CommitWatch RSS
BC
← All projectsBitcoin Core

Hardware Wallet Interface

Python library and command-line interface for Bitcoin hardware-wallet communication.

BitcoinHardware integrationSoftware walletsNormal
Source repository ↗
Repository coverage

79 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

29security candidates8second-pass queue56AI analyses
2commits · 30 days
58commits · 60 days
73commits · 180 days
78commits · 365 days
Backfill bands
Aug 5 → Feb 63 seen1 candidatesComplete
Feb 6 → Jun 63 seen0 candidatesComplete
Jun 6 → Jul 61 seen0 candidatesComplete
Jul 6 → Aug 522 seen1 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

66/100 average clarity
23Strong · 80–100
28Adequate · 60–79
22Thin · 40–59
6Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Sjors Provoost552238066
Ava Chow20714069
Salvatore Ingala202057
andreasgriffin101018
Rohit Yadav101050
Analysis record

Published AI watches

Last scanned 0 minutes ago

Low 29 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#792: Optionally pass BIP388 policy to signtx

This commit adds an optional feature to the HWI tool that lets users pass previously registered Bitcoin wallet policies (BIP388) when signing transactions. It is a feature addition, not a fix for a known vulnerability. The change extends t…

New CLI argument `--registration` is appended to `signtx` and deserialized before being passed to hardware wallet clientsSeveral backends now accept and use `registered_descriptors` during PSBT signingBackends without BIP388 support raise `UnavailableActionError` when registrations are supplied
e63a0af2by Ava Chow+572−19119 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 81 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#853: psbt: enable type checking

This is a code-quality and type-safety patch. It adds the psbt.py file to the project's automated type-checking workflow and fixes two small logic issues where a value was assigned to an object field before being validated. The changes mak…

Validation moved before state mutation (defensive coding)Type annotations added to public methodsFile added to CI type-check coverage
390d9f84by Ava Chow+9−62 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 35 · Opaque
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: enable type checking

This commit turns on automated type checking for one more source file (hwilib/psbt.py) and makes small code changes so the file passes the type checker. The actual code changes move two integer assignments slightly later so validation happ…

Type checking enabled for PSBT moduleValidation ordering tightened for locktime fieldsExplicit type annotations added to PSBT methods
37643bd8by Sjors Provoost+9−62 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: extract PSBT helpers

This commit is a simple code cleanup in the test suite. It pulls out two small blocks of test code into reusable helper functions for signing and finalizing PSBTs, and for setting global xpubs in PSBTs. There is no change to production cod…

adc8ccb3by Sjors Provoost+25−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

coldcard: extract transaction signing helpers

This commit simply reorganizes the Coldcard hardware wallet signing code in HWI by moving existing logic into two new helper methods. There is no change to what the code actually does; it is a pure refactoring (code cleanup) with no securi…

826a2ac5by Sjors Provoost+76−641 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

psbt: detect keys and signatures by fingerprint

This commit adds two helper methods to the PSBT (Partially Signed Bitcoin Transaction) handling code that let the library check whether a specific hardware wallet's fingerprint appears in a transaction input, and whether that fingerprint h…

Adds fingerprint-based key/signature detection in PSBT input parsingIncludes unit tests covering legacy BIP32, Taproot key path, and Taproot script path casesNo caller or usage of new methods shown in the diff
3cc34937by Sjors Provoost+74−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

ledger: support BIP388 policy signing

This commit updates the Ledger hardware wallet support in HWI so that newer Ledger devices can sign Bitcoin transactions using registered BIP388 wallet policies. Previously, any attempt to use registered descriptors with a Ledger was block…

Change removes an explicit error path for registered descriptors, increasing supported functionalityAdds reconstruction of registered wallet policies and propagation of registration HMACs during PSBT signingTouches hardware-wallet signing path where incorrect policy handling could lead to signing unintended transactions
ac80a37bby Sjors Provoost+21−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#849: coldcard: bump firmware, add edge, display taproot address, restore test_signtx (ex. multisig)

This is a routine feature-and-testing update for the Coldcard hardware wallet support in Bitcoin Core's HWI tool. It adds support for Coldcard's 'Edge' experimental firmware, lets users display single-signature Taproot addresses on Edge, a…

PSBT version downgrade logic moved from per-pass to once-per-signing; intended to preserve v2 when supported and downgrade when notNew firmware version parsing heuristic treats Q/X suffixes and Edge/simulator as PSBTv2 capableTaproot singlesig address display enabled only for Coldcard Edge firmware
8593a755by Ava Chow+220−8819 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#842: Add `registerdescriptors` command for registering a descriptor with a device

This commit adds a new command called `registerdescriptor` to the HWI tool, which lets users register Bitcoin output descriptors with supported hardware wallets (Ledger, BitBox02, Jade, Coldcard). It also rewrites how descriptors are parse…

New command registers user-supplied descriptors with hardware walletsHWI explicitly does not validate descriptors before passing them to the device; device errors are propagatedDescriptor parser changed from string-based derivation paths to structured list-of-lists, affecting all descriptor handling
d928dae5by Ava Chow+709−12320 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#839: psbt: misc fixes and add remaining BIP 174 and BIP 370 test vectors

This commit tightens how the Bitcoin hardware wallet interface library reads PSBT files. It now rejects PSBTv0 files that contain fields only allowed in the newer PSBTv2 format, enforces sensible locktime ranges, and fixes several bugs whe…

Strict PSBT version field validationNew locktime bound enforcementWitness-stripped unsigned tx parsing
695c731bby Ava Chow+122−134 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

bitbox02: support BIP388 policy signing

This commit adds support for signing Bitcoin transactions with registered wallet policies (BIP388) on the BitBox02 hardware wallet. Previously this feature was rejected with an error. The change translates a registered wallet descriptor in…

Removal of an explicit unsupported-action error for BIP388 policy signingNew xpub and fingerprint comparison logic to identify the device's key in a policyNew policy script config construction passed to hardware signing routines
a76f3447by Sjors Provoost+32−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 60 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

jade: support BIP388 policy signing

This change removes an error that previously blocked Bitcoin signing for a specific type of wallet policy (BIP388) on the Blockstream Jade hardware wallet. The device now supports these policies, so the software no longer needs to reject t…

Removal of an explicit unsupported-action errorNo new cryptographic operations introducedNo input validation changes observed
db189db5by Sjors Provoost+1−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

coldcard: support BIP388 policy signing

This commit adds support for signing Bitcoin transactions with named wallet policies (BIP388) on newer Coldcard hardware wallets. It is a feature addition, not a fix for a known security flaw. The change removes an error that previously bl…

Feature addition for BIP388 policy signingRemoval of UnavailableActionError guard for registered_descriptorsNew miniscript_name parameter length-bounded to 1-32 ASCII bytes
7e278f48by Sjors Provoost+54−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 68 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

signtx: add BIP388 policy support

This commit adds a new command-line option and API parameter for BIP388 registered descriptor policies to the transaction-signing flow. It does not implement actual signing support in any hardware wallet driver; every device implementation…

New API surface added for BIP388 policy registrationAll device implementations explicitly reject BIP388 policy signing with UnavailableActionErrorNo existing signing path is modified; default behavior unchanged
6f44e489by Sjors Provoost+85−1110 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 91 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Merge bitcoin-core/HWI#819: Drop Python 3.9, use 3.10 for dist, bump Ledger

This is a routine maintenance merge for the Bitcoin Core Hardware Wallet Interface (HWI). It drops support for the end-of-life Python 3.9, switches deterministic builds and CI to Python 3.10, updates Ledger test firmware/simulator versions…

Dependency/toolchain version bump (Python 3.9 EOL removal, Python 3.10 adoption)Ledger firmware/app and Speculos simulator version bump in CI/testsTest automation rules updated for new Ledger UI prompts
2daa5916by Ava Chow+124−15629 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Drop Ledger deny rule from tests

This commit removes an unused test automation rule that automatically pressed a button when a Ledger hardware wallet simulator showed 'Cancel' or 'Reject' on screen. It only affects test data, not the actual wallet interface code users rel…

0379e278by Sjors Provoost+0−71 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: reenable LedgerX tests

This commit only re-enables automated tests for Ledger Nano X hardware wallets. It removes code that was skipping certain tests, but makes no changes to the actual wallet-interaction code that users rely on. There is no security fix or vul…

d2a5874aby Sjors Provoost+0−201 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Skip archiving hwi-qt on non-x86 platforms

This change adjusts the build script so that the graphical hwi-qt program is only bundled into release archives for 64-bit x86 (Intel/AMD) systems. On other CPU architectures, only the command-line hwi tool is packaged. This is a build/pac…

1b0cbea5by Sjors Provoost+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

test: increase stdin command timeout

This commit only changes a test timeout from 60 seconds to 120 seconds so that automated tests can complete when a Ledger hardware wallet running newer firmware takes longer to sign a large test transaction. It does not change any producti…

cd8a4317by Sjors Provoost+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreHardware Wallet Interface BitcoinHardware integrationSoftware wallets

Bump Speculos and Ledger Bitcoin app

This commit updates the versions of testing tools and Ledger Bitcoin app used in HWI's automated test environment. It does not change the actual HWI wallet-interaction code that users run. The changes are purely to keep CI/test simulations…

976353edby Sjors Provoost+28−95 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedDrop Python 3.9 supportby Sjors Provoost · edfeace8 · Aug 4, 2026 · 7 filesMessage 38 · OpaqueInformational 20Details
Commit message · Sjors Provoost

Drop Python 3.9 support

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 20/100

This commit simply removes support for Python 3.9 from the project. It updates configuration files to require Python 3.10 or newer, removes a Python 3.9 Docker test image, and cleans up dependency lock files that were only needed for Python 3.9. There is no code change that fixes or introduces a security vulnerability.

AI review queuedjade: Implement register_descriptorby Ava Chow · 8fc30319 · Aug 4, 2026 · 1 fileMessage 35 · OpaqueInformational 18Details
Commit message · Ava Chow

jade: Implement register_descriptor

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 18/100

This commit adds a missing feature to the Blockstream Jade hardware wallet driver in HWI: the ability to register a Bitcoin output descriptor on the device. It is a small, straightforward implementation of an existing interface method. There is no direct evidence in the commit of a security vulnerability, bug, or malicious change. The change appears to be a normal feature addition.

AI review queuedcoldcard: Implement register_descriptorby Ava Chow · 3fc07a6c · Aug 4, 2026 · 1 fileMessage 35 · OpaqueInformational 19Details
Commit message · Ava Chow

coldcard: Implement register_descriptor

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 19/100

This commit adds a new feature to the Coldcard hardware wallet driver in the HWI library: the ability to register a Bitcoin output descriptor on the device. The code sends the descriptor to the Coldcard in chunks, verifies the upload with a SHA-256 checksum, and then asks the device to enroll/register it. There is no obvious security bug in the diff itself; it is a straightforward implementation of a missing driver method. The main security-relevant observation is that the new code path involves device communication and a checksum check, but the diff does not show any vulnerability.

AI review queuedbitbox02: Implement register_descriptorby Ava Chow · 9f91e1a6 · Aug 3, 2026 · 1 fileMessage 35 · OpaqueInformational 20Details
Commit message · Ava Chow

bitbox02: Implement register_descriptor

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 20/100

This commit adds a new feature to the BitBox02 hardware wallet driver in HWI that lets users register a Bitcoin output descriptor (a recipe for wallet addresses) on the device. The change itself is a straightforward feature implementation and does not appear to fix a security bug. There is no evidence in the commit or supplied references that this is a security patch or that it addresses any disclosed vulnerability.

AI review queuedupgrade protobufby andreasgriffin · a7367506 · Aug 1, 2026 · 2 filesMessage 18 · OpaqueLow 25Details
Commit message · andreasgriffin

upgrade protobuf

18/100 · OpaqueMessage clarity
✓ Subject identifies a change! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 25/100

This commit relaxes the version requirement for the 'protobuf' Python library in the project's dependency files. It changes the requirement from 'exactly 4.23.3 or compatible updates' to 'any version 4.23.3 or newer'. This is a routine dependency management change. There is no direct evidence in the commit that it fixes a specific security vulnerability, but keeping dependencies updated can help avoid known bugs or vulnerabilities in older versions.

AI review queuedtest: add remaining BIP 174 and BIP 370 test vectorsby Sjors Provoost · df8c3f5d · Jul 10, 2026 · 1 fileMessage 87 · StrongInformational 15Details
Commit message · Sjors Provoost

test: add remaining BIP 174 and BIP 370 test vectors

The test data now covers every vector from both BIPs; these all
already pass.

87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds more test data to a JSON file used by the project's test suite. It adds additional encoded PSBT (Partially Signed Bitcoin Transaction) examples from official BIP test vectors. The commit message explicitly says these new test cases already pass, meaning no code behavior was changed and no bug was fixed.

AI review queuedtest: add BIP 370 timelock determination vectorsby Sjors Provoost · 1ff27e02 · Jul 10, 2026 · 2 filesMessage 82 · StrongInformational 15Details
Commit message · Sjors Provoost

test: add BIP 370 timelock determination vectors

compute_lock_time() was previously untested.

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds new test cases for an existing function that determines lock times in PSBTs (Partially Signed Bitcoin Transactions). It does not change any production code, fix a bug, or alter behavior. There is no security issue here.

AI review queuedFix race condition in get_free_port by binding to localhostby Rohit Yadav · 38f55ebd · Feb 11, 2026 · 1 fileMessage 50 · ThinInformational 20Details
Commit message · Rohit Yadav

Fix race condition in get_free_port by binding to localhost

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 20/100

This change fixes a small race condition in test helper code that picks a free network port. Previously the helper bound to all network interfaces ("any address"), which could briefly listen on an externally reachable address during automated tests. The patch restricts it to localhost only (127.0.0.1), reducing exposure. It is in test infrastructure, not the main wallet software users rely on, so real-world security impact is low.