CommitWatch RSS
BC
← All projectsBitcoin Core

Hardware Wallet Interface

Python library and command-line interface for Bitcoin hardware-wallet communication.

BitcoinHardware integrationSoftware walletsNormal
Source repository ↗
Repository coverage

30 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

8security candidates3second-pass queue5AI analyses
23commits · 30 days
24commits · 60 days
27commits · 180 days
30commits · 365 days
Backfill bands
Aug 5 → Feb 63 seen1 candidatesComplete
Feb 6 → Jun 63 seen0 candidatesComplete
Jun 6 → Jul 61 seen0 candidatesComplete
Jul 6 → Aug 522 seen1 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

63/100 average clarity
7Strong · 80–100
7Adequate · 60–79
14Thin · 40–59
2Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Sjors Provoost2065065
Ava Chow620066
Salvatore Ingala200057
andreasgriffin100018
Rohit Yadav100050
Analysis record

Published AI watches

Last scanned 43 minutes ago

Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: make device signing cases more granular

This commit only changes test code. It makes the automated test suite more flexible by letting device simulators opt out of one specific test case involving unusual key derivation paths, while still running the rest of the tests. There is …

eab5bad3by Sjors Provoost+19−97 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

ledger: have sign_psbt return SignPsbtYieldedObject

This commit is a straightforward internal code refactor for Ledger hardware wallet support. It changes the data structure returned when signing a Bitcoin transaction from a simple tuple of raw bytes to a more descriptive object that can ca…

e86440aeby Sjors Provoost+73−274 files
No security note in commit
Open full analysis →Source commit ↗
Low 40 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

ledger: handle script path signatures

This commit updates the Ledger hardware wallet driver in HWI so it can correctly store Taproot script-path signatures in a PSBT, not just key-path signatures. Previously, the code had a placeholder that always treated any Taproot signature…

Previously unimplemented TODO for script-path signaturesIncorrect PSBT field assignment for Taproot script-path spendsFunctional gap that could produce an invalid or incomplete PSBT
fc206450by Sjors Provoost+5−31 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 88 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: don't overwrite PSBTv2 tx version and fallback locktime

This commit fixes a bug in how the HWI library handles a newer Bitcoin transaction format called PSBTv2. Previously, when converting or setting up a PSBTv2 object, the code would accidentally overwrite the transaction's version number and …

Signature invalidation through mutation of transaction version/locktimeIncorrect null-check on PSBTv2 placeholder transaction objectPSBTv2 serialization round-trip failure for valid BIP 370 vectors
ca2caf04by Sjors Provoost+31−43 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 43 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: add MuSig2 fields

This commit adds support for new MuSig2 fields in PSBT (Partially Signed Bitcoin Transaction) parsing and serialization. MuSig2 is a multi-signature protocol for Bitcoin. The change is a feature addition that parses and stores new PSBT fie…

New PSBT field parsing with explicit length validationDuplicate-key rejection for new fieldsNo cryptographic verification of MuSig2 nonces/signatures in this diff
351b3e4eby Sjors Provoost+120−32 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidatetest: make device signing cases more granularby Sjors Provoost · eab5bad3 · Aug 4, 2026 · 7 filesMessage 90 · StrongInformational 15Details
Commit message · Sjors Provoost

test: make device signing cases more granular

Most device simulators accept arbitrary keypool paths, so keep testing
that behavior by default.

Some devices enforce their own derivation path policies. Let those
emulators opt out of the arbitrary-path portion while still running the
remaining keypool checks.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit only changes test code. It makes the automated test suite more flexible by letting device simulators opt out of one specific test case involving unusual key derivation paths, while still running the rest of the tests. There is no change to the actual wallet software that users run, and no security fix or vulnerability is present in the diff.

Security candidateledger: have sign_psbt return SignPsbtYieldedObjectby Sjors Provoost · e86440ae · Jul 31, 2026 · 4 filesMessage 65 · AdequateInformational 15Details
Commit message · Sjors Provoost

ledger: have sign_psbt return SignPsbtYieldedObject

Taken from LedgerHQ/app-bitcoin-new at 2.4.1

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit is a straightforward internal code refactor for Ledger hardware wallet support. It changes the data structure returned when signing a Bitcoin transaction from a simple tuple of raw bytes to a more descriptive object that can carry extra context for newer Taproot-style signatures. There is no indication this fixes a security bug or introduces a vulnerability; it is a compatibility and maintainability update taken from Ledger's own upstream code.

Security candidateledger: handle script path signaturesby Sjors Provoost · fc206450 · Jul 31, 2026 · 1 fileMessage 45 · ThinLow 40Details
Commit message · Sjors Provoost

ledger: handle script path signatures

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundary
AI analysis · Low 40/100

This commit updates the Ledger hardware wallet driver in HWI so it can correctly store Taproot script-path signatures in a PSBT, not just key-path signatures. Previously, the code had a placeholder that always treated any Taproot signature as a key-path signature. For users spending via a Taproot script path (for example, a multisig or timelock branch), the signature would have been placed in the wrong field, likely causing the PSBT to be invalid or incomplete. There is no direct evidence in the commit of an exploitable vulnerability; it appears to be a correctness/functional fix for an unimplemented feature.

Security candidatepsbt: don't overwrite PSBTv2 tx version and fallback locktimeby Sjors Provoost · ca2caf04 · Jul 10, 2026 · 3 filesMessage 88 · StrongModerate 61Details
Commit message · Sjors Provoost

psbt: don't overwrite PSBTv2 tx version and fallback locktime

self.tx is never None, for PSBTv2 it's an empty placeholder. Its
defaults would overwrite the deserialized tx version and fallback
locktime, invalidating any existing signature. Check the PSBT
version instead, here and in get_unsigned_tx().

Without this fix all BIP 370 valid test vectors, now added, fail
the serialization round-trip.

88/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
signing boundaryfuzzing or regression evidencesigning or wallet path
AI analysis · Moderate 61/100

This commit fixes a bug in how the HWI library handles a newer Bitcoin transaction format called PSBTv2. Previously, when converting or setting up a PSBTv2 object, the code would accidentally overwrite the transaction's version number and locktime with default values. That could silently invalidate digital signatures that were already created for the transaction. The fix checks the PSBT version before touching those fields, and adds official BIP 370 test vectors to prevent the bug from returning.

Security candidatepsbt: add MuSig2 fieldsby Sjors Provoost · 351b3e4e · Jan 31, 2026 · 2 filesMessage 43 · ThinInformational 21Details
Commit message · Sjors Provoost

psbt: add MuSig2 fields

Co-Authored-By: Salvatore Ingala <6681844+bigspider@users.noreply.github.com>

43/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 21/100

This commit adds support for new MuSig2 fields in PSBT (Partially Signed Bitcoin Transaction) parsing and serialization. MuSig2 is a multi-signature protocol for Bitcoin. The change is a feature addition that parses and stores new PSBT fields, with length and duplicate checks. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a protocol-support update.