Preserve Zcash account firmware version (#37)
What the developer wrote
Authored by Adam
Preserve Zcash account firmware version (#37)
* Preserve Zcash account firmware version
* Keep UR dependencies at 1.0.7
What changed, and why it matters
This commit is a small, non-security code change. It updates a Zcash wallet test to verify that the firmware version string is preserved when account data is encoded and decoded, and it switches two Rust library dependencies from the public crates.io registry to a specific Git revision from a third-party fork. There is no direct evidence in the commit that this fixes a vulnerability.
Treat as a routine functional/test change unless additional vendor or researcher disclosure confirms security relevance. Verify the integrity and provenance of the valargroup/keystone-sdk-rust Git revision before relying on it in production firmware builds.
Security signals we found
Dependency source changed from crates.io to a third-party Git repository (valargroup/keystone-sdk-rust)
No mention of vulnerability, CVE, security fix, or researcher attribution in commit message or diff
Change is limited to a unit test assertion and dependency source pinning
Evidence from the diff
The diff modifies rust/apps/wallets/src/zcash.rs to rename a unit test and add an assertion that ZcashAccounts::get_device_version() returns Some(“1.2.3”) after a CBOR round-trip. It also patches ur-registry and ur-parse-lib in Cargo.toml/Cargo.lock to use a Git source (valargroup/keystone-sdk-rust rev abc72f08) instead of crates.io 1.0.7. The commit title and message frame this as preserving the Zcash account firmware version. No security relevance is stated, no CVE is referenced, and no vulnerability details are present in the diff.
Changed components
rust/apps/wallets/src/zcash.rsrust/Cargo.tomlrust/Cargo.lockur-registry dependencyur-parse-lib dependencyInspect captured patch +11 / −7
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 0e84895..29d8220 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -4798,8 +4798,7 @@ checksum = "6d49784317cd0d1ee7ec5c716dd598ec5b4483ea832a2dced265471cc0f690ae"
[[package]]
name = "ur-parse-lib"
version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8a5ab613e7067ed9fdda88c981928bfbe4c27266c1e6966c764a3acb55bc984"
+source = "git+https://github.com/valargroup/keystone-sdk-rust.git?rev=abc72f085f4c42e0ad048c60c1102f24a16e1f68#abc72f085f4c42e0ad048c60c1102f24a16e1f68"
dependencies = [
"hex",
"keystone-ur",
@@ -4809,8 +4808,7 @@ dependencies = [
[[package]]
name = "ur-registry"
version = "1.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a2a09a3a773ec71b906f833193b2a81fd872daa2909f9d5fbd20686761d4e0c0"
+source = "git+https://github.com/valargroup/keystone-sdk-rust.git?rev=abc72f085f4c42e0ad048c60c1102f24a16e1f68#abc72f085f4c42e0ad048c60c1102f24a16e1f68"
dependencies = [
"bs58",
"hex",
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 485b3cd..74d15aa 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -119,4 +119,8 @@ blake2b_simd = { version = "1.0.2", default-features = false }
getrandom = "0.2"
minicbor = { version = "0.19", features = ["alloc"] }
zeroize = { version = "1.8.2", default-features = false }
-# third party dependencies end
\ No newline at end of file
+# third party dependencies end
+
+[patch.crates-io]
+ur-registry = { git = "https://github.com/valargroup/keystone-sdk-rust.git", rev = "abc72f085f4c42e0ad048c60c1102f24a16e1f68" }
+ur-parse-lib = { git = "https://github.com/valargroup/keystone-sdk-rust.git", rev = "abc72f085f4c42e0ad048c60c1102f24a16e1f68" }
diff --git a/rust/apps/wallets/src/zcash.rs b/rust/apps/wallets/src/zcash.rs
index 5663012..cd05069 100644
--- a/rust/apps/wallets/src/zcash.rs
+++ b/rust/apps/wallets/src/zcash.rs
@@ -45,7 +45,7 @@ mod tests {
use alloc::vec;
#[test]
- fn test_generate_sync_ur() {
+ fn test_generate_sync_ur_preserves_device_version() {
let seed_fingerprint = [1u8; 32];
let key_infos = vec![
UFVKInfo {
@@ -65,6 +65,8 @@ mod tests {
let accounts = result.unwrap();
let cbor: Vec<u8> = accounts.try_into().unwrap();
- assert!(!cbor.is_empty());
+ let decoded = ZcashAccounts::try_from(cbor).unwrap();
+
+ assert_eq!(decoded.get_device_version(), Some("1.2.3".to_string()));
}
}
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.