feat(tests): always check basic constraints extension
What the developer wrote
Authored by Ondřej Vejpustek
feat(tests): always check basic constraints extension
[no changelog]
What changed, and why it matters
This commit only changes a test helper file in the Trezor firmware repository. It tightens how test code validates X.509 certificate chains by always checking the BasicConstraints extension and path length, rather than skipping the check when the extension is missing. There is no change to the actual device firmware or wallet security logic, so this does not introduce or fix a user-facing security vulnerability.
No action required. This is a test-code quality improvement. Reviewers may optionally confirm the new assertion matches the intended certificate chain semantics for the Tropic Square integration tests.
Security signals we found
Test-only change
Strengthens certificate chain validation in test helper
Removes silent pass on missing BasicConstraints extension
Adds path_length enforcement for CA certificates
Evidence from the diff
The diff modifies tests/device_tests/certificate.py’s verify_cert_chain() helper. Previously, the inner loop attempted to read the current cert’s BasicConstraints and, if missing, silently passed via ExtensionNotFound. The new code instead asserts that every CA cert has a non-None path_length and that the loop index i is within that path_length, effectively requiring every intermediate/CA certificate to declare BasicConstraints. The first (end-entity) cert is assumed non-CA by comment. This is a test-only hardening of certificate chain validation logic; it does not alter firmware runtime behavior.
Changed components
tests/device_tests/certificate.pyInspect captured patch +6 / −10
diff --git a/tests/device_tests/certificate.py b/tests/device_tests/certificate.py
index 8144386d..cfa77bdc 100644
--- a/tests/device_tests/certificate.py
+++ b/tests/device_tests/certificate.py
@@ -32,22 +32,18 @@ TROPIC_ROOT_PUBLIC_KEY = {
def verify_cert_chain(certs, model_name):
- for cert, ca_cert in zip(certs, certs[1:]):
+ for i, (cert, ca_cert) in enumerate(zip(certs, certs[1:])):
assert cert.issuer == ca_cert.subject
ca_basic_constraints = ca_cert.extensions.get_extension_for_class(
ext.BasicConstraints
).value
assert ca_basic_constraints.ca is True
-
- try:
- basic_constraints = cert.extensions.get_extension_for_class(
- ext.BasicConstraints
- ).value
- if basic_constraints.ca:
- assert basic_constraints.path_length < ca_basic_constraints.path_length
- except ext.ExtensionNotFound:
- pass
+ # It is assumed that certs[0] is not a CA
+ assert (
+ ca_basic_constraints.path_length is not None
+ and i <= ca_basic_constraints.path_length
+ )
try:
ski = ca_cert.extensions.get_extension_for_class(
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.