Re-enabling test_get_extended_pubkey_non_standard for Speculos as now it is hardened there
What the developer wrote
Authored by Ilya Artemov
Re-enabling test_get_extended_pubkey_non_standard for Speculos as now it is hardened there
What changed, and why it matters
This commit only changes a test file. It re-enables a previously skipped automated test for the Speculos simulator because the simulator now correctly blocks an insecure key-derivation operation that the real Ledger hardware already blocked. It also adds a comment explaining another test case. There is no change to the actual app code that users run on their devices.
No action required; treat as routine test maintenance. Review the related app-side hardening commit separately if it has not already been audited.
Security signals we found
Test-only change
Re-enables negative security test after simulator hardening
No application code modification
Evidence from the diff
The diff modifies tests/test_get_extended_pubkey.py. It removes a pytest.skip() that bypassed test_get_extended_pubkey_non_standard when running against SpeculosBackend, because Speculos now enforces the same root-level key derivation restriction as physical devices. It adds a clarifying comment that the unauthorized-path assertion does not raise when the app is built with COIN=bitcoin_recovery, since that build permits all paths. No application firmware code is changed.
Changed components
tests/test_get_extended_pubkey.pyInspect captured patch +1 / −3
diff --git a/tests/test_get_extended_pubkey.py b/tests/test_get_extended_pubkey.py
index 71fcbaa..864804e 100644
--- a/tests/test_get_extended_pubkey.py
+++ b/tests/test_get_extended_pubkey.py
@@ -88,9 +88,6 @@ def test_get_extended_pubkey_non_standard(navigator: Navigator, firmware: Firmwa
# (Slow test, not feasible to repeat it for many paths)
# The test will be re-enabled for Speculos once the installation parameters are supported
- if isinstance(client.transport_client, SpeculosBackend):
- pytest.skip("The test derives key at root level - now prohibited and the reinforcement is not yet implemented in Speculos.")
-
# Deriving a key at root level without HAVE_APPLICATION_FLAG_DERIVE_MASTER permission
with pytest.raises(ExceptionRAPDU) as e:
pub_key = client.get_extended_pubkey(
@@ -103,6 +100,7 @@ def test_get_extended_pubkey_non_standard(navigator: Navigator, firmware: Firmwa
assert DeviceException.exc.get(e.value.status) == NotSupportedError
assert len(e.value.data) == 0
# Deriving a key at unauthorized path
+ # The below part does not raise exception when built with COIN=bitcoin_recovery as all paths are permitted
with pytest.raises(ExceptionRAPDU) as e:
pub_key = client.get_extended_pubkey(
path="m/44'/2'/333'", # root pubkey
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.