LGTM, CodeQL and dependabot findings

.github/workflows/codeql.yml

@@ -0,0 +1,42 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ "master", "develop-2.3", "develop-3.0" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: "39 5 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ python ]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
+          queries: +security-and-quality
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v2
+        if: ${{ matrix.language == 'python' }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
+        with:
+          category: "/language:${{ matrix.language }}"

docker/mware/requirements.txt

@@ -1,9 +1,9 @@
 altgraph==0.17 \
     --hash=sha256:1f05a47122542f97028caf78775a095fbe6a2699b5089de8477eb583167d69aa \
     --hash=sha256:c623e5f3408ca61d4016f23a681b9adb100802ca3e3da5e718915a9e4052cebe
-certifi==2019.11.28 \
-    --hash=sha256:017c25db2a153ce562900032d5bc68e9f191e44e9a0f762f373977de9df1fbb3 \
-    --hash=sha256:25b64c7da4cd7479594d035c08c2d809eb4aab3a26e5a990ea98cc450c320f1f
+certifi==2022.12.7 \
+    --hash=sha256:35824b4c3a97115964b408844d64aa14db1cc518f6562e8d7261699d1350a9e3 \
+    --hash=sha256:4ad3232f5e926d6718ec31cfc1fcadfde020920e278684144551c91769c7bc18
 cffi==1.13.2 \
     --hash=sha256:0b49274afc941c626b605fb59b59c3485c17dc776dc3cc7cc14aca74cc19cc42 \
     --hash=sha256:0e3ea92942cb1168e38c05c1d56b0527ce31f1a370f6117f1d490b8dcd6b3a04 \
@@ -86,69 +86,96 @@ packaging==20.4 \
 parameterized==0.7.4 \
     --hash=sha256:190f8cc7230eee0b56b30d7f074fd4d165f7c45e6077582d0813c8557e738490 \
     --hash=sha256:59ab908e31c01505a987a2be78854e19cb1630c047bbab7848169c371d614d56
-Pillow==9.0.1 \
-    --hash=sha256:011233e0c42a4a7836498e98c1acf5e744c96a67dd5032a6f666cc1fb97eab97 \
-    --hash=sha256:0f29d831e2151e0b7b39981756d201f7108d3d215896212ffe2e992d06bfe049 \
-    --hash=sha256:12875d118f21cf35604176872447cdb57b07126750a33748bac15e77f90f1f9c \
-    --hash=sha256:14d4b1341ac07ae07eb2cc682f459bec932a380c3b122f5540432d8977e64eae \
-    --hash=sha256:1c3c33ac69cf059bbb9d1a71eeaba76781b450bc307e2291f8a4764d779a6b28 \
-    --hash=sha256:1d19397351f73a88904ad1aee421e800fe4bbcd1aeee6435fb62d0a05ccd1030 \
-    --hash=sha256:253e8a302a96df6927310a9d44e6103055e8fb96a6822f8b7f514bb7ef77de56 \
-    --hash=sha256:2632d0f846b7c7600edf53c48f8f9f1e13e62f66a6dbc15191029d950bfed976 \
-    --hash=sha256:335ace1a22325395c4ea88e00ba3dc89ca029bd66bd5a3c382d53e44f0ccd77e \
-    --hash=sha256:413ce0bbf9fc6278b2d63309dfeefe452835e1c78398efb431bab0672fe9274e \
-    --hash=sha256:5100b45a4638e3c00e4d2320d3193bdabb2d75e79793af7c3eb139e4f569f16f \
-    --hash=sha256:514ceac913076feefbeaf89771fd6febde78b0c4c1b23aaeab082c41c694e81b \
-    --hash=sha256:528a2a692c65dd5cafc130de286030af251d2ee0483a5bf50c9348aefe834e8a \
-    --hash=sha256:6295f6763749b89c994fcb6d8a7f7ce03c3992e695f89f00b741b4580b199b7e \
-    --hash=sha256:6c8bc8238a7dfdaf7a75f5ec5a663f4173f8c367e5a39f87e720495e1eed75fa \
-    --hash=sha256:718856856ba31f14f13ba885ff13874be7fefc53984d2832458f12c38205f7f7 \
-    --hash=sha256:7f7609a718b177bf171ac93cea9fd2ddc0e03e84d8fa4e887bdfc39671d46b00 \
-    --hash=sha256:80ca33961ced9c63358056bd08403ff866512038883e74f3a4bf88ad3eb66838 \
-    --hash=sha256:80fe64a6deb6fcfdf7b8386f2cf216d329be6f2781f7d90304351811fb591360 \
-    --hash=sha256:81c4b81611e3a3cb30e59b0cf05b888c675f97e3adb2c8672c3154047980726b \
-    --hash=sha256:855c583f268edde09474b081e3ddcd5cf3b20c12f26e0d434e1386cc5d318e7a \
-    --hash=sha256:9bfdb82cdfeccec50aad441afc332faf8606dfa5e8efd18a6692b5d6e79f00fd \
-    --hash=sha256:a5d24e1d674dd9d72c66ad3ea9131322819ff86250b30dc5821cbafcfa0b96b4 \
-    --hash=sha256:a9f44cd7e162ac6191491d7249cceb02b8116b0f7e847ee33f739d7cb1ea1f70 \
-    --hash=sha256:b5b3f092fe345c03bca1e0b687dfbb39364b21ebb8ba90e3fa707374b7915204 \
-    --hash=sha256:b9618823bd237c0d2575283f2939655f54d51b4527ec3972907a927acbcc5bfc \
-    --hash=sha256:cef9c85ccbe9bee00909758936ea841ef12035296c748aaceee535969e27d31b \
-    --hash=sha256:d21237d0cd37acded35154e29aec853e945950321dd2ffd1a7d86fe686814669 \
-    --hash=sha256:d3c5c79ab7dfce6d88f1ba639b77e77a17ea33a01b07b99840d6ed08031cb2a7 \
-    --hash=sha256:d9d7942b624b04b895cb95af03a23407f17646815495ce4547f0e60e0b06f58e \
-    --hash=sha256:db6d9fac65bd08cea7f3540b899977c6dee9edad959fa4eaf305940d9cbd861c \
-    --hash=sha256:ede5af4a2702444a832a800b8eb7f0a7a1c0eed55b644642e049c98d589e5092 \
-    --hash=sha256:effb7749713d5317478bb3acb3f81d9d7c7f86726d41c1facca068a04cf5bb4c \
-    --hash=sha256:f154d173286a5d1863637a7dcd8c3437bb557520b01bddb0be0258dcb72696b5 \
-    --hash=sha256:f25ed6e28ddf50de7e7ea99d7a976d6a9c415f03adcaac9c41ff6ff41b6d86ac
+Pillow==9.3.0 \
+    --hash=sha256:03150abd92771742d4a8cd6f2fa6246d847dcd2e332a18d0c15cc75bf6703040 \
+    --hash=sha256:073adb2ae23431d3b9bcbcff3fe698b62ed47211d0716b067385538a1b0f28b8 \
+    --hash=sha256:0b07fffc13f474264c336298d1b4ce01d9c5a011415b79d4ee5527bb69ae6f65 \
+    --hash=sha256:0b7257127d646ff8676ec8a15520013a698d1fdc48bc2a79ba4e53df792526f2 \
+    --hash=sha256:12ce4932caf2ddf3e41d17fc9c02d67126935a44b86df6a206cf0d7161548627 \
+    --hash=sha256:15c42fb9dea42465dfd902fb0ecf584b8848ceb28b41ee2b58f866411be33f07 \
+    --hash=sha256:18498994b29e1cf86d505edcb7edbe814d133d2232d256db8c7a8ceb34d18cef \
+    --hash=sha256:1c7c8ae3864846fc95f4611c78129301e203aaa2af813b703c55d10cc1628535 \
+    --hash=sha256:22b012ea2d065fd163ca096f4e37e47cd8b59cf4b0fd47bfca6abb93df70b34c \
+    --hash=sha256:276a5ca930c913f714e372b2591a22c4bd3b81a418c0f6635ba832daec1cbcfc \
+    --hash=sha256:2e0918e03aa0c72ea56edbb00d4d664294815aa11291a11504a377ea018330d3 \
+    --hash=sha256:3033fbe1feb1b59394615a1cafaee85e49d01b51d54de0cbf6aa8e64182518a1 \
+    --hash=sha256:3168434d303babf495d4ba58fc22d6604f6e2afb97adc6a423e917dab828939c \
+    --hash=sha256:32a44128c4bdca7f31de5be641187367fe2a450ad83b833ef78910397db491aa \
+    --hash=sha256:3dd6caf940756101205dffc5367babf288a30043d35f80936f9bfb37f8355b32 \
+    --hash=sha256:40e1ce476a7804b0fb74bcfa80b0a2206ea6a882938eaba917f7a0f004b42502 \
+    --hash=sha256:41e0051336807468be450d52b8edd12ac60bebaa97fe10c8b660f116e50b30e4 \
+    --hash=sha256:4390e9ce199fc1951fcfa65795f239a8a4944117b5935a9317fb320e7767b40f \
+    --hash=sha256:502526a2cbfa431d9fc2a079bdd9061a2397b842bb6bc4239bb176da00993812 \
+    --hash=sha256:51e0e543a33ed92db9f5ef69a0356e0b1a7a6b6a71b80df99f1d181ae5875636 \
+    --hash=sha256:57751894f6618fd4308ed8e0c36c333e2f5469744c34729a27532b3db106ee20 \
+    --hash=sha256:5d77adcd56a42d00cc1be30843d3426aa4e660cab4a61021dc84467123f7a00c \
+    --hash=sha256:655a83b0058ba47c7c52e4e2df5ecf484c1b0b0349805896dd350cbc416bdd91 \
+    --hash=sha256:68943d632f1f9e3dce98908e873b3a090f6cba1cbb1b892a9e8d97c938871fbe \
+    --hash=sha256:6c738585d7a9961d8c2821a1eb3dcb978d14e238be3d70f0a706f7fa9316946b \
+    --hash=sha256:73bd195e43f3fadecfc50c682f5055ec32ee2c933243cafbfdec69ab1aa87cad \
+    --hash=sha256:772a91fc0e03eaf922c63badeca75e91baa80fe2f5f87bdaed4280662aad25c9 \
+    --hash=sha256:77ec3e7be99629898c9a6d24a09de089fa5356ee408cdffffe62d67bb75fdd72 \
+    --hash=sha256:7db8b751ad307d7cf238f02101e8e36a128a6cb199326e867d1398067381bff4 \
+    --hash=sha256:801ec82e4188e935c7f5e22e006d01611d6b41661bba9fe45b60e7ac1a8f84de \
+    --hash=sha256:82409ffe29d70fd733ff3c1025a602abb3e67405d41b9403b00b01debc4c9a29 \
+    --hash=sha256:828989c45c245518065a110434246c44a56a8b2b2f6347d1409c787e6e4651ee \
+    --hash=sha256:829f97c8e258593b9daa80638aee3789b7df9da5cf1336035016d76f03b8860c \
+    --hash=sha256:871b72c3643e516db4ecf20efe735deb27fe30ca17800e661d769faab45a18d7 \
+    --hash=sha256:89dca0ce00a2b49024df6325925555d406b14aa3efc2f752dbb5940c52c56b11 \
+    --hash=sha256:90fb88843d3902fe7c9586d439d1e8c05258f41da473952aa8b328d8b907498c \
+    --hash=sha256:97aabc5c50312afa5e0a2b07c17d4ac5e865b250986f8afe2b02d772567a380c \
+    --hash=sha256:9aaa107275d8527e9d6e7670b64aabaaa36e5b6bd71a1015ddd21da0d4e06448 \
+    --hash=sha256:9f47eabcd2ded7698106b05c2c338672d16a6f2a485e74481f524e2a23c2794b \
+    --hash=sha256:a0a06a052c5f37b4ed81c613a455a81f9a3a69429b4fd7bb913c3fa98abefc20 \
+    --hash=sha256:ab388aaa3f6ce52ac1cb8e122c4bd46657c15905904b3120a6248b5b8b0bc228 \
+    --hash=sha256:ad58d27a5b0262c0c19b47d54c5802db9b34d38bbf886665b626aff83c74bacd \
+    --hash=sha256:ae5331c23ce118c53b172fa64a4c037eb83c9165aba3a7ba9ddd3ec9fa64a699 \
+    --hash=sha256:af0372acb5d3598f36ec0914deed2a63f6bcdb7b606da04dc19a88d31bf0c05b \
+    --hash=sha256:afa4107d1b306cdf8953edde0534562607fe8811b6c4d9a486298ad31de733b2 \
+    --hash=sha256:b03ae6f1a1878233ac620c98f3459f79fd77c7e3c2b20d460284e1fb370557d4 \
+    --hash=sha256:b0915e734b33a474d76c28e07292f196cdf2a590a0d25bcc06e64e545f2d146c \
+    --hash=sha256:b4012d06c846dc2b80651b120e2cdd787b013deb39c09f407727ba90015c684f \
+    --hash=sha256:b472b5ea442148d1c3e2209f20f1e0bb0eb556538690fa70b5e1f79fa0ba8dc2 \
+    --hash=sha256:b59430236b8e58840a0dfb4099a0e8717ffb779c952426a69ae435ca1f57210c \
+    --hash=sha256:b90f7616ea170e92820775ed47e136208e04c967271c9ef615b6fbd08d9af0e3 \
+    --hash=sha256:b9a65733d103311331875c1dca05cb4606997fd33d6acfed695b1232ba1df193 \
+    --hash=sha256:bac18ab8d2d1e6b4ce25e3424f709aceef668347db8637c2296bcf41acb7cf48 \
+    --hash=sha256:bca31dd6014cb8b0b2db1e46081b0ca7d936f856da3b39744aef499db5d84d02 \
+    --hash=sha256:be55f8457cd1eac957af0c3f5ece7bc3f033f89b114ef30f710882717670b2a8 \
+    --hash=sha256:c7025dce65566eb6e89f56c9509d4f628fddcedb131d9465cacd3d8bac337e7e \
+    --hash=sha256:c935a22a557a560108d780f9a0fc426dd7459940dc54faa49d83249c8d3e760f \
+    --hash=sha256:dbb8e7f2abee51cef77673be97760abff1674ed32847ce04b4af90f610144c7b \
+    --hash=sha256:e6ea6b856a74d560d9326c0f5895ef8050126acfdc7ca08ad703eb0081e82b74 \
+    --hash=sha256:ebf2029c1f464c59b8bdbe5143c79fa2045a581ac53679733d3a91d400ff9efb \
+    --hash=sha256:f1ff2ee69f10f13a9596480335f406dd1f70c3650349e2be67ca3139280cade0
 pip-api==0.0.14 \
     --hash=sha256:0bbad536c70f0dfdc88e6811418ab0e8ac1aece7cf6c69223ae602a6ebc2943b \
     --hash=sha256:86e03968ac353869b52e57aa8d8572e096f24b797ac34c4fae3a380190bb02be
 pkgconfig==1.5.1 \
     --hash=sha256:97bfe3d981bab675d5ea3ef259045d7919c93897db7d3b59d4e8593cba8d354f \
     --hash=sha256:cddf2d7ecadb272178a942eb852a9dee46bda2adcc36c3416b0fef47a4ed9f38
-protobuf==3.15.0 \
-    --hash=sha256:013a9ec4dccad9a6ed3aa1ad9e86a25a4e0d6d3bbe059b6f6502db20473c3e69 \
-    --hash=sha256:0e00b4e4a4800b389ae7f0058e1fc9d012444fdde926569d8cce55c84a01ef74 \
-    --hash=sha256:11f192d491613f692b3ddc18f06c925785b3019c8e35d32c811421ca9ff7d50e \
-    --hash=sha256:25f0ee57684f7bc3f0511b73cf55c016a891d09079c357794759663fe3da9cd3 \
-    --hash=sha256:2ccc0169b5145b3af676b6997be6fe62961edfc12bb524a7b9c46fb5d208a3d4 \
-    --hash=sha256:40f031f79b0254aa62082ca87776c0959d85adf99f09cdef9d0b320bb772a609 \
-    --hash=sha256:44d824adb48fe8baf81e628c2edaf9911912cd592a83621d2b877ccfde631d61 \
-    --hash=sha256:50f28efa66232a2fbbdd638dd61d9399ff66bcfde40ff305263b229692928081 \
-    --hash=sha256:51e080fb1de5db54b0a6b1519ba8dda55e57404b0a4948e58f1342a3e15d89ec \
-    --hash=sha256:5c2ee13f5ea237a17bd81f52f972b7d334c0a43330d2a2a7b25b07f16eb146d8 \
-    --hash=sha256:830a9c71df347b3fb3cd24ec985c4ed64f6e75983f543a1d8a3c96302dae915c \
-    --hash=sha256:867635c1d541ce336a1a4df3379d1116f02eba6dc326d080c8ef02f34036c415 \
-    --hash=sha256:94b34486986d7683e83f9d02a0112533263fc20fae54fff3f4fd69451e682ec7 \
-    --hash=sha256:ae4bcd5a0ce3f77d0523c3e5ed0d04ed2af454f7bf7cef08cb7a8d0915ac80a9 \
-    --hash=sha256:b04449133e31b65924650d758efbc2397c2d0e5eb3c8cae7428ffc4fa9c3403d \
-    --hash=sha256:d892e487bd544463ce1e656434591593f710169335ac3f02ce30ee866c2f2464 \
-    --hash=sha256:e9f13fadb15b80e4a83ef5d9fa44e19243b1e2d96e84ee2228ca305180ca059e \
-    --hash=sha256:ef69a10d45529a08367e70e736b3ce8e2af51360f23650ef1d4381ff9038467a \
-    --hash=sha256:f6d10b1f86cebb8008a256f474948fc6204391e02a9c12935eebf036bbb07b65 \
-    --hash=sha256:fecf1b00ccc87bb8debca8b56458cc57c486d2d7afe22c7526728f79ffe232f4
+protobuf==3.18.3 \
+    --hash=sha256:0c44e01f74109decea196b5b313b08edb5316df77313995594a6981e95674259 \
+    --hash=sha256:15cdecb0d192ab5f17cdc21a9c0ae7b5c6c4451e42c8a888a4f3344c190e369c \
+    --hash=sha256:196a153e487c0e20d62259872bbf2e1c4fa18e2ce97e20984fcbf9d8b151058d \
+    --hash=sha256:3149c373e9b7ce296bb24d42a3eb677d620185b5dff2c390b2cf57baf79afdc1 \
+    --hash=sha256:370a6b885e94adda021d4cbe43accdfbf6a02af651a0be337a28906a3fa77f3d \
+    --hash=sha256:474247630834f93214fafce49d2ee6ff4c036c8c5382b88432b7eae6f08f131b \
+    --hash=sha256:6380aae2683d0d1b41199e591c8ba06f867e8a778d44309af87073c1b34a9f3a \
+    --hash=sha256:6741d7d1cfcbdd6cf610f38b7976cf8c0b41022203555298925e4061b6616608 \
+    --hash=sha256:700787cb56b4cb7b8ed5f7d197b9d8f30080f257f3c7431eec1fdd8060660929 \
+    --hash=sha256:8117b52c2531e4033f7d02b9be5a78564da41a8b02c255e1b731ad4bd75e7dc0 \
+    --hash=sha256:850da2072d98c6e576b7eb29734cdde6fd9f5d157e43d7818d79f4b373ef5d51 \
+    --hash=sha256:85d1fb5ff1d638a0045bbe4f01a8f287023aa4f2b29011445b1be0edc74a2103 \
+    --hash=sha256:93bca9aaeee8008e15696c2a6b5e56b992da03f9d237ff54310e397d635f8305 \
+    --hash=sha256:98d414513ec44bb3ba77ebdeffcbbe6ebbf3630c767d37a285890c2414fdd4e2 \
+    --hash=sha256:a7f91a4e5bf3cc58b2830c9cb01b04ac5e211c288048e9296cd407ec0455fb89 \
+    --hash=sha256:abbcb8ecd19cfb729b9b71f9a453e37c0c1c017be4bff47804ff25150685386d \
+    --hash=sha256:b03966ca4d1aa7850f5bf0d841c22a8eeb6ce091f77e585ffeb8b95a6b0a96c4 \
+    --hash=sha256:cde2a73b03049b904dbc5d0f500b97e11abb4109dbe2940e6a1595e2eef4e8a9 \
+    --hash=sha256:d52a687e2c74c40f45abd6906f833d4e40f0f8cfa4226a80e4695fedafe6c57e \
+    --hash=sha256:e68ad00695547d9397dd14abd3efba23cb31cef67228f4512d41396971889812 \
+    --hash=sha256:e9bffd52d6ee039a1cafb72475b2900c6fd0f0dca667fb7a09af0a3e119e78cb
 pycparser==2.19 \
     --hash=sha256:a988718abfad80b6b157acce7bf130a30876d27603738ac39f140993246b25b3
 pycryptodome==3.9.8 \

ledger/src/signer/make-difficulty.py

@@ -55,7 +55,7 @@
 remaining = dif
 digit_bits = DIGIT_SIZE*8
 mask = (1 << digit_bits)-1
-for i in range(NUM_DIGITS):
+for _ in range(NUM_DIGITS):
     result_ints.append(int(remaining & mask))
     remaining = remaining >> digit_bits
 

ledger/test/cases/reconnect.py

@@ -72,6 +72,7 @@ def run(self, dongle, debug, run_args):
                 try:
                     dongle.exit_menu(autoexec=True)
                 except Exception:
+                    # exit_menu() always throws due to USB disconnection. we don't care
                     pass
                 output.debug('Device unlocked')
                 # Disconnect from bootloader, connect to app

ledger/test/misc/blockdump.py

@@ -54,7 +54,6 @@ def blockdump(split_dir):
                 print(f"Block #{j} hash = {block_hash}")
 
                 if j == len(blocks) - 1:
-                    block_hash = sha3.keccak_256(rlp.encode(block[:-2])).digest().hex()
                     print(f"  Last block Receipt root = {block[5].hex()}")
 
                 diff = int.from_bytes(block[7], byteorder="big", signed=False)

middleware/admin/attestation.py

@@ -88,6 +88,7 @@ def do_attestation(options):
     try:
         hsm.exit_menu()
     except Exception:
+        # exit_menu() always throws due to USB disconnection. we don't care
         pass
     info("Exit OK")
     dispose_hsm(hsm)

middleware/admin/onboard.py

@@ -124,8 +124,7 @@ def do_onboard(options):
     head(
         [
             "Onboarding done",
-            "Please disconnect and re-connect the ledger to proceed with "
-            "the attestation setup",
+            "Please disconnect and re-connect the ledger to proceed with the attestation setup",  # noqa E501
             "Press [Enter] to continue",
         ],
         nl=False,

middleware/admin/unlock.py

@@ -96,6 +96,7 @@ def do_unlock(options, exit=True, no_exec=False, label=True):
         try:
             hsm.exit_menu(autoexec=autoexec)
         except Exception:
+            # exit_menu() always throws due to USB disconnection. we don't care
             pass
         info("Exit OK")
 

middleware/comm/bip32.py

@@ -95,7 +95,7 @@ def __init__(self, spec, nelements=5):
             _logger.debug(message)
             raise ValueError(message)
 
-        self._elements = list(map(lambda s: BIP32Element(s), spec[2:].split("/")))
+        self._elements = list(map(BIP32Element, spec[2:].split("/")))
 
         if nelements is not None and len(self._elements) != nelements:
             message = "BIP32Path spec must have exactly %d elements, got %d" % (
@@ -121,7 +121,7 @@ def to_binary(self, byteorder="little"):
         return binary
 
     def __str__(self):
-        return "m/%s" % "/".join(map(lambda e: str(e), self._elements))
+        return "m/%s" % "/".join(map(str, self._elements))
 
     def __repr__(self):
         return '<BIP32Path "%s">' % str(self)

middleware/ledger/hsm2dongle.py

@@ -431,14 +431,18 @@ def _send_command(self, command, data=b"", timeout=DONGLE_TIMEOUT):
             if HSM2DongleCommError.is_comm_error(e):
                 raise HSM2DongleCommError(str(e))
 
-            # Otherwise, raise a standard error
-            msg = "Error sending command: %s" % str(e)
-            self.logger.error(msg)
-            raise HSM2DongleError(msg)
-        except Exception as e:
-            msg = "Unknown error sending command: %s" % str(e)
-            self.logger.critical(msg)
+            # Raise a standard error, but
+            # report differently for a CommException and any other
+            # type of exception
+            if type(e) == CommException:
+                msg = "Error sending command: %s" % str(e)
+                self.logger.error(msg)
+            else:
+                msg = "Unknown error sending command: %s" % str(e)
+                self.logger.critical(msg)
+
             raise HSM2DongleError(msg)
+
         return result
 
     # Send command version to be used by command classes
@@ -471,6 +475,7 @@ def disconnect(self):
             try:
                 hid.hidapi_exit()
             except Exception:
+                # hidapi_exit() can sometimes throw. we don't care
                 pass
             # **** End hack ****
             self.logger.info("Disconnected")
@@ -1083,6 +1088,8 @@ def authorize_signer(self, signer_authorization):
             raise HSM2DongleError("Not enough signatures given. "
                                   "Signer authorization failed")
 
+        return True
+
     # Used both for advance blockchain and update ancestor given the protocol
     # is very similar
     def _do_block_operation(
@@ -1401,7 +1408,7 @@ def _send_data_in_chunks(
                 self.logger.debug(
                     "Current operation %s, next operations %s, ledger requesting %s",
                     hex(operation),
-                    str(list(map(lambda op: hex(op), next_operations))),
+                    str(list(map(hex, next_operations))),
                     hex(response[2]),
                 )
                 self.logger.error(

middleware/ledger/protocol.py

@@ -215,6 +215,7 @@ def _handle_bootloader(self):
         try:
             self.hsm2dongle.exit_menu()
         except Exception:
+            # exit_menu() always throws due to USB disconnection. we don't care
             pass
 
         # Wait a little bit to make sure the app is loaded
@@ -255,7 +256,7 @@ def _get_pubkey(self, request):
             self.logger.error("Dongle communication error getting public key")
             return (self.ERROR_CODE_DEVICE,)
         except HSM2DongleError as e:
-            self._error("Dongle error in get_pubkey: %s" % str(e))
+            return self._error("Dongle error in get_pubkey: %s" % str(e))
 
     def _sign(self, request):
         # First validate the required fields are OK

middleware/ledger/protocol_v1.py

@@ -60,7 +60,7 @@ def _get_pubkey(self, request):
             self.logger.error("Dongle communication error getting public key")
             return (self.ERROR_CODE_DEVICE,)
         except HSM2DongleError as e:
-            self._error("Dongle error in get_pubkey: %s" % str(e))
+            return self._error("Dongle error in get_pubkey: %s" % str(e))
 
     def _sign(self, request):
         try: