MANIFEST

Level-Set5770

"verifying before blindly trusting a device" Oh really?! How about yo review this fucking makefile and tell me what is wrong. \# Config for our board. \# MCU\_SERIES = l4 CMSIS\_MCU = STM32L4S5xx AF\_FILE = boards/$(BOARD)/stm32l4s5\_af.csv LD\_FILES = boards/$(BOARD)/layout.ld boards/common\_ifs.ld OPENOCD\_CONFIG = boards/openocd\_stm32l4.cfg \# MicroPython settings MICROPY\_VFS\_LFS2 = 1 MICROPY\_VFS\_FAT = 1 \# see py/mpconfig.h which uses this var if set CFLAGS\_EXTRA += -DMP\_CONFIGFILE=\\"boards/$(BOARD)/ckcc-port.h\\" CFLAGS\_EXTRA += -DCOLDCARD\_DEBUG=$(DEBUG\_BUILD) \# obsolete \# need the CDC inf file to be built before this file \#initfs.c: $(GEN\_CDCINF\_HEADER) \# NgU and uQR libraries NGU\_NEEDS\_CIFRA = 1 USER\_C\_MODULES = boards/$(BOARD)/c-modules \# the bulk of the COLDCARD-specific code \# - do not want contents of stm32/boards/manifest.py FROZEN\_MANIFEST = \\ boards/$(BOARD)/shared/manifest.py \\ boards/$(BOARD)/shared/manifest\_mk4.py \# This will relocate things up by 128k=0x2\_0000 \# see also ./layout.ld CFLAGS\_MOD += -DVECT\_TAB\_OFFSET=0x20000 TEXT0\_ADDR = 0x08020000 TEXT1\_ADDR = 0x08024000 \# don't want any of these: soft\_spi, soft\_qspi, dht \#DRIVERS\_SRC\_C -= drivers/bus/softspi.c \\ \# drivers/bus/softqspi.c drivers/memory/spiflash.c \\ \# drivers/dht/dht.c \# Approximately all the source code files? ALL\_SRC = $(SRC\_LIB) $(SRC\_LIBM) $(EXTMOD\_SRC\_C) $(DRIVERS\_SRC\_C) \\ $(SRC\_HAL) $(SRC\_USBDEV) $(SRC\_MOD) ALL\_SRC += $(addprefix ports/stm32/, $(SRC\_C)) ALL\_SRC += py/\*.\[ch\] \# XXX: this barely works, ignore errors tags: echo $(ALL\_SRC) (cd $(TOP)/../..; pwd; ctags -R -f .tags $(addprefix external/micropython/, $(ALL\_SRC)) \\ external/micropython/lib/stm32lib/STM32L4xx\_HAL\_Driver/\*/\*.\[ch\] \\ external/micropython/lib/stm32lib/CMSIS/STM32L4xx/Include/stm32l475xx.h \\ external/micropython/lib/cmsis/inc/core\_cm4.h \\ external/micropython/ports/stm32/\*.\[ch\] \\ external/micropython/ports/stm32/\*/\*.\[ch\] \\ external/micropython/ports/stm32/usbdev/{core,class}/{src,inc}/\*.\[ch\] \\ external/libngu/ngu/\*.\[ch\]) sed -i .tmp '/dynruntime./d' $(TOP)/../../.tags checksum: $(OBJCOPY) -O binary -j .isr\_vector -j .text -j .data \\ \--pad-to 0x080e0000 --gap-fill 0xff \\ $(BUILD)/firmware.elf $(BUILD)/firmware-complete.bin shasum -a 256 $(BUILD)/firmware-complete.bin \# This costs about 241,136 of flash! Not clear on what I gain. \# It enables -O0 instead of -Os!! Very bad. \#DEBUG = 1 \# we always want debug symbols, since they get stripped anyway COPT += -g \# bugfix IIRC build-COLDCARD\_MK4/boards/COLDCARD\_MK4/modckcc.o: COPT = -O0 -DNDEBUG \# pickiness build-COLDCARD\_MK4/dma.o: COPT=-Werror=unused-const-variable=0 build-COLDCARD\_MK4/boards/COLDCARD\_MK4/psramdisk.o: COPT=-Werror=unused-const-variable=0 \# bugfix: remove unwanted setup code called from ports/stm32/resethandler.s build-COLDCARD\_MK4/lib/stm32lib/CMSIS/STM32L4xx/Source/Templates/system\_stm32l4xx.o: \\ CFLAGS += -DSystemInit=SystemInit\_OMIT \# bugfix: replace keyboard interrupt handling build-COLDCARD\_MK4/lib/utils/interrupt\_char.o: \\ CFLAGS += -Dmp\_hal\_set\_interrupt\_char=mp\_hal\_set\_interrupt\_char\_OMIT \# bugfix: leave my LED's alone build-COLDCARD\_MK4/flashbdev.o: CFLAGS += -Dled\_state=led\_state\_OMIT build-COLDCARD\_MK4/spibdev.o: CFLAGS += -Dled\_state=led\_state\_OMIT build-COLDCARD\_MK4/factoryreset.o: CFLAGS += -Dled\_state=led\_state\_OMIT build-COLDCARD\_MK4/boardctrl.o: CFLAGS += -Dled\_state=led\_state\_OMIT files: \# SRC\_C: $(SRC\_C) u/echo \# SRC\_HAL: $(SRC\_HAL) u/echo \# CFLAGS: $(CFLAGS) u/echo \# FROZEN\_MANIFEST: $(FROZEN\_MANIFEST)

ecurrencyhodler

\>The developer can update the extension later and insert malware later on. If you're this paranoid, you should verify the build every time there's an update. \>Grandma is not going to know how to compare code You can do this for your grandma. Hence, save grandma. \> There's just too much risk involved There's really not that much risk. Much less risk than trusting a chrome extension wallet or even a closed source HWW. Here are the steps to verify the build: [https://github.com/ecurrencyhodler/savegrandma/blob/main/BUILD\_MANIFEST.md](https://github.com/ecurrencyhodler/savegrandma/blob/main/BUILD_MANIFEST.md)