Improvement of tests, single-sig isolation * Better naming and code efficiency * Removed multisig from test inputs until figured out
What changed, and why it matters
This commit only changes a test file. It renames a test, tightens some assertions, and temporarily removes multisig test cases from a loop so only single-signature inputs are exercised. There is no change to the actual PSBT parsing or wallet code, so it does not fix or introduce a security issue by itself.
No security action needed. Treat as a normal test-maintenance commit. If the multisig exclusion is meant to hide a known bug, track the follow-up work that 'figures out' multisig support.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies tests/test_psbt_parser.py. The test_zero_fingerprint_handling method is renamed to test_missing_fingerprint_handling, the loop over PSBTTestData.ALL_INPUTS is narrowed to PSBTTestData.SINGLE_SIG_INPUTS, redundant backup of original derivations is removed, and the post-parse fingerprint checks are simplified from a ‘filled at least once’ flag to an assertion that every derivation fingerprint matches the seed fingerprint. No production code is touched.
Changed components
tests/test_psbt_parser.pyInspect captured patch +16 / −33
diff --git a/tests/test_psbt_parser.py b/tests/test_psbt_parser.py
index bdfdf86..a24c1f5 100644
--- a/tests/test_psbt_parser.py
+++ b/tests/test_psbt_parser.py
@@ -149,25 +149,15 @@ class TestPSBTParser:
assert PSBTParser.has_matching_input_fingerprint(psbt, PSBTTestData.multisig_key_3)
- def test_zero_fingerprint_handling(self):
+ def test_missing_fingerprint_handling(self):
"""
- PSBTParser should correctly handle PSBTs with zero fingerprints (created from XPUB-only imports,
+ PSBTParser should correctly handle PSBTs with missing fingerprints (created from XPUB-only imports,
without derivation path) by matching public keys against the seed and filling in correct fingerprints.
"""
- for input in PSBTTestData.ALL_INPUTS:
+ for input in PSBTTestData.SINGLE_SIG_INPUTS:
psbt = PSBT.parse(a2b_base64(input))
- # Backup original derivations
- original_derivations = []
- original_taproot_derivations = []
- for inp in psbt.inputs:
- for pub, derivation in inp.bip32_derivations.items():
- original_derivations.append((pub, derivation))
-
- for pub, (leaf_hashes, derivation) in inp.taproot_bip32_derivations.items():
- original_taproot_derivations.append((pub, leaf_hashes, derivation))
-
- # Set fingerprints to zero to simulate XPUB-only import
+ # Set fingerprints to zero to simulate XPUB-only import (missing fingerprint)
from embit.psbt import DerivationPath
for inp in psbt.inputs:
for pub, derivation in inp.bip32_derivations.items():
@@ -182,39 +172,32 @@ class TestPSBTParser:
derivation=derivation.derivation
))
- # Verify that has_matching_input_fingerprint works with zero fingerprints
- # This tests the fallback mechanism that tries to derive and match pubkeys
+ # Test that has_matching_input_fingerprint can correctly identify that an input
+ # from the psbt does belong to the provided seed, even when the fingerprints
+ # (in the inputs' bip32 derivations) have been zeroed out.
assert PSBTParser.has_matching_input_fingerprint(psbt, PSBTTestData.seed, SettingsConstants.REGTEST)
# Test that it correctly rejects wrong seeds
wrong_seed = Seed(["bacon"] * 24)
- assert PSBTParser.has_matching_input_fingerprint(psbt, wrong_seed, SettingsConstants.REGTEST) == False
+ assert not PSBTParser.has_matching_input_fingerprint(psbt, wrong_seed, SettingsConstants.REGTEST)
- # Test the PSBTParser's ability to fill zero fingerprints during parsing
+ # Test the PSBTParser's ability to fill missing fingerprints during parsing
parser = PSBTParser(p=psbt, seed=PSBTTestData.seed, network=SettingsConstants.REGTEST)
# Verify fingerprints were correctly filled after parsing
seed_fingerprint = parser.seed.get_fingerprint(SettingsConstants.REGTEST)
- fingerprints_filled = False
for inp in parser.psbt.inputs:
for pub, derivation in inp.bip32_derivations.items():
- if derivation.fingerprint != b"\x00\x00\x00\x00":
- fingerprints_filled = True
- # Should match the seed's fingerprint
- from binascii import hexlify
- assert hexlify(derivation.fingerprint).decode() == seed_fingerprint
-
+ # Must match the signing seed's fingerprint
+ from binascii import hexlify
+ assert hexlify(derivation.fingerprint).decode() == seed_fingerprint
+
# Also check Taproot derivations
for pub, (leaf_hashes, derivation) in inp.taproot_bip32_derivations.items():
- if derivation.fingerprint != b"\x00\x00\x00\x00":
- fingerprints_filled = True
- # Should match the seed's fingerprint
- from binascii import hexlify
- assert hexlify(derivation.fingerprint).decode() == seed_fingerprint
-
- # Fingerprints should have been filled
- assert fingerprints_filled > 0
+ # Must match the signing seed's fingerprint
+ from binascii import hexlify
+ assert hexlify(derivation.fingerprint).decode() == seed_fingerprint
def test_trim_and_sig_count(self):
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.