SDK/Speculos: bump versions

*NB* the ledger-provided workflows always run on latest, so a new PR can occassionally fail, requiring this sort of PR to fix the issues.

For this particular bump, we fix:
- no longer refer to deprecated CX_APILEVEL constant. Ledger provide their own mechanism for preventing apps being sideloaded with incompatible versions.
- remove io_send_response_buffers <- which was integrated directly into the secure-sdk

.github/workflows/build.yml

@@ -21,7 +21,7 @@ jobs:
         device: [nanos, nanosp, nanox, stax]
     runs-on: ubuntu-latest
     container:
-      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:3.5.0
+      image: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:3.8.0
     steps:
       - name: Checkout
         uses: actions/checkout@v3

Makefile

@@ -23,8 +23,8 @@ docker_speculos:
 	$(DOCKER) image tag $(LEDGERHQ)/speculos speculos
 
 docker_ledger_app_builder:
-	$(DOCKER) pull $(LEDGERHQ)/ledger-app-builder/ledger-app-builder:3.5.0
-	$(DOCKER) image tag $(LEDGERHQ)/ledger-app-builder/ledger-app-builder:3.5.0 \
+	$(DOCKER) pull $(LEDGERHQ)/ledger-app-builder/ledger-app-builder:3.8.0
+	$(DOCKER) image tag $(LEDGERHQ)/ledger-app-builder/ledger-app-builder:3.8.0 \
 			ledger-app-builder
 
 docker_ledger_app_ocaml:

app/src/apdu_sign.c

@@ -32,7 +32,6 @@
 
 #include "apdu.h"
 #include "apdu_sign.h"
-#include "compat.h"
 #include "globals.h"
 #include "handle_swap.h"
 #include "keys.h"
@@ -196,12 +195,12 @@ refill(void)
         PRINTF("[DEBUG] refill(errno: %s)\n",
                tz_parser_result_name(st->errno));
         // clang-format off
-	switch (st->errno) {
-	case TZ_BLO_IM_FULL: TZ_CHECK(refill_blo_im_full()); break;
-	case TZ_BLO_FEED_ME: TZ_CHECK(send_continue());      break;
-	case TZ_BLO_DONE:    TZ_CHECK(refill_blo_done());    break;
-	default:             TZ_CHECK(refill_error());       break;
-	}
+        switch (st->errno) {
+        case TZ_BLO_IM_FULL: TZ_CHECK(refill_blo_im_full()); break;
+        case TZ_BLO_FEED_ME: TZ_CHECK(send_continue());      break;
+        case TZ_BLO_DONE:    TZ_CHECK(refill_blo_done());    break;
+        default:             TZ_CHECK(refill_error());       break;
+        }
         // clang-format on
     } while (s2s
              && (st->errno == TZ_BLO_IM_FULL

app/src/handle_swap.c

@@ -23,9 +23,9 @@
 #ifdef HAVE_SWAP
 
 #include <format.h>
+#include <io.h>
 #include <swap.h>
 
-#include "compat.h"
 #include "handle_swap.h"
 #include "keys.h"
 #include "utils.h"

app/src/parser/compat.h

@@ -31,9 +31,6 @@
 #include "os.h"
 #include "os_io_seproxyhal.h"
 #include "cx.h"
-#if CX_APILEVEL < 8
-#error "Only compiles with API level 8 or higher; requires newer firmware"
-#endif
 #else
 #include <stdio.h>
 #define PIC(x) ((void *)x)

docker/Dockerfile.integration-tests

@@ -1,4 +1,4 @@
-FROM ghcr.io/ledgerhq/speculos:sha-6a34680
+FROM ghcr.io/ledgerhq/speculos:sha-bced779
 
 RUN apt update &&                                               \
     apt install -y curl jq build-essential libsodium-dev git &&	\