Skip to content

Fbe/apex porting #34

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Draft
fbeutin-ledger wants to merge 3 commits into
base: develop
Choose a base branch
from
Draft

Fbe/apex porting #34

fbeutin-ledger wants to merge 3 commits into from

Conversation

@fbeutin-ledger
Copy link

@fbeutin-ledger fbeutin-ledger commented Oct 23, 2025

No description provided.

github-advanced-security[bot]
github-advanced-security bot found potential problems Oct 23, 2025
View reviewed changes
deps/ledger-zxlib/app/ui/view_inspect_x.c Outdated
if (err != zxerr_ok) {
// Show error
view_error_show();
// h_rootTxn();

Check notice

Code scanning / CodeQL

Commented-out code

This comment appears to contain commented-out code.

Copilot Autofix

AI 3 months ago

To fix this issue, simply remove the commented-out code // h_rootTxn();. This will clean up the code, eliminate confusion, and ensure that only active logic remains in the error handling block. No change to program functionality will occur, as the code is already commented and not executed. Edit deps/ledger-zxlib/app/ui/view_inspect_x.c, specifically on line 84 within the inspect_init function, and delete the line containing the commented-out code.

Suggested changeset 1
deps/ledger-zxlib/app/ui/view_inspect_x.c

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/deps/ledger-zxlib/app/ui/view_inspect_x.c b/deps/ledger-zxlib/app/ui/view_inspect_x.c
--- a/deps/ledger-zxlib/app/ui/view_inspect_x.c
+++ b/deps/ledger-zxlib/app/ui/view_inspect_x.c
@@ -81,7 +81,6 @@
     if (err != zxerr_ok) {
         // Show error
         view_error_show();
-        // h_rootTxn();
         return;
     }
     view_inspect_show_impl();
EOF
@@ -81,7 +81,6 @@
if (err != zxerr_ok) {
// Show error
view_error_show();
// h_rootTxn();
return;
}
view_inspect_show_impl();
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
deps/ledger-zxlib/app/ui/view_internal.h Outdated
static const char *review_skip_value_msg = "not verifiable";
static const char *review_skip_key_msg_2 = "Could lose";
static const char *review_skip_value_msg_2 = "all assets";
static const char *review_msgvalue = "Review";

Check notice

Code scanning / CodeQL

Unused static variable

Static variable review_msgvalue is never read.

Copilot Autofix

AI 3 months ago

To fix the problem, remove the declaration of the unused static variable review_msgvalue from deps/ledger-zxlib/app/ui/view_internal.h. Only delete the line declaring the variable. This will increase code clarity and prevent unused storage consumption or future confusion. No additional imports, method definitions, or code changes are necessary elsewhere in the file.

Suggested changeset 1
deps/ledger-zxlib/app/ui/view_internal.h

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/deps/ledger-zxlib/app/ui/view_internal.h b/deps/ledger-zxlib/app/ui/view_internal.h
--- a/deps/ledger-zxlib/app/ui/view_internal.h
+++ b/deps/ledger-zxlib/app/ui/view_internal.h
@@ -90,7 +90,6 @@
 static const char *review_skip_value_msg = "not verifiable";
 static const char *review_skip_key_msg_2 = "Could lose";
 static const char *review_skip_value_msg_2 = "all assets";
-static const char *review_msgvalue = "Review";
 static const char *review_msgvalue_2 = "Message";
 
 // Review msg string can be customizable in each app
EOF
@@ -90,7 +90,6 @@
static const char *review_skip_value_msg = "not verifiable";
static const char *review_skip_key_msg_2 = "Could lose";
static const char *review_skip_value_msg_2 = "all assets";
static const char *review_msgvalue = "Review";
static const char *review_msgvalue_2 = "Message";

// Review msg string can be customizable in each app
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
deps/ledger-zxlib/app/ui/view_internal.h Outdated
static const char *review_skip_key_msg_2 = "Could lose";
static const char *review_skip_value_msg_2 = "all assets";
static const char *review_msgvalue = "Review";
static const char *review_msgvalue_2 = "Message";

Check notice

Code scanning / CodeQL

Unused static variable

Static variable review_msgvalue_2 is never read.

Copilot Autofix

AI 3 months ago

To fix this issue, the unused static variable review_msgvalue_2 should be removed from the code. This will improve code clarity, prevent confusion, and contribute to reducing unnecessary static data in the program. The only change needed is to delete, from deps/ledger-zxlib/app/ui/view_internal.h, the line that declares static const char *review_msgvalue_2 = "Message"; (line 94). No other definitions, imports, or references need to be updated, and no additional code is required.

Suggested changeset 1
deps/ledger-zxlib/app/ui/view_internal.h

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/deps/ledger-zxlib/app/ui/view_internal.h b/deps/ledger-zxlib/app/ui/view_internal.h
--- a/deps/ledger-zxlib/app/ui/view_internal.h
+++ b/deps/ledger-zxlib/app/ui/view_internal.h
@@ -91,7 +91,6 @@
 static const char *review_skip_key_msg_2 = "Could lose";
 static const char *review_skip_value_msg_2 = "all assets";
 static const char *review_msgvalue = "Review";
-static const char *review_msgvalue_2 = "Message";
 
 // Review msg string can be customizable in each app
 #if !defined(REVIEW_MSG_TITLE) && !defined(REVIEW_MSG_VALUE)
EOF
@@ -91,7 +91,6 @@
static const char *review_skip_key_msg_2 = "Could lose";
static const char *review_skip_value_msg_2 = "all assets";
static const char *review_msgvalue = "Review";
static const char *review_msgvalue_2 = "Message";

// Review msg string can be customizable in each app
#if !defined(REVIEW_MSG_TITLE) && !defined(REVIEW_MSG_VALUE)
Copilot is powered by AI and may make mistakes. Always verify output.
Unable to commit as this autofix suggestion is now outdated
@socket-security
Copy link

socket-security bot commented Oct 24, 2025

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
github/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 has "GitHub Actions: Input argument flows to dangerous sink".

Location: Package overview

From: .github/workflows/documentation_generation.yml → github/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955

ℹ Read more on: This package | This alert | What are GitHub Actions taint flows?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Validate and sanitize all input arguments before using them in dangerous operations. Use parameterized commands or APIs instead of string concatenation for shell commands.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
github/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 has "GitHub Actions: Environment variable flows to dangerous sink".

Location: Package overview

From: .github/workflows/documentation_generation.yml → github/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955

ℹ Read more on: This package | This alert | What are GitHub Actions taint flows?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Validate and sanitize environment variables before using them in dangerous operations. Ensure environment variables come from trusted sources only, and use parameterized commands or APIs instead of string concatenation.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
github/actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 has "GitHub Actions: Input argument flows to dangerous sink".

Location: Package overview

From: .github/workflows/documentation_generation.yml → github/actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02

ℹ Read more on: This package | This alert | What are GitHub Actions taint flows?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Validate and sanitize all input arguments before using them in dangerous operations. Use parameterized commands or APIs instead of string concatenation for shell commands.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
github/codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 has "GitHub Actions: Input argument flows to dangerous sink".

Location: Package overview

From: .github/workflows/unit_tests.yml → github/codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238

ℹ Read more on: This package | This alert | What are GitHub Actions taint flows?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Validate and sanitize all input arguments before using them in dangerous operations. Use parameterized commands or APIs instead of string concatenation for shell commands.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore github/codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@fbeutin-ledger fbeutin-ledger marked this pull request as draft October 24, 2025 14:10
@codecov-commenter
Copy link

codecov-commenter commented Oct 24, 2025

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

@fbeutin-ledger
Copy link
Author

fbeutin-ledger commented Oct 24, 2025

Hello @tarakby @relatko
I've opened this draft PR of Flow porting on our latest device
Not finished because I'm not sure I understand how to update this local fork of the "zxlib" library you are using

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@fbeutin-ledger @codecov-commenter