# The two firmwares this simulator runs, pinned.
#
# src/seedsigner in a built wallet zip is one of the trees below, verbatim.
# Nothing in this repository patches either of them: the hardware seams are
# replaced from the outside, by the modules in src/shims and by the stand-in
# packages in src/smartcard and src/fakes. That is the property the build script
# exists to let you check for yourself.
#
# Named sections, and every consumer of this file names the section it wants:
# build/build-wallet-zip.sh, which assembles the zip, and the two workflows that
# re-derive its hash and run upstream's own tests against our pins. Nothing reads
# a key outside a section, so the parsers cannot silently pick up the wrong pin
# if a section is renamed or removed.
#
# The first two sections are the two firmwares, and only those two are built. The
# two after them pin the smartcard applets, which nothing here builds at all; the
# comment above them says what they are for.
#
# Every pin here is a release tag rather than a branch tip. A tip moves: rebase
# or force-push dev and the sha stops existing on the remote, at which point every
# rebuild described here fails at the fetch, for everyone, permanently. A tag is
# a name upstream has published and does not move. The sha is still the pin; the
# tag only says which release it is.
#
# Each firmware section also publishes the two hashes of the wallet zip that
# build/build-wallet-zip.sh produces from that pin. Rebuild it yourself and
# compare; if these differ, something between that commit and the file you were
# served is not what it claims to be.

# SeedSigner as the SeedSigner project publishes it: the firmware on a plain
# device. No smartcard support, no card menus, and a much smaller dependency set
# because of it.
[stock]
repo   = https://github.com/SeedSigner/seedsigner.git
commit = e0a80d4b33b8eb7fb1e9fd14a27b7cd11c7d2cd6
tag    = 0.8.7

wallet_zip_sha256          = 2db897dea90a0ecc090e959cbea34c6b4afbaa860478a260cc51f8cfdfd0a253
wallet_zip_contents_sha256 = dbea45131cc89e391b8ced909975b7d0030771d1d284142dd8287668130f2974

# The 3rdIteration fork, which merges the release above and adds smartcard
# support: SeedKeeper and Satochip cards, the card menus, and the dependency
# stack those need. This tag is also what the official pi0-smartcard device
# image is built from, so the simulator and that physical device run the same
# code.
[smartcard]
repo   = https://github.com/3rdIteration/seedsigner.git
commit = 6faaffcb06a2ba578a96fdef689d97e21793ec23
tag    = SeSi-0.8.7+ShSi-B12

wallet_zip_sha256          = 99f38dddf65717d6656205fc747eb553f3b1af48a6d57a32cfee78e96b1a061c
wallet_zip_contents_sha256 = da346e8a7dce5b2e82bd45ac011af6b4fba75f42a5ed3765ebe96d746f4f580c

# The two smartcard applets, pinned as a reference rather than as an input.
#
# Nothing here builds these. They are JavaCard, they run on a secure element,
# and src/smartcard/ emulates them in Python instead: it answers their APDUs so
# that pysatochip and the wallet above it run unmodified. No build script reads
# the two sections below and no artifact contains a byte of them.
#
# They are pinned because "we emulate a SeedKeeper" is a claim with a version in
# it. An applet gains instructions between releases, and a simulator that does
# not say which release it is imitating cannot be checked against anything. So
# these record which one: the tag whose protocol version each simulated card
# reports in its own GET STATUS answer, which is what the wallet reads to decide
# how to lay a seed out. docs/ARCHITECTURE.md maps every APDU src/smartcard/
# answers to the source file and the constant in these two trees that defines
# it, and lists what those trees have that this simulation deliberately does not.
#
# Tag naming is the applets' own: v0.12 is Satochip protocol 0.12, and v0.2-0.1
# is SeedKeeper protocol 0.2, applet build 0.1.

[satochip-applet]
repo   = https://github.com/Toporin/SatochipApplet.git
commit = c3baeb6b1b84f5bdd05b47bbf2dd9cf8631c11ef
tag    = v0.12

[seedkeeper-applet]
repo   = https://github.com/Toporin/Seedkeeper-Applet.git
commit = 2e59f0653c5dd39f6793ee5c41ee7344ffdeb48f
tag    = v0.2-0.1

# The boot game, which is not a firmware and does not replace one.
#
# DoomSigner is SeedSigner OS with a game in front of the wallet: the device
# boots into DOOM and hands off on KEY1, KEY2, KEY3, and the wallet it hands off
# to is the smartcard fork pinned above, unchanged. So there is no third wallet
# zip here and there should not be. What is pinned is the tree the browser build
# of the game is compiled from.
#
# A tag, like every other pin in this file, and for a reason this repository has
# already met: main over there has been force-pushed, and a pin that follows a
# branch is a pin that can be rewritten out from under a rebuild. The tag names
# one commit and stays on it.
#
# build/build-doom-wasm.sh compiles this with emscripten over an unmodified
# doomgeneric. The picture is the device's own: it compiles the port's ss_video.c,
# so the browser is handed the RGB565 the panel would be sent rather than DOOM's
# native 320x200 put on a canvas.

[doomsigner]
repo   = https://github.com/bitsagarob/doomsigner.git
commit = 4285bda39b59e3344fd04f0794791580f70e3b0c
tag    = doomsigner-v0.1

emscripten = 6.0.5

doom_js_sha256   = 6b3e0c7f6dc2a582d4d540069e1c9a864868075d295a30ae289c5388659be7b6
doom_wasm_sha256 = 4a8024b582c93bc9d481df871e0b570132b2244524a3aeb7ab2c69fc53b4aebf
doom_run_sha256  = 59c64231bdbe5940a7ab918e816c507618bd9a55712f96fdc93730af6f406936

# doomgeneric itself, which nothing here patches.
[doomgeneric]
repo   = https://github.com/ozkl/doomgeneric.git
commit = dcb7a8dbc7a16ce3dda29382ac9aae9d77d21284

# The game's data, which is not code and is not built. Freedoom rather than a
# retail WAD because it is freely redistributable, which is what makes it
# servable from a public site at all.
[freedoom]
release    = v0.13.0
wad_sha256 = 7323bcc168c5a45ff10749b339960e98314740a734c30d4b9f3337001f9e703d
