BitBox02 firmware

This commit fixes a test-only setup problem. The unit tests for on-screen UI components were not initializing the graphics library (ugui) before running. Because label sizing now depends on ugui being set up, the tests could fail or hit debug assertions. The change adds a minimal fake graphics setup so the tests run correctly. It does not change the firmware that runs on the actual device.

This commit is a simple code cleanup in the BitBox02 hardware wallet's user interface. It removes a duplicate, upside-down version of a small 'rotate' icon and instead flips the existing icon when needed. There is no security change.

This commit changes a small graphics library inside the BitBox02 hardware wallet so that it uses debug-only safety checks instead of always-on null checks. In normal release builds, the old null checks and the new ASSERT calls both effectively do nothing, so user-facing behavior is unchanged. The main risk is that a developer running a DEBUG build could now trigger a crash if a bug passes a NULL pointer, whereas before the function would silently return. There is no direct evidence this fixes an exploitable security vulnerability.

This commit removes an unused function for drawing transparent characters on the BitBox02 hardware wallet screen. It is a straightforward code cleanup with no security relevance visible in the change.

This commit is a user-interface cleanup: it removes a special 'draw text upside-down' flag from the graphics library and instead uses a generic 180-degree rotation helper when the screen is flipped. It does not fix a security vulnerability and does not appear to introduce one. The change is mostly about simplifying how text and buttons are rendered on the BitBox02 hardware wallet screen.

This commit changes the build system to enable Link-Time Optimization (LTO), a compiler technique that shrinks the final firmware size. It also adds safeguards to keep the stack protector security feature working under LTO and deliberately excludes sensitive low-level code (bootloader, factory setup, hardware drivers) from LTO to avoid subtle bugs. There is no direct evidence in the commit of a security vulnerability being fixed or introduced.

This commit adds a new factory-setup helper program for the BitBox03 hardware wallet and moves some debug logging code around. It does not change the main wallet firmware's security behavior. There is no indication this fixes or introduces a security vulnerability.

This commit adds a brand-new, minimal firmware binary for the BitBox03 hardware wallet. It is essentially a development stub: it initializes the board, sets up a debug logger, prints a log message, and then halts. There is no user-facing functionality, no cryptographic code, and no security-sensitive logic introduced in this change. It is a build-system and scaffolding addition, not a security fix or vulnerability.

This commit adds a new first-stage bootloader component called bitbox03-boot1 for the BitBox03 hardware wallet. It is purely additive: it wires a new Rust binary into the build system, adds a flashing script, and provides a small program that validates a firmware image header and then jumps to the main firmware. Nothing in the commit changes existing security behavior or fixes a known vulnerability.

This commit adds a new first-stage bootloader component called bitbox03-boot0 for an upcoming BitBox03 hardware wallet. It is purely additive development code: it introduces build targets, a linker script, flashing scripts, and a small Rust program that validates and then launches the next-stage bootloader (boot1). There is no indication of a bug fix or security patch, and no disclosed vulnerability.

This commit simply deletes an unused third-party Rust crate (cmake) from the project's vendored dependencies. It is a cleanup change with no functional code modifications and no apparent security relevance.

This commit changes how a graphics library (LVGL) is compiled into the BitBox02 firmware build. It removes the CMake-based build and instead compiles the library's C source files directly using Rust's cc crate. It also merges a separate simulator-specific configuration file into a shared one. The visible configuration changes are: color depth increased from 16 to 32 bits, refresh period shortened from 33 ms to 17 ms, and log level changed from warnings to informational messages. These are build-system and configuration cleanups; there is no direct evidence in the commit of a security vulnerability being fixed.

This commit is a routine developer tooling change. It moves the installation of Rust compiler components (such as code formatting, linting, and target platform support) out of the Docker build script and into a standard Rust toolchain configuration file. There is no indication this change fixes or introduces a security issue.

This commit is a build-script maintenance change. It changes how a Rust dependency-vendoring script is invoked so that the correct Rust compiler version is automatically selected. There is no user-facing feature change and no indication of a security problem being fixed.

This commit is a small optimization in the BitBox02 hardware wallet firmware. It changes how many times the device derives a cryptocurrency address when validating a payment request. Previously, addresses were derived twice (a safety check called 'compute twice'); now they are derived once during payment-request validation, while other operations still derive them twice. This is a performance/counter fix, not a security vulnerability fix. There is no evidence in the commit that it addresses an exploitable bug.

This commit only adds test assertions to check that a secure chip event counter is incremented correctly during payment request validation. It does not change any production code, so it cannot introduce a security vulnerability or fix one directly.

This commit is a straightforward internal code cleanup. It merges two similar functions for computing extended public keys (xpubs) into one function that accepts a mode flag, and moves the mode definition to a more central location. There is no change to security behavior: operations that previously computed xpubs twice still do so, and operations that computed them once still do so. It is a refactoring, not a security fix.

This update fixes a crash in the BitBox02 hardware wallet when a user lists many backups over a Bluetooth connection. Previously, the device could run out of temporary buffer space while sending a large response, causing it to panic and stop working. The fix makes the Bluetooth sender check whether the whole next chunk fits before writing it, and if not, wait until space becomes available. USB connections were not affected because they use a different path.

This commit only updates developer documentation (AGENTS.md). It adds a warning that running multiple make commands in parallel can lock up a development machine, and instructs developers to run them one at a time. There is no code change and no security relevance.

This patch fixes a timing bug in how the BitBox02 hardware wallet talks to its secure chip (Optiga). Previously, the code could overwrite memory buffers that were still being used by an unfinished, dropped secure-chip operation. That could corrupt data or cause the device to behave unpredictably when secure-chip commands were started and then abandoned. The fix simply makes sure the code checks for and reclaims any leftover detached operation before touching the shared buffers.

This commit simply removes a printed warning message during the build process. When a certain environment variable (LV_CONF_PATH) is missing, the build script used to warn the developer; now it silently uses a default configuration file instead. There is no change to security logic, runtime behavior, or how the firmware works.

This change adds a Rust code-quality warning (Clippy lint) that flags async functions whose internal state machines get too large. It is a preventive development tool, not a fix for an existing security bug. The commit does not change any runtime firmware behavior or patch a known vulnerability.

This commit strips out Rust's automatic 'Debug' text-formatting code from the hardware wallet firmware to save space. It replaces a few user-facing error messages that previously relied on Debug formatting with small, hand-written formatters so users still see useful text. The change is primarily a size optimization and code-hardening step, not a fix for an active security bug.

This commit flips a build-time option in the blake2 Rust library from 'fast and large' to 'smaller and less inlined.' It is a pure code-size optimization that does not change the hashing algorithm, inputs, outputs, or how the firmware calls it. There is no security-relevant change visible in the diff.

This commit changes a build-time configuration option for the mbedTLS cryptography library. It disables AES lookup tables stored in read-only flash memory (ROM) and instead uses tables computed at runtime in regular working memory (RAM). The stated purpose is to reduce the overall firmware size by 2,104 bytes. This is a size-optimization change, not a security fix.