BitBox02 firmware

This change updates how the BitBox02 hardware wallet warns users when displaying very long member names in Ethereum typed-data (EIP-712) array confirmations. It replaces a direct confirmation call with a shared helper that adds a truncation warning screen. The practical effect is to make sure users see a 'Warning' screen before a long field name is shown, reducing the chance that a maliciously crafted field name could hide or spoof important confirmation details.

This commit adds vendored copies of two Rust embedded-crates (cortex-m-rt and its companion macro crate) plus a large auto-generated STM32U5 peripheral access crate to the BitBox02 firmware repository. Vendoring means the project is no longer fetching these libraries from the public crates registry at build time; instead it uses its own frozen copy. The change itself is a build-system/dependency-management refactor. There is no direct evidence in the commit message or diff that this fixes a known security vulnerability, but vendoring can affect how future upstream security patches are applied and the STM32 register definitions are security-relevant because they control hardware protections (TrustZone, debug, flash, etc.).

This commit adds the official STMicroelectronics low-level driver package (CMSIS and HAL) for the STM32U5 microcontroller family to the BitBox02 firmware repository. It is a large vendor code import with no functional firmware changes, no bug fixes, and no security patches visible in the diff.

This commit adds new touchscreen keyboard and PIN keypad screens for the BitBox03 hardware wallet, along with changes to how secret text (passphrases, PINs) is read from the on-screen buffer. The most notable security-relevant change is a fix for how the device copies sensitive text: it now reads the LVGL text buffer directly into a zeroizing string, avoiding an intermediate non-zeroized copy that could leave secret characters in memory. The commit also hardens touch handling so that sliding a finger off a key before releasing does not type the key or confirm an action, and it clears stale key selections to prevent accidental double-typing. Most of the rest is UI layout, fonts, and simulator tooling.

This commit only adds two digital signature files for an already-released firmware version (v9.26.5). These signatures are used by users to independently verify that the published firmware binary matches what a specific signer reviewed. No code, no firmware binary, and no behavior of the device or software is changed. There is no security vulnerability here.

This commit fixes a security hygiene issue in the BitBox02 firmware's on-screen text-entry code. Previously, when a user typed a PIN or passphrase, the code briefly created an intermediate plain-text copy of the secret that was not securely erased from memory after use. The patch reads the secret directly into a zeroizing container so it is wiped when no longer needed. The same commit also removes a visual flicker on disabled navigation buttons and changes a simulator command-line flag from '--lock' to '--unlock'.

This commit is a routine merge that adds a new version heading (v9.27.0) to the project's CHANGELOG.md file. It contains no code changes, no bug fixes, and no security-related content.

This commit is a routine changelog update that labels the upcoming firmware release as version 9.27.0. It does not change any source code, configuration, or security behavior. There is no security-relevant content in the diff.

This commit replaces a standard text-formatting function (snprintf) with a small hand-written loop to display a six-digit Bluetooth pairing code on the BitBox02 hardware wallet screen. The change is described by the author as a cleanup to silence a compiler warning and make the numeric bounds more obvious. There is no direct evidence in the commit that this fixes an exploitable security bug.

This commit adds support for timestamp-based Bitcoin nLockTime values (values of 500,000,000 or higher) in the BitBox02 hardware wallet. Previously, such locktimes were rejected as invalid. The change also removes the on-screen RBF (Replace-By-Fee) status display from locktime confirmations and updates the Python library to require firmware version 9.27.0 when using timestamp locktimes. It is a feature addition with associated UI changes, not a security fix for a known vulnerability.

This commit adds signed release assertions for BitBox02 firmware version 9.26.5. These are text files plus cryptographic signatures that record the expected SHA-256 hash of the compiled firmware. They are part of the reproducible-build verification process and do not change any firmware code, wallet logic, or device behavior. There is no security vulnerability here.

This commit adds the ability to sign Bitcoin messages using keys in the m/45' keypath namespace, which is used by some external services like Unchained and Casa. Previously, message signing only worked for standard Bitcoin address keypaths. The change splits address derivation into a validated and an unvalidated variant, and adds a new keypath check for m/45' paths. It also updates the on-screen message to warn users that the key belongs to an external service, so they don't mistake it for a normal wallet address.

This commit updates the BitBox02 Python library so it refuses to sign Bitcoin and Ethereum transactions or messages unless the hardware wallet is running a firmware version that supports the anti-klepto feature. Anti-klepto is a protocol that helps prevent a compromised device from leaking secret key material through biased randomness in signatures. The change removes older, less-protected fallback signing paths and bumps the library version to 8.0.0 because it now requires newer firmware.