Blockstream Jade

This change cleans up temporary '.pin' test files after automated tests finish. It is a minor hygiene improvement in test code, not a fix for an exploitable product vulnerability. There is no indication these leftover files create meaningful security risk in normal use.

This commit is described as updating a submodule or external dependency called 'pinserver' to the latest master version. No actual code diff was provided, and there are no verified references explaining what changed in the pinserver update. Based only on the supplied materials, we cannot determine whether this update fixes a security issue, adds a feature, or is routine maintenance.

This commit only adds a code comment explaining an existing limitation in how Blockstream Jade detects Green multisignature transactions. No code behavior changes. The comment documents that for a specific 2-of-3 recovery wallet setup, the device may skip extra Green-specific validation and fall back to treating the transaction as a standard 2-of-3 multisig, but signing still works correctly.

This commit only adds a new test case and updates a description of an existing test. It does not change any production code. The new test documents that when a recovery key is provided with a full derivation path (from the master key), a Blockstream Jade device will still sign the transaction, but a helper function called is_green_multisig_signers() will return false, meaning some extra Green 2of3 validation is skipped. Because no actual signing logic is changed, this commit by itself is not a security fix or vulnerability.

This commit only adds a new test data file containing a sample Bitcoin transaction (PSBT) for a multi-signature wallet scenario. It does not change any actual wallet code, cryptography, or security logic. There is no indication of a vulnerability or security fix.

This commit changes a helper function that turns numeric Bitcoin key paths (like 0/1/2) into human-readable text. It adds an option to leave off the leading 'm/' so callers that only want the raw path can get it. All existing callers are updated to keep the old behavior (with the 'm/'), so there is no immediate change in behavior. It appears to be a code cleanup or preparation for a future feature rather than a fix for an active security problem.

This commit simply adds more information to an existing device status report (the 'get_version_info' RPC). It now reports whether tamper-evident attestation is active, the battery voltage, and whether the battery is charging. There is no change to security logic, access control, or cryptography. It is a routine telemetry/informational enhancement.

This commit is a cleanup of the device attestation code in Blockstream Jade, which is the cryptographic proof that the device is genuine. The changes fix a memory-management bug where sensitive key data could be cleared in the wrong order, correct a logic issue when debug mode is enabled, avoid repeatedly reloading attestation data from storage, ensure cryptographic keys are initialized before being freed, and move a large attestation data structure from the stack to the heap to prevent a possible stack overflow. Most changes are defensive hardening, but the SENSITIVE_POP ordering and the debug-mode logic fix are genuine security-relevant corrections.

This commit is a small internal code cleanup in a Bitcoin hardware wallet library. It replaces an if/else branch that chose between two similar key-lookup functions with a single function pointer. There is no change to what data is read, what keys are used, or what is returned to the caller. It is a stylistic refactor, not a security fix.

This commit is a pure variable rename inside a single function. The local variable `key_index` is renamed to `found_index` to make the code easier to read. No logic, behavior, or security properties change.

This commit changes how Blockstream Jade handles a private key used for PIN server authentication. Previously, the device kept the same private key even when the user changed or removed their PIN server settings. Now it deletes that key whenever the PIN server settings change, so a fresh key is generated the next time it is needed. This reduces the risk that an old or compromised key could be reused across different PIN server configurations.

This commit adds support for a new hardware variant called Jade Core (jade_v2c), which is a Jade Plus device without a camera or battery. The changes are purely build, configuration, release-script, and documentation updates to recognize the new board type. There is no indication of any security vulnerability being fixed or introduced.

This commit moves when a special device private key (used for PIN server authentication) is created. Previously it was generated at every boot if missing; now it is created only when actually needed during a PIN operation. This is a code-quality and reliability change that reduces unnecessary key creation at startup, but it does not appear to fix an active security vulnerability.

This commit updates the code that signs Bitcoin transactions for Blockstream Jade's Green multisig wallets. It specifically adds support for '2-of-3 recovery signing,' where the Jade device acts as the recovery key rather than the regular user key. The change lets Jade recognize and sign recovery transactions it previously would have rejected. There is no clear security bug being fixed; it appears to be a feature addition to support a missing signing scenario.

This commit changes how Blockstream Jade hardware wallets sign Bitcoin transactions in a specific multi-signature setup called Green 2of3. It lets Jade act as the 'recovery signer' by deriving a special recovery key from the user's key when the first key in the transaction looks like a Blockstream Green server key. The change is a feature addition to support a previously unsupported signing scenario, not a fix for a known exploit. There is no evidence in the commit or supplied references that this is a security patch or that it addresses a disclosed vulnerability.

This commit only updates the user documentation file FWUPDATE.md. It adds instructions for manually fetching firmware hashes, fixes grammar and style issues, and clarifies where to find published firmware metadata. No code, firmware, cryptographic, or security logic was changed.

This commit is a straightforward internal cleanup of how the firmware identifies different Jade hardware versions. It introduces broader 'any Jade v1/v2' configuration flags and replaces many scattered checks with simpler ones. There is no user-facing change, no bug fix, and no security alteration visible in the code.

This commit fixes the direction of PIN-entry wheel navigation on TTGO hardware variants of the Blockstream Jade hardware wallet so it matches the rest of the device's user interface. It is a device-specific usability fix, not a cryptographic or network security fix. There is no indication it allows an attacker to steal funds, bypass the PIN, or access private keys.

This commit fixes a boundary check in code that walks through parts of a Bitcoin transaction (PSBT). The old check allowed an index equal to the number of items, which is one too high. The commit message calls it 'harmless,' meaning it should not cause a real security problem in practice. It is a defensive correction to an assert that guards internal iteration.

This commit improves the on-screen error messages shown when a Blockstream Jade hardware wallet cannot generate a TOTP (time-based one-time password) code because the device does not know the current time. It does not change the security rules or fix a vulnerability; it only makes the failure message clearer to the user, suggesting they unlock the device with the Blockstream app to set the time.

This commit adds a new experimental developer/testing feature called libjade that lets the Jade hardware-wallet firmware be compiled and run as a normal Linux software library or daemon. It is explicitly marked as incomplete, not for real funds, and for development/testing only. There is no indication this is a security fix or that it addresses any vulnerability.

This change tightens a build-time signing script for Blockstream Jade hardware wallet firmware. It adds checks that the public-key digests recorded inside a signed binary match the digests of the keys that were actually used to sign it, and makes the script stop on any error. The patch is defensive: it reduces the chance that a corrupted or wrongly-signed firmware image is produced during release, but it does not by itself fix a vulnerability in already-shipped devices.

This is a tiny build-script change that replaces a silent failure with a clear error message when required signing key files are missing. It does not change what the script does, only what it prints when it fails. There is no security vulnerability here.

This commit fixes a subtle programming bug in the code that decodes base32 one-time-password (OTP) secrets. The bug involves shifting a signed integer left, which is undefined behavior in C and was caught by an undefined-behavior sanitizer. The fix changes the variable from a signed integer to an unsigned integer so the shift is well-defined. The practical security impact is likely low, but undefined behavior in cryptographic/OTP handling is generally undesirable because compilers may optimize it unpredictably.

This commit simply updates a dependency called 'wallycore' used by the Blockstream Jade PIN server from version 1.4.0 to 1.5.1. It changes the version number and the list of cryptographic fingerprints (hashes) that verify the downloaded package. The commit message does not say why the update was made or whether it fixes any security issue. Without knowing what changed between 1.4.0 and 1.5.1, we cannot tell if this is a routine maintenance update or a security fix.