Feature/ledger signer by OBorce · Pull Request #1944 · mintlayer/mintlayer-core

OBorce · 2025-07-30T13:35:25Z

Ledger signer
Ledger tests

Tests assume the ledger app is already running in the emulator same as Trezor tests

ImplOfAnImpl

I haven't dug into the code much yet, will continue next week.

Tests assume the ledger app repo is cloned next to this one with name ledger-mintlayer

To be honest, I'm not a huge fan of this approach. And also of the fact that the emulator is always started automatically. E.g. in the Trezor case it was sometimes useful to see the emulator logs to understand what went wrong.
Was there any particular reason to do it this way instead of expecting the emuator to be running?

wallet/src/signer/ledger_signer/speculus/drivers/mod.rs

wallet/src/signer/ledger_signer/speculus/handle.rs

Cargo.toml

wallet/src/signer/ledger_signer/speculus/mod.rs

wallet/src/signer/ledger_signer/speculos/handle.rs

wallet/src/signer/ledger_signer/speculos/drivers/mod.rs

wallet/src/signer/ledger_signer/ledger_messages.rs

Cargo.toml

wallet/src/signer/ledger_signer/ledger_messages.rs

ImplOfAnImpl · 2025-10-08T12:25:48Z

wallet/src/signer/ledger_signer/ledger_messages.rs

+pub async fn get_app_name<L: Exchange>(ledger: &mut L) -> Result<Vec<u8>, ledger_lib::Error> {
+    let msg_buf = [CLA, Ins::APP_NAME, 0, P2::DONE];
+    ledger.exchange(&msg_buf, Duration::from_millis(100)).await
+}
+
+#[allow(dead_code)]
+pub async fn check_current_app<L: Exchange>(ledger: &mut L) -> SignerResult<()> {
+    let resp = get_app_name(ledger)
+        .await
+        .map_err(|err| LedgerError::DeviceError(err.to_string()))?;


I don't think it's a good way to check for our app, because the INS values are app-specific.

There is a standard way to obtain the app name via CLA=0xB0 and INS=1. E.g. here it's handled by the SDK on the device - https://github.com/LedgerHQ/ledger-device-rust-sdk/blob/4262899a325b9b2fe10f2524d8e4b2f9fec38b83/ledger_device_sdk/src/io_legacy.rs#L330-L331
(The INS is processed inside the handle_bolos_apdu function).

Also, ledger-proto contains something called AppInfoReq which mentions CLA 0xB0 and INS 1, so I guess you don't have to construct the APDU by hand and parse the request.

For some reason it always returns "app" for app name and the OS version instead of the opened app. So, I kept our own instructions.

For some reason it always returns "app" for app name and the OS version instead of the opened app. So, I kept our own instructions.

Well, I tried sending [b0, 1, 0, 0] to my NanoSPlus and got "Mintlayer"/"0.1.0" for our app and "Ethereum"/"1.18.0" for Ethereum.
What device are you using? Can you double check?

In any case, this has to be investigated further. If b0/01 doesn't work indeed, we must at least document that fact, mentioning the particular situations.

For some reason it always returns "app"

So I suppose you were using the emulator, for which this is documented behavior.

In such a case IMO it's better to detect if we're using an emulator (or I guess we could assume that any tcp transport corresponds to an emulator) and skip the app name/version check in that case.

Alternatively, we could go with with a custom APDU. But in this case it has to be handled more carefully. E.g. a) expect that the whole APDU may fail, e.g. with ClaNotSupported or InsNotSupported (because the current app doesn't support it), or with something like WrongP1P2/WrongApduLength (because in the current app this APDU means something else and has different parameters); b) expect that APDU may be handled successfully, but the result is garbage (again, because in the current app this APDU means something else).

The first approach looks easier to implement.

wallet/src/signer/ledger_signer/mod.rs

wallet/src/signer/ledger_signer/tests.rs

ImplOfAnImpl · 2025-11-06T13:54:48Z

wallet/src/signer/ledger_signer/tests.rs

+    Finish,
+}
+
+async fn auto_confirmer(mut control_msg_rx: mpsc::Receiver<ControlMessage>, handle: PodmanHandle) {


Let's have a way to disable the auto-confirmer, to be able to see what the tests are really doing. E.g. for trezor we have the TREZOR_TESTS_AUTO_CONFIRM env var, so we can also have LEDGER_TESTS_AUTO_CONFIRM.

If you disable auto-confirmation (I did it by commenting out the "handle.button" calls below), you'll notice that when running e.g. test_fixed_signatures2::case_1, you have to click the right button 19 times while the device is showing "Review transaction" without any indication that something is happening. I guess it's when the transaction data is being sent in chunks. But in any case, just sending data shouldn't require the user to perform clicks, clicking should only be needed to go to another screen.,

At some point during signing, a message is shown "Press right button to continue message or press both to skip". If both buttons are pressed, it goes straight to "Sign transaction", if the right one is pressed, it also shows a few extra screens related to fees. So:
a) Is this something our app controls? If so, IMO it's better to disable it and always show all the screens.
b) Otherwise we're testing only one of the possible successful flows, which is not great. I guess in such a case we shouldn't just click arbitrary and instead have a list of button clicks that must be performed for each test and also a way to check what is currently shown on the screen (e.g. in the simplest case it could be a list of pairs ("regex that checks the expected contents of the current screen", "button click to go to the next screen")). Though this approach seems to be the correct one, as it'll also allow us to have negative tests, where the operation is aborted by the user (and ideally we should do the same for Trezor tests), it'll probably be hard to implement, so I'd go with the option a) for now, if possible.

wallet/src/signer/ledger_signer/mod.rs

wallet/src/signer/ledger_signer/ledger_messages.rs

ImplOfAnImpl · 2025-11-07T09:38:31Z

wallet/src/signer/ledger_signer/ledger_messages.rs

+        msg_buf.extend([APDU_CLASS, ins, p1, p2]);
+        msg_buf.push(chunk.len() as u8);
+        msg_buf.extend(chunk);
+        resp = exchange_message(ledger, &msg_buf).await?;


Again, let's not ignore intermediate results. If they are supposed to be empty vecs, let's do sanity checks on that.

wallet/src/signer/ledger_signer/ledger_messages.rs

ImplOfAnImpl

Seems to be fine (except for a few comments), but I'd like to take another look after I return from my vacation.

wallet/src/signer/ledger_signer/mod.rs

.github/workflows/build.yml

ImplOfAnImpl · 2025-12-19T14:25:48Z

.github/workflows/build.yml

+        uses: actions/checkout@v4
+        with:
+          repository: mintlayer/mintlayer-ledger-app
+          ref: feature/mintlayer-app


Plz don't forget to update this

.github/workflows/build.yml

wallet/src/signer/ledger_signer/speculos.rs

wallet/src/signer/ledger_signer/ledger_messages.rs

ImplOfAnImpl

I don't want to review this again, so I suggest merging it after applying the comments. The ledger tests will have to be disabled on CI, but it's better to enable the code itself, to make sure it compiles.

Plz make sure that all the comments have been addressed before merging

ImplOfAnImpl · 2026-01-15T21:08:29Z

wallet/src/wallet/mod.rs

+            #[cfg(feature = "trezor")]
+            (WalletType::Ledger, WalletType::Ledger) => {}


feature = "ledger"?

ImplOfAnImpl · 2026-01-15T21:12:51Z

wallet/src/signer/ledger_signer/mod.rs

+        ChainType::Signet => CoinType::Regtest,
+        ChainType::Regtest => CoinType::Signet,


The opposite

ImplOfAnImpl · 2026-01-15T21:14:47Z

common/src/primitives_converters.rs

+    fn try_convert_from(value: VRFPublicKey) -> Result<Self, PrimitivesConvertersError> {
+        match value.kind() {
+            VRFKeyKind::Schnorrkel => {
+                let key: SchnorrkelPublicKey = value.try_into().unwrap();


Return an error instead of unwrapping

ImplOfAnImpl · 2026-01-15T21:14:53Z

common/src/primitives_converters.rs

+    fn try_convert_from(value: PublicKey) -> Result<Self, PrimitivesConvertersError> {
+        match value.kind() {
+            KeyKind::Secp256k1Schnorr => {
+                let key: Secp256k1PublicKey = value.try_into().unwrap();


Return an error instead of unwrapping

ImplOfAnImpl · 2026-01-16T12:47:04Z

.github/workflows/build.yml

+
+      - name: Update local dependency repositories
+        run: sudo apt-get update


"Update the list of available system packages"

ImplOfAnImpl · 2026-01-20T12:53:43Z

wallet/src/signer/trezor_signer/mod.rs

-    #[error("The file being loaded is a software wallet and does not correspond to the connected hardware wallet")]
-    HardwareWalletDifferentFile,
+    #[error("The file being loaded is a Ledger wallet and cannot be used with the connected Trezor wallet")]
+    LedgerWalletDifferentFile,


WalletFileIsLedgerWallet ?

ImplOfAnImpl · 2026-01-20T15:55:00Z

wallet/src/signer/mod.rs

    #[error("Duplicate UTXO input: {0:?}")]
    DuplicateUtxoInput(UtxoOutPoint),
+    #[error("Wallet not initialized")]
+    WalletNotInitialized,


Use this error in the trezor signer too, instead of WalletError::WalletNotInitialized?
Or vice versa. Why the inconsistency?

ImplOfAnImpl · 2026-01-20T16:02:33Z

wallet/types/src/hw_data.rs

+    Stax,
+    Flex,
+    NanoGen5,
+    Unknown(u16),


This u16 is usb-specific, it's better to make it an optional named field usb_pid, same as is rust-ledger

ImplOfAnImpl · 2026-01-20T16:07:33Z

wallet/wallet-controller/src/types/mod.rs

@@ -72,6 +72,11 @@ pub enum WalletExtraInfo {
        // Note: semver::Version is not serializable, so we can't use it here.


Plz move this comment out of the TrezorWallet variant, as it applies to LedgerWallet too

ImplOfAnImpl · 2026-01-20T16:07:48Z

wallet/wallet-controller/src/types/mod.rs

+            #[cfg(feature = "trezor")]
+            Self::Ledger => WalletType::Ledger,


feature = "ledger"

ImplOfAnImpl · 2026-01-22T15:56:01Z

Forgot to mention: I wasn't able to open a ledger wallet in wallet-cli via the --wallet-file argument: "Wallet controller error: Wallet error: Key chain error: Wallet database error: Wallet file corrupted root keys expected 1 got 0"

OBorce changed the base branch from master to refactor/wallet-async-signing July 30, 2025 13:35

OBorce force-pushed the feature/ledger_signer branch 2 times, most recently from ecf51c0 to abe8a88 Compare July 31, 2025 08:24

OBorce force-pushed the refactor/wallet-async-signing branch from 59bd742 to 9099e90 Compare August 22, 2025 10:57

OBorce force-pushed the feature/ledger_signer branch from abe8a88 to 89285d1 Compare August 22, 2025 10:58

OBorce marked this pull request as ready for review August 25, 2025 12:43

OBorce requested review from ImplOfAnImpl and erubboli as code owners August 25, 2025 12:43

OBorce force-pushed the feature/ledger_signer branch from 5f20a4f to 4c64407 Compare August 25, 2025 12:56

ImplOfAnImpl reviewed Aug 28, 2025

View reviewed changes

OBorce force-pushed the refactor/wallet-async-signing branch 3 times, most recently from f21e82b to 75ff652 Compare September 18, 2025 22:31

OBorce force-pushed the feature/ledger_signer branch 4 times, most recently from 61292c5 to eeb6484 Compare September 23, 2025 22:28

OBorce marked this pull request as draft September 25, 2025 08:51

OBorce force-pushed the refactor/wallet-async-signing branch from 75ff652 to 96016cf Compare September 25, 2025 08:57

OBorce force-pushed the feature/ledger_signer branch 3 times, most recently from 5d3edf0 to d6fd484 Compare September 30, 2025 23:37

OBorce marked this pull request as ready for review October 1, 2025 07:09

OBorce force-pushed the feature/ledger_signer branch from 39d3e58 to d6fd484 Compare October 3, 2025 07:07

ImplOfAnImpl requested changes Oct 8, 2025

View reviewed changes

ImplOfAnImpl reviewed Oct 9, 2025

View reviewed changes

wallet/src/signer/ledger_signer/mod.rs Outdated Show resolved Hide resolved

ImplOfAnImpl reviewed Oct 9, 2025

View reviewed changes

wallet/src/signer/ledger_signer/mod.rs Outdated Show resolved Hide resolved

ImplOfAnImpl reviewed Oct 9, 2025

View reviewed changes

wallet/src/signer/ledger_signer/tests.rs Outdated Show resolved Hide resolved

OBorce force-pushed the feature/ledger_signer branch from d6fd484 to 2d5300b Compare October 26, 2025 23:34

OBorce changed the base branch from refactor/wallet-async-signing to master October 26, 2025 23:39

ImplOfAnImpl requested changes Nov 7, 2025

View reviewed changes

OBorce force-pushed the feature/ledger_signer branch 2 times, most recently from 4f56961 to 132141f Compare November 13, 2025 19:47

OBorce force-pushed the feature/ledger_signer branch from 50d5293 to a7d86d1 Compare December 19, 2025 12:31

ImplOfAnImpl reviewed Dec 19, 2025

View reviewed changes

OBorce force-pushed the feature/ledger_signer branch 3 times, most recently from e4b8812 to 74954ab Compare January 15, 2026 08:23

ImplOfAnImpl approved these changes Jan 22, 2026

View reviewed changes

OBorce added 19 commits February 2, 2026 12:46

Add ledger signer

7bc502d

fix ledger tests

a66ab17

ledger cleanup

261c905

Remove podman usage from Ledger tests, fix comments

95ff2db

Use the new ledger messages

9032a3e

Add Ledger signer provider

76492be

Add ledger support in CLI and GUI wallet

3672027

Add ledger CI tests

6f7c365

fix comments

4b507d4

Fix comments

64fa062

Add support for Flex and Stax Ledger emulator tests

c7127c6

Use new ledger messages

0f1be03

fix comments

1cd6777

bump ml_primitives and add more tests

6ab1297

use primitive conversions

0a5d8f4

fix missed comments

2feb350

update ledger lib fork

328ea77

fix after rebase

cc44f06

Fix comments

65d813c

OBorce force-pushed the feature/ledger_signer branch from 74954ab to 65d813c Compare February 6, 2026 09:56

		#[cfg(feature = "trezor")]
		(WalletType::Ledger, WalletType::Ledger) => {}

		ChainType::Signet => CoinType::Regtest,
		ChainType::Regtest => CoinType::Signet,


		- name: Update local dependency repositories
		run: sudo apt-get update

		@@ -72,6 +72,11 @@ pub enum WalletExtraInfo {
		// Note: semver::Version is not serializable, so we can't use it here.

		#[cfg(feature = "trezor")]
		Self::Ledger => WalletType::Ledger,

Conversation

OBorce commented Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ImplOfAnImpl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ImplOfAnImpl left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ImplOfAnImpl left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

OBorce commented Jul 30, 2025 •

edited

Loading