Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
@taquito/ledger-signer
Advanced tools
@taquito/ledger-signer
is an npm package that provides developers with ledger signing functionality for Taquito. It implements the Signer interface of Taquito, allowing you to sign operations from a Ledger Nano device.
You first need to import the desired transport from the LedgerJs library. The Ledger Signer has currently been tested with @ledgerhq/hw-transport-node-hid
for Node-based applications and with @ledgerhq/hw-transport-u2f
for web applications.
You can pass an instance of the transport of your choice to your Ledger Signer as follows:
import TransportU2F from '@ledgerhq/hw-transport-u2f';
import { LedgerSigner } from '@taquito/ledger-signer';
const transport = await TransportU2F.create();
const ledgerSigner = new LedgerSigner(transport);
The constructor of the LedgerSigner
class can take three other parameters. If none are specified, the default values are used.
HDPathTemplate
which refers to 44'/1729'/${account}'/0'
. You have to specify what is the index of the account you want to use. Or you can also use a complete path as a parameter.@ledgerhq/hw-transport-u2f
, so you should not set this parameter to false if you are using this transport.import { LedgerSigner, DerivationType, HDPathTemplate } from '@taquito/ledger-signer';
const ledgerSigner = new LedgerSigner(
transport, //required
HDPathTemplate(1), // path optional (equivalent to "44'/1729'/1'/0'")
true, // prompt optional
DerivationType.ED25519 // derivationType optional
);
import { LedgerSigner } from '@taquito/ledger-signer';
import TransportNodeHid from '@ledgerhq/hw-transport-node-hid';
import { TezosToolkit } from '@taquito/taquito';
const Tezos = new TezosToolkit('https://YOUR_PREFERRED_RPC_URL');
const transport = await TransportNodeHid.create();
const ledgerSigner = new LedgerSigner(transport);
Tezos.setProvider({ signer: ledgerSigner });
//Get the public key and the public key hash from the Ledger
const publicKey = await Tezos.signer.publicKey();
const publicKeyHash = await Tezos.signer.publicKeyHash();
See the top-level https://github.com/ecadlabs/taquito file for details on reporting issues, contributing and versioning.
TypeDoc style documentation is available on-line here
THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
FAQs
Ledger signer provider
The npm package @taquito/ledger-signer receives a total of 5,298 weekly downloads. As such, @taquito/ledger-signer popularity was classified as popular.
We found that @taquito/ledger-signer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.