feat: Feat/introduce native utils margelo #20778

Cal-L · 2025-10-03T19:52:36Z

Description

Re-introduce native utils package from Margelo. Previously, this broke builds in systems using Xcode 16.2, which had a swift compilation issue.

expo_main_pipeline trigger - https://app.bitrise.io/app/be69d4368ee7e86d/pipelines/a509e96b-1fa1-4baf-8879-2e237b72b3eb

Changelog

CHANGELOG entry:

Related issues

Fixes:

Manual testing steps

Feature: my feature name

  Scenario: user [verb for user action]
    Given [describe expected initial app state]

    When user [verb for user action]
    Then [describe expected outcome]

Screenshots/Recordings

Before

After

Pre-merge author checklist

I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
I've completed the PR template to the best of my ability
I’ve included tests if applicable
I’ve documented my code using JSDoc format if applicable
I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

Note

Adds @metamask/native-utils with Nitro Modules and overrides secp256k1 getPublicKey for native performance; updates iOS stacks/tooling to Xcode 16.3 and bumps CI action refs.

Native acceleration:
- Add @metamask/native-utils and react-native-nitro-modules; polyfill secp256k1.getPublicKey in shim.js using getPublicKey from @metamask/native-utils.
- Pin crypto deps (@scure/bip32@1.7.0, @noble/curves@1.9.6); update yarn.lock accordingly and ignore react-native-nitro-modules in .depcheckrc.yml.
- iOS CocoaPods: add NativeUtils and NitroModules pods in Podfile.lock; minor ffi bump in ios/Gemfile.lock.
CI/Build pipelines:
- Bump MetaMask/github-tools setup-e2e-env action SHA across workflows.
- Move macOS/iOS builds to Xcode 16.3 (run-e2e-api-specs, Bitrise meta.stack, etc.); adjust machine types where specified.

^{Written by Cursor Bugbot for commit a0d67f1. This will update automatically on new commits. Configure here.}

## **Description** Replace JS `getPublicKey` function with our new C++ implementation. As you can see in videos it made login ~4s faster but I would take that with grain of salt as login time is quite variable due to other variables, it would require multiple measurements and averages and that would require quite some time and I plan to do it once we have all C++ function implemented in the app. According to code profiling I expect it to be around ~2s for SRP with 100+ accounts. <img width="293" height="209" alt="Screenshot 2025-09-25 at 23 40 16" src="https://github.com/user-attachments/assets/875d43a1-3265-4435-9c43-abe060cf3e4f" /> <img width="271" height="197" alt="Screenshot 2025-09-25 at 23 40 23" src="https://github.com/user-attachments/assets/0088b7ee-0b97-4544-ab92-aec7af77181a" /> CHANGELOG entry: ## **Related issues** Fixes: ## **Manual testing steps** 1. Just general smoke test, login, account import, SRP import... ## **Screenshots/Recordings**  ### **Before** https://github.com/user-attachments/assets/7250fee7-b111-4b46-87a5-e5638606a7b2 ### **After** https://github.com/user-attachments/assets/d8071433-5392-467a-ac97-e63ce8fe39aa ## **Pre-merge author checklist** - [ ] I’ve followed [MetaMask Contributor Docs](https://github.com/MetaMask/contributor-docs) and [MetaMask Mobile Coding Standards](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/CODING_GUIDELINES.md). - [ ] I've completed the PR template to the best of my ability - [ ] I’ve included tests if applicable - [ ] I’ve documented my code using [JSDoc](https://jsdoc.app/) format if applicable - [ ] I’ve applied the right labels on the PR (see [labeling guidelines](https://github.com/MetaMask/metamask-mobile/blob/main/.github/guidelines/LABELING_GUIDELINES.md)). Not required for external contributors. ## **Pre-merge reviewer checklist** - [ ] I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed). - [ ] I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.  --- > [!NOTE] > Replaces JS secp256k1 getPublicKey with a native C++ polyfill and refactors Ramp payment method selection into a new bottom-sheet modal with routing/tests, plus required iOS/dep updates. > > - **Native/Crypto**: > - Polyfill `@noble/curves` `secp256k1.getPublicKey` with native `@metamask/native-utils` in `shim.js`. > - Add deps: `@metamask/native-utils`, `react-native-nitro-modules`, pin `@noble/curves@1.9.6`, `@scure/bip32@1.7.0`; update `yarn.lock`. > - iOS: add pods `NitroModules`, `NativeUtils`; update `ffi` in `Gemfile.lock`. > - **Ramp UI (Buy/Sell)**: > - Replace `PaymentMethodModal` with new bottom-sheet `PaymentMethodSelectorModal` (styles, tests, snapshots). > - Update `BuildQuote` to navigate to `RampPaymentMethodSelectorModal` instead of inline modal; adjust handlers. > - Add route `Routes.RAMP.MODALS.PAYMENT_METHOD_SELECTOR` and register in `routes/index.tsx`. > - **Tests**: > - Update `BuildQuote.test.tsx` to assert navigation to selector modal; add dedicated tests for the new modal. > - **Tooling**: > - Add `react-native-nitro-modules` to `.depcheckrc.yml` ignores. > - Minor formatting changes in analytics/events and network banner tracking. > > <sup>Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit b946d08. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).</sup>

github-actions · 2025-10-03T19:52:44Z

CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes.

socket-security · 2025-10-03T20:32:18Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/@metamask/native-utils@0.5.0
	npm/react-native-nitro-modules@0.29.6

View full report

socket-security · 2025-10-03T20:32:19Z

Warning

MetaMask internal reviewing guidelines:

Do not ignore-all
Each alert has instructions on how to review if you don't know what it means. If lost, ask your Security Liaison or the supply-chain group
Copy-paste ignore lines for specific packages or a group of one kind with a note on what research you did to deem it safe.
@SocketSecurity ignore npm/PACKAGE@VERSION

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		`npm/react-native-nitro-modules@0.29.6` has Install scripts. Install script: postinstall Source: `bun build \|\| exit 0;` From: package.json → `npm/react-native-nitro-modules@0.29.6` ℹ Read more on: This package \| This alert \| What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/react-native-nitro-modules@0.29.6`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

sonarqubecloud · 2025-10-03T21:40:46Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sethkfman

LGTM

Nodonisko and others added 13 commits October 1, 2025 20:53

feat: introduce native utils getPublicKey polyfill

8f78c3e

fix: add missing dependency

ff1c160

chore: add nitro modules to depcheck ignore

5b94bf5

chore: improve comment a bit

b946d08

Merge branch 'main' into feat/introduce-native-utils-margelo

079e0d2

Merge branch 'main' into feat/introduce-native-utils-margelo

a2198e0

Merge branch 'main' into feat/introduce-native-utils-margelo

5f1055c

Merge branch 'main' into feat/introduce-native-utils-margelo

07bc44b

fix formatting error

a950c88

Use Xcode 16.3 for iOS

694f847

Run iOS build with Xcode 16.3 machine

f112b00

bump setup-e2e-env action

7214817

Cal-L requested a review from a team as a code owner October 3, 2025 19:52

Merge from main

fc86203

github-actions bot added the size-S label Oct 3, 2025

Cal-L added 3 commits October 3, 2025 14:15

Bump action hash to latest github-tools main

932f417

Remove redundant bitrise Xcode configurations

128bc0d

Re-add Xcode 16.3 to ios build template for testing purposes

a0d67f1

Cal-L added team-mobile-platform Mobile Platform team no-changelog no-changelog Indicates no external facing user changes, therefore no changelog documentation needed needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) labels Oct 3, 2025

github-project-automation bot added this to PR review queue Oct 3, 2025

github-project-automation bot moved this to Needs dev review in PR review queue Oct 3, 2025

Cal-L enabled auto-merge October 3, 2025 21:24

owencraston approved these changes Oct 3, 2025

View reviewed changes

sethkfman approved these changes Oct 7, 2025

View reviewed changes

Cal-L added this pull request to the merge queue Oct 7, 2025

github-project-automation bot moved this from Needs dev review to Review finalised - Ready to be merged in PR review queue Oct 7, 2025

Merged via the queue into main with commit 4c61594 Oct 7, 2025
244 of 252 checks passed

Cal-L deleted the feat/introduce-native-utils-margelo branch October 7, 2025 15:47

github-project-automation bot moved this from Review finalised - Ready to be merged to Merged, Closed or Archived in PR review queue Oct 7, 2025

github-actions bot locked and limited conversation to collaborators Oct 7, 2025

github-actions bot removed the needs-dev-review PR needs reviews from other engineers (in order to receive required approvals) label Oct 7, 2025

metamaskbot added the release-7.58.0 Issue or pull request that will be included in release 7.58.0 label Oct 7, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat: Feat/introduce native utils margelo #20778

feat: Feat/introduce native utils margelo #20778

Cal-L commented Oct 3, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 3, 2025

Uh oh!

socket-security bot commented Oct 3, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Oct 3, 2025 •

edited

Loading

Uh oh!

sonarqubecloud bot commented Oct 3, 2025

Uh oh!

sethkfman left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

feat: Feat/introduce native utils margelo #20778

feat: Feat/introduce native utils margelo #20778

Conversation

Cal-L commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changelog

Related issues

Manual testing steps

Screenshots/Recordings

Before

After

Pre-merge author checklist

Pre-merge reviewer checklist

Uh oh!

github-actions bot commented Oct 3, 2025

Uh oh!

socket-security bot commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security bot commented Oct 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented Oct 3, 2025

Quality Gate passed

Uh oh!

sethkfman left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Cal-L commented Oct 3, 2025 •

edited

Loading

socket-security bot commented Oct 3, 2025 •

edited

Loading

socket-security bot commented Oct 3, 2025 •

edited

Loading