rob thijssen
b66b0a65c8
The Quantus runtime accepts only ML-DSA signatures. qapi offered every signer
polkahub knows, and none of those could sign here:
- Polkadot Vault, Ledger and WalletConnect produce sr25519, ed25519 or ecdsa
signatures (and WalletConnect was configured only for Polkadot, Kusama and
Paseo);
- the external multisig signer hands signing to multisig.usepapi.app;
- the browser-extension list offered polkadot{.js}, Nova, Talisman,
SubWallet, PolkaGate and Fearless.
These providers, their management buttons, and the Vault and multisig modals
are removed. What remains: browser extensions, read-only (watch) addresses,
and proxies, which sign through whichever signer they wrap.
@polkahub/pjs-wallet is patched (pinned to 0.9.1, like the substrate-bindings
patches) so the extension list is blackbeard alone, with its sigil as the
logo. Its provider only ever sees, offers or connects blackbeard: anything
else injected into window.injectedWeb3 is ignored, not merely unlabelled.
Verified against a local build in Firefox with blackbeard installed. The
Account Providers panel shows blackbeard (with the sigil), Address and Proxy,
and nothing else, including after fake polkadot-js and talisman entries were
injected into the page and the provider's 2 s re-scan had run.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uDUodEcRbBwNRi3UCmw8f
23 lines
1.2 KiB
YAML
23 lines
1.2 KiB
YAML
allowBuilds:
|
|
"@reown/appkit": true
|
|
esbuild: true
|
|
minimumReleaseAgeExclude:
|
|
- '@paraspell/assets@14.3.0 || 14.3.4'
|
|
- '@paraspell/descriptors@14.3.0 || 14.3.4'
|
|
- '@paraspell/pallets@14.3.0 || 14.3.4'
|
|
- '@paraspell/sdk-common@14.3.0 || 14.3.4'
|
|
- '@paraspell/sdk-core@14.3.0 || 14.3.4'
|
|
- '@paraspell/sdk@14.3.0 || 14.3.4'
|
|
patchedDependencies:
|
|
'@polkadot-api/signers-common': patches/@polkadot-api__signers-common.patch
|
|
# Pinned per version, unlike the signers-common patch which is keyed on the
|
|
# bare name. Four copies of substrate-bindings resolve in this tree and their
|
|
# blockHeader.js is NOT identical across majors — 0.19.0 and 0.6.0 differ, and
|
|
# a bare-name key fails the whole install trying to patch them. 0.21.1 is what
|
|
# the console and observable-client actually import; 0.21.0 is byte-identical
|
|
# and patched too so a minor bump does not silently drop the fix.
|
|
'@polkadot-api/substrate-bindings@0.21.0': patches/@polkadot-api__substrate-bindings@0.21.0.patch
|
|
'@polkadot-api/substrate-bindings@0.21.1': patches/@polkadot-api__substrate-bindings@0.21.1.patch
|
|
'@polkahub/pjs-wallet@0.9.1': patches/@polkahub__pjs-wallet@0.9.1.patch
|
|
react18-json-view: patches/react18-json-view.patch
|