant item layouts and address encoding.

SIGN_TX is a PSBT-style state machine driven by P1 (BEGIN / ADD_INPUT /
ADD_OUTPUT / REVIEW / SIGN_INPUT): the host streams the transaction as
structured records, the device accumulates its own view of the values, shows one
review, then signs each input on demand.

Tests run under speculos in a container (./scripts/test), 66 of them, green on
all five devices. test_sign_tx_policy.py covers each refusal above and needs no
golden snapshots because every case is rejected before anything is drawn; the
snapshots that do exist are the record of what the user sees before approving.
tests/application_client/handshake_sighash.py is a deliberately independent
reimplementation of the sighash, used to verify real signatures.

Status: v0.1, pre-audit. Not for mainnet keys. Signing has not yet been
exercised on physical hardware.

Forked from LedgerHQ/app-boilerplate-rust (Apache-2.0).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/standalone/README.md

@@ -0,0 +1,35 @@
+# Standalone Functional Tests
+
+This directory contains the **standalone functional test suite** for the Ledger application.  
+It is intended to validate the application’s behavior in a **generic context**, when launched directly from the device's dashboard.
+
+These tests are written using:
+
+- [pytest](https://docs.pytest.org/en/stable/): Python testing framework
+- [Ragger](https://github.com/LedgerHQ/ragger): Ledger's open-source testing library for simulating device interactions
+
+---
+
+## Purpose
+
+The standalone test suite ensures that:
+
+- The application launches correctly from the dashboard
+- The main menu and navigation behave as expected
+- Core commands (e.g., `GET_VERSION`, `GET_PUBLIC_KEY`, `SIGN_TX`) function properly
+- User approval flows work under normal conditions
+- Errors are correctly reported and handled
+
+---
+
+## Directory Structure
+
+```text
+standalone/
+├── conftest.py              # Pytest fixtures and device setup
+├── test_*.py                # Functional test cases
+├── snapshots/               # Ragger UI snapshots
+├── snapshots-tmp/           # Temporary snapshot diffs (not tracked in git)
+├── requirements.txt         # Python dependencies
+└── utils.py                 # Local test helpers
+```

tests/standalone/conftest.py

@@ -0,0 +1,31 @@
+from ragger.conftest import configuration
+from ragger.navigator import NavInsID
+import pytest
+###########################
+### CONFIGURATION START ###
+###########################
+
+# You can configure optional parameters by overriding the value of ragger.configuration.OPTIONAL_CONFIGURATION
+# Please refer to ragger/conftest/configuration.py for their descriptions and accepted values
+
+#########################
+### CONFIGURATION END ###
+#########################
+
+# Pull all features from the base ragger conftest using the overridden configuration
+pytest_plugins = ("ragger.conftest.base_conftest", )
+
+# Notes :
+# 1. Remove this fixture once the pending review screen is removed from the app
+# 2. This fixture clears the pending review screen before each test
+# 3. The scope should be the same as the one configured by BACKEND_SCOPE in 
+# ragger/conftest/configuration.py
+# @pytest.fixture(scope="class", autouse=True)
+# def clear_pending_review(firmware, navigator):
+#     # Press a button to clear the pending review
+#     if firmware.device.startswith("nano"):
+#         print("Clearing pending review")
+#         instructions = [
+#             NavInsID.BOTH_CLICK,
+#         ]
+#         navigator.navigate(instructions,screen_change_before_first_instruction=False)

tests/standalone/requirements.txt

@@ -0,0 +1,4 @@
+pytest
+ragger[speculos,ledgerwallet]>=1.21.1
+ecdsa>=0.16.1,<0.17.0
+tomli>=2.0.1

tests/standalone/review_nav.py

@@ -0,0 +1,37 @@
+"""Review navigation that does not assume a post-approval status modal.
+
+`scenario_navigator.review_approve()` appends `USE_CASE_STATUS_DISMISS` on touch
+devices, expecting an `NbglReviewStatus` screen after the confirm. This app
+deliberately returns straight to its home screen instead: over BLE that screen's
+sync wait can fail to auto-dismiss and block the next APDU, and the wallet shows
+its own success UI once the broadcast completes. See
+`show_status_and_home_if_needed` in `src/main.rs`.
+
+So drive the navigation directly rather than changing the app to suit the
+framework's default.
+"""
+
+from ragger.navigator import NavInsID
+
+#: Text on the final review page. On touch devices this is NBGL's own hold
+#: button; on Nano it is the finish title passed to `NbglReview::titles`.
+TOUCH_FINISH = "^Hold to sign$"
+NANO_FINISH = r"^Sign (transaction|message)$"
+
+
+def approve_review(device, navigator, path, test_name, nano_text=NANO_FINISH):
+    """Page through a review and approve it."""
+    if device.is_nano:
+        navigate, validate, text = NavInsID.RIGHT_CLICK, [NavInsID.BOTH_CLICK], nano_text
+    else:
+        navigate, validate, text = (NavInsID.SWIPE_CENTER_TO_LEFT,
+                                    [NavInsID.USE_CASE_REVIEW_CONFIRM],
+                                    TOUCH_FINISH)
+    navigator.navigate_until_text_and_compare(
+        navigate_instruction=navigate,
+        validation_instructions=validate,
+        text=text,
+        path=path,
+        test_case_name=test_name,
+        screen_change_after_last_instruction=True,
+    )

tests/standalone/setup.cfg

@@ -0,0 +1,2 @@
+[tool:pytest]
+addopts = --strict-markers