Blockstream Jade

This commit fixes the use of the "%zu" printf format specifier, which is not supported by the ESP32 toolchain used in this project. The unsupported format could cause log messages and user-facing strings to display incorrect or garbage values. The commit also adds a CI check to prevent future use of "%zu". There is no direct evidence in the commit that this caused a security vulnerability such as information disclosure or memory corruption, but it is a code-quality fix that removes undefined/unsupported formatting behavior.

This commit fixes cleanup in the one-time-password (OTP) code. Previously, if setting up the cryptographic hash context failed, the code could return without freeing that context, and temporary buffers holding sensitive counter/HMAC data were not always wiped. The change ensures the context is released on failure and wipes temporary buffers before returning. It is a defensive hardening fix rather than a clear exploitable vulnerability.

This commit fixes a small but real security hygiene issue in Blockstream Jade, a hardware wallet. A temporary buffer that holds a sensitive cryptographic hash (HMAC-SHA512 output used to derive child private keys) was not marked as sensitive memory. That means the buffer could be left uncleared in RAM after use, potentially leaking key material if an attacker could read device memory. The patch marks the buffer with SENSITIVE_PUSH so it is properly wiped with SENSITIVE_POP. It is a cleanup/fix, not a full exploit chain by itself.

This commit adds cleanup of a temporary memory buffer used when turning data into QR codes on the Blockstream Jade hardware wallet. The buffer could previously remain in memory after use, potentially leaving sensitive QR data behind for later code to read. The fix marks the buffer as sensitive and securely clears it after use.

This commit changes how Blockstream Jade handles its PIN server settings. Previously, changing the PIN server web address (URL) also wiped the device's private PIN encryption key, forcing the device to create a fresh one. The patch keeps the existing private key when only the URL changes, while still erasing it when the PIN server's public key changes. This avoids unnecessary key rotation and reduces the risk that a legitimate URL-only update silently breaks PIN security by generating a new key.

This commit is a documentation update for the do-it-yourself (DIY) hardware section of the Blockstream Jade project. It adds descriptions and photos for additional supported circuit boards and updates image file references. There are no code changes that affect security.

This commit adds size limits to several message-handling functions in the Blockstream Jade hardware wallet firmware. It caps how many asset records, transaction inputs/outputs, multisig signers, and BIP85 RSA digests a single RPC message can contain. The change appears to be a hardening patch: without these limits, an attacker or malformed host application could send an extremely large array and potentially exhaust device memory, cause long processing delays, or trigger memory corruption during signing and multisig registration. The patch also makes the array-length check happen earlier and more consistently across the code.

This commit only updates the project's CHANGELOG.md file to add release notes for version 1.0.41. It does not change any source code, build scripts, or configuration. The changelog text itself states that version 1.0.41 contains important security updates and thanks several security researchers, but this commit is purely documentation and does not implement any of those updates.

This commit simply bumps the version of a Python dependency called jade-client from 1.0.40 to 1.0.41, along with its matching cryptographic hashes and a fresh PGP signature. There is no code change visible here, and nothing in the commit message or diff indicates a security fix or vulnerability.

This commit fixes five spelling mistakes in documentation, code comments, and a script comment. None of the changes alter program behavior or affect security.

This commit copies the ESP-IDF 'esp_lcd' display-driver component directly into the Blockstream Jade firmware repository (a process called 'vendoring') at version 5.5.4. It adds about 8,700 lines of display-interface code for LCD panels using I2C, SPI, I80, RGB, and MIPI-DSI buses. The change itself is a build/dependency packaging step, not a fix for a known security bug. There is no indication in the commit message or diff that this is intended to address a security issue, and no external security references are provided.

This commit adds an official developer-only 'fakeprod' build mode for Blockstream Jade hardware wallets. It deliberately weakens several security settings (single signature, committed private keys, readable flash-encryption key, enabled JTAG and ROM download mode) so developers can easily flash and debug a production-like firmware. The commit and its documentation explicitly warn that this mode is NOT secure and must never be used on a real wallet. It is a development/testing feature, not a vulnerability in production firmware.

This commit hardens a URL-decoding helper in Blockstream Jade's firmware. It adds validation so malformed percent-encoding, embedded null bytes, control characters, and non-ASCII bytes are rejected instead of being silently decoded. A new 'dry run' validation function is also exposed so callers can check an encoded string before decoding it. The change is defensive: it reduces the chance that an attacker could smuggle dangerous characters into URLs or trick downstream code with truncated or malformed strings.

This change rewrites how a small QR-code scanning library allocates memory. Instead of one big 16 KB block, it now uses two separate 8 KB blocks, and it frees them in the reverse order they were allocated. The stated goal is to avoid memory-allocation failures on a small embedded device when memory is fragmented. The patch itself does not fix a known exploitable bug, but it touches memory allocation and pointer handling in code that processes untrusted QR images, so it has defensive-security relevance.

This commit tightens how Blockstream Jade reads output amounts from a Partially Signed Bitcoin Transaction (PSBT). Before, the code tried to read the amount directly without first confirming it was actually present. Now it checks whether the amount exists before reading it. This is a defensive hardening change that could prevent incorrect handling of missing or malformed PSBT output data during transaction signing.

This commit tightens how Blockstream Jade verifies a Bitcoin transaction file (PSBT) before signing. It now requires that every byte in the file is part of the transaction, with no leftover or trailing data allowed. Previously, extra bytes at the end could have been ignored, which might let a malicious or malformed PSBT hide unexpected content or influence how the device interprets what it is signing.

This commit reorganizes existing hardware design files for the original Jade device into a new subfolder and adds the open-source hardware design files for a new product, the Jade Plus. It does not change any software, firmware, or device behavior. There is no indication of a security fix or vulnerability being addressed.

This commit only moves and reorganizes existing test code. It adds a new helper to check whether the current transport is a specific type, moves a shared wait() function into a common test package file, and migrates a large set of low-level RPC tests into a new file. There are no changes to the actual Jade firmware, wallet logic, or production code, so this cannot introduce a security vulnerability in the shipped product.

This commit adds a new way to restore a Bitcoin wallet on a Blockstream Jade hardware device: instead of typing each recovery word, users can enter each word's one-based BIP39 number (for example, '1' for 'abandon'). The change also refactors the existing word-entry code and adds cleanup of sensitive on-screen state when the user exits. There is no direct evidence in the commit that this fixes an active security vulnerability, but it touches sensitive seed-recovery code and changes how user input is validated and cleared.

This commit refactors the on-screen digit-entry keypad in Blockstream Jade so callers can ask for shorter number fields (for example 4 digits instead of 6) and optionally cap the entered value. The existing 6-digit PIN and index entry behavior is kept unchanged. There is no direct evidence in the commit that this fixes an active security bug; it reads as a feature/generalization to support new UI flows such as entering BIP39 word numbers.

This commit is purely a testing infrastructure cleanup. It removes leftover command-line options and test files related to an older transaction-signing workflow, and makes sure temporary PIN files created during automated tests are cleaned up. There is no change to the actual Jade wallet firmware or its security behavior.

This commit updates a bundled dependency (libwally-core) to a newer release, but no actual diff content or release notes were provided. We cannot see what changed or whether any security issue is involved.

This commit fixes a boot failure on the M5CoreS3 hardware. A recent update to the underlying Espressif SDK (ESP-IDF v5.5) changed the rules for deleting an I2C bus: it now refuses to delete a bus that still has devices attached. The power initialization code was attaching two power-management chips to the bus and then trying to delete the bus without detaching them first, causing the device to abort boot. The fix simply detaches those two devices before deleting the bus. There is no security vulnerability here—it's a compatibility/bug fix for a crash-on-boot scenario.

This commit fixes a bug where the touchscreen driver failed to clean up internal handles when shutting down. On newer ESP-IDF firmware, this cleanup failure caused the device to panic and freeze during boot and when using the camera or QR scanner. The fix releases the touch and panel IO handles before deleting the I2C bus, preventing freezes and a memory leak. There is no evidence this is a security vulnerability or exploitable by an attacker.

This commit adds a screen brightness control feature for the M5StickC Plus2 hardware variant of the Blockstream Jade device. It is a hardware-support and user-interface change, not a security fix or vulnerability. There is no indication of a security issue in the code changes.