Add unified Minotari Ledger installer

.github/workflows/ci.yml

@@ -103,6 +103,10 @@ jobs:
       - name: checkout tari
         uses: actions/checkout@v6
 
+      - name: ledger installer python tests
+        shell: bash
+        run: python3 applications/minotari_ledger_wallet/wallet/install_scripts/test_install_minotari_ledger.py
+
       - name: ledger build tests
         shell: bash
         run: |

applications/minotari_ledger_wallet/wallet/README.md

@@ -20,6 +20,31 @@ will not start and produce an error with a message to update the firmware.
 If the firmware needs to be updated, it must be done via Ledger Live. To update the firmware, open Ledger Live, select
 `My Ledger` and follow the instructions.
 
+## One-step installer
+
+The release installer in `install_scripts/install_minotari_ledger.py` works on macOS, Windows, and Linux. It detects the
+connected Ledger model, downloads the matching Minotari Ledger Wallet release artifact, verifies the `.zip.sha256`
+checksum, and installs the app.
+
+Supported devices are Nano S Plus, Nano X, Stax, and Flex. The original Nano S is not supported by the Minotari Ledger
+Wallet.
+
+Run the installer from the `install_scripts` directory:
+
+```
+python install_minotari_ledger.py
+```
+
+Python 3.9 or newer is required.
+
+To install a specific release:
+
+```
+python install_minotari_ledger.py --tag v5.4.0-pre.1
+```
+
+The per-model scripts under `install_scripts/<model>/` are compatibility wrappers around this unified installer.
+
 ## Development environment setup
 
 Ledger does not build with the standard library, so we need to install `rust-src`. This can be done with:
@@ -145,21 +170,18 @@ ledgerctl delete "MinoTari Wallet"
 
 - Installation
 
-The following command has to be run from the root of the Tari ledger wallet repository, i.e. 
-`<TARI>/applications/minotari_ledger_wallet/wallet`.
+For release artifacts, use the one-step installer above. Current Tari release archives contain
+`minotari_ledger_wallet.apdu`, and the installer downloads, verifies, extracts, and loads that APDU file through
+Ledger's secure loader.
 
-First locate `app_nanosplus.json`. It will either be in the ledger wallet root
-`<TARI>/applications/minotari_ledger_wallet/wallet` or in its the target directory `./target/nanosplus/release`,
-then run one of the following commands to install the application:
+For a local development build, install the manifest generated for the selected build target if one is present:
 
 ```
-ledgerctl install app_nanosplus.json
-```
-```
-ledgerctl install ./target/nanosplus/release/app_nanosplus.json
-ledgerctl install ./target/stax/release/app_stax.json
+ledgerctl install ./target/{TARGET}/release/app_{TARGET}.json
 ```
 
+Replace `{TARGET}` with the Ledger target used for the build, for example `nanosplus`, `nanox`, `stax`, or `flex`.
+
 **Notes for Windows users:**
 - For a standard Anaconda 3 installation, the Python shell can be started from your development terminal with
   ```

applications/minotari_ledger_wallet/wallet/install_scripts/README.md

@@ -0,0 +1,52 @@
+# Minotari Ledger Wallet Installer
+
+Use `install_minotari_ledger.py` to install the Minotari Ledger Wallet app on
+a supported Ledger device from a Tari GitHub release.
+
+Supported devices:
+- Ledger Nano S Plus
+- Ledger Nano X
+- Ledger Stax
+- Ledger Flex
+
+The original Ledger Nano S is not supported by the Minotari Ledger Wallet.
+
+## Usage
+
+From this directory:
+
+```bash
+python install_minotari_ledger.py
+```
+
+The installer detects the connected device, finds the newest non-draft Tari
+release with a matching `minotari_ledger_wallet-<model>-*.zip` asset, verifies
+the `.zip.sha256` sidecar, extracts the archive safely, and installs it.
+
+To install a specific release:
+
+```bash
+python install_minotari_ledger.py --tag v5.4.0-pre.1
+```
+
+## Compatibility Wrappers
+
+The existing per-model scripts remain as thin wrappers:
+
+- `nanosplus/install_minotari_ledger_nanosplus.sh`
+- `nanox/install_minotari_ledger_nanox.sh`
+- `stax/install_minotari_ledger_stax.sh`
+- `flex/install_minotari_ledger_flex.sh`
+- `*/install_ledger_win.ps1`
+
+They call the same auto-detecting installer so existing entry-point paths keep
+working without bypassing device detection.
+
+## Notes
+
+- Python 3.9 or newer is required.
+- The installer creates an isolated Python environment in the user cache and
+  installs Ledger tooling there instead of modifying the system Python.
+- Tari Ledger release archives must contain `minotari_ledger_wallet.apdu`,
+  which is loaded through Ledger's secure APDU loader.
+- Keep the Ledger connected, unlocked, and approve prompts on the device.

applications/minotari_ledger_wallet/wallet/install_scripts/flex/README.md

@@ -1,100 +1,20 @@
-# Minotari Ledger Flex Installer (macOS)
+# Minotari Ledger Flex Installer
 
-This script installs the **Minotari Ledger Wallet app** (`minotari_ledger_wallet-flex`) onto a **Ledger Flex** on macOS.
+This directory keeps compatibility entry points for Ledger Flex users.
+Both scripts delegate to the auto-detecting unified installer in
+`../install_minotari_ledger.py`.
 
-It is fully automated and handles:
-- System dependencies
-- Python virtual environment setup
-- `ledgerctl` installation
-- Downloading the **latest** Minotari Ledger release
-- Installing the app onto the Ledger device
-
----
-
-## Supported Platforms
-
-- **macOS** (Intel & Apple Silicon)
-- **Ledger Flex**
-
----
-
-## What the Script Does
-
-1. Installs required tools via **Homebrew**
-2. Creates a Python **virtual environment**
-3. Installs required Python dependencies
-4. Automatically installs `ledgerctl` (if missing)
-5. Downloads the **latest** `minotari_ledger_wallet-flex` release from GitHub
-6. Unzips the release
-7. Uploads the app to the Ledger device using `ledgerctl`
-
-All tooling is isolated inside the virtual environment to avoid polluting system Python.
-
----
-
-## Prerequisites
-
-### Homebrew
-
-```bash
-brew --version
-```
-
-If not installed, see https://brew.sh
-
-### Ledger Device
-
-Ensure your **Ledger Flex** is:
-- Connected via USB
-- Unlocked
-- Developer Mode enabled
-- Not running another app
-
----
-
-## Installation
+## macOS / Linux
 
 ```bash
-chmod +x install_minotari_ledger_flex.sh
 ./install_minotari_ledger_flex.sh
 ```
 
----
-
-## Directory Layout
+## Windows PowerShell
 
-```text
-~/src/tari/
-└── tari-ledger-live/
-    ├── bin/
-    ├── lib/
-    └── tari-downloads/
+```powershell
+.\install_ledger_win.ps1
 ```
 
----
-
-## Re-running the Script
-
-The script is safe to re-run and will always fetch the latest release.
-
----
-
-## Troubleshooting
-
-- Ensure the Ledger is unlocked and Developer Mode is enabled
-- Close Ledger Live before installing
-- Use a data-capable USB cable
-
----
-
-## Security
-
-- Downloads are from the official Tari GitHub
-- No keys or secrets are accessed
-- Installation requires physical confirmation on the Ledger
-
----
-
-## License
-
-Provided as-is. Minotari Ledger app is licensed by the Tari Project.
+Pass `--tag <release>` on macOS/Linux or `-Tag <release>` on Windows to install
+a specific Tari release.

applications/minotari_ledger_wallet/wallet/install_scripts/flex/install_ledger_win.ps1

@@ -1,113 +1,27 @@
 [CmdletBinding()]
 param(
-    # Install a specific release tag (e.g. v5.2.0-pre.7), including pre-releases.
-    # If omitted, the latest published release is used.
-    [string]$Tag
+    [string]$Tag,
+    [Parameter(ValueFromRemainingArguments = $true)]
+    [string[]]$RemainingArgs
 )
 
 $ErrorActionPreference = "Stop"
 
-Write-Host "🚀 Installing Minotari Ledger Wallet (Flex)" -ForegroundColor Cyan
+$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$Installer = Join-Path (Split-Path -Parent $ScriptDir) "install_minotari_ledger.py"
+$Python = Get-Command python -ErrorAction SilentlyContinue
 
-# -------------------------
-# Prerequisites
-# -------------------------
-
-if (-not (Get-Command python -ErrorAction SilentlyContinue)) {
-    Write-Error "Python is not installed or not on PATH. Install Python 3 first."
-}
-
-if (-not (Get-Command pip -ErrorAction SilentlyContinue)) {
-    Write-Error "pip not found. Ensure Python was installed with pip enabled."
-}
-
-# -------------------------
-# Project setup
-# -------------------------
-
-$ProjectDir = "$env:USERPROFILE\src\tari"
-$VenvDir    = "$ProjectDir\tari-ledger-live"
-$DownloadDir = "$VenvDir\tari-downloads"
-
-Write-Host "📁 Setting up project directory at $ProjectDir"
-New-Item -ItemType Directory -Force -Path $ProjectDir | Out-Null
-Set-Location $ProjectDir
-
-if (-not (Test-Path $VenvDir)) {
-    Write-Host "🐍 Creating Python virtual environment..."
-    python -m venv $VenvDir
-}
-
-# Activate venv
-& "$VenvDir\Scripts\Activate.ps1"
-
-Write-Host "📦 Installing Python dependencies..."
-pip install --upgrade pip
-pip install protobuf setuptools ecdsa ledgerwallet
-
-# -------------------------
-# Auto-install ledgerctl
-# -------------------------
-
-if (-not (Get-Command ledgerctl -ErrorAction SilentlyContinue)) {
-    Write-Host "🔐 ledgerctl not found — installing..."
-    pip install ledgerctl
-} else {
-    Write-Host "✅ ledgerctl already installed"
+if (-not $Python) {
+    Write-Error "Python 3 is required to run the Minotari Ledger installer."
 }
 
-# -------------------------
-# Download latest release
-# -------------------------
-
+$InstallerArgs = @()
 if ($Tag) {
-    Write-Host "🌐 Fetching Minotari Ledger release info for tag '$Tag'..."
-    $ReleaseUri = "https://api.github.com/repos/tari-project/tari/releases/tags/$Tag"
-} else {
-    Write-Host "🌐 Fetching latest Minotari Ledger release..."
-    $ReleaseUri = "https://api.github.com/repos/tari-project/tari/releases/latest"
+    $InstallerArgs += @("--tag", $Tag)
 }
-
-New-Item -ItemType Directory -Force -Path $DownloadDir | Out-Null
-Set-Location $DownloadDir
-
-$Release = Invoke-RestMethod `
-    -Uri $ReleaseUri `
-    -Headers @{ "User-Agent" = "PowerShell" }
-
-$Asset = $Release.assets |
-    Where-Object { $_.name -match "minotari_ledger_wallet-flex.*\.zip" } |
-    Select-Object -First 1
-
-if (-not $Asset) {
-    Write-Error "Could not find flex release asset."
+if ($RemainingArgs) {
+    $InstallerArgs += $RemainingArgs
 }
 
-Write-Host "⬇️ Downloading $($Asset.name)"
-Invoke-WebRequest $Asset.browser_download_url -OutFile $Asset.name
-
-Write-Host "📦 Extracting archive..."
-Expand-Archive -Path $Asset.name -DestinationPath . -Force
-
-# -------------------------
-# Install onto Ledger
-# -------------------------
-
-$appJson = Get-ChildItem -Recurse -Filter "app_flex.json" | Select-Object -First 1
-
-if (-not $appJson) {
-    Write-Error "app_flex.json not found after extraction."
-}
-
-Write-Host ""
-Write-Host "🔐 Installing app onto Ledger Flex..." -ForegroundColor Yellow
-Write-Host "👉 Ensure:"
-Write-Host "   • Ledger connected via USB"
-Write-Host "   • Device unlocked"
-Write-Host "   • Developer Mode enabled"
-Write-Host ""
-
-ledgerctl install $appJson.FullName
-
-Write-Host ""
-Write-Host "✅ Minotari Ledger Wallet installed successfully!" -ForegroundColor Green
+& $Python.Source $Installer @InstallerArgs
+exit $LASTEXITCODE