BitBox02 firmware

This commit fixes a test-only simulator feature so that a command-line flag called --preseed actually loads a known test wallet. It only changes test/simulator code, not the real BitBox02/BitBox03 firmware that runs on the hardware wallet. There is no security-relevant change to production code.

This commit adds placeholder user-interface screens for restoring a wallet from a recovery phrase on the BitBox03 hardware wallet. It replaces some unfinished 'todo!' stubs with basic screens and adds a retry loop so users must enter a valid BIP39 word. There is no clear security bug in the change, but it is a new, incomplete UI implementation that could contain latent issues.

This commit is a routine maintenance update for the BitBox02 hardware wallet firmware. It upgrades the pinned Rust compiler toolchain from an older version to Rust 1.96.0, updates the project's Docker build container and related developer tools (like clang-format and clang-tidy) from version 21 to 22, and refreshes several vendored Rust library dependencies to newer versions. The only application code change is a small test-only cleanup in the Bitcoin transaction signing tests to satisfy a new Rust linter warning. There is no direct evidence in the commit message or diff that this fixes a specific security vulnerability.

This commit removes the use of the standard snprintf formatting function from the BitBox02 bootloader's developer menu and replaces it with a small, fixed-format helper. The main goal is to reduce the bootloader's binary size and make the project's automated checks apply to all bootloader builds, not just production ones. There is no direct evidence this fixes an active security vulnerability, but it is a defensive hardening change that reduces attack surface by avoiding a complex formatting library in security-sensitive bootloader code.

This commit is a code-size optimization for the BitBox02 bootloader. It switches the Bluetooth Low Energy (BLE) firmware hash verification from a Rust SHA-256 implementation to an existing C-based SHA-256 implementation already used by the bootloader. The change saves 1,352 bytes and adds a CI check to prevent the larger Rust SHA-256 code from creeping back into production bootloaders. There is no indication this fixes a security vulnerability.

This commit removes the use of standard string-formatting functions (like snprintf and Rust's format!) from the bootloader and related low-level code, replacing them with smaller, fixed-size string builders. The stated goal is to reduce binary size ('bloat') in the production bootloader, not to fix a known security bug. The change also adds a CI check that rejects any future use of these formatting symbols in production bootloader builds. While removing complex formatting libraries from a bootloader is generally good defensive practice, the commit itself does not describe or demonstrate any exploitable vulnerability.

This commit is a simple code cleanup: it moves a handful of string-formatting helpers (for pairing codes, progress percentages, hash display, timers, and unknown-command messages) out of the main bootloader file into a new dedicated file, and adds unit tests for them. The actual formatting logic is unchanged, and there is no indication of any security fix or behavior change.

This commit removes a 100-character stack buffer and passes bootloader messages straight to the screen-drawing function. The old code used snprintf to copy the message into a fixed-size buffer, which could silently truncate very long strings. There is no direct evidence in the commit that this fixed a security vulnerability; it appears to be a cleanup or robustness improvement. The change does not introduce obvious new risks because the drawing function consumes the string immediately.

This commit changes the default on-screen font used by the bootloader from an 11x10 pixel font to a 9x9 pixel font. The only stated purpose is to make the bootloader firmware file smaller by avoiding inclusion of the larger font's data table. There is no indication this fixes a security vulnerability.

This change only adjusts a code-quality tool configuration. It tells clang-tidy to skip linting header files located in an external driver directory (asf4-drivers). It does not modify firmware behavior, fix a bug, or change any executable code.

This commit only improves an internal CI script that checks the built firmware for unwanted software-implemented floating-point and other bloat-causing symbols. It is a build-hygiene and binary-size guard, not a security patch. There is no vulnerability being fixed here.

This commit replaces floating-point progress calculations with integer math to save firmware space. It removes the use of f32 arithmetic for progress bars in Bitcoin transaction signing and Bluetooth firmware upgrades. There is no direct security vulnerability in the change itself; it is a code-quality and size-reduction refactor. However, it introduces new integer arithmetic paths that must keep numerator/denominator assumptions valid to avoid incorrect progress display.

This commit simply adds the official STMicroelectronics (ST) driver library for the STM32U5 microcontroller family into the project's source tree. It is a large import of vendor-provided header files, source files, and license files. There is no bug fix, no functional change to the wallet application, and no indication of a security issue being addressed.

This commit adds a visual progress bar that appears on the BitBox02 screen while the device is receiving large Ethereum transaction data or typed-message data from the host computer. It is purely a user-experience change: it shows 'Loading data...' with a progress fraction during streaming, and updates the test mock UI so automated tests can verify the progress values. There is no security-relevant change to cryptography, parsing, bounds checking, or host/device trust boundaries.

This commit fixes a test-only setup problem. The unit tests for on-screen UI components were not initializing the graphics library (ugui) before running. Because label sizing now depends on ugui being set up, the tests could fail or hit debug assertions. The change adds a minimal fake graphics setup so the tests run correctly. It does not change the firmware that runs on the actual device.

This commit is a simple code cleanup in the BitBox02 hardware wallet's user interface. It removes a duplicate, upside-down version of a small 'rotate' icon and instead flips the existing icon when needed. There is no security change.

This commit changes a small graphics library inside the BitBox02 hardware wallet so that it uses debug-only safety checks instead of always-on null checks. In normal release builds, the old null checks and the new ASSERT calls both effectively do nothing, so user-facing behavior is unchanged. The main risk is that a developer running a DEBUG build could now trigger a crash if a bug passes a NULL pointer, whereas before the function would silently return. There is no direct evidence this fixes an exploitable security vulnerability.

This commit removes an unused function for drawing transparent characters on the BitBox02 hardware wallet screen. It is a straightforward code cleanup with no security relevance visible in the change.

This commit is a user-interface cleanup: it removes a special 'draw text upside-down' flag from the graphics library and instead uses a generic 180-degree rotation helper when the screen is flipped. It does not fix a security vulnerability and does not appear to introduce one. The change is mostly about simplifying how text and buttons are rendered on the BitBox02 hardware wallet screen.

This commit changes the build system to enable Link-Time Optimization (LTO), a compiler technique that shrinks the final firmware size. It also adds safeguards to keep the stack protector security feature working under LTO and deliberately excludes sensitive low-level code (bootloader, factory setup, hardware drivers) from LTO to avoid subtle bugs. There is no direct evidence in the commit of a security vulnerability being fixed or introduced.

This commit adds a new factory-setup helper program for the BitBox03 hardware wallet and moves some debug logging code around. It does not change the main wallet firmware's security behavior. There is no indication this fixes or introduces a security vulnerability.

This commit adds a brand-new, minimal firmware binary for the BitBox03 hardware wallet. It is essentially a development stub: it initializes the board, sets up a debug logger, prints a log message, and then halts. There is no user-facing functionality, no cryptographic code, and no security-sensitive logic introduced in this change. It is a build-system and scaffolding addition, not a security fix or vulnerability.