feat(kapp): add support to paper wallet generation as too

.gitignore

@@ -82,7 +82,8 @@ simulator/flash
 !tests/files/*
 
 # ignore build-release files
-krux-*/ktool*
+ktool-*
+*mpy.sig
 
 # IDE files
 .vscode

CHANGELOG.md

@@ -14,6 +14,11 @@
 ### New Device Support: Embed Fire
 This device shares similarities with the WonderMV but stands out with its larger 2.4" touchscreen.
 
+### Krux apps (Kapps)
+New tool for executing developer-signed utility apps that extend Krux functionality. Includes two initial Kapps: 
+- Nostr: Create or load your key using NIP-06 or NIP-19, and airgap-sign events
+- Steganography: Concel data within BMP image files
+
 ### New Device Support: WonderK PRO
 From the wonderful land of Korea, a new creation arrives: the WonderK PRO. Created by an entrepreneur who loves the Krux project, the WonderK follows in the footsteps of the WonderMV, but boasts a larger 2.8" display! Computer simulator for the WonderK device is also included.
 

Dockerfile

@@ -70,6 +70,8 @@ RUN cd kendryte-gnu-toolchain && \
       --recursive \
       --depth 1
 
+
+
 RUN cd kendryte-gnu-toolchain && \
     export PATH=$PATH:/opt/kendryte-toolchain/bin && \
     ./configure --prefix=/opt/kendryte-toolchain --with-cmodel=medany --with-arch=rv64imafc --with-abi=lp64f --enable-threads=posix --enable-libatomic && \
@@ -85,30 +87,43 @@ RUN python3 -m venv /kruxenv
 RUN /kruxenv/bin/pip install astor
 RUN /kruxenv/bin/pip install pyserial==3.4
 
+# Provide memset_s for host tools (mpy-cross) that expect it during link time
+RUN set -eux; \
+  cat > /tmp/memset_s.c <<'EOF'
+#include <errno.h>
+#include <stddef.h>
 
-############
-# build-software
-# copy vendor, firmware and Krux (src) files
-# install embit dependency
-############
-FROM build-base AS build-software
+typedef size_t rsize_t;
+typedef int errno_t;
+
+errno_t memset_s(void *dest, rsize_t destsz, int ch, rsize_t count) {
+    if (!dest) return EINVAL;
+    if (count > destsz) return EINVAL;
+    volatile unsigned char *p = (volatile unsigned char *)dest;
+    while (count--) *p++ = (unsigned char)ch;
+    __asm__ __volatile__("" : : : "memory"); /* compiler barrier */
+    return 0;
+}
+EOF
+RUN set -eux; \
+  gcc -O2 -c /tmp/memset_s.c -o /tmp/memset_s.o; \
+  ar rcs /usr/local/lib/libmemset_s.a /tmp/memset_s.o; \
+  nm -g /usr/local/lib/libmemset_s.a | grep -w memset_s
+
+###############
+# build-vendor
+# everything except COPY ./src
+###############
+FROM build-base AS build-vendor
 ARG DEVICE="maixpy_m5stickv"
 ENV DEVICE_BUILTIN="firmware/MaixPy/projects/${DEVICE}/builtin_py"
 RUN mkdir /src
 WORKDIR /src
 
-# copy vendor to WORKDIR (src)
 COPY ./vendor vendor
-
-# clean vendor/urtypes
 RUN find vendor/urtypes -type d -name '__pycache__' -exec rm -rv {} + -depth
-
-# clean vendor/foundation-ur-py
 RUN find vendor/foundation-ur-py -type d -name '__pycache__' -exec rm -rv {} + -depth
-
-# install vendor/embit
 RUN /kruxenv/bin/pip install vendor/embit
-# clean vendor/embit
 RUN rm -rf vendor/embit/src/embit/util/prebuilt && \
     rm -rf vendor/embit/src/embit/liquid && \
     rm -f vendor/embit/src/embit/psbtview.py && \
@@ -119,25 +134,41 @@ RUN rm -rf vendor/embit/src/embit/util/prebuilt && \
     rm -f vendor/embit/src/embit/util/py_ripemd160.py && \
     find vendor/embit -type d -name '__pycache__' -exec rm -rv {} + -depth
 
-# copy firmware to WORKDIR (src)
 COPY ./firmware firmware
-# clean firmware
 RUN find firmware -type d -name '__pycache__' -exec rm -rv {} + -depth
-
-# copy all vendors to DEVICE_BUILTIN
 RUN cp -r vendor/urtypes/src/urtypes "${DEVICE_BUILTIN}"
 RUN cp -r vendor/foundation-ur-py/src/ur "${DEVICE_BUILTIN}"
 RUN cp -r vendor/embit/src/embit "${DEVICE_BUILTIN}"
 
-# copy Krux (src) to WORKDIR (src)
+############
+# build-software
+# copy vendor, firmware and Krux (src) files
+# install embit dependency
+############
+FROM build-vendor AS build-software
+ARG DEVICE="maixpy_m5stickv"
+ENV DEVICE_BUILTIN="firmware/MaixPy/projects/${DEVICE}/builtin_py"
+WORKDIR /src
+
 COPY ./src src
-# rename boot.py
 RUN mv src/boot.py src/_boot.py
-# clean it
 RUN find src -type d -name '__pycache__' -exec rm -rv {} + -depth
-# copy it to DEVICE_BUILTIN
 RUN cp -r src/. "${DEVICE_BUILTIN}"
 
+################
+# build-safeclib
+################
+FROM build-vendor AS build-safeclib
+RUN apt-get update -y && apt-get install --no-install-recommends -y \
+    git make autoconf automake libtool pkg-config ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
+WORKDIR /src
+RUN git clone --depth 1 https://github.com/rurban/safeclib.git
+WORKDIR /src/safeclib
+RUN ./build-aux/autogen.sh \
+ && ./configure --prefix=/opt/safeclib \
+ && make -j"$(nproc)" \
+ && make install
 
 ############
 # build-firmware
@@ -151,13 +182,66 @@ WORKDIR /src/firmware/MaixPy
 # overrides the DEVICE specific C files (font, sensor, ...) in componets/micropython
 RUN cp -rf projects/"${DEVICE}"/compile/overrides/. ./
 
+# ensure host mpy-cross link gets memset_s
+ENV LIB="-lm /usr/local/lib/libmemset_s.a"
+
+# MaixPy/MicroPython firmware link: riscv64-unknown-elf toolchain doesn't ship memset_s.
+# Use MicroPython's internal secure memset helper instead (already present in gc.c).
+RUN set -eux; \
+  gc="/src/firmware/MaixPy/components/micropython/core/py/gc.c"; \
+  test -f "$gc"; \
+  grep -q "mp_memset_s" "$gc"; \
+  sed -i -E 's/\bmemset_s[[:space:]]*\(/mp_memset_s(/g' "$gc"
+
 RUN cd projects/"${DEVICE}" && \
     /kruxenv/bin/python project.py clean && \
     /kruxenv/bin/python project.py distclean && \
     /kruxenv/bin/python project.py build && \
     mv build/maixpy.bin build/firmware.bin
 
 
+###########
+# build-mpy
+###########
+FROM build-safeclib AS build-mpy
+RUN apt-get update -y && apt-get install --no-install-recommends -y \
+    git make python3 ca-certificates \
+  && rm -rf /var/lib/apt/lists/*
+COPY --from=build-safeclib /opt/safeclib /opt/safeclib
+ENV LD_LIBRARY_PATH=/opt/safeclib/lib
+
+WORKDIR /src
+COPY firmware/MaixPy/components/micropython/core/mpy-cross/ \
+     firmware/MaixPy/components/micropython/core/mpy-cross/
+
+# Provide memset_s for host tool only (mpy-cross). No upstream repo edits.
+RUN set -eux; \
+  cat > /tmp/memset_s.c <<'EOF'
+#include <errno.h>
+#include <stddef.h>
+
+typedef size_t rsize_t;
+typedef int errno_t;
+
+errno_t memset_s(void *dest, rsize_t destsz, int ch, rsize_t count) {
+    if (!dest) return EINVAL;
+    if (count > destsz) return EINVAL;
+    volatile unsigned char *p = (volatile unsigned char *)dest;
+    while (count--) *p++ = (unsigned char)ch;
+    __asm__ __volatile__("" : : : "memory"); /* compiler barrier */
+    return 0;
+}
+EOF
+RUN set -eux; \
+  gcc -O2 -c /tmp/memset_s.c -o /tmp/memset_s.o; \
+  ar rcs /usr/local/lib/libmemset_s.a /tmp/memset_s.o; \
+  nm -g /usr/local/lib/libmemset_s.a | grep -w memset_s
+
+WORKDIR /src/firmware/MaixPy/components/micropython/core/mpy-cross
+RUN set -eux; \
+  make V=1 LIB="-lm /usr/local/lib/libmemset_s.a"; \
+  chmod +x ./mpy-cross
+
 ############
 # build
 # creation of kboot.kfpkg using firmware.bin
@@ -171,3 +255,15 @@ RUN cp /src/firmware/MaixPy/projects/"${DEVICE}"/build/firmware.bin .
 RUN sed -i -e 's/\r$//' *.sh
 
 RUN ./CLEAN.sh && ./BUILD.sh
+
+##############
+# build kapps
+# compilation of kapps inside kapps/ folders
+#############
+FROM build-mpy AS build-kapp
+ARG KAPP="nostr"
+WORKDIR /work
+COPY kapps/${KAPP}.py /work/${KAPP}.py
+RUN mkdir -p /out \
+ && /src/firmware/MaixPy/components/micropython/core/mpy-cross/mpy-cross \
+      -X heapsize=4194304 -O2 -o "/out/${KAPP}.mpy" "/work/${KAPP}.py"

docs/getting-started/features/tools.en.md

@@ -3,6 +3,16 @@ Here are some useful tools that are available as soon as Krux starts! These are
 <img src="../../../img/maixpy_amigo/tools-options-300.png" class="amigo">
 <img src="../../../img/maixpy_m5stickv/tools-options-250.png" class="m5stickv">
 
+### Load Krux app
+<img src="../../../img/maixpy_m5stickv/krux-apps-250.png" align="right" class="m5stickv">
+<img src="../../../img/maixpy_amigo/krux-apps-300.png" align="right" class="amigo">
+
+Run developer-signed Krux applications (Kapps) that are not suited to be part of the main firmware. Copy its `.mpy` file and corresponding signature to an SD card to load it onto the device. When executed, the Kapp is stored in the user's flash memory (just like custom settings) and this process modifies the last two words of the [Tamper Detection](tamper-detection.md#tamper-check-flash-hash-tc-flash-hash-a-tamper-detection-tool) (User's Region).
+
+For example, the **Nostr Kapp** allows converting a mnemonic into a Nostr `nsec` key and air-gapped event signing.
+
+<div style="clear: both"></div>
+
 ### Datum Tool
 <img src="../../../img/maixpy_m5stickv/tools-datum-tool-load-250.png" align="right" class="m5stickv">
 <img src="../../../img/maixpy_amigo/tools-datum-tool-load-300.png" align="right" class="amigo">
@@ -111,6 +121,32 @@ This option permanently removes all stored encrypted mnemonics, settings and `TC
 
 <div style="clear: both"></div>
 
+### Paper Wallet
+
+The **Paper Wallet** Kapp loads and exports Bitcoin paper wallets compatible with WIF, CSV and Base64 private keys; currently we not support encrypted [BIP38](https://bips.xyz/38) wallets[ˆ1]. Also we do not generate any paper wallet[^2].
+
+
+#### Loading wallets
+
+Load it via **Tools > Load Krux app** after copying the signed `.mpy` file to an SD card.
+
+Load one or more WIF ([Wallet Import Format](https://en.bitcoin.it/wiki/Wallet_import_format)) private keys by scanning QR codes or reading encrypted wallets from the SD card. Supported input formats include raw WIF, Base64-encoded WIF, and CSV. When a single key is loaded, Krux creates a **single wallet**; loading two or more keys creates a **bulk wallet** identified by a combined checksum.
+
+#### Backup key
+
+Encrypt and store the loaded wallet using Krux's encrypted format (KEF). Wallets can be saved to the SD card or to the device's internal flash memory. For bulk wallets, each key is encrypted and stored individually. 
+
+#### Export key
+
+Export the wallet in one of several plaintext or encrypted formats:
+
+- **Base64** (.txt) - WIF re-encoded as Base64. For bulk wallets, exported as CSV with Base64-encoded WIFs.
+- **Hex** (.hex) - WIF re-encoded as hexadecimal. For bulk wallets, exported as CSV with hex-encoded WIFs.
+- **CSV** (.csv) - Comma-separated format: `index, "address", "wif"`.
+- **SVG** (.svg) - Styled paper wallet in the bitaddress.org style with SHARE (public address + QR) and SECRET (private key + QR) sections separated by a fold line. For bulk wallets, all wallets are combined into a single SVG file. Each format can optionally be encrypted before saving.
+
+<div style="clear: both"></div>
+
 ### Remove Mnemonic
 <img src="../../../img/maixpy_m5stickv/load-mnemonic-storage-options-250.png" align="right" class="m5stickv">
 <img src="../../../img/maixpy_amigo/load-mnemonic-storage-options-300.png" align="right" class="amigo">

i18n/i18n.py

@@ -19,6 +19,7 @@
 # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 # THE SOFTWARE.
+# pylint: disable=invalid-name
 
 import binascii
 import sys

i18n/translations/de-DE.json

@@ -19,7 +19,10 @@
     "Additional entropy from camera required for %s": "Zusätzliche Entropie von der Kamera erforderlich für %s",
     "Address": "Adresse",
     "Align camera and backup plate properly.": "Richte Kamera und Sicherungsplatte richtig aus.",
+    "Allow Krux apps": "Krux-Apps zulassen",
+    "Allow in settings first!": "Erlaube zuerst Einstellungen!",
     "Anti-glare mode": "Blendschutzmodus",
+    "App will be stored internally on flash.": "Die App wird intern auf Flash gespeichert.",
     "Appearance": "Aussehen",
     "Are you sure?": "Bist Du sicher?",
     "BGR Colors": "BGR-Farben",
@@ -93,6 +96,7 @@
     "Erasing user's data…": "Benutzerdaten werden gelöscht…",
     "Error:": "Fehler:",
     "Esc": "Esc",
+    "Execute %s Krux app?": "%s Krux-App ausführen?",
     "Explore files?": "Dateien durchsuchen?",
     "Export Addresses": "Adressen exportieren",
     "Exporting %s to SD card…": "%s wird auf SD-Karte exportiert…",
@@ -151,6 +155,7 @@
     "Line Delay": "Leitungsverzögerung",
     "Line:": "Linie:",
     "List Addresses": "Adressen auflisten",
+    "Load Krux app": "Krux-App laden",
     "Load Mnemonic": "Mnemonic laden",
     "Load Wallet": "Wallet laden",
     "Load a trusted wallet descriptor to view addresses?": "Einen vertrauenswürdigen Wallet-Deskriptor laden, um Adressen anzuzeigen?",
@@ -285,6 +290,7 @@
     "Spend (%d):": "Ausgabe (%d):",
     "Spend:": "Ausgaben:",
     "Standard mode": "Standardmodus",
+    "Startup Kapp": "Startup Kapp",
     "Static": "Statisch",
     "Stats for Nerds": "Statistiken für Nerds",
     "Store on Flash": "Auf Flash speichern",
@@ -317,6 +323,7 @@
     "Type Key": "Schlüssel eingeben",
     "Undo": "Widerrufen",
     "Unit": "Einheit",
+    "Unsigned apps found in flash will be deleted.": "Nicht signierte Apps, die in Flash gefunden wurden, werden gelöscht.",
     "Update KEF ID?": "KEF-ID aktualisieren?",
     "Update QR Label?": "QR-Etikett aktualisieren?",
     "Upgrade complete.": "Upgrade abgeschlossen.",

i18n/translations/es-MX.json

@@ -19,7 +19,10 @@
     "Additional entropy from camera required for %s": "Se requiere entropía adicional de la cámara para %s",
     "Address": "Dirección",
     "Align camera and backup plate properly.": "Alinea la cámara y la placa de respaldo correctamente.",
+    "Allow Krux apps": "Permitir aplicaciones Krux",
+    "Allow in settings first!": "¡Permitir en la configuración primero!",
     "Anti-glare mode": "Modo antirreflejo",
+    "App will be stored internally on flash.": "La aplicación se almacenará internamente en flash.",
     "Appearance": "Apariencia",
     "Are you sure?": "¿Estás seguro?",
     "BGR Colors": "Colores BGR",
@@ -93,6 +96,7 @@
     "Erasing user's data…": "Borrando los datos del usuario…",
     "Error:": "Error:",
     "Esc": "Esc",
+    "Execute %s Krux app?": "¿Ejecutar %s aplicación Krux?",
     "Explore files?": "¿Explorar archivos?",
     "Export Addresses": "Exportar direcciones",
     "Exporting %s to SD card…": "Exportando %s a la tarjeta SD…",
@@ -151,6 +155,7 @@
     "Line Delay": "Retraso de Línea",
     "Line:": "Línea:",
     "List Addresses": "Listar direcciones",
+    "Load Krux app": "Cargar aplicación Krux",
     "Load Mnemonic": "Importar Mnemónico",
     "Load Wallet": "Cargar Cartera",
     "Load a trusted wallet descriptor to view addresses?": "¿Cargar un descriptor de monedero de confianza para ver las direcciones?",
@@ -285,6 +290,7 @@
     "Spend (%d):": "Gastos (%d):",
     "Spend:": "Gasto:",
     "Standard mode": "Modo estándar",
+    "Startup Kapp": "Startup Kapp",
     "Static": "Estático",
     "Stats for Nerds": "Estadísticas para Entendidos",
     "Store on Flash": "Almacenar en Flash",
@@ -317,6 +323,7 @@
     "Type Key": "Introduce la clave",
     "Undo": "Deshacer",
     "Unit": "Unidad",
+    "Unsigned apps found in flash will be deleted.": "Se eliminarán las aplicaciones sin firmar que se encuentren en Flash.",
     "Update KEF ID?": "¿Actualizar ID de Kef?",
     "Update QR Label?": "¿Actualizar etiqueta QR?",
     "Upgrade complete.": "Actualización completa.",