Blockstream Jade

This commit only fixes spelling mistakes in code comments, changing the misspelled word 'implmentation' to 'implementation' across eight files. It does not change any actual program instructions, so it cannot affect security or functionality.

This commit fixes a hardware compatibility problem for one specific Blockstream Jade device variant (Waveshare S3 Touch LCD 2). It swaps the USB debug/serial interface from the chip's built-in JTAG controller to the TinyUSB software stack so Windows computers can recognize the device reliably. It also improves how the device detects whether it is running on USB power. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a connectivity and power-detection improvement.

This commit fixes the direction of PIN-entry wheel navigation on TTGO hardware variants of the Blockstream Jade hardware wallet so it matches the rest of the device's user interface. It is a device-specific usability fix, not a cryptographic or network security fix. There is no indication it allows an attacker to steal funds, bypass the PIN, or access private keys.

This commit changes one configuration line for a specific Jade hardware variant (Waveshare S3 touch LCD2). It turns on the USB JTAG serial feature, which is a normal debug/serial communication option for ESP32S3-based devices. There is nothing in the commit message, title, or diff that indicates a security fix, vulnerability, or malicious change. It appears to be a hardware-enablement or functionality fix.

This commit fixes the assignment of physical A and B buttons on two specific TTGO hardware boards used with the Jade crypto wallet. Previously, the button pins were swapped or set to invalid values, which could cause button presses to be misread or ignored. The fix corrects the pin mapping so the right physical button registers as the right logical action. There is no direct evidence in the commit that this is a security vulnerability, but in a hardware wallet, confusing or ignoring button confirmations could theoretically affect user confirmations of sensitive actions.

This commit only updates the project's automated GitHub build workflow. It adds a second build job for a newer hardware variant (Jade Plus), renames the existing job, updates the checkout action version, and changes the build commands to use a project switching script. There is no change to the firmware code that runs on the device, no change to cryptographic logic, and no indication of a security fix or vulnerability.

This commit only updates the README.md documentation file. It rewrites build and configuration instructions for developers, adds details about new device targets, and reorganizes sections. No source code, firmware logic, or security-sensitive behavior was changed.

This commit only fixes a typo in the release date for version 1.0.38 in the project's CHANGELOG file, changing '2025-13-26' (an invalid month) to '2025-11-26'. It does not change any software code, functionality, or security behavior.

This commit changes a compiler setting in four development configuration files for the Blockstream Jade hardware wallet. It switches the stack overflow protection level from 'STRONG' to 'ALL' for developer devices only. This is a defensive hardening step, not a fix for an active security flaw. There is no evidence in the commit of any vulnerability being patched.

This commit removes six pre-made debug configuration files for the Blockstream Jade hardware wallet. The project message says these debug settings can now be created on demand using a build script instead of being stored in the repository. The change itself is a cleanup and does not fix a vulnerability, but shipping debug configs that enable verbose logging and JTAG debugging could make it easier for an attacker to analyze or tamper with a device if those configs were accidentally used in a production build. There is no direct evidence in the commit of a security incident or exploit.

This commit is a performance tweak for the camera preview screen on Blockstream Jade hardware wallets. It skips updating the on-screen preview every second camera frame so the device can analyze more frames per second when scanning QR codes. There is no security-relevant change visible in the code.

This change is a developer tooling update. It makes the project's continuous-integration flash script work on local developer machines, not just the CI server. It adds fallback serial ports, creates a local Python virtual environment if one isn't present, skips Bluetooth testing if a Bluetooth tool is missing, and deactivates the virtual environment at the end. There is no indication this affects end-user security or the firmware itself.

This commit is a routine build-system cleanup. It changes how GitLab CI jobs select firmware configuration files, replacing inline shell commands with calls to a helper script called switch_to.sh. There is no indication this fixes or introduces a security vulnerability.

This commit simply loosens a test timeout in the project's automated test suite. It changes how long a self-check test is allowed to take, likely because the test was failing due to slower internal safety checks. There is no change to the actual device firmware or wallet security logic, and no security issue is introduced.

This commit fixes a boundary check in code that walks through parts of a Bitcoin transaction (PSBT). The old check allowed an index equal to the number of items, which is one too high. The commit message calls it 'harmless,' meaning it should not cause a real security problem in practice. It is a defensive correction to an assert that guards internal iteration.

This commit only swaps the order of two C keywords ('const static' becomes 'static const') and adds a missing newline at the end of a file. It is a cosmetic/compiler-warning fix with no functional or security change.

This commit only fixes spelling mistakes in comments, documentation, debug log messages, and a usage string. There are no code behavior changes, no security fixes, and no functional patches.

This commit updates a build configuration for a sub-component called bc_ur to support native (non-embedded) builds. The title and stats suggest a one-line change to a submodule or build file. There is no code diff available, no security-related language in the commit message, and no references linking this change to any security issue.

This commit simply shortens the text shown on screen when an over-the-air (OTA) firmware update fails on older 1.x displays. It changes strings like 'OTA_ERR_SETUP' to 'ERR_SETUP' so they fit better on small screens. There is no security change.

This commit is a minor compiler-level optimization. It tells the compiler to always inline a small helper function used when mapping QR code corners to image coordinates. There is no visible security relevance: no input validation, memory access, or logic changes are made.

This commit is a routine performance and portability cleanup in the QR-code recognition library used by Blockstream Jade. It replaces floating-point division operations with equivalent multiplication-by-reciprocal operations and adds explicit 'float' type casts to numeric constants. There is no security-relevant change: the mathematical results are intended to be identical, and no bounds checks, memory handling, or cryptographic logic is modified.

This commit adds an optional Wi-Fi logging feature to the Blockstream Jade hardware wallet. When enabled at compile time, the device can connect to a Wi-Fi network and stream its internal log messages over a TCP socket to a configured IP address and port. The feature is off by default and is intended only for development/debugging. It also includes extra profiling commands (like 'reset', 'stats', 'tasks') that can be sent over the same socket if another compile-time option is enabled. Because this feature can expose sensitive internal log data over a wireless network and includes remote commands, it could weaken security if accidentally enabled in a production build or used on an untrusted network.

This commit adds a new developer helper script that lets engineers switch between different Jade hardware build configurations. It does not change any firmware code, cryptography, or user-facing behavior. It only automates build setup steps that developers could already do manually.

This commit improves the on-screen error messages shown when a Blockstream Jade hardware wallet cannot generate a TOTP (time-based one-time password) code because the device does not know the current time. It does not change the security rules or fix a vulnerability; it only makes the failure message clearer to the user, suggesting they unlock the device with the Blockstream app to set the time.

This commit adds a new experimental developer/testing feature called libjade that lets the Jade hardware-wallet firmware be compiled and run as a normal Linux software library or daemon. It is explicitly marked as incomplete, not for real funds, and for development/testing only. There is no indication this is a security fix or that it addresses any vulnerability.