Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit reorganizes existing hardware design files for the original Jade device into a new subfolder and adds the open-source hardware design files for a new product, the Jade Plus. It does not change any software, firmware, or device …
This commit fixes a boot failure on the M5CoreS3 hardware. A recent update to the underlying Espressif SDK (ESP-IDF v5.5) changed the rules for deleting an I2C bus: it now refuses to delete a bus that still has devices attached. The power …
This commit fixes a bug where the touchscreen driver failed to clean up internal handles when shutting down. On newer ESP-IDF firmware, this cleanup failure caused the device to panic and freeze during boot and when using the camera or QR …
Device freeze/DoS-like symptom on affected hardwareMemory leak fixedNo input validation, authentication, or cryptographic weakness visible
This commit adds a new command-line command called 'selfcheck' to the Jade CLI tool. It simply calls an existing device function and prints the result. There is no indication of a security fix or vulnerability being patched.
This commit changes how Blockstream Jade handles the 'genesis blockhash' when signing Liquid transactions. Previously, the device only accepted the network's built-in genesis hash. Now it lets users provide a custom genesis hash for test n…
Adds input validation for caller-supplied genesis blockhashPrevents mainnet genesis hash from being used on Liquid test networksRestricts genesis_hash parameter to Liquid networks only
This commit adds compiler annotations (WARN_UNUSED_RESULT) to functions that return success/failure codes, so the compiler will warn if a caller ignores the result. It also fixes a few places where return values were being ignored, replaci…
Functions returning error/success codes annotated with WARN_UNUSED_RESULTCallers now check return values of rpc_get_bip32_path() and rpc_get_boolean()Use of default-value helpers (rpc_get_boolean_or) to ensure predictable behavior on missing fields
This commit simply renames an internal helper function from `rpc_get_uint64_t` to `rpc_get_uint64` and updates every place that calls it. There are no changes to what the function does, how it checks data, or how secure it is. It is a rout…
This commit is a simple rename of two internal helper functions from `rpc_get_boolean`/`rpc_get_boolean_or` to `rpc_get_bool`/`rpc_get_bool_or`, updating all call sites accordingly. There is no change to what the code does, no bug fix, and…
This commit is a straightforward code cleanup that replaces verbose 'read this optional value, or leave the default' patterns with shorter helper functions that do the same thing. There is no change in behavior and no security issue visibl…
This commit tightens how Blockstream Jade handles the 'precision' value in asset contracts for Liquid assets. Previously, a very large precision value could be accepted and later used to read past the end of an internal lookup table (POW_1…
Out-of-bounds read mitigation: bounds-checking of user-controlled precision before indexing fixed-size POW_10 arrayInteger truncation safety: explicit cast of validated precision to uint8_t after range checkCompile-time invariant enforcement: JADE_STATIC_ASSERT ties array size to ASSET_PRECISION_MAX
This commit simply updates the SHA256 digest of the 'blockstream/jade_builder' Docker image used for building and testing Jade in four configuration files. There is no code change, no disclosed security fix, and no evidence in the commit o…
This commit is a large feature/refactor patch for Blockstream Jade's libjade (a desktop emulator of the Jade hardware wallet). It adds RPC endpoints that let a host application read the emulated device's screen, push fake button presses, r…
New RPC endpoints allow external read/write of emulated NVS storageNew RPC endpoints allow external screen capture and synthetic input injectionNew RPC endpoints allow external camera frame injection
This commit fixes a user-interface navigation quirk on the M5StickC Plus 2 hardware for Blockstream Jade. When entering a PIN, the up/down button directions were not inverted to match the rest of the device's menus, making number entry con…
This commit is a preventive build-hardening change. It adds compiler annotations (WARN_UNUSED_RESULT) to many functions that return success/failure codes, so the compiler will warn if a caller ignores the result. The goal is to catch futur…
Compiler annotation added to enforce checking of error-returning functionsNo specific vulnerability fixed in the diffNo functional code changes or call-site fixes included
This commit adds a safety check to Blockstream Jade's 'sign identity' feature. Before the change, the device would accept any identity string a connected app sent. Now it rejects identities that contain non-printable or unusual characters.…
Input validation added to a signing/identity processNew length-bounded string helper reduces reliance on null-terminationRejection of non-printable characters in user-presented identity string
This commit tightens error handling when decoding the 'issuer' field of an OTP (one-time password) setup URI. Previously, a malformed issuer string could fail to decode silently; now the device shows an error and cancels the operation inst…
Input validation added for OTP URI issuer fieldSilent failure on malformed URL-decoding replaced with explicit error returnDebug assertion added for label/issuer URL-decoding in UI display path
This commit fixes a small but meaningful bug in how Jade, a hardware wallet, reads key paths from Bitcoin PSBT data. The code was passing the byte size of a buffer when it should have passed the number of 32-bit entries. Depending on how t…
Buffer-size semantic mismatch in security-critical PSBT parsingUse of sizeof() on uint32_t array where element count is expectedCode path involved in 2of3 multisig recovery key identification
This commit fixes a logic gap in how Blockstream Jade checks cryptographic commitments for transaction outputs during signing. Previously, the code treated a missing commitment the same as an invalid one, which could cause the device to re…
Inconsistent commitment validation between signing code pathsPossible transaction signing failure or acceptance of unvalidated output commitmentsLogic alignment with existing sign_tx commitment handling
This commit changes the declared return type of a transaction-signing helper function from a transaction-type code (TxType_t) to a simple success/fail boolean (bool). The function body already appears to return true/false, so the change fi…
Return-type mismatch between function declaration/definition and headerFunction is in transaction-signing utility code (sign_utils.c/h)Function handles CBOR transaction parameters and writes output transaction metadata
This commit tightens bounds checks in URL encoding/decoding functions used in Blockstream Jade, a hardware wallet. The changes fix potential off-by-one/out-of-bounds memory reads and writes when handling percent-encoded characters. Because…
Bounds-check rewrite in URL decoder to prevent out-of-bounds reads before percent-decodingCast to unsigned char moved into isxdigit() to avoid undefined behavior with signed char inputsDestination bounds checks in URL encoder changed from pointer-subtraction form to remaining-space form, mitigating possible underflow/wrap
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
Security candidatebuild: fail if any step of signing v2 firmwares failsby Jon Griffiths · edc17778 · Sep 29, 2025 · 1 fileMessage 62 · AdequateLow 34Details
Commit message · Jon Griffiths
build: fail if any step of signing v2 firmwares fails
62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 34/100
This commit hardens the firmware signing script used when releasing Blockstream Jade hardware wallet firmware. It adds `set -e` so the script stops immediately if any command fails, and explicitly checks that the public and private key files exist before proceeding. Without these changes, the script could silently continue past errors (for example, if a key file was missing or a signing command failed), potentially producing or releasing firmware that was not properly signed. Proper signing is important because users rely on firmware signatures to verify that the software running on their device is authentic and has not been tampered with.
Security candidatebuild: add a script for testing v1 firmware signingby Jon Griffiths · 76a30841 · Sep 29, 2025 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Jon Griffiths
build: add a script for testing v1 firmware signing
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing boundary
AI analysis · Informational 15/100
This commit adds a new build helper script that signs production firmware files with a private key during release testing. It does not change any device code, cryptographic checks, or user-facing behavior. It is purely a release-engineering convenience script.
Security candidatechore: fix some minor issues in the commentsby quantpoet · f96353b1 · Sep 28, 2025 · 6 filesMessage 72 · AdequateInformational 15Details
Commit message · quantpoet
chore: fix some minor issues in the comments
Signed-off-by: quantpoet <quantway@outlook.com>
72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing or wallet pathauthentication path
AI analysis · Informational 15/100
This commit only fixes spelling mistakes inside code comments (for example, changing 'sufficent' to 'sufficient' and 'Explcitly' to 'Explicitly'). No actual program instructions were changed, so it cannot affect security or functionality.
docs: fix firmware version note for extended replies
Extended replies were introduced in 118336ec64ee, which was already in firmware version 1.0.33. This is also confirmed by CHANGELOG.md.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
Lower-priorityjadepy: update jadepy version numberby Jon Griffiths · cc5582fe · Sep 23, 2025 · 2 filesMessage 45 · ThinTriage 0Details
Commit message · Jon Griffiths
jadepy: update jadepy version number
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityjadepy: update jadepy version numberby Jon Griffiths · 48785d1f · Sep 23, 2025 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Jon Griffiths
jadepy: update jadepy version number
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI review queuedbuild: initial re-work of the ci pipelineby Daniel Newton · 3025ce83 · Sep 23, 2025 · 39 filesMessage 100 · StrongInformational 15Details
Commit message · Daniel Newton
build: initial re-work of the ci pipeline
Split up and rename the various build stages to reflect what they do and disambiguate e.g. building from flashing/testing. Use consistent naming for jobs/config then leverage it to reduce boilerplate repetition.
Generate the CI build config from the developer build config, then remove the developer build-only CI step.
Update the v2.0 developer build config to use JTAG so flashing between it and CI builds doesn't require physically switching to JTAG mode.
Collate the build artifacts into a single download for release, pre-sign the dev images for release automatically. Ensure sequential access to devices using flock to prevent flaky failures.
Remove the CI use of ttgo as a substitute v2.0 device.
Co-authored-by: Jon Griffiths <jon_p_griffiths@yahoo.com>
100/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
second-pass: unusually broad change
AI analysis · Informational 15/100
This commit is a housekeeping rework of the project's continuous-integration (CI) build and test pipeline. It renames build stages, splits the GitLab CI configuration into smaller files, generates CI test configurations from developer configs, removes a substitute test device, and adds a release-staging script. There is no change to the wallet firmware's security logic, cryptography, or user-facing behavior.
Lower-prioritymnemonic: avoid an unused variable warning for ci buildsby Jon Griffiths · 1c076250 · Sep 23, 2025 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Jon Griffiths
mnemonic: avoid an unused variable warning for ci builds
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityconsistency: don't repeatedly re-set the activity when it doesn't changeby Jon Griffiths · be23f845 · Sep 16, 2025 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Jon Griffiths
consistency: don't repeatedly re-set the activity when it doesn't change
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidategui: share code to wait for buttons with ci auto-click (2)by Jon Griffiths · 05359dbf · Sep 16, 2025 · 14 filesMessage 65 · AdequateInformational 13Details
Commit message · Jon Griffiths
gui: share code to wait for buttons with ci auto-click (2)
Remove redundant checks for timeout. Note there are no functional changes, just a fair amount of code churn.
65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathboot or update pathauthentication path
AI analysis · Informational 13/100
This commit is a code cleanup in the user-interface layer of the Blockstream Jade hardware wallet. It removes repeated 'if timeout' checks around button-waiting loops and lets the shared helper handle the timeout case instead. The commit message explicitly says there are no functional changes, and the diff shows only structural simplification—no security-sensitive logic was altered.
Security candidategui: share code to wait for buttons with ci auto-clickby Jon Griffiths · 2947dcaf · Sep 16, 2025 · 18 filesMessage 50 · ThinInformational 18Details
Commit message · Jon Griffiths
gui: share code to wait for buttons with ci auto-click
Minimal change for easier review.
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathboot or update pathauthentication path
AI analysis · Informational 18/100
This commit is a code cleanup: it pulls the logic for waiting on a button press into a single shared helper function so the same code isn't repeated in many places. The behavior is essentially unchanged. The only functional difference is that one screen (the mnemonic setup) now explicitly treats a timeout as an error in normal builds, whereas before it would have hit a generic assertion. This is a minor hardening improvement, not a security vulnerability.
Security candidategui: add fill type and parent params to fill nodesby Jon Griffiths · 0caa7cfe · Sep 15, 2025 · 10 filesMessage 50 · ThinInformational 15Details
Commit message · Jon Griffiths
gui: add fill type and parent params to fill nodes
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Informational 15/100
This commit is a straightforward internal cleanup of the user-interface drawing code for the Blockstream Jade hardware wallet. It changes how solid-color background boxes (called 'fill nodes') are created so callers can specify a fill style and parent container in one function call instead of two. There is no indication this fixes or introduces any security issue.
Lower-prioritygui: remove the now-unused old qr background colorsby Jon Griffiths · 3da845e6 · Sep 15, 2025 · 3 filesMessage 50 · ThinTriage 0Details
Commit message · Jon Griffiths
gui: remove the now-unused old qr background colors
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100
This commit only fixes three spelling mistakes in code comments within a single source file. No program logic, variables, or security behavior was changed.
Lower-prioritygui: don't reuse the qrcode background color for unhighlighted buttonsby Jon Griffiths · 818dfdf5 · Sep 8, 2025 · 3 filesMessage 50 · ThinTriage 0Details
Commit message · Jon Griffiths
gui: don't reuse the qrcode background color for unhighlighted buttons
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-prioritydisplay: share code to fetch the display bufferby Jon Griffiths · 829756be · Sep 8, 2025 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Jon Griffiths
display: share code to fetch the display buffer
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body