test(stellar): verify signatures in fixtures
What the developer wrote
Authored by Jakub Janků
test(stellar): verify signatures in fixtures
Instead of relying on the fixtures as the single source of truth,
let's verify the fixtures as well. This should prevent taking a
wrong device-produced signature and declaring it as the correct one
when adding a new fixture.
What changed, and why it matters
This commit only changes a test file for Stellar cryptocurrency transaction signing. It adds a check that the expected signatures stored in test fixtures are mathematically valid, so that future tests don't accidentally treat a bad signature as correct. It does not change the actual Trezor firmware code that users rely on, so it has no direct security impact on devices.
No action required; this is a benign test improvement. Reviewers may optionally confirm the verification logic uses the correct network passphrase and envelope hashing.
Security signals we found
test-only change
fixture integrity verification added
no modification of signing implementation
Evidence from the diff
The diff modifies tests/device_tests/stellar/test_stellar.py to import b64decode and Keypair from stellar_sdk, then verifies any fixture signature against the transaction envelope hash using the fixture’s public key. This is a test-hardening change: it cross-validates fixture data rather than trusting recorded device output. No production firmware code is altered.
Changed components
tests/device_tests/stellar/test_stellar.pyInspect captured patch +7 / −2
diff --git a/tests/device_tests/stellar/test_stellar.py b/tests/device_tests/stellar/test_stellar.py
index 1c47250d..5d4dce1d 100644
--- a/tests/device_tests/stellar/test_stellar.py
+++ b/tests/device_tests/stellar/test_stellar.py
@@ -50,7 +50,7 @@
# 9. Scroll down to the bottom and look at the "signatures" section. The Trezor should generate the same signature
#
-from base64 import b64encode
+from base64 import b64decode, b64encode
import pytest
@@ -135,7 +135,7 @@ def test_sign_tx(session: Session, parameters, result):
# check fixture consistency
if stellar.HAVE_STELLAR_SDK:
- from stellar_sdk import TransactionEnvelope
+ from stellar_sdk import Keypair, TransactionEnvelope
envelope = TransactionEnvelope.from_xdr(
parameters["xdr"], parameters["network_passphrase"]
@@ -149,6 +149,11 @@ def test_sign_tx(session: Session, parameters, result):
for op, op_parsed in zip(operations, operations_parsed):
assert op == op_parsed
+ if "signature" in result:
+ pubkey = bytes.fromhex(result["public_key"])
+ keypair = Keypair.from_raw_ed25519_public_key(pubkey)
+ keypair.verify(envelope.hash(), b64decode(result["signature"]))
+
if "signature" in result:
response = stellar.sign_tx(
session,
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.