firmware/api: add support for BitBoxSync

.github/workflows/ci.yml

@@ -1,84 +1,63 @@
-# See reference docs at
-# https://help.github.com/en/actions/reference/workflow-syntax-for-github-actions
 name: ci
-on: [push, pull_request]
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
 env:
-  GO_VERSION: "^1.24"
-  GOLANGCI_LINT_VERSION: "v2.8.0"
+  GOLANGCI_LINT_VERSION: "v2.12.2"
 
 jobs:
   lint:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-      - name: Clone the repo
-        uses: actions/checkout@v4
-      - name: Enable caching
-        uses: actions/cache@v4
+      - name: Check out repository
+        uses: actions/checkout@v7
+      - name: Set up Go
+        uses: actions/setup-go@v6
         with:
-          # Increment cache number to invalidate.
-          key: ${{runner.os}}-cache-1
-          path: |
-            ~/go/pkg
-            ~/.cache/go-build
-            ~/.cache/golangci-lint
-      - name: Install Go
-        uses: actions/setup-go@v4
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+      - name: Run golangci-lint
+        uses: golangci/golangci-lint-action@v9
         with:
-          go-version: ${{env.GO_VERSION}}
-      # Keep the linter version and its config in .golangci.yml in sync with the app repo at
-      # https://github.com/BitBoxSwiss/bitbox-wallet-app/blob/98e815c25950dc7f55a27551d053239e6fd804ca/Makefile#L24
-      - name: Install golangci-lint
-        run: |
-          curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | \
-          sh -s -- -b $HOME $GOLANGCI_LINT_VERSION
-      - name: Lint
-        run: ~/golangci-lint run
+          version: ${{ env.GOLANGCI_LINT_VERSION }}
+          args: ./...
+
   test:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-      - name: Clone the repo
-        uses: actions/checkout@v4
-      - name: Enable caching
-        uses: actions/cache@v4
+      - name: Check out repository
+        uses: actions/checkout@v7
+      - name: Set up Go
+        uses: actions/setup-go@v6
         with:
-          # Increment cache number to invalidate.
-          key: ${{runner.os}}-cache-1
-          path: |
-            ~/go/pkg
-            ~/.cache/go-build
-            ~/.cache/golangci-lint
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
       - name: Enable simulators caching
         uses: actions/cache@v4
         with:
           key: ${{runner.os}}-simulators-cache-${{hashFiles('./api/firmware/testdata/simulators.json')}}
           path: |
             ./api/firmware/testdata/simulators
-      - name: Install Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: ${{env.GO_VERSION}}
       - name: Test
         run: |
           go version
           go test ./... -v
+
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
-      - name: Clone the repo
-        uses: actions/checkout@v4
-      - name: Enable caching
-        uses: actions/cache@v4
-        with:
-          # Increment cache number to invalidate.
-          key: ${{runner.os}}-cache-1
-          path: |
-            ~/go/pkg
-            ~/.cache/go-build
-            ~/.cache/golangci-lint
-      - name: Install Go
-        uses: actions/setup-go@v4
+      - name: Check out repository
+        uses: actions/checkout@v7
+      - name: Set up Go
+        uses: actions/setup-go@v6
         with:
-          go-version: ${{env.GO_VERSION}}
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
       - name: Build
         run: |
           go version

.golangci.yml

@@ -25,6 +25,7 @@ linters:
     - gocognit
     - gocyclo
     - godox
+    - gomodguard
     - gosec
     - gosmopolitan
     - inamedparam

api/firmware/attestation_test.go

@@ -10,7 +10,6 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
-	"math/big"
 	"testing"
 
 	"github.com/BitBoxSwiss/bitbox02-api-go/api/common"
@@ -44,16 +43,24 @@ func makeCertificate(rootPrivkey *btcec.PrivateKey, bootloaderHash []byte, devic
 	return signature[1:]
 }
 
-// adapted from ecdsa.GenerateKey()
 func p256PrivKeyFromBytes(k []byte) *ecdsa.PrivateKey {
-	priv := new(ecdsa.PrivateKey)
-	c := elliptic.P256()
-	priv.Curve = c
-	priv.D = new(big.Int).SetBytes(k)
-	priv.X, priv.Y = c.ScalarBaseMult(k)
+	priv, err := ecdsa.ParseRawPrivateKey(elliptic.P256(), k)
+	if err != nil {
+		panic(err)
+	}
 	return priv
 }
 
+func p256PubkeyBytes(t *testing.T, priv *ecdsa.PrivateKey) []byte {
+	t.Helper()
+	publicKey, ok := priv.Public().(*ecdsa.PublicKey)
+	require.True(t, ok)
+	encoded, err := publicKey.Bytes()
+	require.NoError(t, err)
+	require.Len(t, encoded, 65)
+	return encoded[1:]
+}
+
 func TestPerformAttestation(t *testing.T) {
 
 	// Arbitrary values, they do not have any special meaning.
@@ -66,10 +73,7 @@ func TestPerformAttestation(t *testing.T) {
 	devicePrivateKey := p256PrivKeyFromBytes(
 		unhex("9b1a4d293a6eef1960d8afab5e58dd581b135152ec3399bde9268fa23051321b"),
 	)
-	devicePublicKey := devicePrivateKey.PublicKey
-	devicePubkeyBytes := make([]byte, 64)
-	copy(devicePubkeyBytes[:32], devicePublicKey.X.Bytes())
-	copy(devicePubkeyBytes[32:], devicePublicKey.Y.Bytes())
+	devicePubkeyBytes := p256PubkeyBytes(t, devicePrivateKey)
 
 	undo := addAttestationPubkey(hex.EncodeToString(rootPublicKey.SerializeUncompressed()))
 	defer undo()
@@ -205,10 +209,7 @@ func TestVerifyAttestation(t *testing.T) {
 	devicePrivateKey := p256PrivKeyFromBytes(
 		unhex("9b1a4d293a6eef1960d8afab5e58dd581b135152ec3399bde9268fa23051321b"),
 	)
-	devicePublicKey := devicePrivateKey.PublicKey
-	devicePubkeyBytes := make([]byte, 64)
-	copy(devicePubkeyBytes[:32], devicePublicKey.X.Bytes())
-	copy(devicePubkeyBytes[32:], devicePublicKey.Y.Bytes())
+	devicePubkeyBytes := p256PubkeyBytes(t, devicePrivateKey)
 	certificate := makeCertificate(rootPrivateKey, bootloaderHash, devicePubkeyBytes)
 
 	undo := addAttestationPubkey(hex.EncodeToString(rootPublicKey.SerializeUncompressed()))