[DaughterOfMars]

Description of change

• Pin the SDK crates to iotaledger/iota-rust-sdk@15f2524 (feat/ledger-crate, with feat: sign with a Ledger through the transaction builder iota-rust-sdk#1705 merged), which ships iota-sdk-ledger and the ledger feature of iota-sdk-transaction-builder.
• Sign with the SDK's LedgerSigner in iota client and iota keytool, and delete crates/iota-ledger and crates/iota-ledger-signer.
• Keep the JSON-RPC object loader in the CLI and sign through the SDK's TransactionSigner::sign_with_objects, which blind-signs with a warning on IOTA apps older than 1.0.
• The device finds objects by digest, so the loader now fetches the gas coins and owned or immutable inputs at the versions the transaction references. Signing fails if one cannot be loaded, where it used to fall back to blind signing.
• The SDK signer no longer takes an expected address, so the CLI checks that the device's address at the derivation path matches the keystore address.
• LEDGER_SIMULATOR still connects to Speculos at 127.0.0.1:9999.
• docs/examples/rust/Cargo.lock also picks up unrelated changes from the cargo fetch that ./scripts/update_rust_sdk.sh runs.

Draft until iotaledger/iota-rust-sdk#1702 merges into develop; the SDK pin then moves to its commit there. Until iota-sdk-ledger is on crates.io, ./scripts/update_rust_sdk.sh without a commit fails.

Links to any relevant issues

Fixes #13134. Part of iotaledger/iota-rust-sdk#1675.

How the change has been tested

• Basic tests (linting, compilation, formatting, unit/integration tests)

• Patch-specific tests (correctness, functionality coverage)

• I have added tests that prove my fix is effective or that my feature works

• I have checked that new and existing unit tests pass locally with my changes

• New unit test: an object rebuilt from its JSON-RPC response keeps its digest.

• The CLI signing sim tests pass (test_signature_flag, test_execute_signed_tx, test_move_authenticator*).

• Not yet run against a Ledger device or Speculos.

Release Notes

• Protocol:
• Nodes (Validators and Full nodes):
• Indexer:
• JSON-RPC:
• GraphQL:
• CLI: Ledger clear signing loads the transaction's objects at the versions it references, and fails if one cannot be loaded instead of falling back to blind signing.
• Rust SDK:
• gRPC:

---

🤖 Generated with Claude Code