Blockstream Jade

This commit simplifies how a Blockstream Jade hardware wallet handles an over-the-air (OTA) firmware update reply received over USB. Previously, the code checked whether a CBOR boolean 'result' field existed and only updated the success flag if it did. Now it updates the success flag regardless of whether the field is present, and no longer treats a missing 'result' as a failure. This could mean a malformed or unexpected reply leaves the success flag set to its previous value rather than being explicitly cleared, potentially making an unsuccessful update appear successful.

This commit changes how firmware-update (OTA) messages are passed internally in the Blockstream Jade hardware wallet's USB code. Instead of using a helper that allocates extra memory and copies the message, the code now embeds a one-byte source tag at the start of a single fixed buffer and passes that buffer directly. The stated goal is to reduce memory fragmentation. The change itself does not obviously fix a security bug, but it removes a memory-allocation path during firmware updates, which could indirectly reduce the chance of update failures or instability caused by low memory.

This commit removes four lines of code from the USB mass-storage handling task. The deleted branch checked for two event flags that the surrounding logic already handles earlier, so it could never actually run. There is no indication this change fixes a security bug; it is a routine cleanup of dead code.

This commit is purely a rename: a variable called 'interface_semaphore' is renamed to 'interface_mutex' throughout the code because it is actually a mutex, not a semaphore. No behavior changes, no security fix.

This update fixes a boundary check in how Blockstream Jade handles wallet descriptors (the instructions that say how many keys are needed to spend funds). Previously, the device accepted descriptors with one more signer than its internal limit, which could cause memory corruption or unexpected behavior. The fix rejects oversized descriptors earlier and adds tests to confirm the boundary.

This commit fixes a small race condition in how USB event flags are set. Previously, two related event flags could be set in separate, non-atomic calls, meaning an observer might see only one flag update and miss the other. The patch combines the flags and sets them in a single atomic operation, ensuring consistent state. There is no direct evidence this is exploitable for security harm, but race conditions in event handling can theoretically lead to inconsistent USB host state.

This commit fixes a potential deadlock in the Blockstream Jade hardware wallet's USB mass-storage code. Previously, a protective lock was held while calling a user-provided callback function. If that callback tried to unregister itself (for example, during error handling), it would wait forever for the lock that was already held, freezing the USB task. The fix copies the callback details under the lock, releases the lock, and only then invokes the callback. It is a reliability and availability fix, not a direct theft-of-funds bug, but deadlocks in a hardware wallet's USB path can affect device responsiveness and error recovery.

This commit only fixes a few on-screen text labels and messages. It changes phrases like 'Setup Jade' to 'Set Up Jade', 'temporarily login using' to 'temporarily log in with', and 'Logout' to 'Log Out'. There are no code logic, security, or functional changes.

This is a small user-interface fix in Blockstream Jade's USB storage mode. It moves one line of code so that the 'please plug in USB device' screen is only set as the current screen when it is first created, not repeatedly every time the code checks for events. The change appears to prevent the screen from being reset/redrawn unnecessarily after help text is shown. There is no direct evidence in the commit that this is a security fix.

This commit only updates the README.md file to add clearer instructions for installing test dependencies (virtualenv, bluez-tools, and an additional requirements file). It is purely a documentation change with no code modifications.

This commit simply waits longer (about 3 seconds instead of 1 second) before showing a 'please insert USB device' prompt when a user plugs in a slow USB storage device. It is a usability fix, not a security fix.

This commit fixes a small user-experience bug in how Blockstream Jade's USB storage feature shuts down. Previously, the device had to wait for the user to physically unplug the USB storage device before it could finish turning off its USB libraries. The change now actively cuts power to the connected USB device so the software can detect it as 'unplugged' and complete cleanup automatically. There is no direct security vulnerability here; it is a robustness/usability improvement.

This commit changes how Blockstream Jade handles USB mass-storage events. Previously, a separate background task was created to process USB events, which caused a visible "Processing..." freeze on the device. The fix moves event handling into the existing task and makes it run in smaller, more frequent chunks. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a user-experience and stability improvement.

This commit adds extra on-screen logging and debugging messages for the USB storage feature. It does not change how the device protects keys or data, and it does not fix or introduce a security vulnerability. The new logging is disabled by default.

This change tightens a build-time signing script for Blockstream Jade hardware wallet firmware. It adds checks that the public-key digests recorded inside a signed binary match the digests of the keys that were actually used to sign it, and makes the script stop on any error. The patch is defensive: it reduces the chance that a corrupted or wrongly-signed firmware image is produced during release, but it does not by itself fix a vulnerability in already-shipped devices.

This is a tiny build-script change that replaces a silent failure with a clear error message when required signing key files are missing. It does not change what the script does, only what it prints when it fails. There is no security vulnerability here.

This commit adds a single missing header file include for FreeRTOS semaphore functions in the GUI source file. It is a straightforward build fix with no visible security relevance in the diff or commit message.

This commit fixes a low-level memory-handling issue in Blockstream Jade's CBOR encoding helper. When adding an empty byte string to a data map, the code previously could pass a null pointer to a memory-copy routine. The fix substitutes a dummy non-null pointer when the data length is zero, avoiding undefined behavior detected by AddressSanitizer. It is a defensive hardening change rather than a confirmed exploitable vulnerability.

This commit fixes a subtle programming bug in the code that decodes base32 one-time-password (OTP) secrets. The bug involves shifting a signed integer left, which is undefined behavior in C and was caught by an undefined-behavior sanitizer. The fix changes the variable from a signed integer to an unsigned integer so the shift is well-defined. The practical security impact is likely low, but undefined behavior in cryptographic/OTP handling is generally undesirable because compilers may optimize it unpredictably.

This commit changes how the QR code scanning box is sized on the Blockstream Jade hardware wallet. Previously, the scan area was based on how much of the camera image was shown on the device's screen plus a small extra margin. Now it uses the largest centered square that fits in the full camera image, minus a small margin. This is a UI/behavior adjustment, not a security fix.

This commit simply updates a dependency called 'wallycore' used by the Blockstream Jade PIN server from version 1.4.0 to 1.5.1. It changes the version number and the list of cryptographic fingerprints (hashes) that verify the downloaded package. The commit message does not say why the update was made or whether it fixes any security issue. Without knowing what changed between 1.4.0 and 1.5.1, we cannot tell if this is a routine maintenance update or a security fix.

This commit lets a Blockstream Jade hardware wallet automatically detect whether a transaction file is for Bitcoin or the Liquid sidechain (including test networks) when signing via QR codes or USB. Before, the wallet always assumed Bitcoin, which could cause it to fail or behave incorrectly when signing a Liquid transaction through those offline methods. The change itself is a feature fix and does not appear to introduce a security vulnerability.

This commit is a straightforward user-interface change for Blockstream Jade hardware wallets. It replaces a 'help' button with a 'brightness' button on QR code display screens and removes the now-unused help button code. There is no security-relevant change visible in the diff.

This commit fixes a user-interface help link in a QR code display menu. Previously, pressing the help button while viewing options for a displayed QR code would open a help page about scanning QR codes (blkstrm.com/scanjade), which is the opposite of what the user is doing. Now it opens the help page for the screen the user came from. There is no security issue here.

This commit hardens the firmware signing script used when releasing Blockstream Jade hardware wallet firmware. It adds `set -e` so the script stops immediately if any command fails, and explicitly checks that the public and private key files exist before proceeding. Without these changes, the script could silently continue past errors (for example, if a key file was missing or a signing command failed), potentially producing or releasing firmware that was not properly signed. Proper signing is important because users rely on firmware signatures to verify that the software running on their device is authentic and has not been tampered with.