Blockstream Jade

This commit adds a new build-time setting (CONFIG_LOG_CBOR) that is off by default. Previously, the Jade hardware wallet could send log messages over its serial interface; now that behavior is gated behind an explicit opt-in flag. The change reduces the risk that diagnostic logs leak sensitive information over the serial port in normal production builds.

This commit only edits the project's changelog. It adds a note saying version 1.0.38 contains important security updates and thanks an outside security research group called DARKNAVY. The actual code fixes are not shown in this commit, so we cannot evaluate what the security problem is or how serious it is from the diff alone.

This commit changes the build tooling that creates over-the-air (OTA) firmware update patches for the Blockstream Jade hardware wallet. It now refuses to generate a delta patch if the patch would be larger than half the size of the full new firmware, unless the caller explicitly uses a new '--force' flag. The CI scripts were updated to pass '--force' for their existing self-to-self test patches, so those tests still run. The change is a build/operational hardening measure: it prevents the release pipeline from shipping oversized delta updates that could be inefficient or potentially problematic, but it does not by itself fix a runtime vulnerability in the device.

This is a small fix to a release verification script. Previously, the script would try to compare a firmware file against its expected hash even when the hash file was missing, which could cause the script to crash or behave unpredictably. Now it only performs the comparison when the hash file actually exists. This is a build/release hygiene improvement rather than a fix for an active security vulnerability in the device itself.

This commit only updates the project's CHANGELOG.md file, adding release notes for version 1.0.37. It does not change any source code, configuration, or executable files. There is no security-relevant change in the diff itself.

This commit changes the build settings for all production variants of the Blockstream Jade hardware wallet to set a 'secure version' to 1. This is part of the device's anti-rollback protection: once this version is set, the bootloader will refuse to run older firmware that has a lower secure version. On its own, this change does not fix a bug or add a feature users interact with; it is a build-time policy change that affects which firmware versions the device will accept in the future. It could be a routine hardening step, or it could be a response to a known vulnerability that the vendor wants to ensure cannot be exploited by downgrading to an older, vulnerable firmware. The commit message and diff do not say which is the case.

This commit is a straightforward user-interface cleanup: it removes pre-made QR guide corner images and instead draws the same corner guides directly using simple rectangles. There is no security change visible in the code.

This commit only updates the project's CHANGELOG.md file. It documents what was added, changed, and fixed in firmware versions 1.0.36 and 1.0.37, but does not modify any source code, build scripts, or configuration. There is no direct security-relevant code change to review in this commit itself.

This commit is a major internal rewrite of how Blockstream Jade handles USB storage and firmware updates over USB. It simplifies the code, removes several old synchronization mechanisms, and adds timeouts and better error handling. The changes appear to be defensive hardening and reliability fixes rather than a patch for a known active security flaw. There is no mention of a CVE, security advisory, or external researcher in the commit itself.

This change only adjusts the project's automated build pipeline to include an extra configuration file (sdkconfig.defaults) in the published firmware build artifacts. It does not modify the actual firmware code, device behavior, or security controls. There is no indication of a security vulnerability or fix.

This commit is a simple rename of a function from usb_connected() to usb_is_powered() across 18 files. There are no logic changes, no security fixes, and no behavioral differences. It appears to be a code-clarity refactor to make the function's purpose clearer.

This commit refactors the firmware-update (OTA) error-handling code in Blockstream Jade so both the normal and delta update paths use the same cleanup logic. The stated goal is to avoid replying when there is no current message or replying to the same message twice. The change centralizes final checks and error replies, but the diff alone does not prove a specific exploitable vulnerability; it looks like a defensive code-quality fix.

This commit restructures how a Blockstream Jade hardware wallet confirms firmware updates. It moves the 'user has approved' flag into the validation routine itself and adds a safety check: if the first chunk of firmware data is smaller than expected, the device now aborts rather than risk skipping the user-approval step. The change is defensive hardening, not a confirmed exploit fix, because the commit message only calls it a theoretical case.

This commit fixes three places in the firmware update (OTA) code where an error was recorded but the code kept running instead of jumping to cleanup. After an update error, the device could continue to process messages and potentially finalize or report a successful update when it should have aborted. This is a logic bug in error handling that could lead to a corrupted or incomplete firmware being accepted.

This commit is a code cleanup that rewrites how the Blockstream Jade hardware wallet handles firmware updates. It moves all update-related state into a single heap-allocated structure and makes the cleanup logic more consistent. The change itself is a refactor, not an obvious security fix, but it touches sensitive firmware-update code where mistakes can have serious consequences. There is no direct evidence in the commit message or diff that a specific vulnerability was being fixed.

This commit moves the 'success' handling of firmware updates (sending an OK reply, showing a success message, and rebooting) into a shared helper function called ota_finalize(). Previously, this success logic was duplicated in two places after calling ota_finalize(). The change is a code cleanup and does not appear to alter security behavior, but it does mean the success path now lives inside the finalization routine rather than after it returns.

This commit refactors how firmware update finalization works in the Blockstream Jade hardware wallet. Previously, the final verification and boot-partition switch only ran if the update had already been marked successful. Now the finalization routine always runs and sets the success/failure status itself. The change is mostly a code-cleanup, but it removes a guard that could have silently skipped final checks when an earlier error was already recorded. There is no direct evidence in the commit that this fixes an exploitable vulnerability, but it hardens the OTA flow so that final verification and boot-partition selection are consistently applied.

This commit fixes a bug in the firmware update (OTA) code for Blockstream Jade hardware wallets. Previously, if the device received an unexpected message after a firmware upload whose size did not match expectations, it could return without sending an error reply to the host. The fix ensures the device always sends an error response in those cases, so the host app knows something went wrong instead of being left hanging.

This commit is a straightforward internal code cleanup in the firmware update (OTA) module. It removes an unnecessary layer of pointers inside the OTA context structure, storing values directly instead of pointing to separate local variables. There is no indication this fixes a security bug or changes security behavior.

This commit changes how a USB storage callback is unregistered when a background task shuts down. Instead of directly clearing two internal variables while holding a mutex, the code now calls the existing registration function with NULL values. This is a cleanup/refactoring change that likely fixes a potential race condition or inconsistent state, but the diff alone does not show an exploitable vulnerability.

This commit fixes a small user-interface bug in Blockstream Jade's USB storage mode. When a user plugs in a USB drive and the device mounts it, the code now restores the previous on-screen activity before running the requested action. It also swaps a generic message screen for a proper error screen when USB storage fails, and removes an unnecessary short delay after an earlier error. There is no clear security vulnerability being patched here; it reads as a UI polish and robustness improvement.

This commit changes how a Blockstream Jade hardware wallet reads firmware update files from USB storage. It switches from using standard C file reading (fopen/fread/fclose) to lower-level Unix file reading (open/read/close). The stated goal is to reduce memory overhead and buffering during over-the-air (OTA) firmware updates. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a performance or robustness improvement.

This is a one-line fix to a GitLab CI configuration file. It changes the path used to copy a default developer build configuration file so the CI pipeline can find the correct file. There is no indication this affects the security of the Jade firmware or user funds.

This commit refactors the code that handles firmware updates over USB on the Blockstream Jade hardware wallet. The main goal is to make the update process more robust: it now waits for replies from the update process in a more sensible order, adds a timeout so the device doesn't get stuck forever if the update process stops responding, and cleans up error handling. There is no direct evidence in the commit that this fixes a specific security vulnerability, but it does remove risky behaviors like infinite waits and improves reliability during a sensitive operation (firmware updates).

This commit fixes a race condition in the way Blockstream Jade handles USB storage state. Previously, the device could read the USB storage state while it was being updated by another task (a 'dirty read'), which could lead to incorrect decisions such as trying to use a USB drive before it was fully mounted, or missing an error. The fix introduces a mutex (a locking mechanism) so that reads and writes of the USB state cannot happen at the same time. It also increases the wait time before prompting the user to insert a USB device from about 3 seconds to 5 seconds.