CommitWatch RSS
BC
← All projectsBitcoin Core

Hardware Wallet Interface

Python library and command-line interface for Bitcoin hardware-wallet communication.

BitcoinHardware integrationSoftware walletsNormal
Source repository ↗
Repository coverage

30 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

8security candidates3second-pass queue5AI analyses
23commits · 30 days
24commits · 60 days
27commits · 180 days
30commits · 365 days
Backfill bands
Aug 5 → Feb 63 seen1 candidatesComplete
Feb 6 → Jun 63 seen0 candidatesComplete
Jun 6 → Jul 61 seen0 candidatesComplete
Jul 6 → Aug 522 seen1 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

63/100 average clarity
7Strong · 80–100
7Adequate · 60–79
14Thin · 40–59
2Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Sjors Provoost2065065
Ava Chow620066
Salvatore Ingala200057
andreasgriffin100018
Rohit Yadav100050
Analysis record

Published AI watches

Last scanned 43 minutes ago

Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: make device signing cases more granular

This commit only changes test code. It makes the automated test suite more flexible by letting device simulators opt out of one specific test case involving unusual key derivation paths, while still running the rest of the tests. There is …

eab5bad3by Sjors Provoost+19−97 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

ledger: have sign_psbt return SignPsbtYieldedObject

This commit is a straightforward internal code refactor for Ledger hardware wallet support. It changes the data structure returned when signing a Bitcoin transaction from a simple tuple of raw bytes to a more descriptive object that can ca…

e86440aeby Sjors Provoost+73−274 files
No security note in commit
Open full analysis →Source commit ↗
Low 40 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

ledger: handle script path signatures

This commit updates the Ledger hardware wallet driver in HWI so it can correctly store Taproot script-path signatures in a PSBT, not just key-path signatures. Previously, the code had a placeholder that always treated any Taproot signature…

Previously unimplemented TODO for script-path signaturesIncorrect PSBT field assignment for Taproot script-path spendsFunctional gap that could produce an invalid or incomplete PSBT
fc206450by Sjors Provoost+5−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 88 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: don't overwrite PSBTv2 tx version and fallback locktime

This commit fixes a bug in how the HWI library handles a newer Bitcoin transaction format called PSBTv2. Previously, when converting or setting up a PSBTv2 object, the code would accidentally overwrite the transaction's version number and …

Signature invalidation through mutation of transaction version/locktimeIncorrect null-check on PSBTv2 placeholder transaction objectPSBTv2 serialization round-trip failure for valid BIP 370 vectors
ca2caf04by Sjors Provoost+31−43 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 43 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: add MuSig2 fields

This commit adds support for new MuSig2 fields in PSBT (Partially Signed Bitcoin Transaction) parsing and serialization. MuSig2 is a multi-signature protocol for Bitcoin. The change is a feature addition that parses and stores new PSBT fie…

New PSBT field parsing with explicit length validationDuplicate-key rejection for new fieldsNo cryptographic verification of MuSig2 nonces/signatures in this diff
351b3e4eby Sjors Provoost+120−32 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedFix race condition in get_free_port by binding to localhostby Rohit Yadav · 38f55ebd · Feb 11, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Rohit Yadav

Fix race condition in get_free_port by binding to localhost

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
Lower-prioritybuild: Bump to 3.2.0by Ava Chow · a4d66f8b · Feb 10, 2026 · 3 filesMessage 50 · ThinTriage 0Details
Commit message · Ava Chow

build: Bump to 3.2.0

50/100 · ThinMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-prioritybuild: Bump to 3.2.0-rc.1by Ava Chow · 7c1229ac · Feb 3, 2026 · 3 filesMessage 57 · ThinTriage 0Details
Commit message · Ava Chow

build: Bump to 3.2.0-rc.1

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Security candidatepsbt: add MuSig2 fieldsby Sjors Provoost · 351b3e4e · Jan 31, 2026 · 2 filesMessage 43 · ThinInformational 21Details
Commit message · Sjors Provoost

psbt: add MuSig2 fields

Co-Authored-By: Salvatore Ingala <6681844+bigspider@users.noreply.github.com>

43/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 21/100

This commit adds support for new MuSig2 fields in PSBT (Partially Signed Bitcoin Transaction) parsing and serialization. MuSig2 is a multi-signature protocol for Bitcoin. The change is a feature addition that parses and stores new PSBT fields, with length and duplicate checks. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a protocol-support update.

Security candidateMerge bitcoin-core/HWI#786: fix usage linkby Ava Chow · ccb986b2 · Jan 30, 2026 · 263 filesMessage 76 · AdequateTriage 16Details
Commit message · Ava Chow

Merge bitcoin-core/HWI#786: fix usage link

44fcd6e932a319fca8ba0d812bcaf4ac0a5205ba fix usage link (naiyoma)

Pull request description:

Noticed [this is broken ](https://hwi.readthedocs.io/en/latest/examples/bitcoin-core-usage.rst)while going through Trezor [walkthrough ](https://hwi.readthedocs.io/en/latest/examples/walkthrough/walkthrough.html)

ACKs for top commit:
Sjors:
ACK 44fcd6e932a319fca8ba0d812bcaf4ac0a5205ba
achow101:
ACK 44fcd6e932a319fca8ba0d812bcaf4ac0a5205ba

Tree-SHA512: aa9e659b1ca2c2240c82c20435658d4194aa6385dcf370d159cc321d78fa0920c2864885df34602ac514c24c4e2f99dae3a02afec96ae384015cb5ad11a1a62a

76/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathsigning or wallet pathboot or update pathauthentication pathparser or protocol pathmerge-commit duplicate discount