v0.2.0 - two firmwares, and a multisig tutorial that runs

Two firmwares, a multisig tutorial that really runs, and a page that proves what it is serving you.

This is a simulator, not a wallet. No secure element, no air gap, a general purpose computer. Never enter a seed phrase you rely on: use a public test seed.

What is new

Two firmwares, switchable on the page. The 3rdIteration smartcard fork and stock SeedSigner 0.8.7, each pinned to a release, each built reproducibly, each with its own published hashes. The card tray is absent under stock, because stock has no smartcards. The simulator now defaults to Testnet rather than Mainnet.

A multisig tutorial, inside the simulator. One button runs a whole 2 of 3 on Bitsaga Signet, a private test network we run: three SeedKeeper cards each holding a public test seed, three account keys read back off them, a 2 of 3 built and registered on the device, coins from a faucet, a spend signed by two of the three cards, broadcast and confirmed. Self driving or hands on, with the QR exchange shown between a device and a phone rather than hidden. About two and a half minutes.

Technical details, on the page. A panel naming the firmware, the upstream tag and commit, the interpreter and every pinned dependency, and, next to the published hash, the hash of the wallet zip your browser actually received. It says plainly that a page checking itself is a convenience rather than proof, and links to the rebuild that is not.

Smartcards that behave like the hardware. Save a seed to a SeedKeeper and load it back; a Satochip that holds a real key and derives from it; descriptors stored on a card. The simulator now ships the same pysatochip the device builds from GitHub, rather than the older one on PyPI, so it reproduces the device's behaviour including its bugs.

What is checkable

wallet-smartcard.zip	22e6034509b547242db58ea7303d3f605007c60e637444b173e505eabbb834ca
contents	d2527f58d122a7155343b215b596dc94991dad5e893b9f5ec30da6ffe1463684
wallet-stock.zip	2db897dea90a0ecc090e959cbea34c6b4afbaa860478a260cc51f8cfdfd0a253
contents	dbea45131cc89e391b8ced909975b7d0030771d1d284142dd8287668130f2974

./build/build-wallet-zip.sh smartcard
sha256sum build/out/wallet-smartcard.zip
curl -s https://bitsaga.be/seedsigner-simulator/wallet-smartcard.zip | sha256sum

Or check that the attached file came out of this repository's workflow, which involves nothing from us:

gh attestation verify wallet-smartcard.zip --repo bitsagarob/seedsigner-sim

Twenty tests, and four things CI does on every push: run them, rebuild both firmwares on a clean runner and fail if either hash moved, run SeedSigner's own test suite against the dependency versions this repository pins, and scan for anything that should not be committed. The tag is signed; .github/allowed_signers holds the key.

Also

Mainnet signing is proven correct offline, against an implementation sharing no code with the wallet, which is why the warning about Mainnet is worded the way it is. The pin can be overridden with SS_REPO and SS_COMMIT to build against your own fork, and such a build says so rather than passing itself off as published.