Blockstream Jade

This commit tightens validation when a Bitcoin hardware wallet reloads saved 'descriptors' (recipe-like data that describes how coins can be spent). It changes several length checks from 'greater than' to 'greater than or equal to', and adds a cap on the number of stored values. The change prevents a stored descriptor from claiming a length exactly equal to the fixed buffer size, which could leave the buffer without a terminating zero byte and cause memory corruption or crashes when the data is later used. Because the data is reloaded from the device's own storage, exploitation likely requires an attacker who can already tamper with stored data or trick the user into registering a malicious descriptor.

This commit fixes a small but real bug in the device attestation setup code for Blockstream Jade, a hardware crypto wallet. When a one-time programmable security fuse failed to burn, the code used to exit immediately without releasing memory or undoing earlier setup steps. The fix makes it jump to a cleanup routine instead. The direct risk is mainly a resource leak or partial initialization state on a rare hardware failure, not an obvious remote attack.

This commit fixes a bug in the Blockstream Jade hardware wallet's attestation signing process. Previously, if signing the attestation challenge failed, the device would send an error message but then continue running the rest of the function anyway, potentially sending an invalid or uninitialized reply back to the caller. The fix ensures the function stops immediately after reporting the error.

This commit fixes a bug where a memory-backed file handle could fail to open, but the code immediately tried to use and close it anyway. If opening failed, the program could crash or behave unpredictably when handling asset contract data on a Blockstream Jade hardware wallet. The fix checks whether the file handle was created successfully before using it.

This change makes the Jade hardware wallet library wipe sensitive key material from memory when the library is stopped. Previously, stopping the library may have left private keys or seed data sitting in memory, which could be read by other software or later code running on the same device. The fix adds a single cleanup call when libjade_stop() runs.

This commit is a routine build-script maintenance change for the QEMU Docker container used to emulate the Jade hardware wallet. It merges two build commands into one so the ESP-IDF environment stays activated, and updates the container command syntax for newer Docker versions. There is no indication this affects the security of the actual Jade firmware or real devices.

This commit only updates the project's test file (test_jade.py). It adjusts test cases and adds new tests for how Bitcoin/Liquid wallet descriptors are parsed and validated, including new rules around SLIP-77 blinding keys on Liquid. There is no change to production firmware or wallet code in this commit, so it does not introduce or fix a runtime security vulnerability by itself.

This commit only adds a new test case to the device's self-check suite. It exercises Liquid Bitcoin descriptor parsing and checks that blinding keys and script outputs are produced correctly. There is no change to production code, no bug fix, and no security-relevant behavior change.

This commit adds support for Liquid confidential descriptors to the Blockstream Jade hardware wallet. It is a feature addition, not a fix for a known vulnerability. The code introduces new validation rules that reject non-SLIP77 blinding keys on Liquid and reject confidential descriptors on Bitcoin. It also shows the blinding key on the device screen during wallet registration and management. The feature is gated so it is only active in debug builds unless explicitly enabled at compile time.

This commit updates an internal dependency (libwally-core) to a newer version so that Blockstream Jade can support Liquid descriptors. No actual code changes are shown, and the commit message describes only a feature addition, not a security fix.

This commit only changes a test file. It fixes how a multi-signature wallet test is structured so that wallet registration happens inside the test loop and so that blinding-key and commitment checks run for each wallet separately. There is no change to the actual Jade firmware or wallet code that users rely on.

This commit only changes the project's internal test script. It adds a command-line option that lets developers run a subset of test cases by matching JSON fixture filenames with a glob pattern. There is no change to the actual Jade firmware, wallet logic, cryptography, or any code that end users run on the device.

This commit only adds three new test data files for the Blockstream Jade hardware wallet. The files are deliberately invalid Liquid Bitcoin swap transactions used to verify that the device correctly rejects bad asset summaries. No production code was changed, so this commit does not introduce or fix a security vulnerability by itself.

This commit fixes a bug in the Blockstream Jade hardware wallet where a function that tracks assets during transaction signing could fail silently. Previously, if an unexpected or wrong asset was encountered while building a summary of transaction inputs and outputs, the wallet ignored the failure and continued signing. The patch now checks the function's return value and aborts signing with an error. This could have allowed a malicious or malformed transaction to bypass the wallet's balance checks, potentially misleading the user about what assets were actually being moved.

This commit updates a list of Python helper libraries used by the project, mainly to keep them in line with another related project called 'pinserver'. The changes bump versions of common networking and code-style packages (pycodestyle, idna, certifi, urllib3, charset-normalizer, requests). There is no direct evidence in the commit that this fixes a specific security vulnerability, but updating dependencies—especially urllib3 and requests—often includes routine security patches. The commit message does not describe a security issue.

This commit updates a submodule or external dependency called 'pinserver' to the latest master version in the Blockstream Jade hardware wallet project. The actual code changes are not visible because the diff is unavailable. Without seeing what changed in pinserver, we cannot determine whether this update fixes a security issue, adds a feature, or is routine maintenance. The title suggests it is a routine dependency update.

This commit only changes internal CI (continuous integration) configuration. It comments out automated test jobs that flash firmware onto older Jade v1.0 hardware because those devices do not reliably reboot during testing. There is no change to the product firmware, no user-facing change, and no security fix or vulnerability patch.

This commit reworks how a Blockstream Jade hardware wallet labels transaction outputs. The key change is that the 'change' flag is now only set when the output is also confirmed as belonging to the wallet ('is ours'). Previously, downstream code had to check both 'validated' and 'change' bits to safely hide a change output; now it can rely on the 'change' bit alone. The commit also renames the flag from VALIDATED to IS_OURS and adds comments. The stated intent is to prevent a change output from being marked as change unless it is also confirmed as a wallet output, which could reduce the risk of an attacker tricking the device into hiding a payment to an external address.

This commit simply updates the version of the Espressif build tools used by automated GitHub test builds from v5.4 to v5.5.4. It is a routine CI/CD maintenance change with no visible security relevance.

This commit is a routine build-system update that renames several ESP-IDF configuration options to match the names used in ESP-IDF version 5.5. It does not change any actual behavior or security settings of the firmware. The old and new configuration names control the same features, so this is purely a compatibility change.

This commit simply updates the version of Espressif's ESP-IDF development framework used to build Jade's Docker builder image, from v5.4.3 to v5.5.4. There is no indication in the commit of any security issue, vulnerability, or functional code change.

This is a routine build-system update. It changes the Dockerfile to use a newer internal base image and a newer version of Espressif's ESP-IDF toolchain. There is no indication of a security bug, vulnerability fix, or malicious change in the commit itself.

This is a large update that pulls in Espressif's ESP-IDF v5.5.4 bootloader code, plus Blockstream's own multi-signature secure-boot patches. Most of the visible changes are routine: support for newer ESP32 chips, larger flash sizes, and a new Trusted Execution Environment (TEE) mode. There are also several security-hardening touches, such as preventing the TEE from writing or erasing its own active flash partition and adding anti-fault-injection checks. However, the commit is a broad vendor SDK refresh rather than a single focused security fix, and the diff provided is only a partial sample of the whole change.

This commit explicitly sets the physical pins used for the device's main serial (UART0) communication on ESP32 chips. In newer ESP-IDF versions (from v5.5), the default pins are no longer assigned automatically, so without this change the serial port might not work at all or might map to unexpected pins. It is a hardware-configuration fix rather than a patch for an active security vulnerability, but misconfigured serial pins could in theory cause communication failures or expose debug traffic on unintended pins.

This commit changes a build configuration script for the ESP32 version of Blockstream Jade. When Wi-Fi logging is enabled, the script now places some FreeRTOS operating system functions into flash memory instead of fast internal RAM (IRAM). The stated reason is to free up IRAM space so the firmware can compile. This is a build tooling change to avoid a linker memory overflow, not a fix for an exploitable security vulnerability.