CommitWatch RSS
BC
← All projectsBitcoin Core

Hardware Wallet Interface

Python library and command-line interface for Bitcoin hardware-wallet communication.

BitcoinHardware integrationSoftware walletsNormal
Source repository ↗
Repository coverage

79 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

29security candidates8second-pass queue56AI analyses
2commits · 30 days
58commits · 60 days
73commits · 180 days
78commits · 365 days
Backfill bands
Aug 5 → Feb 63 seen1 candidatesComplete
Feb 6 → Jun 63 seen0 candidatesComplete
Jun 6 → Jul 61 seen0 candidatesComplete
Jul 6 → Aug 522 seen1 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
23Strong · 80–100
28Adequate · 60–79
22Thin · 40–59
6Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Sjors Provoost552238066
Ava Chow20714069
Salvatore Ingala202057
andreasgriffin101018
Rohit Yadav101050
Analysis record

Published AI watches

Last scanned 16 minutes ago

Low 29 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#792: Optionally pass BIP388 policy to signtx

This commit adds an optional feature to the HWI tool that lets users pass previously registered Bitcoin wallet policies (BIP388) when signing transactions. It is a feature addition, not a fix for a known vulnerability. The change extends t…

New CLI argument `--registration` is appended to `signtx` and deserialized before being passed to hardware wallet clientsSeveral backends now accept and use `registered_descriptors` during PSBT signingBackends without BIP388 support raise `UnavailableActionError` when registrations are supplied
e63a0af2by Ava Chow+572−19119 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 81 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#853: psbt: enable type checking

This is a code-quality and type-safety patch. It adds the psbt.py file to the project's automated type-checking workflow and fixes two small logic issues where a value was assigned to an object field before being validated. The changes mak…

Validation moved before state mutation (defensive coding)Type annotations added to public methodsFile added to CI type-check coverage
390d9f84by Ava Chow+9−62 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 35 · Opaque
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: enable type checking

This commit turns on automated type checking for one more source file (hwilib/psbt.py) and makes small code changes so the file passes the type checker. The actual code changes move two integer assignments slightly later so validation happ…

Type checking enabled for PSBT moduleValidation ordering tightened for locktime fieldsExplicit type annotations added to PSBT methods
37643bd8by Sjors Provoost+9−62 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: extract PSBT helpers

This commit is a simple code cleanup in the test suite. It pulls out two small blocks of test code into reusable helper functions for signing and finalizing PSBTs, and for setting global xpubs in PSBTs. There is no change to production cod…

adc8ccb3by Sjors Provoost+25−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

coldcard: extract transaction signing helpers

This commit simply reorganizes the Coldcard hardware wallet signing code in HWI by moving existing logic into two new helper methods. There is no change to what the code actually does; it is a pure refactoring (code cleanup) with no securi…

826a2ac5by Sjors Provoost+76−641 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: detect keys and signatures by fingerprint

This commit adds two helper methods to the PSBT (Partially Signed Bitcoin Transaction) handling code that let the library check whether a specific hardware wallet's fingerprint appears in a transaction input, and whether that fingerprint h…

Adds fingerprint-based key/signature detection in PSBT input parsingIncludes unit tests covering legacy BIP32, Taproot key path, and Taproot script path casesNo caller or usage of new methods shown in the diff
3cc34937by Sjors Provoost+74−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

ledger: support BIP388 policy signing

This commit updates the Ledger hardware wallet support in HWI so that newer Ledger devices can sign Bitcoin transactions using registered BIP388 wallet policies. Previously, any attempt to use registered descriptors with a Ledger was block…

Change removes an explicit error path for registered descriptors, increasing supported functionalityAdds reconstruction of registered wallet policies and propagation of registration HMACs during PSBT signingTouches hardware-wallet signing path where incorrect policy handling could lead to signing unintended transactions
ac80a37bby Sjors Provoost+21−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#849: coldcard: bump firmware, add edge, display taproot address, restore test_signtx (ex. multisig)

This is a routine feature-and-testing update for the Coldcard hardware wallet support in Bitcoin Core's HWI tool. It adds support for Coldcard's 'Edge' experimental firmware, lets users display single-signature Taproot addresses on Edge, a…

PSBT version downgrade logic moved from per-pass to once-per-signing; intended to preserve v2 when supported and downgrade when notNew firmware version parsing heuristic treats Q/X suffixes and Edge/simulator as PSBTv2 capableTaproot singlesig address display enabled only for Coldcard Edge firmware
8593a755by Ava Chow+220−8819 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#842: Add `registerdescriptors` command for registering a descriptor with a device

This commit adds a new command called `registerdescriptor` to the HWI tool, which lets users register Bitcoin output descriptors with supported hardware wallets (Ledger, BitBox02, Jade, Coldcard). It also rewrites how descriptors are parse…

New command registers user-supplied descriptors with hardware walletsHWI explicitly does not validate descriptors before passing them to the device; device errors are propagatedDescriptor parser changed from string-based derivation paths to structured list-of-lists, affecting all descriptor handling
d928dae5by Ava Chow+709−12320 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#839: psbt: misc fixes and add remaining BIP 174 and BIP 370 test vectors

This commit tightens how the Bitcoin hardware wallet interface library reads PSBT files. It now rejects PSBTv0 files that contain fields only allowed in the newer PSBTv2 format, enforces sensible locktime ranges, and fixes several bugs whe…

Strict PSBT version field validationNew locktime bound enforcementWitness-stripped unsigned tx parsing
695c731bby Ava Chow+122−134 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

bitbox02: support BIP388 policy signing

This commit adds support for signing Bitcoin transactions with registered wallet policies (BIP388) on the BitBox02 hardware wallet. Previously this feature was rejected with an error. The change translates a registered wallet descriptor in…

Removal of an explicit unsupported-action error for BIP388 policy signingNew xpub and fingerprint comparison logic to identify the device's key in a policyNew policy script config construction passed to hardware signing routines
a76f3447by Sjors Provoost+32−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 60 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

jade: support BIP388 policy signing

This change removes an error that previously blocked Bitcoin signing for a specific type of wallet policy (BIP388) on the Blockstream Jade hardware wallet. The device now supports these policies, so the software no longer needs to reject t…

Removal of an explicit unsupported-action errorNo new cryptographic operations introducedNo input validation changes observed
db189db5by Sjors Provoost+1−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

coldcard: support BIP388 policy signing

This commit adds support for signing Bitcoin transactions with named wallet policies (BIP388) on newer Coldcard hardware wallets. It is a feature addition, not a fix for a known security flaw. The change removes an error that previously bl…

Feature addition for BIP388 policy signingRemoval of UnavailableActionError guard for registered_descriptorsNew miniscript_name parameter length-bounded to 1-32 ASCII bytes
7e278f48by Sjors Provoost+54−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

signtx: add BIP388 policy support

This commit adds a new command-line option and API parameter for BIP388 registered descriptor policies to the transaction-signing flow. It does not implement actual signing support in any hardware wallet driver; every device implementation…

New API surface added for BIP388 policy registrationAll device implementations explicitly reject BIP388 policy signing with UnavailableActionErrorNo existing signing path is modified; default behavior unchanged
6f44e489by Sjors Provoost+85−1110 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#819: Drop Python 3.9, use 3.10 for dist, bump Ledger

This is a routine maintenance merge for the Bitcoin Core Hardware Wallet Interface (HWI). It drops support for the end-of-life Python 3.9, switches deterministic builds and CI to Python 3.10, updates Ledger test firmware/simulator versions…

Dependency/toolchain version bump (Python 3.9 EOL removal, Python 3.10 adoption)Ledger firmware/app and Speculos simulator version bump in CI/testsTest automation rules updated for new Ledger UI prompts
2daa5916by Ava Chow+124−15629 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Drop Ledger deny rule from tests

This commit removes an unused test automation rule that automatically pressed a button when a Ledger hardware wallet simulator showed 'Cancel' or 'Reject' on screen. It only affects test data, not the actual wallet interface code users rel…

0379e278by Sjors Provoost+0−71 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: reenable LedgerX tests

This commit only re-enables automated tests for Ledger Nano X hardware wallets. It removes code that was skipping certain tests, but makes no changes to the actual wallet-interaction code that users rely on. There is no security fix or vul…

d2a5874aby Sjors Provoost+0−201 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Skip archiving hwi-qt on non-x86 platforms

This change adjusts the build script so that the graphical hwi-qt program is only bundled into release archives for 64-bit x86 (Intel/AMD) systems. On other CPU architectures, only the command-line hwi tool is packaged. This is a build/pac…

1b0cbea5by Sjors Provoost+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: increase stdin command timeout

This commit only changes a test timeout from 60 seconds to 120 seconds so that automated tests can complete when a Ledger hardware wallet running newer firmware takes longer to sign a large test transaction. It does not change any producti…

cd8a4317by Sjors Provoost+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Bump Speculos and Ledger Bitcoin app

This commit updates the versions of testing tools and Ledger Bitcoin app used in HWI's automated test environment. It does not change the actual HWI wallet-interaction code that users run. The changes are purely to keep CI/test simulations…

976353edby Sjors Provoost+28−95 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidateMerge bitcoin-core/HWI#792: Optionally pass BIP388 policy to signtxby Ava Chow · e63a0af2 · Aug 25, 2026 · 19 filesMessage 91 · StrongLow 29Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#792: Optionally pass BIP388 policy to signtx

97c13f1e99384816518a48095e59a8a1f9468d7a test: navigate Ledger transaction review screens (Sjors Provoost)
4ca5396e7f794fe5bef3e2c65257ceb23dc3df32 test: dismiss Ledger completion screens (Sjors Provoost)
e0b2b836236e7978bcdeb7aa2097ec44791fae5b test: sign with multiple registered descriptors (Sjors Provoost)
5642ebdda3d0d836039c6bca8bd4631774e46993 test: sign with registered descriptors (Sjors Provoost)
adc8ccb3a9644f5b179ee40aafbd273a87fa9142 test: extract PSBT helpers (Sjors Provoost)
a76f344799d659442e5d2ce3ce92f210a0d85408 bitbox02: support BIP388 policy signing (Sjors Provoost)
db189db5271a0fcaee93e36307ff73290efa3ecb jade: support BIP388 policy signing (Sjors Provoost)
7e278f48f82c3276da318cdf16d753b7304e6de9 coldcard: support BIP388 policy signing (Sjors Provoost)
826a2ac5d8d4f9b2b7adb3b98e8a70a393244b59 coldcard: extract transaction signing helpers (Sjors Provoost)
3cc349378aff80936943ddff087b3502eb207346 psbt: detect keys and signatures by fingerprint (Sjors Provoost)
ac80a37b80a0a8160aa1cfe32362abc2b2b39ebd ledger: support BIP388 policy signing (Sjors Provoost)
b8cecf0e4345b73436fc5fcd85331d9f0a0523c8 descriptor: remove unused script expansion (Sjors Provoost)
db15214dd9227f6dbea80ab5a3deb483392445e7 descriptor: add address type helper (Sjors Provoost)
6f44e48980bf610a57195f43a74027f4dc20e385 signtx: add BIP388 policy support (Sjors Provoost)
dc1f9b42cf9ac251ae980b579b20c6f2d2e934d6 Consistently name sign_tx psbt argument (Sjors Provoost)

Pull request description:

Another step toward #785.

This adds optional registered BIP388 descriptor policy information to
`signtx`. Existing `signtx` usage remains unchanged when no registration
is supplied.

`signtx` accepts `--registration`, containing the serialized
`RegisteredDescriptor` returned by the `registerdescriptor` command from
#842. The registration contains the policy name, descriptor, device type,
and any device-specific registration data, so separate `--policy-desc`
and `--policy-name` arguments are not needed.

Example:

```bash
hwi --device-type ledger signtx \
--registration "cmRlc2M..." \
"cHNidP..."

ACKs for top commit:
achow101:
ACK 97c13f1e99384816518a48095e59a8a1f9468d7a

Tree-SHA512: dd1fc192f06016ade895e4f87d35a7f1b22a01a8e562e3a3d2a4ddcf1da6dd36dd2ad80ac414b339affeab99389c8dee0750e63ac93f38f0fe1ffcb1f4c5ffdd

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarysigning or wallet pathparser or protocol pathmerge-commit duplicate discount
AI analysis · Low 29/100

This commit adds an optional feature to the HWI tool that lets users pass previously registered Bitcoin wallet policies (BIP388) when signing transactions. It is a feature addition, not a fix for a known vulnerability. The change extends the command-line interface and several hardware wallet backends to accept an optional `--registration` argument during signing. Existing behavior is preserved when the argument is not provided. There is no direct evidence in the commit that this introduces a security bug, but any code that handles cryptographic signing and parses external data deserves careful review.

Security candidateMerge bitcoin-core/HWI#853: psbt: enable type checkingby Ava Chow · 390d9f84 · Aug 25, 2026 · 2 filesMessage 81 · StrongInformational 18Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#853: psbt: enable type checking

37643bd8e4f86324b75723525149eb945275395c psbt: enable type checking (Sjors Provoost)

Pull request description:

ACKs for top commit:
achow101:
ACK 37643bd8e4f86324b75723525149eb945275395c

Tree-SHA512: aa1722f2e3f65c387a3bb5d6631cb666c6aa83f8ccc3b46c6a8f4585eb6ba02462dd78ec8027fc278fca1b2b0fc7d1bb9f6729781c2cb9b82321017919a6aeba

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarysigning or wallet pathmerge-commit duplicate discount
AI analysis · Informational 18/100

This is a code-quality and type-safety patch. It adds the psbt.py file to the project's automated type-checking workflow and fixes two small logic issues where a value was assigned to an object field before being validated. The changes make the code safer and cleaner, but they do not appear to fix an active security vulnerability that could be exploited.

Lower-prioritytest: navigate Ledger transaction review screensby Sjors Provoost · 97c13f1e · Aug 24, 2026 · 1 fileMessage 82 · StrongTriage 0Details
Commit message · Sjors Provoost

test: navigate Ledger transaction review screens

Handle the paginated To heading and From section shown while reviewing registered-descriptor transactions.

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Lower-prioritytest: dismiss Ledger completion screensby Sjors Provoost · 4ca5396e · Aug 24, 2026 · 1 fileMessage 67 · AdequateTriage 0Details
Commit message · Sjors Provoost

test: dismiss Ledger completion screens

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Security candidatepsbt: enable type checkingby Sjors Provoost · 37643bd8 · Aug 24, 2026 · 2 filesMessage 35 · OpaqueInformational 18Details
Commit message · Sjors Provoost

psbt: enable type checking

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 18/100

This commit turns on automated type checking for one more source file (hwilib/psbt.py) and makes small code changes so the file passes the type checker. The actual code changes move two integer assignments slightly later so validation happens before storing the value, and add explicit type annotations to two methods. There is no direct evidence this fixes a security vulnerability; it is primarily a code-quality and type-safety improvement.

Lower-prioritydescriptor: remove unused script expansionby Sjors Provoost · b8cecf0e · Aug 24, 2026 · 2 filesMessage 70 · AdequateTriage 0Details
Commit message · Sjors Provoost

descriptor: remove unused script expansion

Script expansion was unused outside tests and does not handle
multipath descriptors.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Lower-prioritydescriptor: add address type helperby Sjors Provoost · db15214d · Aug 24, 2026 · 2 filesMessage 60 · AdequateTriage 0Details
Commit message · Sjors Provoost

descriptor: add address type helper

Expose the address type directly from a descriptor. Bare descriptors
return no address type.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-priorityMerge bitcoin-core/HWI#841: Optionally pass BIP388 policy to displayaddressby Ava Chow · 4ae6006f · Aug 21, 2026 · 12 filesMessage 91 · StrongTriage 0Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#841: Optionally pass BIP388 policy to displayaddress

458a92009f5f7244863f0e3def070f9212d8b479 test: make Ledger approval automation atomic (Sjors Provoost)
1a6fb497cb29f0c53b1b6176c5fd755a17e7d0e5 test: disambiguate Ledger fee automation (Sjors Provoost)
fc113c74d8160c07dc25c4b7f0ac8b3de2f326e4 test: display registered descriptor address (Sjors Provoost)
dcb524532dda60b38dc39db7c7a0f7bc2f2fff5e bitbox02: support BIP388 policy address display (Sjors Provoost)
26cbbe45913bef8f5e5f64aead693ecab4a213a0 jade: support BIP388 policy address display (Sjors Provoost)
86a86c6f26b1fcb8be44b151cead3e3ba661a40f test: fix Coldcard simulator multisig path iteration (Sjors Provoost)
169fdd0004b6090682c7cc7c730259d15e980df2 coldcard: support registered policy address display (Sjors Provoost)
23fb64e7f28e45aa0abb14cd56ba5f8db4c61881 coldcard: enroll Edge policies with Miniscript (Sjors Provoost)
ac8391fac183eee6dc0e4895404b3be2eab4475a ledger: support BIP388 policy address display (Sjors Provoost)
d8b0d995e6ac23d39372b893266f2b59adc7354b displayaddress: add BIP388 policy support (Sjors Provoost)
62d3ea144be1abe00ef6b009b85561c88a3df641 descriptor: add ranged descriptor derivation (Sjors Provoost)

Pull request description:

Support addresses display for registered BIP388 descriptor policies.

`displayaddress` accepts:
- the `RegisteredDescriptor` registration returned by `registerdescriptor` (introduced by #842)
- an address index
- receive/change selection (multipath index)

A generic device test registers the simple multisig policy introduced by
#842 and then displays address index 7. Device support is added one
device per commit.

ACKs for top commit:
achow101:
ACK 458a92009f5f7244863f0e3def070f9212d8b479

Tree-SHA512: c62166d72bb248f09ba6c6d44a1ef7de6becbc2f7a25b80a18ba56d8debccb78aeabc42e2fc0435085ad27e4340b3a71f672567a7650d178f2593c586dacd17e

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Lower-prioritytest: sign with multiple registered descriptorsby Sjors Provoost · e0b2b836 · Aug 21, 2026 · 3 filesMessage 82 · StrongTriage 0Details
Commit message · Sjors Provoost

test: sign with multiple registered descriptors

Create a transaction with two registered policies and an inferred
single-sig policy, and sign it in one call.

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Security candidatetest: extract PSBT helpersby Sjors Provoost · adc8ccb3 · Aug 21, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · Sjors Provoost

test: extract PSBT helpers

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit is a simple code cleanup in the test suite. It pulls out two small blocks of test code into reusable helper functions for signing and finalizing PSBTs, and for setting global xpubs in PSBTs. There is no change to production code, no security fix, and no behavior change.

Security candidatecoldcard: extract transaction signing helpersby Sjors Provoost · 826a2ac5 · Aug 21, 2026 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Sjors Provoost

coldcard: extract transaction signing helpers

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit simply reorganizes the Coldcard hardware wallet signing code in HWI by moving existing logic into two new helper methods. There is no change to what the code actually does; it is a pure refactoring (code cleanup) with no security-relevant behavior change visible in the diff.

Security candidatepsbt: detect keys and signatures by fingerprintby Sjors Provoost · 3cc34937 · Aug 21, 2026 · 2 filesMessage 45 · ThinInformational 24Details
Commit message · Sjors Provoost

psbt: detect keys and signatures by fingerprint

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 24/100

This commit adds two helper methods to the PSBT (Partially Signed Bitcoin Transaction) handling code that let the library check whether a specific hardware wallet's fingerprint appears in a transaction input, and whether that fingerprint has already provided a signature. The change is purely additive and includes tests. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a defensive or feature-oriented improvement to support better transaction signing workflows.

Lower-prioritytest: fix Coldcard simulator multisig path iterationby Sjors Provoost · 86a86c6f · Aug 21, 2026 · 1 fileMessage 72 · AdequateTriage 0Details
Commit message · Sjors Provoost

test: fix Coldcard simulator multisig path iteration

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Lower-prioritycoldcard: support registered policy address displayby Sjors Provoost · 169fdd00 · Aug 21, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Sjors Provoost

coldcard: support registered policy address display

Derive the selected wsh(sortedmulti()) policy address and display it
through the existing multisig command.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritycoldcard: enroll Edge policies with Miniscriptby Sjors Provoost · 23fb64e7 · Aug 21, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Sjors Provoost

coldcard: enroll Edge policies with Miniscript

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-prioritytest: make Ledger approval automation atomicby Sjors Provoost · 458a9200 · Aug 21, 2026 · 1 fileMessage 90 · StrongTriage 0Details
Commit message · Sjors Provoost

test: make Ledger approval automation atomic

The automation models a simultaneous left-and-right press as four
separate events. If the app redraws between events, Speculos can
apply the remaining input on a different screen. In the observed
failure this advanced to "Reject transaction" and confirmed it.

Use button mask 3 for one combined press and release for all
two-button approvals, keeping them atomic across redraws.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Security candidateledger: support BIP388 policy signingby Sjors Provoost · ac80a37b · Aug 21, 2026 · 1 fileMessage 68 · AdequateLow 31Details
Commit message · Sjors Provoost

ledger: support BIP388 policy signing

Reconstruct each registered wallet policy and pass its registration HMAC
when signing the PSBT. Inferred policies continue to be signed alongside
registered policies.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Low 31/100

This commit updates the Ledger hardware wallet support in HWI so that newer Ledger devices can sign Bitcoin transactions using registered BIP388 wallet policies. Previously, any attempt to use registered descriptors with a Ledger was blocked with an error. The change removes that blanket block for modern Ledger apps and adds logic to reconstruct each registered wallet policy and include its registration proof when signing. Inferred policies still work as before. This is a feature addition, not a fix for an active vulnerability, but it touches security-sensitive signing code.

Security candidateMerge bitcoin-core/HWI#849: coldcard: bump firmware, add edge, display taproot address, restore test_signtx (ex. multisig)by Ava Chow · 8593a755 · Aug 20, 2026 · 19 filesMessage 91 · StrongLow 25Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#849: coldcard: bump firmware, add edge, display taproot address, restore test_signtx (ex. multisig)

aa3e73359c9d49140015f1e55ec61241ed39e313 ci: add finite APT connection timeouts/retries (Sjors Provoost)
90b7b0a6d498641704acefc920bbe1a772bdf799 ci: bump GitHub Actions versions (Sjors Provoost)
f8bd2942aae917f17c453308888bfe96aa7996e7 coldcard: preserve PSBTv2 when supported (Sjors Provoost)
e5aa9ccba5c93ad567a29f6e64b466dba202e8e5 coldcard: display singlesig taproot address on EDGE (Sjors Provoost)
534468cf1f79523d736dae1718116cb5933a8cdf ci: run Coldcard Edge simulator tests (Sjors Provoost)
454e36e3b32816c4bd0ad6269b03a2e3947d16f3 ci: parameterize device test matrix (Sjors Provoost)
2cda52a024e304be4b6db88c7d8bf946ffcd09c8 test: support Coldcard Edge in device tests (Sjors Provoost)
8dc9a6f796f58728a05c24b5c6218af700d386aa ci: build Coldcard Edge simulator (Sjors Provoost)
57b062ee12a5bdf3773a509a203d58aa95c287ae test: factor out Coldcard firmware setup (Sjors Provoost)
9b420ea7240bc11a720bdea0b2a20a842cea5899 test: limit Coldcard simulator checkout (Sjors Provoost)
893818a3f6421a2125260f0c81c68702b79e9ae0 test: bump Coldcard firmware to 5.6.0 (Sjors Provoost)
257e1ae1c8fb7aa099ce9a98e52a4c6606832398 test: reenable Coldcard singlesig transaction signing (Sjors Provoost)

Pull request description:

The Edge firmware supports displaying taproot single sig addresses, and more importantly MuSig2.

Rather than blowing up the CI matrix, this PR only adds it for Python 3.14. It can be easily be dropped again if all Edge features we care about land in their regular firmware.

The first commit re-enables `test_signtx`, which was already possible. It achieves this by dropping multisig for ColdCard in that these. This can be re-introduced by #792.

The multisig patch is adjusted or Edge. Alternatively after #847 it could be dropped entirely. It builds, but CI won't cover it until #792. I did test it locally.

- fixes #799
- fixes #703
- superseedes #833
- superseedes #725

ACKs for top commit:
achow101:
ACK aa3e73359c9d49140015f1e55ec61241ed39e313

Tree-SHA512: e67745bdea35c9d6d6515d83daecbb2f750bf925f403e03b102e4996b9a56194b4b7a4316d44565ab2a1768a2bb6b0a19068e7bfe2cedca829c6d39006329c66

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarymerge-commit duplicate discount
AI analysis · Low 25/100

This is a routine feature-and-testing update for the Coldcard hardware wallet support in Bitcoin Core's HWI tool. It adds support for Coldcard's 'Edge' experimental firmware, lets users display single-signature Taproot addresses on Edge, and re-enables transaction-signing tests by dropping multisig cases for Coldcard. It also changes how PSBT version 2 is handled: newer Coldcard firmware keeps PSBTv2, while older firmware is downgraded to PSBTv0 before signing. There is no obvious security bug in the diff, but the PSBT version handling and new firmware support are worth a careful look because mistakes there could affect transaction validity or compatibility.

Lower-priorityMerge bitcoin-core/HWI#846: errors: fix UNKNWON_DEVICE_TYPE misspelling, keep it as a compat aliasby Ava Chow · bbbc8a65 · Aug 20, 2026 · 1 fileMessage 81 · StrongTriage 0Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#846: errors: fix UNKNWON_DEVICE_TYPE misspelling, keep it as a compat alias

6e8cecafadd78d3f78ef1eaad353725b0c21348f errors: fix UNKNWON_DEVICE_TYPE misspelling, keep it as a compat alias (Ferdinando Ametrano)

Pull request description:

Fixes #845.

`UNKNWON_DEVICE_TYPE` (error code -4, in `hwilib/errors.py`) is a transposition of "UNKNOWN". This adds the correctly-spelled `UNKNOWN_DEVICE_TYPE` and aliases the old name to it, rather than renaming outright: it's a public, documented module-level name (the module is `automodule`'d), so an external importer of the misspelled name should not break.

`UnknownDeviceError` now raises with the correct spelling. Its docstring's `:data:`DEVICE_TYPE`` cross-reference is also fixed — it pointed at a name that didn't exist under either spelling, so the Sphinx `:data:` role couldn't have resolved it before this either.

Out of scope for this PR: `hwilib/devices/ledger_bitcoin/errors.py` carries the same misspelling in a comment-credited copy of this file ("Original version: https://github.com/bitcoin-core/HWI"), vendored as part of the `ledger_bitcoin` client subpackage. I didn't touch it, since it's a separate vendored copy and not literally this file; flagging it here in case maintainers want it addressed too, either in this PR or separately.

No behavioural change: both names resolve to the same value, `UnknownDeviceError().get_code()` still returns -4.

ACKs for top commit:
achow101:
ACK 6e8cecafadd78d3f78ef1eaad353725b0c21348f

Tree-SHA512: e5964e90b40e103acdb4e1a73586fb411c696d8eb94464a68f77e6259c35a4e5fe74d073a60c3a1c1979ec7c201bf664d353d069ca4ef2d8c67747df1fe8dc66

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Security candidateMerge bitcoin-core/HWI#842: Add `registerdescriptors` command for registering a descriptor with a deviceby Ava Chow · d928dae5 · Aug 18, 2026 · 20 filesMessage 91 · StrongLow 32Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#842: Add `registerdescriptors` command for registering a descriptor with a device

50f5781e70552cca094cba23d0d301f46d364306 test: Add basic test for register_descriptor (Ava Chow)
8fc30319af2fc7f20417be594164f73c596723ad jade: Implement register_descriptor (Ava Chow)
3fc07a6ced1aa1c43d8265ef245c303b5cd385b9 coldcard: Implement register_descriptor (Ava Chow)
9f91e1a61c10ed13782407eac7a0bfb67933d2e2 bitbox02: Implement register_descriptor (Ava Chow)
1d6361bb32332eabcc78862bbcdc0de8e7c504e5 ledger: Implement register_descriptor (Ava Chow)
24ca3c64536b5ff71639b6dab614803edf4c8432 Implement register_descriptors for devices that don't support it (Ava Chow)
da7aa3f32178b1028069d71dfbc45fb070ded063 CLI command and boilerplate for registerdescriptor (Ava Chow)
875d7b6ee4142d9b57c90417ef768b0b80f1b934 descriptor: Add RegisteredDescriptor for holding registration data (Ava Chow)
50a6e78dd6e5dc39bbf964fa52f22f07f9c24ba4 descriptor: Add functions for making BIP 388 wallet policies (Ava Chow)
3cfc210e6fb2f28b37eaad527d96f1932f9da9ab descriptor: Parse multipath path specifiers (Ava Chow)
e2bd86e88c736e51dc36b6ad7c1de2baae37e78e descriptors: Actually parse the derivation path (Ava Chow)
1f5d85a4f3b520983cf1d646b2481bf82d3a80cf descriptor: Track key expression index (Ava Chow)
447991ffcbdeb05762ae81a2e20d204ec0d0c72d descriptor: Don't sort PubkeyProviders in sortedmulti (Ava Chow)

Pull request description:

The Ledger, BitBox02, Jade, and Coldcard all support registering descriptors with the device to enable signing txs involving complex scripts. This PR adds a `registerdescriptor` command which takes a name and the descriptor to register. The command returns a `registration` which may contain data that must be provided to the device at a later time to remind it of the registered descriptor.

For the BiBox02, Jade, and Coldcard, this command returns an empty string for the registration as these devices store the registration and do not need a reminder.

For the Ledger, the `registration` is the HMAC that the device returns.

Some devices take a descriptor, others take a BIP 388 policy that is stuffed into their protocol. The `Descriptor` and `PubkeyProvider` classes are modified to allow produce BIP 388 compatible strings that can be provided as needed.

Each device does different validation of the descriptor it is provided. We will not do any validation - the user may provide a descriptor that a device refuses to register and any such registration errors will be propagated from the device.

The test case includes a descriptor that should work on all devices.

ACKs for top commit:
Sjors:
re-ACK 50f5781e70552cca094cba23d0d301f46d364306

Tree-SHA512: d4b15c7a94f4045d66c9604e1eaa9a2f94514322a0014ec32b60d8beddb7b2269d639cfddc6c1db28304d384b9f06e66e6e8dd6a3a546810b673e3f37c8bcf4a

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarymerge-commit duplicate discount
AI analysis · Low 32/100

This commit adds a new command called `registerdescriptor` to the HWI tool, which lets users register Bitcoin output descriptors with supported hardware wallets (Ledger, BitBox02, Jade, Coldcard). It also rewrites how descriptors are parsed and stored internally to support newer multi-path descriptor formats and to convert descriptors into BIP 388 wallet policies where needed. The change is a feature addition, not a bug fix, and the commit message and code do not describe any security vulnerability. The main security-relevant aspect is that the tool now passes user-supplied descriptors directly to the device without extra validation, relying on each device's own checks.

Lower-prioritytest: disambiguate Ledger fee automationby Sjors Provoost · 1a6fb497 · Aug 17, 2026 · 1 fileMessage 90 · StrongTriage 0Details
Commit message · Sjors Provoost

test: disambiguate Ledger fee automation

The new app renders the "Fees" title at y=3, while the legacy app
renders it at y=7. Match both positions explicitly so an address line
such as "Fee3bWhy6jMv2rzbRs" does not trigger the fee-screen action.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityMerge bitcoin-core/HWI#843: Bump dependencies and modernize pyproject.tomlby Ava Chow · d4687a25 · Aug 12, 2026 · 16 filesMessage 81 · StrongTriage 0Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#843: Bump dependencies and modernize pyproject.toml

d26304f0640e85413f68fa3ff4407e9a12bb0ad2 ci: Add Python 3.13 and 3.14 jobs (Ava Chow)
01da910f54df5d0da6e1027d98bf6ce6f6da1b51 ci, ledger: Bump speculos to ed952a54801f59a71399462b5422976d84c817bb (Ava Chow)
95c580090f3e7cce3dfdc52968f40b5f263b59e8 ci: Remove unused scripts and containers (Ava Chow)
7625779b09078a48221833363762114bd24169dd Remove legacy setup.py (Ava Chow)
1226f4cb61a4ec7ce5ebcc98dea58e98aeba6cf1 pyproject: Modernize to modern pyproject.toml (Ava Chow)
4b019344d5750b6a6422cf2aaf25f4afc4c85961 deps: Convert caret and tilde requirements to inequality requirements (Ava Chow)
ec8a4a521a6723fde5a3e5b397011d77bd5a7faf deps: Update pinned deps in poetry.lock to latest (Ava Chow)
07d6dff0df379e440f90c13e1efbe532efeb7ba6 deps: Bump cbor2 to at 5.9.0 (Ava Chow)
b43207f181af5f0b65489565db9dc02609b0b9f0 pyproject: Bump maximal python version to 3.16 (Ava Chow)

Pull request description:

Updates:
- Python >=3.10,<3.16
- cbor2 >=5.9.0<6.0.0

All other dependencies should have the same minimum and maximums.

typing-extensions is dropped as we aren't using it anymore.

Ran `poetry update` to update all locked dependencies to latest version.

The pyproject.toml file is also modernized to follow PEP 517. Additionally, given that PEP 517 is in use in our minimum python version, we can safely drop the setup.py.

Depends on #819 for the python bump.

Top commit has no ACKs.

Tree-SHA512: b6f47dc1500aab06c3cd6ee97a004128f72e7565cf4143620838cd454f49c67df09679d436b4767aceebed56ec8ea0cb7f0ee768b2abd81b6c034f3336d49e02

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
merge-commit duplicate discount
Security candidateMerge bitcoin-core/HWI#839: psbt: misc fixes and add remaining BIP 174 and BIP 370 test vectorsby Ava Chow · 695c731b · Aug 10, 2026 · 4 filesMessage 91 · StrongModerate 60Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#839: psbt: misc fixes and add remaining BIP 174 and BIP 370 test vectors

df8c3f5d4b7e6c6b4856af8bde50c6fc9cf7431c test: add remaining BIP 174 and BIP 370 test vectors (Sjors Provoost)
1ff27e0262f1bffe969ebd68038903930955b20e test: add BIP 370 timelock determination vectors (Sjors Provoost)
498e85a7b31237b57eb110620f62e6bef64fb52e psbt: enforce required locktime bounds (Sjors Provoost)
2a431b8819652473893b0e5dba7feb58ad08a5a5 psbt: reject PSBTv2 input and output fields in PSBTv0 (Sjors Provoost)
8a4052300772adefaf034e498375bd0ccfa18708 psbt: track whether an unsigned tx key was seen (Sjors Provoost)
b34f94a6d5648cf9f4dbce73bfe385fc076cd322 psbt: parse the global unsigned tx without witness data (Sjors Provoost)
f0520e7e813a4a93a617456a82ae39f0e52213d4 psbt: assume final sequence when PSBT_IN_SEQUENCE is omitted (Sjors Provoost)
2db24a2a0839218843db65b0deeb858676c2a186 psbt: set locktime on the transaction, not the PSBT (Sjors Provoost)

Pull request description:

Each fix / hardening commit introduces the test vectors that cover it.

Mostly straight-forward, but `psbt: parse the global unsigned tx without witness data` is worth a closer look. IIUC it catches up with https://github.com/bitcoin/bips/pull/1099.

ACKs for top commit:
achow101:
ACK df8c3f5d4b7e6c6b4856af8bde50c6fc9cf7431c

Tree-SHA512: 1fedaca5eeceb9c3c5df8ef87041d0ba97be87b876ebe8eadf4173f19e93d370438edb1e8d98a7363e661228bea6f3f094fc91e13e6975a5dfabce475e285303

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing boundarydefensive validationfuzzing or regression evidencesigning or wallet pathmerge-commit duplicate discount
AI analysis · Moderate 60/100

This commit tightens how the Bitcoin hardware wallet interface library reads PSBT files. It now rejects PSBTv0 files that contain fields only allowed in the newer PSBTv2 format, enforces sensible locktime ranges, and fixes several bugs where the library could build a transaction with the wrong sequence number or locktime. These are defensive correctness fixes rather than a single obvious remote exploit, but they close paths where a malformed or malicious PSBT could confuse a hardware wallet or downstream software.

Security candidatebitbox02: support BIP388 policy signingby Sjors Provoost · a76f3447 · Aug 6, 2026 · 1 fileMessage 68 · AdequateLow 32Details
Commit message · Sjors Provoost

bitbox02: support BIP388 policy signing

Translate the registered descriptor into the policy script
configuration and use it for transaction inputs and change outputs.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Low 32/100

This commit adds support for signing Bitcoin transactions with registered wallet policies (BIP388) on the BitBox02 hardware wallet. Previously this feature was rejected with an error. The change translates a registered wallet descriptor into a format the BitBox02 understands and uses it when signing transaction inputs and change outputs. It is a feature addition rather than a fix for a known vulnerability, but it touches security-critical signing logic.

Security candidatejade: support BIP388 policy signingby Sjors Provoost · db189db5 · Aug 6, 2026 · 1 fileMessage 60 · AdequateInformational 22Details
Commit message · Sjors Provoost

jade: support BIP388 policy signing

Sign with the existing PSBT flow after registerdescriptor has stored the
policy on the device.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing boundary
AI analysis · Informational 22/100

This change removes an error that previously blocked Bitcoin signing for a specific type of wallet policy (BIP388) on the Blockstream Jade hardware wallet. The device now supports these policies, so the software no longer needs to reject them. There is no obvious security bug being fixed; it appears to be a feature-enablement patch.