BitBox02 firmware

This commit improves the Python firmware-flashing tool for BitBox hardware wallets. It adds clearer warnings, requires user confirmation before flashing, detects firmware type automatically instead of relying on filename or a debug flag, and exposes more detailed bootloader error messages. The changes are primarily usability and safety improvements for a developer/testing tool, not a fix for an exploitable device vulnerability.

This commit improves a Python helper used by developers to flash firmware onto BitBox hardware wallets. It makes the tool smarter about whether the connected device is a production or development unit, detects signed vs unsigned firmware files automatically, and adds clearer warnings and confirmation prompts. The changes are mostly usability and safety improvements for a developer-facing script, not a fix for a remote attack on user devices.

This commit is a merge that adds and updates release-helper scripts for the BitBox02 hardware wallet. It introduces a new script to draft GitHub firmware releases, refactors existing scripts to share a common parser for signed firmware files, and adds type annotations and tests. There is no direct evidence in the diff of a security vulnerability or malicious change; it appears to be routine release-tooling maintenance.

This commit adds a new read-only field to the BitBox02's device information response so the host app can learn which bootloader version is installed. It does not change how data is signed, encrypted, or authorized. The main security-relevant aspect is that the firmware now reads a small version string from the bootloader area and validates the bootloader header's magic value and length before exposing it. This is a defensive information-disclosure change rather than a vulnerability fix.

This update adds an extra confirmation screen when signing Ethereum typed messages (EIP-712). Before the user approves a signature, the device now shows the message's primary type, such as 'Authorize' or 'Revoke'. This helps users notice if a website is asking them to sign a different kind of message than they expect, reducing the risk of being tricked into approving a harmful signature.

This change updates how the BitBox02 hardware wallet warns users when displaying very long member names in Ethereum typed-data (EIP-712) array confirmations. It replaces a direct confirmation call with a shared helper that adds a truncation warning screen. The practical effect is to make sure users see a 'Warning' screen before a long field name is shown, reducing the chance that a maliciously crafted field name could hide or spoof important confirmation details.

This commit adds vendored copies of two Rust embedded-crates (cortex-m-rt and its companion macro crate) plus a large auto-generated STM32U5 peripheral access crate to the BitBox02 firmware repository. Vendoring means the project is no longer fetching these libraries from the public crates registry at build time; instead it uses its own frozen copy. The change itself is a build-system/dependency-management refactor. There is no direct evidence in the commit message or diff that this fixes a known security vulnerability, but vendoring can affect how future upstream security patches are applied and the STM32 register definitions are security-relevant because they control hardware protections (TrustZone, debug, flash, etc.).

This commit adds the official STMicroelectronics low-level driver package (CMSIS and HAL) for the STM32U5 microcontroller family to the BitBox02 firmware repository. It is a large vendor code import with no functional firmware changes, no bug fixes, and no security patches visible in the diff.

This commit adds new touchscreen keyboard and PIN keypad screens for the BitBox03 hardware wallet, along with changes to how secret text (passphrases, PINs) is read from the on-screen buffer. The most notable security-relevant change is a fix for how the device copies sensitive text: it now reads the LVGL text buffer directly into a zeroizing string, avoiding an intermediate non-zeroized copy that could leave secret characters in memory. The commit also hardens touch handling so that sliding a finger off a key before releasing does not type the key or confirm an action, and it clears stale key selections to prevent accidental double-typing. Most of the rest is UI layout, fonts, and simulator tooling.

This commit only adds two digital signature files for an already-released firmware version (v9.26.5). These signatures are used by users to independently verify that the published firmware binary matches what a specific signer reviewed. No code, no firmware binary, and no behavior of the device or software is changed. There is no security vulnerability here.

This commit fixes a security hygiene issue in the BitBox02 firmware's on-screen text-entry code. Previously, when a user typed a PIN or passphrase, the code briefly created an intermediate plain-text copy of the secret that was not securely erased from memory after use. The patch reads the secret directly into a zeroizing container so it is wiped when no longer needed. The same commit also removes a visual flicker on disabled navigation buttons and changes a simulator command-line flag from '--lock' to '--unlock'.

This commit is a routine merge that adds a new version heading (v9.27.0) to the project's CHANGELOG.md file. It contains no code changes, no bug fixes, and no security-related content.

This commit is a routine changelog update that labels the upcoming firmware release as version 9.27.0. It does not change any source code, configuration, or security behavior. There is no security-relevant content in the diff.

This commit replaces a standard text-formatting function (snprintf) with a small hand-written loop to display a six-digit Bluetooth pairing code on the BitBox02 hardware wallet screen. The change is described by the author as a cleanup to silence a compiler warning and make the numeric bounds more obvious. There is no direct evidence in the commit that this fixes an exploitable security bug.

This commit adds support for timestamp-based Bitcoin nLockTime values (values of 500,000,000 or higher) in the BitBox02 hardware wallet. Previously, such locktimes were rejected as invalid. The change also removes the on-screen RBF (Replace-By-Fee) status display from locktime confirmations and updates the Python library to require firmware version 9.27.0 when using timestamp locktimes. It is a feature addition with associated UI changes, not a security fix for a known vulnerability.

This commit adds signed release assertions for BitBox02 firmware version 9.26.5. These are text files plus cryptographic signatures that record the expected SHA-256 hash of the compiled firmware. They are part of the reproducible-build verification process and do not change any firmware code, wallet logic, or device behavior. There is no security vulnerability here.

This commit adds the ability to sign Bitcoin messages using keys in the m/45' keypath namespace, which is used by some external services like Unchained and Casa. Previously, message signing only worked for standard Bitcoin address keypaths. The change splits address derivation into a validated and an unvalidated variant, and adds a new keypath check for m/45' paths. It also updates the on-screen message to warn users that the key belongs to an external service, so they don't mistake it for a normal wallet address.

This commit updates the BitBox02 Python library so it refuses to sign Bitcoin and Ethereum transactions or messages unless the hardware wallet is running a firmware version that supports the anti-klepto feature. Anti-klepto is a protocol that helps prevent a compromised device from leaking secret key material through biased randomness in signatures. The change removes older, less-protected fallback signing paths and bumps the library version to 8.0.0 because it now requires newer firmware.

This firmware update changes how long merchant or recipient names are shown when approving Bitcoin payments. Instead of breaking the name across two lines, which could be cut off or hidden, the name now appears on a single line that the user can scroll through. This helps users actually see and verify long names like 'SWAPKIT (...)' during payment approval. The change is a usability and anti-spoofing improvement, not a vulnerability fix in the traditional sense, but it does close a small security gap where truncated or wrapped names might mislead a user.

This commit adds an extra on-device confirmation step when signing Ethereum typed messages (EIP-712). Before walking through the message fields, the BitBox02 now shows the user the 'primary type' (for example 'Authorize' or 'Revoke'). The goal is to prevent a malicious computer program from swapping one message type for another that has the same field shapes, because the device would then bind the user-approved signature to the wrong type. It is a hardening fix rather than a clear-cut vulnerability patch.

This commit adds support for timestamp-based Bitcoin transaction locktimes in the BitBox02 hardware wallet. Previously, locktimes at or above 500,000,000 were rejected; now they are accepted and shown to the user as a UTC date and time. The commit also removes the on-screen 'RBF' (Replace-By-Fee) indicator because RBF is a network policy, not a guaranteed property of the signed transaction. This is a normal feature addition with no obvious security bug, though it changes what transaction details users see before signing.

This commit is a large merge that adds a new Rust crate called bitbox-test-vectors. It is purely a testing and quality-assurance change: it creates shared Bitcoin transaction test vectors (sample PSBTs and expected firmware behavior) so that the firmware, the Go client library, and the Rust client library can all use the same test data. There is no change to the actual device firmware logic, no new runtime feature, and no fix for a security bug. It is a test-infrastructure improvement.

This commit simply updates a version number in a JSON file from v9.26.5 to v9.27.0. There are no code changes, no security fixes, and no functional changes visible in the diff.

This commit is a build-system and test-infrastructure fix. It changes Rust conditional-compilation flags so that unit tests can compile and run on a normal computer (host target) instead of only on the embedded device. It also limits the custom panic handler to bare-metal ARM builds and exposes some test-only helper functions under the test configuration. There is no change to runtime security behavior for end users.

This commit improves the user warning shown when a Bitcoin transaction has an unusually high fee. Previously, the device calculated the fee as a percentage of the amount being sent. For transactions that send nothing to an outside recipient (for example, sending everything back to yourself or only carrying an OP_RETURN memo), the denominator was zero, so no percentage warning could be shown and the user might not be alerted if the fee consumed most of the funds. The patch now falls back to comparing the fee against the total value of all transaction inputs, and tells the user whether the warning is based on the send amount or on all inputs. It is a defensive hardening change, not a fix for an active exploit.