feat(kapp): add support to paper wallet generation as too

.gitignore

@@ -82,7 +82,8 @@ simulator/flash
 !tests/files/*
 
 # ignore build-release files
-krux-*/ktool*
+ktool-*
+*mpy.sig
 
 # IDE files
 .vscode

CHANGELOG.md

@@ -3,6 +3,11 @@
 ### New Device Support: Embed Fire
 This device shares similarities with the WonderMV but stands out with its larger 2.4" touchscreen.
 
+### Krux apps (Kapps)
+New tool for executing developer-signed utility apps that extend Krux functionality. Includes two initial Kapps: 
+- Nostr: Create or load your key using NIP-06 or NIP-19, and airgap-sign events
+- Steganography: Concel data within BMP image files
+
 ### New Device Support: WonderK PRO
 From the wonderful land of Korea, a new creation arrives: the WonderK PRO. Created by an entrepreneur who loves the Krux project, the WonderK follows in the footsteps of the WonderMV, but boasts a larger 2.8" display! Computer simulator for the WonderK device is also included.
 

Dockerfile

@@ -70,6 +70,8 @@ RUN cd kendryte-gnu-toolchain && \
       --recursive \
       --depth 1
 
+
+
 RUN cd kendryte-gnu-toolchain && \
     export PATH=$PATH:/opt/kendryte-toolchain/bin && \
     ./configure --prefix=/opt/kendryte-toolchain --with-cmodel=medany --with-arch=rv64imafc --with-abi=lp64f --enable-threads=posix --enable-libatomic && \
@@ -85,30 +87,43 @@ RUN python3 -m venv /kruxenv
 RUN /kruxenv/bin/pip install astor
 RUN /kruxenv/bin/pip install pyserial==3.4
 
+# Provide memset_s for host tools (mpy-cross) that expect it during link time
+RUN set -eux; \
+  cat > /tmp/memset_s.c <<'EOF'
+#include <errno.h>
+#include <stddef.h>
 
-############
-# build-software
-# copy vendor, firmware and Krux (src) files
-# install embit dependency
-############
-FROM build-base AS build-software
+typedef size_t rsize_t;
+typedef int errno_t;
+
+errno_t memset_s(void *dest, rsize_t destsz, int ch, rsize_t count) {
+    if (!dest) return EINVAL;
+    if (count > destsz) return EINVAL;
+    volatile unsigned char *p = (volatile unsigned char *)dest;
+    while (count--) *p++ = (unsigned char)ch;
+    __asm__ __volatile__("" : : : "memory"); /* compiler barrier */
+    return 0;
+}
+EOF
+RUN set -eux; \
+  gcc -O2 -c /tmp/memset_s.c -o /tmp/memset_s.o; \
+  ar rcs /usr/local/lib/libmemset_s.a /tmp/memset_s.o; \
+  nm -g /usr/local/lib/libmemset_s.a | grep -w memset_s
+
+###############
+# build-vendor
+# everything except COPY ./src
+###############
+FROM build-base AS build-vendor
 ARG DEVICE="maixpy_m5stickv"
 ENV DEVICE_BUILTIN="firmware/MaixPy/projects/${DEVICE}/builtin_py"
 RUN mkdir /src
 WORKDIR /src
 
-# copy vendor to WORKDIR (src)
 COPY ./vendor vendor
-
-# clean vendor/urtypes
 RUN find vendor/urtypes -type d -name '__pycache__' -exec rm -rv {} + -depth
-
-# clean vendor/foundation-ur-py
 RUN find vendor/foundation-ur-py -type d -name '__pycache__' -exec rm -rv {} + -depth
-
-# install vendor/embit
 RUN /kruxenv/bin/pip install vendor/embit
-# clean vendor/embit
 RUN rm -rf vendor/embit/src/embit/util/prebuilt && \
     rm -rf vendor/embit/src/embit/liquid && \
     rm -f vendor/embit/src/embit/psbtview.py && \
@@ -119,25 +134,41 @@ RUN rm -rf vendor/embit/src/embit/util/prebuilt && \
     rm -f vendor/embit/src/embit/util/py_ripemd160.py && \
     find vendor/embit -type d -name '__pycache__' -exec rm -rv {} + -depth
 
-# copy firmware to WORKDIR (src)
 COPY ./firmware firmware
-# clean firmware
 RUN find firmware -type d -name '__pycache__' -exec rm -rv {} + -depth
-
-# copy all vendors to DEVICE_BUILTIN
 RUN cp -r vendor/urtypes/src/urtypes "${DEVICE_BUILTIN}"
 RUN cp -r vendor/foundation-ur-py/src/ur "${DEVICE_BUILTIN}"
 RUN cp -r vendor/embit/src/embit "${DEVICE_BUILTIN}"
 
-# copy Krux (src) to WORKDIR (src)
+############
+# build-software
+# copy vendor, firmware and Krux (src) files
+# install embit dependency
+############
+FROM build-vendor AS build-software
+ARG DEVICE="maixpy_m5stickv"
+ENV DEVICE_BUILTIN="firmware/MaixPy/projects/${DEVICE}/builtin_py"
+WORKDIR /src
+
 COPY ./src src
-# rename boot.py
 RUN mv src/boot.py src/_boot.py
-# clean it
 RUN find src -type d -name '__pycache__' -exec rm -rv {} + -depth
-# copy it to DEVICE_BUILTIN
 RUN cp -r src/. "${DEVICE_BUILTIN}"
 
+################
+# build-safeclib
+################
+FROM build-vendor AS build-safeclib
+RUN apt-get update -y && apt-get install --no-install-recommends -y \
+    git make autoconf automake libtool pkg-config ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+RUN git clone --depth 1 https://github.com/rurban/safeclib.git
+WORKDIR /src/safeclib
+RUN ./build-aux/autogen.sh \
+ && ./configure --prefix=/opt/safeclib \
+ && make -j"$(nproc)" \
+ && make install
 
 ############
 # build-firmware
@@ -151,13 +182,66 @@ WORKDIR /src/firmware/MaixPy
 # overrides the DEVICE specific C files (font, sensor, ...) in componets/micropython
 RUN cp -rf projects/"${DEVICE}"/compile/overrides/. ./
 
+# ensure host mpy-cross link gets memset_s
+ENV LIB="-lm /usr/local/lib/libmemset_s.a"
+
+# MaixPy/MicroPython firmware link: riscv64-unknown-elf toolchain doesn't ship memset_s.
+# Use MicroPython's internal secure memset helper instead (already present in gc.c).
+RUN set -eux; \
+  gc="/src/firmware/MaixPy/components/micropython/core/py/gc.c"; \
+  test -f "$gc"; \
+  grep -q "mp_memset_s" "$gc"; \
+  sed -i -E 's/\bmemset_s[[:space:]]*\(/mp_memset_s(/g' "$gc"
+
 RUN cd projects/"${DEVICE}" && \
     /kruxenv/bin/python project.py clean && \
     /kruxenv/bin/python project.py distclean && \
     /kruxenv/bin/python project.py build && \
     mv build/maixpy.bin build/firmware.bin
 
 
+###########
+# build-mpy
+###########
+FROM build-safeclib AS build-mpy
+RUN apt-get update -y && apt-get install --no-install-recommends -y \
+    git make python3 ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
+COPY --from=build-safeclib /opt/safeclib /opt/safeclib
+ENV LD_LIBRARY_PATH=/opt/safeclib/lib
+
+WORKDIR /src
+COPY firmware/MaixPy/components/micropython/core/mpy-cross/ \
+     firmware/MaixPy/components/micropython/core/mpy-cross/
+
+# Provide memset_s for host tool only (mpy-cross). No upstream repo edits.
+RUN set -eux; \
+  cat > /tmp/memset_s.c <<'EOF'
+#include <errno.h>
+#include <stddef.h>
+
+typedef size_t rsize_t;
+typedef int errno_t;
+
+errno_t memset_s(void *dest, rsize_t destsz, int ch, rsize_t count) {
+    if (!dest) return EINVAL;
+    if (count > destsz) return EINVAL;
+    volatile unsigned char *p = (volatile unsigned char *)dest;
+    while (count--) *p++ = (unsigned char)ch;
+    __asm__ __volatile__("" : : : "memory"); /* compiler barrier */
+    return 0;
+}
+EOF
+RUN set -eux; \
+  gcc -O2 -c /tmp/memset_s.c -o /tmp/memset_s.o; \
+  ar rcs /usr/local/lib/libmemset_s.a /tmp/memset_s.o; \
+  nm -g /usr/local/lib/libmemset_s.a | grep -w memset_s
+
+WORKDIR /src/firmware/MaixPy/components/micropython/core/mpy-cross
+RUN set -eux; \
+  make V=1 LIB="-lm /usr/local/lib/libmemset_s.a"; \
+  chmod +x ./mpy-cross
+
 ############
 # build
 # creation of kboot.kfpkg using firmware.bin
@@ -171,3 +255,15 @@ RUN cp /src/firmware/MaixPy/projects/"${DEVICE}"/build/firmware.bin .
 RUN sed -i -e 's/\r$//' *.sh
 
 RUN ./CLEAN.sh && ./BUILD.sh
+
+##############
+# build kapps
+# compilation of kapps inside kapps/ folders
+#############
+FROM build-mpy AS build-kapp
+ARG KAPP="nostr"
+WORKDIR /work
+COPY kapps/${KAPP}.py /work/${KAPP}.py
+RUN mkdir -p /out \
+ && /src/firmware/MaixPy/components/micropython/core/mpy-cross/mpy-cross \
+      -X heapsize=4194304 -O2 -o "/out/${KAPP}.mpy" "/work/${KAPP}.py"

docs/getting-started/features/tools.en.md

@@ -3,6 +3,16 @@ Here are some useful tools that are available as soon as Krux starts! These are
 <img src="../../../img/maixpy_amigo/tools-options-300.png" class="amigo">
 <img src="../../../img/maixpy_m5stickv/tools-options-250.png" class="m5stickv">
 
+### Load Krux app
+<img src="../../../img/maixpy_m5stickv/krux-apps-250.png" align="right" class="m5stickv">
+<img src="../../../img/maixpy_amigo/krux-apps-300.png" align="right" class="amigo">
+
+Run developer-signed Krux applications (Kapps) that are not suited to be part of the main firmware. Copy its `.mpy` file and corresponding signature to an SD card to load it onto the device. When executed, the Kapp is stored in the user's flash memory (just like custom settings) and this process modifies the last two words of the [Tamper Detection](tamper-detection.md#tamper-check-flash-hash-tc-flash-hash-a-tamper-detection-tool) (User's Region).
+
+For example, the **Nostr Kapp** allows converting a mnemonic into a Nostr `nsec` key and air-gapped event signing.
+
+<div style="clear: both"></div>
+
 ### Datum Tool
 <img src="../../../img/maixpy_m5stickv/tools-datum-tool-load-250.png" align="right" class="m5stickv">
 <img src="../../../img/maixpy_amigo/tools-datum-tool-load-300.png" align="right" class="amigo">

i18n/i18n.py

@@ -19,6 +19,7 @@
 # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 # THE SOFTWARE.
+# pylint: disable=invalid-name
 
 import binascii
 import sys

i18n/translations/de-DE.json

@@ -19,7 +19,10 @@
     "Additional entropy from camera required for %s": "Zusätzliche Entropie von der Kamera erforderlich für %s",
     "Address": "Adresse",
     "Align camera and backup plate properly.": "Richte Kamera und Sicherungsplatte richtig aus.",
+    "Allow Krux apps": "Krux-Apps zulassen",
+    "Allow in settings first!": "Erlaube zuerst Einstellungen!",
     "Anti-glare mode": "Blendschutzmodus",
+    "App will be stored internally on flash.": "Die App wird intern auf Flash gespeichert.",
     "Appearance": "Aussehen",
     "Are you sure?": "Bist Du sicher?",
     "BGR Colors": "BGR-Farben",
@@ -93,6 +96,7 @@
     "Erasing user's data…": "Benutzerdaten werden gelöscht…",
     "Error:": "Fehler:",
     "Esc": "Esc",
+    "Execute %s Krux app?": "%s Krux-App ausführen?",
     "Explore files?": "Dateien durchsuchen?",
     "Export Addresses": "Adressen exportieren",
     "Exporting %s to SD card…": "%s wird auf SD-Karte exportiert…",
@@ -151,6 +155,7 @@
     "Line Delay": "Leitungsverzögerung",
     "Line:": "Linie:",
     "List Addresses": "Adressen auflisten",
+    "Load Krux app": "Krux-App laden",
     "Load Mnemonic": "Mnemonic laden",
     "Load Wallet": "Wallet laden",
     "Load a trusted wallet descriptor to view addresses?": "Einen vertrauenswürdigen Wallet-Deskriptor laden, um Adressen anzuzeigen?",
@@ -284,6 +289,7 @@
     "Spend (%d):": "Ausgabe (%d):",
     "Spend:": "Ausgaben:",
     "Standard mode": "Standardmodus",
+    "Startup Kapp": "Startup Kapp",
     "Static": "Statisch",
     "Stats for Nerds": "Statistiken für Nerds",
     "Store on Flash": "Auf Flash speichern",
@@ -316,6 +322,7 @@
     "Type Key": "Schlüssel eingeben",
     "Undo": "Widerrufen",
     "Unit": "Einheit",
+    "Unsigned apps found in flash will be deleted.": "Nicht signierte Apps, die in Flash gefunden wurden, werden gelöscht.",
     "Update KEF ID?": "KEF-ID aktualisieren?",
     "Update QR Label?": "QR-Etikett aktualisieren?",
     "Upgrade complete.": "Upgrade abgeschlossen.",

i18n/translations/es-MX.json

@@ -19,7 +19,10 @@
     "Additional entropy from camera required for %s": "Se requiere entropía adicional de la cámara para %s",
     "Address": "Dirección",
     "Align camera and backup plate properly.": "Alinea la cámara y la placa de respaldo correctamente.",
+    "Allow Krux apps": "Permitir aplicaciones Krux",
+    "Allow in settings first!": "¡Permitir en la configuración primero!",
     "Anti-glare mode": "Modo antirreflejo",
+    "App will be stored internally on flash.": "La aplicación se almacenará internamente en flash.",
     "Appearance": "Apariencia",
     "Are you sure?": "¿Estás seguro?",
     "BGR Colors": "Colores BGR",
@@ -93,6 +96,7 @@
     "Erasing user's data…": "Borrando los datos del usuario…",
     "Error:": "Error:",
     "Esc": "Esc",
+    "Execute %s Krux app?": "¿Ejecutar %s aplicación Krux?",
     "Explore files?": "¿Explorar archivos?",
     "Export Addresses": "Exportar direcciones",
     "Exporting %s to SD card…": "Exportando %s a la tarjeta SD…",
@@ -151,6 +155,7 @@
     "Line Delay": "Retraso de Línea",
     "Line:": "Línea:",
     "List Addresses": "Listar direcciones",
+    "Load Krux app": "Cargar aplicación Krux",
     "Load Mnemonic": "Importar Mnemónico",
     "Load Wallet": "Cargar Cartera",
     "Load a trusted wallet descriptor to view addresses?": "¿Cargar un descriptor de monedero de confianza para ver las direcciones?",
@@ -284,6 +289,7 @@
     "Spend (%d):": "Gastos (%d):",
     "Spend:": "Gasto:",
     "Standard mode": "Modo estándar",
+    "Startup Kapp": "Startup Kapp",
     "Static": "Estático",
     "Stats for Nerds": "Estadísticas para Entendidos",
     "Store on Flash": "Almacenar en Flash",
@@ -316,6 +322,7 @@
     "Type Key": "Introduce la clave",
     "Undo": "Deshacer",
     "Unit": "Unidad",
+    "Unsigned apps found in flash will be deleted.": "Se eliminarán las aplicaciones sin firmar que se encuentren en Flash.",
     "Update KEF ID?": "¿Actualizar ID de Kef?",
     "Update QR Label?": "¿Actualizar etiqueta QR?",
     "Upgrade complete.": "Actualización completa.",

i18n/translations/fr-FR.json

@@ -19,7 +19,10 @@
     "Additional entropy from camera required for %s": "Entropie supplémentaire de la caméra requise pour %s",
     "Address": "Adresse",
     "Align camera and backup plate properly.": "Alignez correctement la caméra et plaque de sauvegarde.",
+    "Allow Krux apps": "Autoriser les applications Krux",
+    "Allow in settings first!": "Autoriser d'abord dans les paramètres !",
     "Anti-glare mode": "Mode anti-reflets",
+    "App will be stored internally on flash.": "L'application sera stockée en interne sur flash.",
     "Appearance": "Apparence",
     "Are you sure?": "Es-tu sûr ?",
     "BGR Colors": "Couleurs BGR",
@@ -93,6 +96,7 @@
     "Erasing user's data…": "Effacement des données de l'utilisateur…",
     "Error:": "Erreur :",
     "Esc": "Esc",
+    "Execute %s Krux app?": "Exécuter l'application %s Krux ?",
     "Explore files?": "Explorer des fichiers ?",
     "Export Addresses": "Adresses d'exportation",
     "Exporting %s to SD card…": "Exportation de %s vers la carte SD…",
@@ -151,6 +155,7 @@
     "Line Delay": "Délai de Ligne",
     "Line:": "Ligne :",
     "List Addresses": "Listage d'Addresses",
+    "Load Krux app": "Charger l'application Krux",
     "Load Mnemonic": "Charger Mnémonique",
     "Load Wallet": "Charger le portefeuille",
     "Load a trusted wallet descriptor to view addresses?": "Charger un descripteur de portefeuille de confiance pour afficher les adresses ?",
@@ -284,6 +289,7 @@
     "Spend (%d):": "Dépense (%d) :",
     "Spend:": "Dépense :",
     "Standard mode": "Mode standard",
+    "Startup Kapp": "Startup Kapp",
     "Static": "Statique",
     "Stats for Nerds": "Statistiques pour les geeks",
     "Store on Flash": "Stocker sur flash",
@@ -316,6 +322,7 @@
     "Type Key": "Taper clé",
     "Undo": "Annuler",
     "Unit": "Unité",
+    "Unsigned apps found in flash will be deleted.": "Les applications non signées trouvées dans Flash seront supprimées.",
     "Update KEF ID?": "Mettre à jour l'ID KEF ?",
     "Update QR Label?": "Mettre à jour l'étiquette QR ?",
     "Upgrade complete.": "Mise à jour complète.",