Hardening + porting to Apex P

CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.1] - 2026-03-23
+
+### Added
+
+- Apex P poring (Ledger Nano Gen 5)
+- Derivation Path Hardening:
+    - New master key fingerprint syscall use, `HAVE_APPLICATION_FLAG_DERIVE_MASTER` is removed
+    - BIP-32 derivation paths is reinforced using wildcard syntax (`m/*/<COIN_TYPE>`)
+
 ## [0.1.0] - 2025-03-13
 
 ### Added

Makefile

@@ -22,7 +22,7 @@
 # Application version
 APPVERSION_M = 0
 APPVERSION_N = 1
-APPVERSION_P = 0
+APPVERSION_P = 1
 APPVERSION = "$(APPVERSION_M).$(APPVERSION_N).$(APPVERSION_P)"
 
 APPDEVELOPPER="Ledger"
@@ -63,5 +63,6 @@ ICON_NANOX = icons/nanox_app_core.gif
 ICON_NANOSP = icons/nanox_app_core.gif
 ICON_STAX = icons/stax_app_core.gif
 ICON_FLEX = icons/flex_app_core.gif
+ICON_APEX_P = icons/apex_p_app_core.png
 
 include bitcoin_app_base/Makefile

ledger_app.toml

@@ -1,7 +1,7 @@
 [app]
 build_directory = "./"
 sdk = "C"
-devices = ["nanox", "nanos+", "flex", "stax"]
+devices = ["nanox", "nanos+", "flex", "stax", "apex_p"]
 
 [tests]
 pytest_directory = "./tests/"

src/core.c

@@ -3,25 +3,28 @@
 #include <stdint.h>
 #include <string.h>
 
+/* Local headers */
 #include "core.h"
 #include "debug.h"
 
-#include "../bitcoin_app_base/src/crypto.h"
-#include "../bitcoin_app_base/src/common/script.h"
-#include "../bitcoin_app_base/src/common/read.h"
-#include "../bitcoin_app_base/src/common/write.h"
-
+/* SDK headers */
 #include "cx.h"
 #include "ledger_assert.h"
+#include "read.h"
+#include "write.h"
+
+/* Baseapp branch headers */
+#include "../bitcoin_app_base/src/crypto.h"
+#include "../bitcoin_app_base/src/common/script.h"
 
 #define EXPECTED_PAYLOAD_LEN \
     80  // SAT+(4)+ VERSION(1) + CHAIN_ID(2) + DELEGATOR(20) + VALIDATOR(20) + FEE(1) + REDEEM(32)
 
 #define SUPPORTED_VERSION 1
 
-static bool get_core_compressed_pubkey(const uint32_t bip32_path[],
-                                       uint8_t bip32_path_len,
-                                       uint8_t out_pubkey[static 33]) {
+static cx_err_t get_core_compressed_pubkey(const uint32_t bip32_path[],
+                                           uint8_t bip32_path_len,
+                                           uint8_t out_pubkey[static 33]) {
     uint8_t chaincode[32];
 
     return crypto_get_compressed_pubkey_at_path(bip32_path, bip32_path_len, out_pubkey, chaincode);
@@ -31,7 +34,7 @@ static bool get_core_pubkey_hash160(const uint32_t bip32_path[],
                                     uint8_t bip32_path_len,
                                     uint8_t out_hash160[static 20]) {
     uint8_t pubkey[33];
-    if (!get_core_compressed_pubkey(bip32_path, bip32_path_len, pubkey)) {
+    if (CX_OK != get_core_compressed_pubkey(bip32_path, bip32_path_len, pubkey)) {
         return false;
     }
     crypto_hash160(pubkey, 33, out_hash160);
@@ -201,4 +204,4 @@ void format_address(const uint8_t *buffer, size_t buffer_len, char *out, size_t
     out_len -= 2;
 
     buffer_to_hex(buffer, buffer_len, out, out_len);
-}
+}