Blockstream Jade

This commit refactors how Bluetooth Low Energy (BLE) messages are handled in the Blockstream Jade hardware wallet so that BLE uses the same message-parsing path as USB serial and TCP (QEMU). Previously, BLE had a special 'reject_incomplete' flag that could discard buffered data when the buffer was full. The change removes that special-case logic and makes all input sources feed data the same way. The commit message frames this as a cleanup that enables future work on recovering from message-stream errors, not as a security fix. There is no direct evidence in the diff of an exploitable vulnerability, but unifying input handling reduces the chance of subtle BLE-only bugs such as partial-message truncation or inconsistent state.

This commit only changes a test file. It removes a workaround that previously skipped large QR code tests on Jade v1.1 hardware because of serial timeouts. The commit message says a separate fix now allows the device to process valid data received after a timeout, so the test skip is no longer needed. There is no change to production firmware or wallet security logic in this commit.

This commit only adds a new test case to the project's test file. It does not change any production code, fix a bug, or alter device behavior. The test checks that a hardware wallet correctly handles two messages sent back-to-back, even when the data is split across two writes and when a delay is inserted between the writes. There is no security issue in this change itself.

This commit refactors the code that reads incoming messages on a Blockstream Jade hardware wallet. The main change is that the device now checks up-front whether incoming bytes form a valid CBOR 'map' (a structured data format) before treating them as a real RPC command. It also changes how stale or oversized data is rejected. The commit message and diff do not claim to fix a specific security bug, but the refactor tightens input validation and removes some timeout-driven rejection logic. The test changes enable previously skipped message tests for the 'libjade' build.

This commit only changes a test file. It enables an existing buffer-overflow test to run against the libjade simulator and makes the test wait a little longer between message chunks. There is no change to the actual Jade firmware or wallet code, so it does not fix or introduce a security issue in the product itself.

This commit is a straightforward internal code cleanup in Blockstream Jade's message-receiving code. It merges two functions into one and removes a few redundant safety checks. The commit message explicitly says there are no functional changes, and the diff does not alter the actual message-handling logic or security boundaries.

This change updates how the libjade test/development library feeds data into the Jade firmware's message handler. Previously, large messages could be rejected outright if they exceeded the input buffer. Now, data is fed in chunks, matching how real serial-port data arrives. The commit message says this is for testing real-world communication behavior, and it explicitly notes that Bluetooth message handling is still different. There is no direct evidence in the commit that this fixes an exploitable security bug.

This commit changes how message context is passed between functions in the Blockstream Jade hardware wallet firmware. Instead of copying the entire message context structure on the stack, functions now receive a pointer to it. The stated goal is to reduce stack memory usage. There is no direct evidence in the commit that this fixes an exploitable vulnerability, but reducing stack pressure can help prevent stack overflow crashes or corruption in a security-critical embedded device.

This commit is a small memory-optimization cleanup. It removes several large, permanently allocated output buffers used only to send short 'message rejected' error replies, replacing them with a tiny temporary buffer on the function call stack. There is no direct security bug being fixed here; it is primarily a resource-saving change. However, using stack memory instead of heap memory slightly reduces the attack surface related to heap allocation misuse, and the new code is more careful about buffer sizes.

This commit fixes a bug in how Blockstream Jade processes incoming messages when a communication timeout occurs. Previously, if old, partial data was sitting in the buffer when new data arrived after a timeout, the code would discard the old bytes and move only the new bytes to the start of the buffer, potentially ignoring any complete message that could be formed by combining the old and new data. The fix changes the logic so that, after a timeout, the code still tries to process all bytes in the buffer together, only rejecting incomplete data if no complete message can be parsed. The commit also renames a parameter for clarity. There is no explicit vendor statement that this is a security fix, and no CVE or researcher attribution is present in the materials.

This commit only changes a test script. It increases the maximum allowed runtime from 60 minutes to 90 minutes when tests are run inside a QEMU emulator. There is no change to the actual Jade wallet firmware or any security-sensitive code.

This commit adds a test helper and command-line tool for capturing camera images from a Blockstream Jade hardware wallet during testing. It also adds a new QR code test case and resets the device clock after QR scanning tests. There is no security vulnerability here—this is purely testing/debugging infrastructure.

This commit simply renames the displayed issuer label for the Liquid Bitcoin token from 'peg-in' to 'federation' in the wallet's built-in asset list. It is a cosmetic string change with no security relevance.

This commit is mostly a cleanup of how logging is set up on the device. It moves where the event loop is created, makes some log functions disappear when logging is completely disabled, and changes one error message to a less alarming one. The visible changes do not appear to fix a clear security bug, but they do remove a few rough edges that could make the device behave unexpectedly during boot or when logging is configured in unusual ways.

This commit only updates QEMU emulator helper scripts and documentation. It renames a script from make-flash-img.sh to make_flash_img.sh, adds command-line options, updates README instructions, and removes an unused reboot script. There is no change to the actual Jade firmware or wallet security code.

This commit only turns on diagnostic logging for automated QEMU (emulated hardware) test runs in CI. It adds a new logger that writes messages to the emulated serial port, changes CI scripts to capture that output, and adjusts a build helper so the '--log' flag is allowed for QEMU builds. There is no indication it fixes or introduces a security vulnerability.

This commit changes how the QEMU emulator build of the Jade hardware wallet behaves when the firmware hits a critical error. Previously it would silently reboot; now it prints diagnostic information and halts. This is a developer/testing convenience change, not a fix for an exploitable security flaw in production devices.

This change only adjusts the project's automated test suite. It adds a one-second wait before sending a 'ping' check so the test hardware has time to finish background tasks before the test asserts it is idle. There is no change to the actual Jade firmware or wallet software that users rely on, and no security fix or vulnerability is present in the diff.

This commit only changes test code to print more helpful error messages when a test assertion fails. It does not modify the actual Jade wallet firmware or any production code. There is no security issue here.

This commit is a routine code cleanup in Blockstream Jade's QR message handling. It removes a helper function that added an extra memory allocation and copy, and instead lets callers reserve a leading byte directly when allocating the buffer. There is no indication this fixes a security bug; it appears to be an efficiency and consistency improvement.

This commit only changes how automated tests are run. It adds an option to run a random 33% sample of test cases when testing in a slow emulator (QEMU), in order to save CI time. It does not change any wallet, firmware, or cryptographic code that end users interact with.

This change simply adds a user-configurable timeout to a serial connection script used for firmware updates, and uses a longer timeout during automated testing in a simulated (QEMU) environment. There is no security issue here.

This commit is a straightforward maintenance change: it removes the old firmware-level gcov code-coverage support and switches to a new libjade-based coverage workflow. There is no security bug being fixed here, and no new attack path is introduced. The only user-visible change is that the 'GCOV' field is no longer reported in the get_version_info RPC response.

This commit adds a desktop GUI mode for testing the Jade hardware wallet firmware on a regular computer. It is a development/testing feature, not a change to the production firmware that runs on real Jade devices. The code introduces a new event-dispatching shim and lets a Python/Tkinter window drive the firmware's screen and buttons. There is no indication this fixes a security vulnerability; it is a tooling enhancement.

This commit only changes a release date in the project's CHANGELOG.md file. It does not modify any software code, security settings, or functionality. There is no security relevance.