Dependency checker: git submodules as three claims

Nunchuk desktop 2.9.1, checked 2026-10-27 · code: MR !1845, commits a02ec5742c and 2e35524bd0 · by Carol for Leo's review

What changed

• In the nightly pass. Every release analysis now walks the release's git submodules recursively. Nothing is built: git fetches commit history and a few build files by blob id, and OSV is queried over HTTP. A release without .gitmodules costs nothing.
• Three separate claims per submodule. RB is the product's verification and covers what is compiled in. Identity asks whether the pinned commit is an upstream tag, an upstream commit, or modified on top of a release. Advisories carry over only when identity holds. A modified copy gets its base release's advisories as "status unknown", each with a fix-commit hint, and is never shown as clean.
• Build scope. If a parent's build files name only some folders of a child, the child's other submodules are marked "not in the app". Submodules in test, fuzz, bench, docs or examples folders, plus openssl's external test suites, are marked "tests only". They stay listed but don't count towards the release.
• First party. A submodule with the same owner as the wallet's repository is the wallet's own code, not an upstream library.
• In the panel. A one-line summary with the counts opens into the table below. A C/C++ release that the lockfile check calls "unsupported" now still shows its submodules.

Nunchuk 2.9.1: what we can tell users

Findings worth your judgment

1. Correction to my earlier thread summary. I had reported the micropython "likely missing" fixes and the nanopb CVE against Nunchuk. Neither is compiled into the app, so the build-scope check was the missing piece. Without it we would have overclaimed against the provider.
2. CVE-2023-25758 is very likely a false match. It describes OneKey hardware wallets: a seed leak after physically disassembling the device. OSV attributes it to trezor-firmware commits because OneKey forks trezor. Nunchuk desktop uses 9 C files of trezor's crypto library. It's a real OSV hit by commit, so it stays listed, but it is a natural first triage statement.
3. Fixed while building this page. For a C/C++ release with no lockfile, the panel used to show green "0 advisory matches" and "0 known malware" tiles above 42 submodule advisories. It now hides those tiles and says that only the submodules were checked.

Limits (stated so we don't overclaim the other way)

• "May be in the app" is not proof that code is compiled in. gtad (a code generator) and doxygen-awesome-css (doc styling) read "may be". Their parents don't name them in build files, and an unnamed submodule could still come in through a glob or variable, so the check doesn't exclude it.
• Exclusion is proven only when a parent picks files by path. add_subdirectory, variables and globs count as "the whole child".
• The "after <tag>" base comes from git describe and can name an odd tag. Bitcoin shows "17271 commits after v21.99-guixtest1". Identity (upstream, unmodified) is unaffected, but the wording needs a better base pick.
• The openssl test-suite entry is a hand-kept table, one entry long.
• Fix hints miss renamed files: the micropython fixes target modselect.c, which the fork still calls moduselect.c.
• Not live yet. The service picks this up at the next deploy:source-analysis, and Nunchuk's rows appear after its next release analysis.

The panel, as a wallet page would show it

The real panel module from the commit, with the real export from this run. Click the submodules line to open the table.