lssa/lez/wallet/Cargo.toml
jonesmarvin8 914f14e870
refactor(keycard_wallet): replace keycard-py with keycard-rs (#595)
* refactor(keycard_wallet): replace keycard-py (pyo3) with native keycard-rs

Rewrites the Keycard integration to talk to the LEE-flavored applet
directly from Rust via keycard-rs (pinned git dependency), dropping the
pyo3 shim, python_path.rs, and the vendored keycard-py Python library
entirely. Verified end-to-end against real hardware: pairing, PIN
verification, mnemonic loading, BIP340 Schnorr signing, and transfers
between keycard and public/private accounts.

Also cleans up the pyo3 usage that had leaked into wallet's signing
path (signing.rs, account_manager.rs) beyond the keycard CLI itself,
and trims wallet_with_keycard.sh's Python setup down to just pyscard,
which is only needed by the force_unpower.py test helper now.

* Updated to v2 secure communication

* ci: install libpcsclite-dev for pcsc crate builds

* docs(keycard): clarify personalization is mandatory and document default CA

Reinstalling the applet via `./gradlew install` wipes any existing
personalization regardless of firmware source, which wasn't previously
called out and is a common source of "card not available" confusion.
Also state plainly that personalization is required before any command
works, and document keycard-rs's actual baked-in default CA public key
instead of only describing the override mechanism.

Export KEYCARD_CA_PUBLIC_KEY in all keycard test scripts so they work
against the dev/test-CA personalization flow they rely on.

* fix(keycard): address PR #595 review comments

- Propagate the load_mnemonic error instead of swallowing it behind
  is_ok(), matching every other command handler in this file.
- Add deny.toml allowing the keycard-rs git source, fixing the
  source-not-allowed failure in `cargo deny check`. Licenses and
  advisories checks still have pre-existing, separate failures not
  addressed here.
- Drop the pinned rev for the keycard-rs git dependency so it tracks
  the upstream default branch instead.

* chore(deny): trim deny.toml to essentials and allow all in-use licenses

Replace the full cargo-deny init template with just the two sections
that matter: the keycard-rs git-source allowance, and an explicit
license allow-list covering every license currently in the dependency
tree. cargo deny check now passes on sources, bans, and licenses;
advisories still fails on a pre-existing, unrelated RUSTSEC advisory.

* fix(deny): remove second config and add source to the original one

* chore: pin keycard-rs dependency and fix factory-reset debug-gate doc

* chore: regenerate test fixture and lockfile after rebase onto dev

---------

Co-authored-by: Daniil Polyakov <arjentix@gmail.com>
2026-07-23 15:50:30 -04:00

62 lines
1.6 KiB
TOML

[package]
name = "wallet"
version = "0.1.0"
edition = "2024"
license = { workspace = true }
[lints]
workspace = true
[dependencies]
lee_core.workspace = true
lee.workspace = true
common.workspace = true
authenticated_transfer_core.workspace = true
key_protocol.workspace = true
sequencer_service_rpc = { workspace = true, features = ["client"] }
amm_core.workspace = true
testnet_initial_state.workspace = true
token_core.workspace = true
vault_core.workspace = true
bridge_core.workspace = true
keycard_wallet.workspace = true
programs.workspace = true
system_accounts.workspace = true
associated_token_account_core.workspace = true
bip39.workspace = true
rpassword = "7"
zeroize.workspace = true
anyhow.workspace = true
thiserror.workspace = true
serde_json.workspace = true
env_logger.workspace = true
log.workspace = true
serde.workspace = true
humantime-serde.workspace = true
humantime.workspace = true
tokio = { workspace = true, features = ["macros"] }
clap.workspace = true
base58.workspace = true
hex.workspace = true
rand.workspace = true
itertools.workspace = true
sha2.workspace = true
futures.workspace = true
async-stream.workspace = true
indicatif = { version = "0.18.3", features = ["improved_unicode"] }
optfield = "0.4.0"
url.workspace = true
derive_more = { workspace = true, features = ["display"] }
[features]
# Enables `keycard get-private-keys` command that prints sensitive secret keys to terminal.
# Never enable in production builds.
keycard-debug = []
[dev-dependencies]
tempfile.workspace = true
key_protocol = { workspace = true, features = ["test_utils"] }
bincode.workspace = true