Blockstream Jade

This commit updates the Python library that talks to the Blockstream Jade hardware wallet. It lets callers pass an optional extra data dictionary called additional_info when signing a Bitcoin PSBT, matching a feature already available for Liquid transactions. The change itself just forwards the new parameter to the device; it does not appear to fix or introduce a vulnerability on its own.

This commit blocks PSET (a privacy-enhanced Bitcoin transaction format) parsing on Blockstream Jade hardware wallets that lack extra RAM (SPIRAM). The change prevents the device from running out of memory while handling complex PSET data. It is a hardening/defensive fix rather than a clear exploit patch, because the commit message and diff do not describe an actual vulnerability—only a known resource limitation.

This commit only changes test code. It makes the test helper pass an optional 'additional_info' field through to the sign_psbt() function when it is present in test cases. There is no change to the actual signing code or wallet behavior, so it does not create or fix a security vulnerability.

This commit is a code cleanup in the transaction signing logic for Blockstream Jade hardware wallets. It splits one function into two: one that gathers output information and another that validates it. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a refactoring to make the code clearer and to allow future reuse in PSBT signing.

This commit fixes a minor user-experience and diagnostic issue in Blockstream Jade's transaction signing code. Previously, when the optional 'additional_info' block for Liquid transactions could not be parsed or validated, the device rejected the request without telling the caller exactly what went wrong. After the patch, the specific error message is passed back to the caller. There is no direct evidence this change fixes an exploitable security vulnerability.

This commit adds checks for the Liquid network's 'genesis blockhash' in a Bitcoin hardware wallet signing flow. It ensures the PSBT (Partially Signed Bitcoin Transaction) includes the correct network identifier before signing, and fills it in if missing. Without this, a specially crafted transaction could potentially trick the device into signing for the wrong Liquid network or into producing invalid Taproot signatures. The change is defensive and aligns with the ELIP-0101 specification.

This commit fixes how Blockstream Jade signs Liquid (Elements) Taproot transactions. Previously, the device used Bitcoin-style signature hashing for all networks, which is incorrect for Liquid Taproot. The fix passes a special 'Elements' flag when signing on Liquid so the signature hash matches Liquid's rules. Without this, signatures produced for Liquid Taproot transactions would be invalid or could potentially be produced using the wrong cryptographic formula, which in hardware wallets can sometimes lead to security issues like key leakage or signature-forgery attacks.

This commit blocks a specific kind of Bitcoin/Liquid transaction signing on the Blockstream Jade hardware wallet. It prevents 'swap' transactions from using 'taproot' inputs because the device's signature-calculation code does not yet safely handle that combination. Without the fix, a user might have been able to build a transaction that the wallet would sign incorrectly or in a way that could be exploited, potentially leading to loss or theft of funds in a swap.

This commit adds Liquid swap signing support for PSBTs in the Blockstream Jade hardware wallet firmware. It also restructures cleanup paths so memory is freed correctly when validation fails. The change is a feature addition with defensive cleanup improvements, not a clear-cut security fix, but it touches code that protects user funds during transaction signing.

This commit reorganizes how a hardware wallet stores temporary blinding proofs while validating a confidential transaction. It moves large proof data out of a small 'commitment' structure into a larger extended structure, and only copies the smaller validated data back to the caller. The stated goal is to reduce memory use, not to fix a security bug. There is no direct evidence in the commit that this prevents an exploitable vulnerability, but memory handling changes in security-critical code always warrant careful review.

This commit changes how a Bitcoin hardware wallet (Blockstream Jade) tracks which transaction inputs it needs to sign. Previously it stored a simple yes/no flag; now it stores the actual signature type requested by the PSBT (Partially Signed Bitcoin Transaction). The change is mostly a code-quality improvement, but it removes a place where the wrong signature type could silently be assumed. There is no direct evidence in the commit that an actual vulnerability was fixed, and no vendor security disclosure is present.

This commit adds a safety check in the code that signs Bitcoin transactions. It ensures that when the wallet decides to produce a Taproot-style signature, the script being spent actually looks like a Taproot script, and vice versa. Without this check, a mismatch between the script type and signature type could potentially lead to incorrect signatures or unexpected behavior when signing transactions.

This commit renames a function from get_commitment_data to params_commitment_data, moves a helper function earlier in the file to remove a forward declaration, and adds documentation comments. The commit message explicitly states there are no functional changes, and the diff shows only renaming, reordering, and comment additions with no logic changes.

This commit is a code cleanup that moves the rules for which Bitcoin/Liquid 'sighash' flags are allowed into one shared helper function used by both signing paths. Before, the PSBT signing path only rejected non-ALL sighashes for non-Taproot inputs, while the direct sign_tx path had more detailed rules (for example, allowing SINGLE|ANYONECANPAY for partial Liquid swaps). Unifying the logic reduces the chance that one path accidentally allows a dangerous sighash. The change itself does not add new user-facing behavior; it is defensive hardening/refactoring.

This commit is a pure code-style refactor. It flips a large 'if' block into an early 'continue' so the code inside is no longer deeply indented. The commit message explicitly says there are 'No functional changes'. No security issue is introduced or fixed.

This commit hardens how Blockstream Jade validates confidential (blinded) transaction data on Liquid. It moves and strengthens checks so that any asset/value commitment pair supplied by the caller must match the transaction actually being signed, and it removes redundant commitment fields from an internal data structure. The change is defensive: it reduces the chance that a malicious or buggy host could trick the hardware wallet into signing a transaction with mismatched blinding data.

This commit changes how a Bitcoin hardware wallet (Blockstream Jade) obtains the transaction it signs from a Partially Signed Bitcoin Transaction (PSBT). For older v0 PSBTs, it now uses the transaction embedded in the PSBT directly instead of extracting a fresh copy. The main risk is that the code now trusts the PSBT's internal transaction more directly, but the commit also adds a safety check that the transaction exists and matches the PSBT's input/output counts. There is no clear security bug visible in the diff, but the change touches sensitive signing logic and is described only as a simplification, not a security fix.

This commit is a pure file rename: the contents of sign_liquid_tx.c were moved unchanged into a new file called sign_utils.c, and the build include list in amalgamated.c was updated accordingly. The diff shows exactly the same 649 lines deleted and added with no functional changes. There is no security-relevant change.