Blockstream Jade

This commit simply renames an internal helper function from `rpc_get_uint64_t` to `rpc_get_uint64` and updates every place that calls it. There are no changes to what the function does, how it checks data, or how secure it is. It is a routine code cleanup with no security relevance.

This commit adds compiler annotations (WARN_UNUSED_RESULT) to functions that return success/failure codes, so the compiler will warn if a caller ignores the result. It also fixes a few places where return values were being ignored, replacing them with safer default-value helpers. The changes reduce the chance that a malformed or missing RPC parameter silently causes wrong behavior, such as using an empty wallet path or a false success flag. This is a defensive hardening patch rather than a confirmed exploit fix.

This commit adds convenience functions that read settings from CBOR messages and return a default value if the setting is missing or invalid. It is a straightforward feature addition with no visible security bug.

This commit tightens how Blockstream Jade handles the 'precision' value in asset contracts for Liquid assets. Previously, a very large precision value could be accepted and later used to read past the end of an internal lookup table (POW_10), which could cause a crash or undefined behavior when displaying or signing a transaction. The patch caps precision at 8 and adds a compile-time check that the lookup table is sized correctly for that cap.

This commit is a straightforward code cleanup that replaces verbose 'read this optional value, or leave the default' patterns with shorter helper functions that do the same thing. There is no change in behavior and no security issue visible in the diff.

This commit strengthens a security guardrail on Blockstream Jade hardware wallets by turning on the most thorough stack-smashing protection for production builds. Stack smashing is a common way attackers try to take control of a device by overflowing a memory region; enabling 'ALL' mode tells the compiler to insert checks on every function, rather than only risky-looking ones, making exploitation harder. It is a defensive hardening change, not a fix for a known active bug.

This commit fixes a race condition in the Blockstream Jade hardware wallet's camera and screen rendering code. When the camera task finished, its stack memory could be freed while the GUI task was still trying to draw the last camera image, potentially causing a crash or corrupted display. The fix adds a new function that safely clears the picture reference under a lock before the camera task's memory is released.

This commit simply updates the SHA256 digest of the 'blockstream/jade_builder' Docker image used for building and testing Jade in four configuration files. There is no code change, no disclosed security fix, and no evidence in the commit or supplied references that this update addresses a vulnerability.

This commit is a large feature/refactor patch for Blockstream Jade's libjade (a desktop emulator of the Jade hardware wallet). It adds RPC endpoints that let a host application read the emulated device's screen, push fake button presses, read/write all emulated flash storage (NVS), and feed camera frames. The README explicitly warns that these RPCs mean 'a libjade instance is NOT SECURE FROM EXTERNAL APPLICATIONS, and that SECRET DATA CAN BE READ FROM THE RUNNING FIRMWARE.' The change is intended for development/testing only, but it removes the option to build without GUI support and makes the GUI code always compiled in. The security relevance is therefore primarily about increased attack surface and accidental misuse of a testing tool, rather than a vulnerability in production hardware wallets.

This commit adds three simple file-like method declarations (readable, writable, seekable) to a Python class that communicates with a Blockstream Jade hardware wallet. The change appears to be a compatibility fix so the Jade interface object works correctly with newer versions of the cbor2 library, which may now expect these methods to exist. There is no obvious security vulnerability in the diff itself; it is a small API compatibility patch.

This commit fixes a user-interface navigation quirk on the M5StickC Plus 2 hardware for Blockstream Jade. When entering a PIN, the up/down button directions were not inverted to match the rest of the device's menus, making number entry confusing or inconsistent. There is no security vulnerability here—just a UI consistency bug.

This is a small compatibility fix for the Python Jade library so it works with both older and newer versions of the cbor2 serialization library. Newer cbor2 changed which exception it raises when data runs out, so the code now detects the available exception type and catches the right one. It is a robustness improvement rather than a fix for an active security vulnerability.

This commit simply updates the version of a Python library called cbor2 from 5.9.0 to 6.1.2 in the project's dependency list. There is no information in the commit itself saying this fixes a security problem. It is a routine dependency bump with no visible security relevance based on the provided materials.

This commit removes a custom bitmap-drawing function used only in the libjade build and makes that build use the same drawing path as other configurations. It is a code cleanup with no visible security relevance.

This commit fixes a small but real bug in Blockstream Jade's USB/serial message handling. A variable that decides whether a version-info message should get an immediate reply was not given a safe starting value. In C, that means it could accidentally contain leftover garbage data, causing the device to reply immediately when it shouldn't. The fix simply sets that variable to 'false' by default. This is a defensive hardening change; there is no public evidence it has been exploited.

This is a small fix to a developer helper script (format.sh) used during code formatting. It prevents the script from trying to move a temporary file into place when a configuration-file check fails or never creates that temporary file. The change is about avoiding a build-tool error, not about stopping an attacker or protecting user funds.

This commit adds compiler flags and helper macros to make the build fail whenever a function's return value is ignored without explicit intent. It is a hardening change, not a fix for a specific known bug. By enforcing that programmers check or deliberately discard return values, it reduces the chance that silent failures (for example, a failed security check or memory operation) slip into future code. There is no direct evidence in the commit that an existing vulnerability is being patched.

This commit is a preventive build-hardening change. It adds compiler annotations (WARN_UNUSED_RESULT) to many functions that return success/failure codes, so the compiler will warn if a caller ignores the result. The goal is to catch future bugs where an error return is silently dropped, but the commit itself does not fix any specific known bug or change runtime behavior.

This small change makes the 'precision' number in asset metadata optional, defaulting to 0 if missing. Previously, the code may have treated a missing precision field as a failure. The patch uses a wrapper that explicitly ignores any error from reading the field, which could hide unexpected parsing problems. There is no direct evidence this is exploitable, but silently ignoring errors can make future bugs harder to detect.

This commit tightens error handling when decoding the 'issuer' field of an OTP (one-time password) setup URI. Previously, a malformed issuer string could fail to decode silently; now the device shows an error and cancels the operation instead of continuing with potentially bad data. It also makes minor logging message changes and adds an assertion for the label/issuer decode in the display code.

This commit is a minor code cleanup in the USB storage feature of the Blockstream Jade hardware wallet. It changes two functions so they return nothing (void) instead of a true/false value, because the returned value was never actually used. There is no security-relevant change here.

This commit fixes a small but meaningful bug in how Jade, a hardware wallet, reads key paths from Bitcoin PSBT data. The code was passing the byte size of a buffer when it should have passed the number of 32-bit entries. Depending on how the underlying library interprets that value, this could lead to reading truncated paths, rejecting valid transactions, or possibly reading past the intended buffer. It is a defensive fix in security-sensitive parsing code, but the commit itself does not claim a specific exploitable vulnerability.

This commit adds a safety check to Blockstream Jade's 'sign identity' feature. Before the change, the device would accept any identity string a connected app sent. Now it rejects identities that contain non-printable or unusual characters. This reduces the risk that a malicious or buggy app could trick the user into signing an identity they did not intend to, or could smuggle control characters into a string shown on the device's screen.

This commit fixes a logic gap in how Blockstream Jade checks cryptographic commitments for transaction outputs during signing. Previously, the code treated a missing commitment the same as an invalid one, which could cause the device to reject valid transactions or accept improperly validated ones. The change aligns this code path with the existing sign_tx logic, making output commitment handling consistent and more secure.

This commit changes the declared return type of a transaction-signing helper function from a transaction-type code (TxType_t) to a simple success/fail boolean (bool). The function body already appears to return true/false, so the change fixes a type mismatch between the function's implementation and its header. In plain terms, the code was telling the rest of the program 'I return a transaction type' while actually returning 'yes/no' answers; this patch makes the two match. That kind of mismatch can confuse the compiler and, in rare cases, lead to wrong decisions about what kind of transaction is being signed, but the diff itself is tiny and only shows the declaration/header change, not the full function body or any callers.