Blockstream Jade

This commit lets a Blockstream Jade hardware wallet automatically detect whether a transaction file is for Bitcoin or the Liquid sidechain (including test networks) when signing via QR codes or USB. Before, the wallet always assumed Bitcoin, which could cause it to fail or behave incorrectly when signing a Liquid transaction through those offline methods. The change itself is a feature fix and does not appear to introduce a security vulnerability.

This commit hardens the firmware signing script used when releasing Blockstream Jade hardware wallet firmware. It adds `set -e` so the script stops immediately if any command fails, and explicitly checks that the public and private key files exist before proceeding. Without these changes, the script could silently continue past errors (for example, if a key file was missing or a signing command failed), potentially producing or releasing firmware that was not properly signed. Proper signing is important because users rely on firmware signatures to verify that the software running on their device is authentic and has not been tampered with.

This commit adds a new build helper script that signs production firmware files with a private key during release testing. It does not change any device code, cryptographic checks, or user-facing behavior. It is purely a release-engineering convenience script.

This commit only fixes spelling mistakes inside code comments (for example, changing 'sufficent' to 'sufficient' and 'Explcitly' to 'Explicitly'). No actual program instructions were changed, so it cannot affect security or functionality.

This commit is a code cleanup in the user-interface layer of the Blockstream Jade hardware wallet. It removes repeated 'if timeout' checks around button-waiting loops and lets the shared helper handle the timeout case instead. The commit message explicitly says there are no functional changes, and the diff shows only structural simplification—no security-sensitive logic was altered.

This commit is a code cleanup: it pulls the logic for waiting on a button press into a single shared helper function so the same code isn't repeated in many places. The behavior is essentially unchanged. The only functional difference is that one screen (the mnemonic setup) now explicitly treats a timeout as an error in normal builds, whereas before it would have hit a generic assertion. This is a minor hardening improvement, not a security vulnerability.

This commit is a straightforward internal cleanup of the user-interface drawing code for the Blockstream Jade hardware wallet. It changes how solid-color background boxes (called 'fill nodes') are created so callers can specify a fill style and parent container in one function call instead of two. There is no indication this fixes or introduces any security issue.

This commit reverts a previous change that made the Jade Plus (ESP32-S3) camera use a higher VGA resolution. It returns all hardware variants to the lower QVGA resolution because QVGA was found to scan QR codes faster and more accurately on Jade Plus. It also removes the larger VGA test images and simplifies the output-message buffer size logic. There is no security fix or vulnerability here.

This commit fixes a bug in how Blockstream Jade signs Liquid Bitcoin transactions. When extra data ('additional_info') was provided for a transaction input, the hardware wallet was not updating its internal running totals of input amounts per asset. This could cause the device to miscalculate whether a transaction is balanced—potentially allowing a malicious or buggy host to trick the wallet into approving a transaction that silently moves more value than the user expects. The fix makes the wallet explicitly require and record the input's asset and amount in this code path.

This change only affects the project's test script. It deletes leftover test PIN files before running tests so developers don't get confused by stale data from earlier runs. There is no security issue in the product itself.

This commit blocks PSET (a privacy-enhanced Bitcoin transaction format) parsing on Blockstream Jade hardware wallets that lack extra RAM (SPIRAM). The change prevents the device from running out of memory while handling complex PSET data. It is a hardening/defensive fix rather than a clear exploit patch, because the commit message and diff do not describe an actual vulnerability—only a known resource limitation.

This commit updates the Python library that talks to the Blockstream Jade hardware wallet. It lets callers pass an optional extra data dictionary called additional_info when signing a Bitcoin PSBT, matching a feature already available for Liquid transactions. The change itself just forwards the new parameter to the device; it does not appear to fix or introduce a vulnerability on its own.

This commit only changes test code. It makes the test helper pass an optional 'additional_info' field through to the sign_psbt() function when it is present in test cases. There is no change to the actual signing code or wallet behavior, so it does not create or fix a security vulnerability.

This commit only adds new test cases for signing Liquid multisig transactions on the Blockstream Jade hardware wallet. It introduces two JSON test fixtures and a one-line change to include them in the test suite. There is no change to production code, no bug fix, and no security-relevant behavior.

This commit adds checks for the Liquid network's 'genesis blockhash' in a Bitcoin hardware wallet signing flow. It ensures the PSBT (Partially Signed Bitcoin Transaction) includes the correct network identifier before signing, and fills it in if missing. Without this, a specially crafted transaction could potentially trick the device into signing for the wrong Liquid network or into producing invalid Taproot signatures. The change is defensive and aligns with the ELIP-0101 specification.

This commit is a code cleanup in the transaction signing logic for Blockstream Jade hardware wallets. It splits one function into two: one that gathers output information and another that validates it. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a refactoring to make the code clearer and to allow future reuse in PSBT signing.

This commit blocks a specific kind of Bitcoin/Liquid transaction signing on the Blockstream Jade hardware wallet. It prevents 'swap' transactions from using 'taproot' inputs because the device's signature-calculation code does not yet safely handle that combination. Without the fix, a user might have been able to build a transaction that the wallet would sign incorrectly or in a way that could be exploited, potentially leading to loss or theft of funds in a swap.

This commit fixes how Blockstream Jade signs Liquid (Elements) Taproot transactions. Previously, the device used Bitcoin-style signature hashing for all networks, which is incorrect for Liquid Taproot. The fix passes a special 'Elements' flag when signing on Liquid so the signature hash matches Liquid's rules. Without this, signatures produced for Liquid Taproot transactions would be invalid or could potentially be produced using the wrong cryptographic formula, which in hardware wallets can sometimes lead to security issues like key leakage or signature-forgery attacks.

This commit adds Liquid swap signing support for PSBTs in the Blockstream Jade hardware wallet firmware. It also restructures cleanup paths so memory is freed correctly when validation fails. The change is a feature addition with defensive cleanup improvements, not a clear-cut security fix, but it touches code that protects user funds during transaction signing.

This commit is a pure code-style refactor. It flips a large 'if' block into an early 'continue' so the code inside is no longer deeply indented. The commit message explicitly says there are 'No functional changes'. No security issue is introduced or fixed.

This commit adds a safety check in the code that signs Bitcoin transactions. It ensures that when the wallet decides to produce a Taproot-style signature, the script being spent actually looks like a Taproot script, and vice versa. Without this check, a mismatch between the script type and signature type could potentially lead to incorrect signatures or unexpected behavior when signing transactions.

This commit is a code cleanup that moves the rules for which Bitcoin/Liquid 'sighash' flags are allowed into one shared helper function used by both signing paths. Before, the PSBT signing path only rejected non-ALL sighashes for non-Taproot inputs, while the direct sign_tx path had more detailed rules (for example, allowing SINGLE|ANYONECANPAY for partial Liquid swaps). Unifying the logic reduces the chance that one path accidentally allows a dangerous sighash. The change itself does not add new user-facing behavior; it is defensive hardening/refactoring.

This commit changes how a Bitcoin hardware wallet (Blockstream Jade) tracks which transaction inputs it needs to sign. Previously it stored a simple yes/no flag; now it stores the actual signature type requested by the PSBT (Partially Signed Bitcoin Transaction). The change is mostly a code-quality improvement, but it removes a place where the wrong signature type could silently be assumed. There is no direct evidence in the commit that an actual vulnerability was fixed, and no vendor security disclosure is present.

This commit refactors how the Blockstream Jade hardware wallet checks transaction fees when signing a PSBT. Previously, the fee was calculated and validated inside the PSBT-specific code. Now it uses a shared validation routine that is also used for regular transaction signing. The goal is consistency: the same duplicate-fee and fee-validation checks apply regardless of whether the user is signing a raw transaction or a PSBT. The commit removes several local fee checks (such as rejecting blinded fee outputs or unexpected fee asset IDs) and relies on the shared function instead. This is a code-quality and consistency improvement, not a clear-cut security fix, but it touches security-critical fee logic.

This commit is a straightforward code cleanup: it moves type and function declarations that were scattered across several files into a single new header file called sign_utils.h. There is no change to what the code actually does, only to how the source files are organized. It does not fix or introduce any security issue.