feat(tests): add client methods, tests, and SECTIONS for message-signing parity

Covers all four firmware feature branches in one python-keepkey branch:

Client methods (keepkeylib/client.py):
- tron_sign_typed_hash() — TIP-712 hash mode
- ton_sign_message() — bare Ed25519 (AdvancedMode-gated)
- solana_sign_offchain_message() — domain-separated envelope

Test files:
- test_msg_tron_signtypedhash.py (6 tests) — TIP-712 hash + domain-only +
  rejection cases
- test_msg_ton_signmessage.py (6 tests) — AdvancedMode gate + sign +
  pubkey consistency
- test_msg_solana_signoffchainmessage.py (7 tests) — format/version
  validation + envelope-not-raw assertion (load-bearing: catches firmware
  regressions that drop the envelope)

Report generator (scripts/generate-test-report.py):
- TRON section: T6-T18 added (7 SignMessage + 6 TIP-712), description
  mentions TIP-191 + TIP-712, dropped 'NEW:' prefix (no longer literally new)
- TON section: N8-N13 added, description mentions SignMessage + AdvancedMode
  gate, TON Connect ton_proof noted as deferred
- Solana section: S13-S19 added, description mentions off-chain envelope
  as 'the proper fix for the SignMessage AdvancedMode band-aid'
- KK_BUILD_LABEL env var support — CI sets to '<head_ref>@<sha[0:8]>' so
  per-PR PDFs are no longer byte-identical (was issue #2 in the report
  audit: PR #221/#223/#224 all produced the same PDF md5)

These additions only render when the corresponding firmware handler is
present (requires_message gates the test classes), so PRs that don't
yet implement a feature still get green PDFs without false coverage.

Author: BitHighlander

keepkeylib/client.py

@@ -1633,6 +1633,20 @@ def solana_sign_message(self, address_n, message):
             solana_proto.SolanaSignMessage(address_n=address_n, message=message)
         )
 
+    @expect(solana_proto.SolanaOffchainMessageSignature)
+    def solana_sign_offchain_message(
+        self, address_n, message, version=0, message_format=0, show_display=False
+    ):
+        return self.call(
+            solana_proto.SolanaSignOffchainMessage(
+                address_n=address_n,
+                version=version,
+                message_format=message_format,
+                message=message,
+                show_display=show_display,
+            )
+        )
+
     # ── Tron ───────────────────────────────────────────────────
     @expect(tron_proto.TronAddress)
     def tron_get_address(self, address_n, show_display=False):
@@ -1665,6 +1679,16 @@ def tron_verify_message(self, address, signature, message):
             )
         )
 
+    @expect(tron_proto.TronTypedDataSignature)
+    def tron_sign_typed_hash(self, address_n, domain_separator_hash, message_hash=None):
+        msg = tron_proto.TronSignTypedHash(
+            address_n=address_n,
+            domain_separator_hash=domain_separator_hash,
+        )
+        if message_hash is not None:
+            msg.message_hash = message_hash
+        return self.call(msg)
+
     # ── TON ────────────────────────────────────────────────────
     @expect(ton_proto.TonAddress)
     def ton_get_address(self, address_n, show_display=False):
@@ -1678,6 +1702,16 @@ def ton_sign_tx(self, address_n, raw_tx):
             ton_proto.TonSignTx(address_n=address_n, raw_tx=raw_tx)
         )
 
+    @expect(ton_proto.TonMessageSignature)
+    def ton_sign_message(self, address_n, message, show_display=False):
+        return self.call(
+            ton_proto.TonSignMessage(
+                address_n=address_n,
+                message=message,
+                show_display=show_display,
+            )
+        )
+
     # ── Zcash Address Display ─────────────────────────────────
     @expect(zcash_proto.ZcashAddress)
     def zcash_display_address(self, address_n, address, ak, nk, rivk, account=None):

scripts/generate-test-report.py

@@ -813,13 +813,15 @@ def parse_junit(path):
      ]),
 
     ('S', 'Solana', '7.14.0',
-     'NEW: Full Solana with Ed25519 (SLIP-10), base58 addresses, 37 instruction types across 7 '
+     'Full Solana with Ed25519 (SLIP-10), base58 addresses, 37 instruction types across 7 '
      'programs. Key security fix: full 44-character address display replaces old 8-char truncation '
-     'that was a spoofing vector.',
+     'that was a spoofing vector. Off-chain message signing (domain-separated envelope) added '
+     'in 7.14.x — the proper fix for the SignMessage AdvancedMode band-aid.',
      [
          'ADDRESS: m/44\'/501\'/0\' Ed25519 -> full 44-char base58 on OLED',
          'SIGN TX: Parse instructions -> per-instruction confirmation -> Ed25519 sign',
-         'SIGN MESSAGE: Arbitrary bytes -> hex display -> Ed25519 sign',
+         'SIGN MESSAGE: Arbitrary bytes -> hex display -> Ed25519 sign (AdvancedMode-gated)',
+         'SIGN OFFCHAIN: "\\xff" || "solana offchain" || ver || fmt || len || msg -> Ed25519 sign',
      ],
      [
          ('S1', 'test_msg_solana_getaddress', 'test_solana_get_address',
@@ -858,14 +860,41 @@ def parse_junit(path):
           'SPL Token with metadata',
           'Token transfer with SolanaTokenInfo (mint, symbol, decimals). OLED shows human-readable token name.',
           ['Token name + amount']),
+         ('S13', 'test_msg_solana_signoffchainmessage', 'test_sign_ascii_message',
+          'Off-chain ASCII (fmt 0)',
+          'Domain-separated envelope; format 0 (printable ASCII) renders + signs.',
+          ['Off-chain message confirm']),
+         ('S14', 'test_msg_solana_signoffchainmessage', 'test_sign_at_size_ceiling',
+          'Off-chain at 1212-byte ceiling',
+          'Spec ceiling for formats 0/1; firmware accepts at the limit.', []),
+         ('S15', 'test_msg_solana_signoffchainmessage', 'test_format_2_rejected',
+          'Reject format 2',
+          'Extended UTF-8 (Ledger-only blind sign) explicitly rejected on this device.', []),
+         ('S16', 'test_msg_solana_signoffchainmessage', 'test_invalid_version_rejected',
+          'Reject non-zero version',
+          'Spec defines only version 0; firmware rejects others.', []),
+         ('S17', 'test_msg_solana_signoffchainmessage', 'test_empty_message_rejected',
+          'Reject empty message',
+          'Zero-length payload rejected with SyntaxError.', []),
+         ('S18', 'test_msg_solana_signoffchainmessage', 'test_pubkey_matches_get_address',
+          'Pubkey binding',
+          'Returned public_key Base58 == solana_get_address() at same path.', []),
+         ('S19', 'test_msg_solana_signoffchainmessage', 'test_envelope_signature_verifies_offdevice',
+          'Envelope (not raw msg) is signed',
+          'Off-device Ed25519 verify against the envelope succeeds; against the bare message fails. Catches firmware regressions that drop the envelope.',
+          []),
      ]),
 
     ('T', 'TRON', '7.14.0',
-     'NEW: TRON with secp256k1 signing, base58 addresses. Blind-sign via raw_data. '
-     'Structured reconstruct-then-sign and TRC-20 clear-signing deferred to 7.15+.',
+     'TRON with secp256k1 signing, base58 addresses. Blind-sign via raw_data. '
+     'TIP-191 personal_sign + VerifyMessage and TIP-712 typed-data hash mode '
+     'added in 7.14.x. Structured reconstruct-then-sign and TRC-20 clear-signing '
+     'deferred to 7.15+.',
      [
          'ADDRESS: m/44\'/195\'/0\'/0/0 -> full 34-char base58 TRON address',
          'BLIND-SIGN: Raw protobuf data -> hash + sign',
+         'TIP-191: keccak256("\\x19TRON Signed Message:\\n" + len + msg) -> secp256k1',
+         'TIP-712: keccak256("\\x19\\x01" + domainHash + msgHash) -> secp256k1',
      ],
      [
          ('T1', 'test_msg_tron_getaddress', 'test_tron_get_address',
@@ -880,16 +909,45 @@ def parse_junit(path):
           'Sign TRX blind (raw_data)', 'Raw protobuf data triggers blind sign path. Shows amount + address if provided.', ['TRON blind sign']),
          ('T5', 'test_msg_tron_signtx', 'test_tron_sign_missing_fields_rejected',
           'Missing fields rejected', 'Incomplete transaction data is refused.', []),
+         ('T6', 'test_msg_tron_signmessage', 'test_sign_text_roundtrip',
+          'TIP-191 sign + verify text', 'Sign printable ASCII message; verify the returned signature with the same client.', ['TRON message confirm']),
+         ('T7', 'test_msg_tron_signmessage', 'test_sign_bytes_roundtrip',
+          'TIP-191 sign + verify bytes', 'Non-printable byte payload renders as hex preview, round-trips through verify.', ['TRON bytes confirm']),
+         ('T8', 'test_msg_tron_signmessage', 'test_sign_empty_message',
+          'TIP-191 empty message', 'Zero-length message is valid per TIP-191 (ASCII "0" length encoding).', []),
+         ('T9', 'test_msg_tron_signmessage', 'test_sign_address_matches_get_address',
+          'Address binding', 'Signature response address equals tron_get_address() at the same path.', []),
+         ('T10', 'test_msg_tron_signmessage', 'test_verify_rejects_corrupted_signature',
+          'Reject corrupted signature', 'Flipping a byte in r/s causes verify to recover a different pubkey -> Failure.', []),
+         ('T11', 'test_msg_tron_signmessage', 'test_verify_rejects_wrong_message',
+          'Reject wrong message', 'Valid signature against a different message -> Failure.', []),
+         ('T12', 'test_msg_tron_signmessage', 'test_invalid_path_rejected',
+          'Reject non-TRON path', 'm/44\'/60\'/... rejected by firmware path guard before signing.', []),
+         ('T13', 'test_msg_tron_signtypedhash', 'test_sign_typed_hash_with_message',
+          'TIP-712 sign hash + message', 'Domain + message hash mode; 65-byte recoverable secp256k1 sig.', ['TIP-712 confirm dialogs']),
+         ('T14', 'test_msg_tron_signtypedhash', 'test_sign_typed_hash_domain_only',
+          'TIP-712 domain-only', 'primaryType=EIP712Domain case: no message hash, domain digest only.', []),
+         ('T15', 'test_msg_tron_signtypedhash', 'test_sign_typed_hash_address_matches_get_address',
+          'Address binding', 'Sig response address matches tron_get_address() at same path.', []),
+         ('T16', 'test_msg_tron_signtypedhash', 'test_invalid_domain_hash_length_rejected',
+          'Reject bad domain hash', '31-byte domain_separator_hash rejected; must be exactly 32 bytes.', []),
+         ('T17', 'test_msg_tron_signtypedhash', 'test_invalid_message_hash_length_rejected',
+          'Reject bad message hash', '33-byte message_hash rejected; must be exactly 32 bytes.', []),
+         ('T18', 'test_msg_tron_signtypedhash', 'test_invalid_path_rejected',
+          'Reject non-TRON path', 'm/44\'/60\'/... rejected by path guard before TIP-712 signing.', []),
      ]),
 
     ('N', 'TON', '7.14.0',
-     'NEW: TON v4r2 wallet contracts. Ed25519 signing with structured field display. '
-     'Blind-sign for raw transactions. Memo/comment support. '
-     'Full clear-sign with cell tree reconstruction deferred to 7.15+.',
+     'TON v4r2 wallet contracts. Ed25519 signing with structured field display. '
+     'Blind-sign for raw transactions. Memo/comment support. Bare Ed25519 SignMessage '
+     'added in 7.14.x with AdvancedMode policy gate (no domain separation; TON Connect '
+     'ton_proof envelope deferred to a follow-up). Full clear-sign with cell tree '
+     'reconstruction deferred to 7.15+.',
      [
          'ADDRESS: m/44\'/607\'/0\' -> full 48-char base64url TON address',
          'STRUCTURED: Amount + address + memo shown as display context -> sign',
          'BLIND-SIGN: Raw tx without structured fields -> "BLIND SIGNATURE" warning',
+         'SIGN-MESSAGE: Raw Ed25519 over message bytes; gated by AdvancedMode policy',
      ],
      [
          ('N1', 'test_msg_ton_getaddress', 'test_ton_get_address',
@@ -908,6 +966,18 @@ def parse_junit(path):
           'Sign TON blind', 'Raw tx without structured fields triggers blind sign.', ['Blind warning']),
          ('N7', 'test_msg_ton_signtx', 'test_ton_sign_missing_fields_rejected',
           'Missing fields rejected', 'Incomplete data refused.', []),
+         ('N8', 'test_msg_ton_signmessage', 'test_blocked_when_advanced_mode_disabled',
+          'AdvancedMode gate blocks default', 'Without AdvancedMode policy, request fails with ActionCancelled.', []),
+         ('N9', 'test_msg_ton_signmessage', 'test_sign_text_advanced_mode',
+          'Sign text (AdvancedMode)', '64-byte Ed25519 sig + 32-byte pubkey returned for printable text.', ['TON message confirm']),
+         ('N10', 'test_msg_ton_signmessage', 'test_sign_bytes_advanced_mode',
+          'Sign bytes (AdvancedMode)', 'Non-printable bytes render as hex preview before signing.', ['TON bytes confirm']),
+         ('N11', 'test_msg_ton_signmessage', 'test_empty_message_rejected',
+          'Reject empty message', 'Zero-length message rejected with SyntaxError.', []),
+         ('N12', 'test_msg_ton_signmessage', 'test_invalid_path_rejected',
+          'Reject non-TON path', 'Solana / non-TON BIP-44 path rejected by guard.', []),
+         ('N13', 'test_msg_ton_signmessage', 'test_pubkey_consistency',
+          'Pubkey stable, sig varies', 'Same path returns same Ed25519 pubkey across signs; different msgs -> different sigs.', []),
      ]),
 
     ('Z', 'Zcash Orchard', '7.14.0',
@@ -972,6 +1042,10 @@ def parse_junit(path):
 def render(output_path, fw_version, results, screenshot_dir=None):
     pdf = PDF(); pb = PB(pdf)
     ts = datetime.now().strftime('%Y-%m-%d %H:%M')
+    # Optional build label (branch + commit) for per-PR differentiation.
+    # CI sets KK_BUILD_LABEL from "${head_ref}@${sha:0:8}" so identical
+    # SECTIONS + same firmware version still produce distinct PDFs.
+    build_label = os.environ.get('KK_BUILD_LABEL', '').strip()
     active = [(l,t,mf,bg,fl,tests) for l,t,mf,bg,fl,tests in SECTIONS if ver_ge(fw_version, mf)]
     # Separate specs section (no tests) from test sections
     specs = [s for s in active if not s[5]]
@@ -994,6 +1068,8 @@ def render(output_path, fw_version, results, screenshot_dir=None):
         pb.text(11, f'Firmware {fw_version}  |  {ts}  |  {failed} FAILED of {total} tests', bold=True, color=RED)
     else:
         pb.text(10, f'Firmware {fw_version}  |  {ts}  |  {total} tests: {passed} passed, {skipped} pending')
+    if build_label:
+        pb.text(9, f'Build: {build_label}')
     pb.gap(6)
     pb.text(12, 'Sections', bold=True)
     _shown_tested = _shown_pending = False

tests/test_msg_solana_signoffchainmessage.py

@@ -0,0 +1,161 @@
+# This file is part of the KeepKey project.
+#
+# Copyright (C) 2026 KeepKey
+#
+# This library is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Lesser General Public License version 3
+# as published by the Free Software Foundation.
+
+import struct
+import unittest
+
+import pytest
+
+try:
+    from keepkeylib import messages_solana_pb2 as _sol_msgs
+    _has_offchain = hasattr(_sol_msgs, 'SolanaSignOffchainMessage')
+except Exception:
+    _has_offchain = False
+
+import common
+from keepkeylib.client import CallException
+from keepkeylib.tools import parse_path
+
+
+SOLANA_DEFAULT_PATH = "m/44'/501'/0'/0'"
+
+# Per the Solana off-chain message spec:
+#   "\xff" || "solana offchain" || version:u8 || format:u8
+#         || length:u16 LE      || message bytes
+SOL_OFFCHAIN_PREFIX = b"\xffsolana offchain"
+
+
+def _envelope(message, version=0, message_format=0):
+    return (
+        SOL_OFFCHAIN_PREFIX
+        + bytes([version, message_format])
+        + struct.pack("<H", len(message))
+        + message
+    )
+
+
+@unittest.skipUnless(
+    _has_offchain,
+    "SolanaSignOffchainMessage protobuf not available in this build",
+)
+class TestMsgSolanaSignOffchainMessage(common.KeepKeyTest):
+
+    def setUp(self):
+        super().setUp()
+        self.requires_firmware("7.14.0")
+        self.requires_message("SolanaSignOffchainMessage")
+
+    def test_sign_ascii_message(self):
+        """Format 0 (ASCII): printable text signs successfully."""
+        self.requires_fullFeature()
+        self.setup_mnemonic_allallall()
+
+        resp = self.client.solana_sign_offchain_message(
+            parse_path(SOLANA_DEFAULT_PATH),
+            b"Sign this off-chain message",
+            message_format=0,
+        )
+        self.assertEqual(len(resp.signature), 64)   # Ed25519
+        self.assertEqual(len(resp.public_key), 32)  # Ed25519
+
+    def test_sign_at_size_ceiling(self):
+        """1212-byte message at the spec ceiling for formats 0/1 succeeds."""
+        self.requires_fullFeature()
+        self.setup_mnemonic_allallall()
+
+        resp = self.client.solana_sign_offchain_message(
+            parse_path(SOLANA_DEFAULT_PATH),
+            b"a" * 1212,
+            message_format=0,
+        )
+        self.assertEqual(len(resp.signature), 64)
+
+    def test_format_2_rejected(self):
+        """Extended UTF-8 (format=2) is Ledger-only and not supported on device."""
+        self.requires_fullFeature()
+        self.setup_mnemonic_allallall()
+
+        with pytest.raises(CallException):
+            self.client.solana_sign_offchain_message(
+                parse_path(SOLANA_DEFAULT_PATH),
+                b"hello",
+                message_format=2,
+            )
+
+    def test_invalid_version_rejected(self):
+        """Spec defines only version 0; non-zero must be rejected."""
+        self.requires_fullFeature()
+        self.setup_mnemonic_allallall()
+
+        with pytest.raises(CallException):
+            self.client.solana_sign_offchain_message(
+                parse_path(SOLANA_DEFAULT_PATH),
+                b"hello",
+                version=1,
+            )
+
+    def test_empty_message_rejected(self):
+        """Zero-length message rejected with SyntaxError."""
+        self.requires_fullFeature()
+        self.setup_mnemonic_allallall()
+
+        with pytest.raises(CallException):
+            self.client.solana_sign_offchain_message(
+                parse_path(SOLANA_DEFAULT_PATH),
+                b"",
+            )
+
+    def test_pubkey_matches_get_address(self):
+        """Returned public_key must match SolanaGetAddress at the same path."""
+        self.requires_fullFeature()
+        self.setup_mnemonic_allallall()
+
+        addr_resp = self.client.solana_get_address(
+            parse_path(SOLANA_DEFAULT_PATH),
+        )
+        sig_resp = self.client.solana_sign_offchain_message(
+            parse_path(SOLANA_DEFAULT_PATH),
+            b"binding-check",
+        )
+        # Solana addresses are Base58(pubkey); compare by re-encoding the pubkey.
+        from keepkeylib import tools
+        derived_addr = tools.b58encode(bytes(sig_resp.public_key))
+        self.assertEqual(derived_addr, addr_resp.address)
+
+    def test_envelope_signature_verifies_offdevice(self):
+        """Signature must verify against the spec envelope, not the bare message.
+
+        This is the load-bearing assertion: if firmware accidentally signs
+        msg.message instead of envelope(msg.message), this test catches it.
+        """
+        self.requires_fullFeature()
+        self.setup_mnemonic_allallall()
+
+        message = b"verify-envelope"
+        resp = self.client.solana_sign_offchain_message(
+            parse_path(SOLANA_DEFAULT_PATH),
+            message,
+        )
+
+        try:
+            from nacl.signing import VerifyKey
+            from nacl.exceptions import BadSignatureError
+        except ImportError:
+            self.skipTest("nacl not installed; envelope verification skipped")
+
+        envelope = _envelope(message, version=0, message_format=0)
+        vk = VerifyKey(bytes(resp.public_key))
+        # Should verify the envelope, not the raw message.
+        vk.verify(envelope, bytes(resp.signature))
+
+        with self.assertRaises(BadSignatureError):
+            vk.verify(message, bytes(resp.signature))
+
+
+if __name__ == "__main__":
+    unittest.main()