CommitWatch RSS
BS
← All projectsBlockstream

Blockstream Jade

Firmware for Jade and Jade Plus Bitcoin hardware wallets.

BitcoinHardware walletsElevated watch
Source repository ↗
Repository coverage

502 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

106security candidates69second-pass queue437AI analyses
25commits · 30 days
67commits · 60 days
220commits · 180 days
417commits · 365 days
Backfill bands
Aug 5 → Feb 6216 seen38 candidatesComplete
Feb 6 → Jun 6131 seen9 candidatesComplete
Jun 6 → Jul 657 seen10 candidatesComplete
Jul 6 → Aug 510 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

57/100 average clarity
32Strong · 80–100
182Adequate · 60–79
250Thin · 40–59
38Opaque · 0–39
5security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Jon Griffiths31357282157
Mike Tolkachev431438152
Daniel Newton771668055
Mihailo Milenkovic878057
roderico333060
Valerio Vaccaro1526054
Jamie C. Driver525053
Gustavo Cateim917078
Austin-Fulbright414060
quantpoet111072
cmiguelrn111045
tokyovyse111063
Analysis record

Published AI watches

Last scanned 29 minutes ago

Informational 20 AI analysisMessage 65 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

fmt: fix and prevent future use of unsupported format spec "zu"

This commit fixes the use of the "%zu" printf format specifier, which is not supported by the ESP32 toolchain used in this project. The unsupported format could cause log messages and user-facing strings to display incorrect or garbage val…

Use of unsupported printf format specifier %zu on embedded targetPotential for malformed log/UI output due to undefined format behaviorAddition of CI guard to prevent recurrence
26042182by Jon Griffiths+21−145 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 30 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

otp: release md context on failure and clean temporary buffers

This commit fixes cleanup in the one-time-password (OTP) code. Previously, if setting up the cryptographic hash context failed, the code could return without freeing that context, and temporary buffers holding sensitive counter/HMAC data w…

Resource leak fix: mbedtls_md_free() now called on prepare_md_ctx failure pathSensitive buffer zeroization: wally_bzero() added for rcnt_buf and hmacControl-flow change from macro-based early return to explicit success checks
6e2cb6b6by Mike Tolkachev+26−141 file
No security note in commit
Open full analysis →Source commit ↗
Low 47 AI analysisMessage 25 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

identity: clean temporary hash buffer

This commit fixes a small but real security hygiene issue in Blockstream Jade, a hardware wallet. A temporary buffer that holds a sensitive cryptographic hash (HMAC-SHA512 output used to derive child private keys) was not marked as sensiti…

Sensitive memory not marked for clearing (missing SENSITIVE_PUSH/POP)Buffer holds HMAC-SHA512 output used in BIP32 hardened child key derivationPatch adds explicit sensitive-memory lifecycle management
b5c35779by Mike Tolkachev+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 15 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

qrmode: clean temporary buffer

This commit adds cleanup of a temporary memory buffer used when turning data into QR codes on the Blockstream Jade hardware wallet. The buffer could previously remain in memory after use, potentially leaving sensitive QR data behind for la…

Sensitive temporary buffer not cleared before fixUse of SENSITIVE_PUSH/SENSITIVE_POP memory-clearing macrosQR payload data may include private or confidential material
34f68c20by Mike Tolkachev+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

pinserver: retain unit private key on url change

This commit changes how Blockstream Jade handles its PIN server settings. Previously, changing the PIN server web address (URL) also wiped the device's private PIN encryption key, forcing the device to create a fresh one. The patch keeps t…

PIN private key lifecycle change: key retained on URL-only pinserver updatePublic-key change still triggers private-key erasure/regenerationDebug-clean and full reset still erase private key
ddcd93a3by Mike Tolkachev+38−324 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

add more boards and descriptions

This commit is a documentation update for the do-it-yourself (DIY) hardware section of the Blockstream Jade project. It adds descriptions and photos for additional supported circuit boards and updates image file references. There are no co…

f4fb150dby Valerio Vaccaro+65−1625 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

process: limit array sizes in sign_tx, register_multisig and sign_bip85_digests

This commit adds size limits to several message-handling functions in the Blockstream Jade hardware wallet firmware. It caps how many asset records, transaction inputs/outputs, multisig signers, and BIP85 RSA digests a single RPC message c…

Adds explicit upper bounds on attacker-controllable array sizesRejects zero-input/zero-output transactions before further processingMoves BIP85 digest count validation before memory allocation
e87f26bfby Daniel Newton+251−8114 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

Update CHANGELOG.md

This commit only updates the project's CHANGELOG.md file to add release notes for version 1.0.41. It does not change any source code, build scripts, or configuration. The changelog text itself states that version 1.0.41 contains important …

Changelog describes prior security fixes in release 1.0.41Mentions external security researchers and tools (Loupe, Kvazar)References security-relevant improvements: stack protection, entropy, secure version, memory scrubbing, thread safety
dd45a7dcby Jon Griffiths+49−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BS BlockstreamBlockstream Jade BitcoinHardware wallets

jadepy: update jadepy release

This commit simply bumps the version of a Python dependency called jade-client from 1.0.40 to 1.0.41, along with its matching cryptographic hashes and a fresh PGP signature. There is no code change visible here, and nothing in the commit m…

75eeada4by Jon Griffiths+19−192 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

consistency: fix docs/comment/script typos

This commit fixes five spelling mistakes in documentation, code comments, and a script comment. None of the changes alter program behavior or affect security.

9ea7eed3by Jon Griffiths+5−55 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

esp_lcd: vendor the esp_lcd component (ESP-IDF v5.5.4)

This commit copies the ESP-IDF 'esp_lcd' display-driver component directly into the Blockstream Jade firmware repository (a process called 'vendoring') at version 5.5.4. It adds about 8,700 lines of display-interface code for LCD panels us…

Large vendored third-party driver import (+8,718 lines, 43 files)Driver code runs in interrupt context and uses DMA, which historically carries memory-safety and cache-coherency risksNo explicit security fix or bug-fix narrative in commit title/message
d89207bfby Daniel Newton+8718−043 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 57 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

build: "fakeprod" prod-like development mode

This commit adds an official developer-only 'fakeprod' build mode for Blockstream Jade hardware wallets. It deliberately weakens several security settings (single signature, committed private keys, readable flash-encryption key, enabled JT…

In-tree private keys committed to repository (tools/fakeprod_v2.pem, tools/fakeprod_attest.pem)Secure boot minimum signatures reduced from 2 to 1Flash encryption set to DEVELOPMENT mode with key readable
cecedc76by Daniel Newton+350−59 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

urldecode: add validation for URL encoding

This commit hardens a URL-decoding helper in Blockstream Jade's firmware. It adds validation so malformed percent-encoding, embedded null bytes, control characters, and non-ASCII bytes are rejected instead of being silently decoded. A new …

Input validation added for percent-encoded sequencesRejection of embedded NUL bytes and control characters in decoded outputRejection of non-ASCII decoded bytes (>=0x80 and DEL 0x7f)
dd0d699dby Mike Tolkachev+100−272 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 73 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

qr: split datastream data into its own allocation, reorder alloc/free calls

This change rewrites how a small QR-code scanning library allocates memory. Instead of one big 16 KB block, it now uses two separate 8 KB blocks, and it frees them in the reverse order they were allocated. The stated goal is to avoid memor…

Memory allocation pattern changed from single large allocation to two smaller allocationsAllocation/free ordering changed to LIFO-style reverse pairingPointer field added to struct that previously held an inline array
43640f8cby Jon Griffiths+24−153 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 45 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

psbt: check output amount presence before reading

This commit tightens how Blockstream Jade reads output amounts from a Partially Signed Bitcoin Transaction (PSBT). Before, the code tried to read the amount directly without first confirming it was actually present. Now it checks whether t…

Missing-field check added before sensitive value readPSBT output amount parsing hardenedDefensive validation of libwally presence flags
9f2b916dby Jon Griffiths+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

psbt: require that all psbt bytes are consumed when parsing

This commit tightens how Blockstream Jade verifies a Bitcoin transaction file (PSBT) before signing. It now requires that every byte in the file is part of the transaction, with no leftover or trailing data allowed. Previously, extra bytes…

Parsing now rejects trailing/unconsumed bytes in PSBT inputChange is in the signing code path, directly affecting what the hardware wallet will signUse of stricter libwally-core parse flag (COMPLETE) indicates parser hardening
605d86acby Jon Griffiths+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

hardware: add Jade Plus design files

This commit reorganizes existing hardware design files for the original Jade device into a new subfolder and adds the open-source hardware design files for a new product, the Jade Plus. It does not change any software, firmware, or device …

5ad85661by bitcoinhelp+2573−122520 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
BS BlockstreamBlockstream Jade BitcoinHardware wallets

tests: migrate low level tests

This commit only moves and reorganizes existing test code. It adds a new helper to check whether the current transport is a specific type, moves a shared wait() function into a common test package file, and migrates a large set of low-leve…

767006a0by Valerio Vaccaro+1580−54 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 68 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

mnemonic: restore recovery phrase by word number

This commit adds a new way to restore a Bitcoin wallet on a Blockstream Jade hardware device: instead of typing each recovery word, users can enter each word's one-based BIP39 number (for example, '1' for 'abandon'). The change also refact…

New user-input path for seed recovery (word numbers instead of words)Refactoring of mnemonic input/validation helpersAddition of SENSITIVE_PUSH/POP for local mnemonic buffers
99927491by roderico+580−3183 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
BS BlockstreamBlockstream Jade BitcoinHardware wallets

ui: support bounded variable-length digit entry

This commit refactors the on-screen digit-entry keypad in Blockstream Jade so callers can ask for shorter number fields (for example 4 digits instead of 6) and optionally cap the entered value. The existing 6-digit PIN and index entry beha…

New bounded numeric input path may prevent out-of-range values in future callersRefactoring centralizes input validation rather than relying on callersNo buffer-size changes observed; digit array remains DIGIT_ENTRY_SIZE (6) elements
69627745by roderico+128−332 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritytests: remove blinding tests from test_jade.pyby Valerio Vaccaro · 4285f95f · Jul 17, 2026 · 2 filesMessage 55 · ThinTriage 0Details
Commit message · Valerio Vaccaro

tests: remove blinding tests from test_jade.py

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Lower-prioritytests: migrate blindings testsby Valerio Vaccaro · 2a7560cb · Jul 17, 2026 · 2 filesMessage 45 · ThinTriage 0Details
Commit message · Valerio Vaccaro

tests: migrate blindings tests

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Mentions testing or verification! No meaningful explanatory body
Lower-prioritytests: remove address tests from test_jade.pyby Valerio Vaccaro · b1c8ed9d · Jul 17, 2026 · 1 fileMessage 55 · ThinTriage 0Details
Commit message · Valerio Vaccaro

tests: remove address tests from test_jade.py

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Lower-prioritywally: update wally to release 1.5.6by Jon Griffiths · cfce08ce · Jul 11, 2026 · 1 fileMessage 45 · ThinInformational 0Details
Commit message · Jon Griffiths

wally: update wally to release 1.5.6

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 0/100

This commit updates a bundled dependency (libwally-core) to a newer release, but no actual diff content or release notes were provided. We cannot see what changed or whether any security issue is involved.

Lower-prioritypower: release PMU devices before deleting the i2c bus on M5CoreS3by Gustavo Cateim · fb3a009a · Jul 11, 2026 · 1 fileMessage 100 · StrongLow 26Details
Commit message · Gustavo Cateim

power: release PMU devices before deleting the i2c bus on M5CoreS3

Since ESP-IDF v5.5 i2c_del_master_bus() refuses to delete a bus that
still has devices attached and returns ESP_ERR_INVALID_STATE. On the
M5CoreS3, power_init() attaches the axp2101 and aw9523 devices and
then deletes the bus without releasing them, so under IDF 5.5.4 the
deinit fails, power_init() propagates the error and the JADE_ASSERT
in main.c aborts the boot. Same root cause as the touchscreen fix in
the previous commit (#306).

Remove both devices from the bus before deleting it.

Not tested on hardware (none available); the change mirrors the
touchscreen fix validated on the Waveshare S3 Touch LCD 2.

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
defensive validation
AI analysis · Low 26/100

This commit fixes a boot failure on the M5CoreS3 hardware. A recent update to the underlying Espressif SDK (ESP-IDF v5.5) changed the rules for deleting an I2C bus: it now refuses to delete a bus that still has devices attached. The power initialization code was attaching two power-management chips to the bus and then trying to delete the bus without detaching them first, causing the device to abort boot. The fix simply detaches those two devices before deleting the bus. There is no security vulnerability here—it's a compatibility/bug fix for a crash-on-boot scenario.

Security candidateinput: release touch handles before deleting the i2c busby Gustavo Cateim · 36776fec · Jul 11, 2026 · 1 fileMessage 86 · StrongLow 27Details
Commit message · Gustavo Cateim

input: release touch handles before deleting the i2c bus

Since ESP-IDF v5.5 (espressif/esp-idf@e73d78ba) i2c_del_master_bus()
refuses to delete a bus that still has devices attached and returns
ESP_ERR_INVALID_STATE. The touchscreen task registers a panel IO
device on the bus but never releases it, so under IDF 5.5.4 the first
touchscreen_deinit() fails and aborts via ESP_ERROR_CHECK.

On boards that panic with PRINT_HALT, such as the Waveshare S3 Touch
LCD 2, this freezes the device on the boot splash screen while
gathering camera entropy, and also hangs the QR scanner and the
camera exit path, since the touchscreen is restarted around every
camera start/stop (see #306).

Releasing the touch handle and the panel IO device (which removes it
from the bus) before deleting the bus restores the deinit/init cycle,
and also fixes a heap leak present under IDF 5.4 where both handles
leaked on every cycle.

Co-authored-by: oroderico <oroderico@users.noreply.github.com>

86/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
entropy or randomness
AI analysis · Low 27/100

This commit fixes a bug where the touchscreen driver failed to clean up internal handles when shutting down. On newer ESP-IDF firmware, this cleanup failure caused the device to panic and freeze during boot and when using the camera or QR scanner. The fix releases the touch and panel IO handles before deleting the I2C bus, preventing freezes and a memory leak. There is no evidence this is a security vulnerability or exploitable by an attacker.

Lower-prioritydisplay: redraw touch navbar on orientation flipby oroderico · b15df8e5 · Jul 11, 2026 · 4 filesMessage 68 · AdequateTriage 0Details
Commit message · oroderico

display: redraw touch navbar on orientation flip

On boards with a virtual touch navbar (TTGO TWatchS3, M5 CoreS3,
Waveshare S3 Touch LCD 2) the prev/OK/next buttons are drawn only once
at startup, inside display_init(). Flipping the display orientation
remaps the panel scan direction, so the navbar was left stale and
upside down at the wrong edge of the panel.

Extract the drawing code into display_touch_navbar_redraw() and call
it from gui_set_flipped_orientation() whenever the orientation
actually changes. Boards without a navbar get an inline no-op stub.
The TOUCH_BUTTON_AREA constant moves to display.h so the touch input
code can share it. The two 50 ms settle delays stay in display_init(),
as flipping does not need them.

Co-authored-by: Gustavo Cateim <cateim@gmail.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityinput: mirror touch navbar band on display orientation flipby Gustavo Cateim · 9819ed29 · Jul 11, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · Gustavo Cateim

input: mirror touch navbar band on display orientation flip

The touch controllers keep reporting physical panel coordinates after the display orientation is flipped, so the virtual navbar band stops lining up with the rendered buttons: taps still land on the stale Y band.

Mirror only the touch Y coordinate from the touchscreen task whenever the GUI orientation changes. This keeps the navbar hit area in the same coordinate space as the display while preserving the physical left/right button actions. Mirroring X would make the right-side button trigger prev after a flip.

The M5 Core2 is excluded: its buttons are silk-screened on a fixed capacitive strip below the display and must not follow the flip.

For the software mirror to be correct, y_max must span the full touch panel, including the navbar area below the main display, so it gains TOUCH_BUTTON_AREA. The navbar band check also replaces the hardcoded touch_y > 200 with the board display height: on displays taller than 200 pixels, such as the Waveshare S3 Touch LCD 2 (280 pixels), the old value made taps on the bottom of the GUI area trigger navigation.

Neither expression includes CONFIG_DISPLAY_OFFSET_Y. That value is not panel geometry: it is the ST7789 GRAM gap fed to esp_lcd_panel_set_gap(), a display-side API. The touch controller reports panel coordinates and never sees it, so adding it here would mix two coordinate spaces. It is 0 on three of the four touchscreen boards, but 80 on the TTGO TWatchS3, where it would push the navbar threshold to 280 on a panel that only reports 0..239 and make the navbar unreachable in the default orientation.

Co-authored-by: oroderico <oroderico@users.noreply.github.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritydiy: Add M5StickC Plus2 backlight brightness controlby oroderico · 5c22b7d3 · Jul 10, 2026 · 4 filesMessage 50 · ThinInformational 15Details
Commit message · oroderico

diy: Add M5StickC Plus2 backlight brightness control

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit adds a screen brightness control feature for the M5StickC Plus2 hardware variant of the Blockstream Jade device. It is a hardware-support and user-interface change, not a security fix or vulnerability. There is no indication of a security issue in the code changes.

AI review queuedurldecode: add self-tests for validation and decodeby Mike Tolkachev · c9873a11 · Jul 9, 2026 · 1 fileMessage 60 · AdequateInformational 12Details
Commit message · Mike Tolkachev

urldecode: add self-tests for validation and decode

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This commit only adds a new test file that exercises an existing URL-decoding function. It does not change any production code, so by itself it cannot introduce a security vulnerability or fix one. It is a defensive-quality improvement that adds self-tests.

Lower-prioritytests: remove ping test from test_jade.pyby Valerio Vaccaro · 2a4379f4 · Jul 9, 2026 · 1 fileMessage 55 · ThinTriage 0Details
Commit message · Valerio Vaccaro

tests: remove ping test from test_jade.py

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI review queuedtests: remove multisig tests from test_jade.pyby Valerio Vaccaro · 74e3af87 · Jul 9, 2026 · 62 filesMessage 55 · ThinInformational 15Details
Commit message · Valerio Vaccaro

tests: remove multisig tests from test_jade.py

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only deletes test files and test code for multisignature wallet features from the Blockstream Jade test suite. It does not change the actual firmware, runtime code, or how the device handles multisig wallets. There is no security fix or vulnerability introduced here—only a cleanup of automated tests.

Security candidatetests: migrate ping testby Valerio Vaccaro · 486acb06 · Jul 9, 2026 · 1 fileMessage 38 · OpaqueInformational 15Details
Commit message · Valerio Vaccaro

tests: migrate ping test

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Mentions testing or verification! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
authentication path
AI analysis · Informational 15/100

This commit adds a new automated test file that checks whether sending a simple 'ping' message to a Jade hardware wallet interrupts an ongoing signing process. It is purely a test addition with no changes to production code, and it does not fix or introduce any security vulnerability.

Lower-priorityrepo: remove stray cUR submodule gitlinkby odudex · 88d69aa6 · Jul 8, 2026 · 1 fileMessage 68 · AdequateInformational 15Details
Commit message · odudex

repo: remove stray cUR submodule gitlink

Commit 121adaad was cherry-picked from a branch where components/cUR is a proper submodule, and accidentally carried the cUR gitlink along without a matching .gitmodules entry. This breaks 'git submodule update --init' with "no submodule mapping found in .gitmodules for path 'components/cUR'".

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit removes a leftover Git submodule reference (a 'gitlink') that had no matching configuration entry. It fixes a Git checkout error but does not change any compiled code, cryptographic logic, or device behavior. There is no security issue here.

Lower-prioritylibjade: accept non-literal tags in mocked ESP_LOG macrosby odudex · 121adaad · Jul 8, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · odudex

libjade: accept non-literal tags in mocked ESP_LOG macros

k_quirc logs with a 'static const char* TAG' tag, which the mocked
macros could not handle as they pasted the tag as a string literal.
Print it via %s instead, fixing the libjade host build.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This is a small build-fix change. The project has mock versions of ESP logging macros used when building on a regular computer (host build). Previously these macros treated the log tag as a string literal, which broke compilation when a module passed a variable tag. The patch changes the macros to print the tag via %s instead. There is no security issue here.

AI review queuedjade_cli: add selfcheck commandby Jon Griffiths · 32d3c9a7 · Jul 8, 2026 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Jon Griffiths

jade_cli: add selfcheck command

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit adds a new command-line command called 'selfcheck' to the Jade CLI tool. It simply calls an existing device function and prints the result. There is no indication of a security fix or vulnerability being patched.

Lower-priorityAdd TTGO T-Display backlight brightness controlby oroderico · b28e145c · Jul 8, 2026 · 4 filesMessage 45 · ThinInformational 15Details
Commit message · oroderico

Add TTGO T-Display backlight brightness control

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit adds a screen brightness control feature for the TTGO T-Display development board used with Blockstream Jade. It is a hardware-support change, not a security fix or vulnerability. There are no security signals in the code or commit message.

Lower-priorityci: avoid downloading artifacts for non-flash testingby Jon Griffiths · d786cefa · Jul 8, 2026 · 2 filesMessage 72 · AdequateInformational 15Details
Commit message · Jon Griffiths

ci: avoid downloading artifacts for non-flash testing

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit only changes CI (Continuous Integration) pipeline configuration. It tells certain automated test jobs not to download build artifacts from previous stages because those tests do not need them. There is no change to the actual Jade firmware, wallet logic, cryptography, or any code that users run.

Security candidateotp: add validation of URL-encoded strings in OTP contextby Mike Tolkachev · b0552c8e · Jul 3, 2026 · 3 filesMessage 50 · ThinLow 46Details
Commit message · Mike Tolkachev

otp: add validation of URL-encoded strings in OTP context

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · Low 46/100

This commit adds input validation to make sure the text shown in the OTP (one-time password) setup screen is properly URL-encoded and printable. It is likely a hardening fix to prevent malformed or sneaky label/issuer strings from confusing the user or causing unexpected behavior on the hardware wallet's screen, but the commit message does not call it a security fix.

Lower-prioritylog: move cbor message and read bytes logging to debug levelby Daniel Newton · 545fb1e7 · Jul 2, 2026 · 2 filesMessage 50 · ThinTriage 0Details
Commit message · Daniel Newton

log: move cbor message and read bytes logging to debug level

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-prioritydocs: update sign_tx docs to include genesis_hashby Jon Griffiths · b937de6f · Jun 29, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Jon Griffiths

docs: update sign_tx docs to include genesis_hash

Also remove trailing spaces for consistency.

72/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates documentation. It adds a description of an optional 'genesis_hash' parameter for Liquid transaction signing and removes trailing whitespace. There are no code changes, so it cannot directly introduce or fix a security vulnerability.

Security candidateLiquid (taproot): add sign_liquid_tx genesis blockhash supportby Jon Griffiths · 888eff30 · Jun 29, 2026 · 4 filesMessage 95 · StrongLow 42Details
Commit message · Jon Griffiths

Liquid (taproot): add sign_liquid_tx genesis blockhash support

Allow providing the genesis blockhash for sign_liquid_tx in
addition to the already existing sign_psbt support for PSET.

For test networks, do not require that the provided genesis blockhash
matches the network genesis blockhash. This allows signing for e.g.
custom regtest environments. Ensure that test network signing cannot
use the mainnet genesis blockhash in order to prevent spoofing.

Suggested-by: topologoanatom <survisysy@gmail.com>

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 42/100

This commit changes how Blockstream Jade handles the 'genesis blockhash' when signing Liquid transactions. Previously, the device only accepted the network's built-in genesis hash. Now it lets users provide a custom genesis hash for test networks (like regtest), but blocks attempts to use the real Liquid mainnet genesis hash on test networks to prevent spoofing. The change also applies the same validation to both PSBT/PSET signing and raw transaction signing. It appears to be a hardening/feature addition rather than a fix for an active exploit, but it does close a spoofing path on test networks.

Lower-priorityqemu: increase interrupt watchdog timeout on qemu to account for non realtime behavior due to CPU emulationby Daniel Newton · 65eb36c5 · Jun 25, 2026 · 2 filesMessage 62 · AdequateTriage 0Details
Commit message · Daniel Newton

qemu: increase interrupt watchdog timeout on qemu to account for non realtime behavior due to CPU emulation

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Explains rationale or failure mode! No meaningful explanatory body
Lower-priorityci: run only one qemu job per physical boxby Jon Griffiths · 18fdfd07 · Jun 25, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · Jon Griffiths

ci: run only one qemu job per physical box

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
AI analysis · Informational 15/100

This commit changes a CI/CD configuration file so that QEMU-based test jobs run on a dedicated GitLab runner tag (ga-qemu) instead of a shared one (ga). The stated purpose is to limit QEMU jobs to one per physical CI box, likely to avoid resource contention or hardware conflicts during automated testing. There is no change to the Blockstream Jade firmware, wallet logic, cryptography, or any code that end users run.

AI review queuedrpc: annotate functions returning error codes to ensure they are checkedby Mike Tolkachev · 517075ba · Jun 25, 2026 · 5 filesMessage 62 · AdequateLow 48Details
Commit message · Mike Tolkachev

rpc: annotate functions returning error codes to ensure they are checked

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Explains rationale or failure mode! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 48/100

This commit adds compiler annotations (WARN_UNUSED_RESULT) to functions that return success/failure codes, so the compiler will warn if a caller ignores the result. It also fixes a few places where return values were being ignored, replacing them with safer default-value helpers. The changes reduce the chance that a malformed or missing RPC parameter silently causes wrong behavior, such as using an empty wallet path or a false success flag. This is a defensive hardening patch rather than a confirmed exploit fix.