Blockstream Jade

This commit explicitly sets the physical pins used for the device's main serial (UART0) communication on ESP32 chips. In newer ESP-IDF versions (from v5.5), the default pins are no longer assigned automatically, so without this change the serial port might not work at all or might map to unexpected pins. It is a hardware-configuration fix rather than a patch for an active security vulnerability, but misconfigured serial pins could in theory cause communication failures or expose debug traffic on unintended pins.

This commit updates two Python library version requirements in the Jade Python package's setup file. It raises the minimum required version of cbor2 (a data-serialization library) from 5.4.6 to 5.9.0, and updates the bleak Bluetooth library from 0.13.0 to 2.1.1 for the optional Bluetooth feature. The commit message gives no security reason for the change, and the diff alone does not show any vulnerability being fixed. It is most likely routine dependency maintenance, but pinning older, possibly insecure library versions can indirectly affect users if those older versions have known security flaws.

This update fixes a security gap in how Blockstream Jade signs Bitcoin transactions for a specific wallet type called Green 2of3. Previously, the device trusted the connected app to supply a recovery public key and might silently treat an output as 'change' going back to the user's own wallet. A malicious or compromised companion app could have supplied a fake recovery key, tricking the device into marking a payment to an attacker's address as safe internal change. The fix forces the user to manually verify such outputs on the device screen instead of trusting the app, matching the behavior already used for PSBT signing.

This commit simply bumps the version of a Python client library (jade-client) used by the project from version 1.0.37 to 1.0.40, and updates the corresponding cryptographic signature file. There is no indication in the commit itself that this is a security fix, vulnerability, or malicious change. It is a routine dependency update.

This commit updates the command-line tool for Blockstream Jade hardware wallets so that its 'sign transaction' command now requires additional pieces of information (the transaction inputs and any change output details) and formats its output as JSON. The change appears to be a normal feature/API update rather than a fix for a security vulnerability. There is no evidence in the commit that this was done to address a security issue.

This commit is a straightforward code cleanup. It replaces a verbose way of showing on-screen messages and errors with simpler helper functions, and fixes a spelling mistake ('re-encypt' to 're-encrypt'). There is no change to security logic, no bug fix, and no vulnerability addressed.

This commit simply moves existing production build configuration files from one folder (production/) into a subfolder (configs/production/). The contents of the files are unchanged, and only two helper scripts are updated to point to the new location. There is no change to the actual software behavior, security settings, or user-facing functionality.

This commit only adds automated security scanning steps to the project's continuous-integration (CI) pipeline. It does not change any firmware, application, or wallet code, and it does not fix a known vulnerability. It enables GitLab's built-in SAST, dependency-scanning, and secret-detection tools to run on future commits.

This commit is a small internal cleanup of how fonts are selected on the device's screen. It removes an unused second argument from the font-setting function and adds a minor caching shortcut so the same font isn't re-initialized repeatedly. There is no visible security change.

This commit simply deletes two unused font files and removes their references from a combined source file. It is a cleanup change with no security relevance.

This commit simply deletes a helper Python script used to capture image data from a Blockstream Jade hardware wallet. The commit message says the same task can now be done with jade_cli, so the old standalone script is no longer needed. There is no code change to the wallet firmware, no bug fix, and no security-related content in the diff or message.

This commit is a straightforward internal cleanup of how a hardware wallet's screen font lookup works. It rewrites a helper function to be faster and simpler, but does not change what the function does or fix any security problem. There is no indication this is a security patch.

This commit refactors how Bluetooth Low Energy (BLE) messages are handled in the Blockstream Jade hardware wallet so that BLE uses the same message-parsing path as USB serial and TCP (QEMU). Previously, BLE had a special 'reject_incomplete' flag that could discard buffered data when the buffer was full. The change removes that special-case logic and makes all input sources feed data the same way. The commit message frames this as a cleanup that enables future work on recovering from message-stream errors, not as a security fix. There is no direct evidence in the diff of an exploitable vulnerability, but unifying input handling reduces the chance of subtle BLE-only bugs such as partial-message truncation or inconsistent state.

This commit only changes a test file. It removes a workaround that previously skipped large QR code tests on Jade v1.1 hardware because of serial timeouts. The commit message says a separate fix now allows the device to process valid data received after a timeout, so the test skip is no longer needed. There is no change to production firmware or wallet security logic in this commit.

This commit only adds a new test case to the project's test file. It does not change any production code, fix a bug, or alter device behavior. The test checks that a hardware wallet correctly handles two messages sent back-to-back, even when the data is split across two writes and when a delay is inserted between the writes. There is no security issue in this change itself.

This commit refactors the code that reads incoming messages on a Blockstream Jade hardware wallet. The main change is that the device now checks up-front whether incoming bytes form a valid CBOR 'map' (a structured data format) before treating them as a real RPC command. It also changes how stale or oversized data is rejected. The commit message and diff do not claim to fix a specific security bug, but the refactor tightens input validation and removes some timeout-driven rejection logic. The test changes enable previously skipped message tests for the 'libjade' build.

This commit only changes a test file. It enables an existing buffer-overflow test to run against the libjade simulator and makes the test wait a little longer between message chunks. There is no change to the actual Jade firmware or wallet code, so it does not fix or introduce a security issue in the product itself.

This commit is a straightforward internal code cleanup in Blockstream Jade's message-receiving code. It merges two functions into one and removes a few redundant safety checks. The commit message explicitly says there are no functional changes, and the diff does not alter the actual message-handling logic or security boundaries.

This commit changes how message context is passed between functions in the Blockstream Jade hardware wallet firmware. Instead of copying the entire message context structure on the stack, functions now receive a pointer to it. The stated goal is to reduce stack memory usage. There is no direct evidence in the commit that this fixes an exploitable vulnerability, but reducing stack pressure can help prevent stack overflow crashes or corruption in a security-critical embedded device.

This change updates how the libjade test/development library feeds data into the Jade firmware's message handler. Previously, large messages could be rejected outright if they exceeded the input buffer. Now, data is fed in chunks, matching how real serial-port data arrives. The commit message says this is for testing real-world communication behavior, and it explicitly notes that Bluetooth message handling is still different. There is no direct evidence in the commit that this fixes an exploitable security bug.

This commit is a small memory-optimization cleanup. It removes several large, permanently allocated output buffers used only to send short 'message rejected' error replies, replacing them with a tiny temporary buffer on the function call stack. There is no direct security bug being fixed here; it is primarily a resource-saving change. However, using stack memory instead of heap memory slightly reduces the attack surface related to heap allocation misuse, and the new code is more careful about buffer sizes.

This commit fixes a bug in how Blockstream Jade processes incoming messages when a communication timeout occurs. Previously, if old, partial data was sitting in the buffer when new data arrived after a timeout, the code would discard the old bytes and move only the new bytes to the start of the buffer, potentially ignoring any complete message that could be formed by combining the old and new data. The fix changes the logic so that, after a timeout, the code still tries to process all bytes in the buffer together, only rejecting incomplete data if no complete message can be parsed. The commit also renames a parameter for clarity. There is no explicit vendor statement that this is a security fix, and no CVE or researcher attribution is present in the materials.

This commit only changes a test script. It increases the maximum allowed runtime from 60 minutes to 90 minutes when tests are run inside a QEMU emulator. There is no change to the actual Jade wallet firmware or any security-sensitive code.

This commit adds a test helper and command-line tool for capturing camera images from a Blockstream Jade hardware wallet during testing. It also adds a new QR code test case and resets the device clock after QR scanning tests. There is no security vulnerability here—this is purely testing/debugging infrastructure.

This commit is mostly a cleanup of how logging is set up on the device. It moves where the event loop is created, makes some log functions disappear when logging is completely disabled, and changes one error message to a less alarming one. The visible changes do not appear to fix a clear security bug, but they do remove a few rough edges that could make the device behave unexpectedly during boot or when logging is configured in unusual ways.