mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
6912bcba53
Replaces the NOTIMPL stub with a working ApprovalProvider that delegates
to the host-side ledgerctl tool for USB / APDU access. No new C
dependencies, no firmware required — the same Ledger app shipped in
luxfi/ledger handles every chain in the Lux/Hanzo/Zoo/Pars family via
its existing CLA=0xE0 path.
Pubkeys are parsed as compressed SEC1 secp256k1 (33 bytes) and pinned
at enrollment time. Approvals sign the canonical-intent digest; the
device-returned signature is normalized (DER, 64-byte r||s, or 65-byte
recoverable) and verified locally against the pinned pubkey before
returning — a tampering ledgerctl wrapper would be caught here.
10 tests, all green:
- default config, normalization, error rejection
- cross-provider isolation
- tampered-digest / unenrolled-approver rejection
- end-to-end ceremony via a fake ledgerctl wrapper that re-invokes
the test binary (TestMain sentinel pattern, no external deps)