Blockstream Jade

This commit only updates the project's CHANGELOG.md file, adding release notes for version 1.0.37. It does not change any source code, configuration, or executable files. There is no security-relevant change in the diff itself.

This commit only updates the project's CHANGELOG.md file. It documents what was added, changed, and fixed in firmware versions 1.0.36 and 1.0.37, but does not modify any source code, build scripts, or configuration. There is no direct security-relevant code change to review in this commit itself.

This commit simplifies how a Blockstream Jade hardware wallet handles an over-the-air (OTA) firmware update reply received over USB. Previously, the code checked whether a CBOR boolean 'result' field existed and only updated the success flag if it did. Now it updates the success flag regardless of whether the field is present, and no longer treats a missing 'result' as a failure. This could mean a malformed or unexpected reply leaves the success flag set to its previous value rather than being explicitly cleared, potentially making an unsuccessful update appear successful.

This commit only fixes a few on-screen text labels and messages. It changes phrases like 'Setup Jade' to 'Set Up Jade', 'temporarily login using' to 'temporarily log in with', and 'Logout' to 'Log Out'. There are no code logic, security, or functional changes.

This commit adds a single missing header file include for FreeRTOS semaphore functions in the GUI source file. It is a straightforward build fix with no visible security relevance in the diff or commit message.

This commit is a housekeeping rework of the project's continuous-integration (CI) build and test pipeline. It renames build stages, splits the GitLab CI configuration into smaller files, generates CI test configurations from developer configs, removes a substitute test device, and adds a release-staging script. There is no change to the wallet firmware's security logic, cryptography, or user-facing behavior.

This commit only fixes three spelling mistakes in code comments within a single source file. No program logic, variables, or security behavior was changed.

This commit updates a release signing helper script so the operator can optionally specify which serial port a connected Jade hardware device uses. It is a usability/operational change, not a fix for a software vulnerability in the device or wallet itself. There is no indication it addresses a security incident.

This commit fixes a trivial typo in a debug log message: a missing space between two words ('length ...and encoding' becomes 'length ... and encoding'). It has no effect on program logic, security, or behavior.

This commit fixes a minor user-experience and diagnostic issue in Blockstream Jade's transaction signing code. Previously, when the optional 'additional_info' block for Liquid transactions could not be parsed or validated, the device rejected the request without telling the caller exactly what went wrong. After the patch, the specific error message is passed back to the caller. There is no direct evidence this change fixes an exploitable security vulnerability.

This commit hardens how Blockstream Jade validates confidential (blinded) transaction data on Liquid. It moves and strengthens checks so that any asset/value commitment pair supplied by the caller must match the transaction actually being signed, and it removes redundant commitment fields from an internal data structure. The change is defensive: it reduces the chance that a malicious or buggy host could trick the hardware wallet into signing a transaction with mismatched blinding data.

This commit reorganizes how a hardware wallet stores temporary blinding proofs while validating a confidential transaction. It moves large proof data out of a small 'commitment' structure into a larger extended structure, and only copies the smaller validated data back to the caller. The stated goal is to reduce memory use, not to fix a security bug. There is no direct evidence in the commit that this prevents an exploitable vulnerability, but memory handling changes in security-critical code always warrant careful review.

This commit renames a function from get_commitment_data to params_commitment_data, moves a helper function earlier in the file to remove a forward declaration, and adds documentation comments. The commit message explicitly states there are no functional changes, and the diff shows only renaming, reordering, and comment additions with no logic changes.

This commit is a pure file rename: the contents of sign_liquid_tx.c were moved unchanged into a new file called sign_utils.c, and the build include list in amalgamated.c was updated accordingly. The diff shows exactly the same 649 lines deleted and added with no functional changes. There is no security-relevant change.

This commit is a straightforward code cleanup: it moves several on-screen confirmation function declarations from individual source files into a shared header file. There is no change to what the code actually does, no bug fix, and no security-related behavior change.

This commit simply moves an existing Bitcoin transaction fee confirmation function from one source file to another. The code logic is copied verbatim with no functional changes, so it does not fix, introduce, or change any security behavior.

This commit changes how the Blockstream Jade hardware wallet examines transaction outputs before signing a Liquid (Elements-based) PSBT. It now inspects outputs for confidential/unblinded asset and value data, detects scriptless fee outputs, validates that fee outputs use the correct policy asset, and rejects blinded fee outputs. Previously, the code only tried to identify 'change' outputs on Bitcoin-like transactions. The change appears to be a security hardening/fix for Liquid transactions, but the commit message does not explicitly call it a security fix.

This commit changes how Blockstream Jade hardware wallets parse PSET (a variant of Bitcoin's PSBT format used on the Liquid sidechain). Previously, parsing PSET data could crash the device because verifying confidential transaction proofs needs about 54 KB of temporary memory—more than the normal task stack provides. The fix runs PSET parsing in a temporary task with a larger 54 KB stack, while ordinary PSBT parsing stays unchanged. The commit also adds explicit recognition of the PSET magic bytes, whereas before Jade only checked for PSBT magic bytes and noted that PSET was not yet supported.

This commit adds user confirmation screens for Liquid (Elements) transactions in the Blockstream Jade hardware wallet. Previously, Liquid PSBT signing likely did not show the user the outputs and fee before signing, or used Bitcoin-only confirmation logic that did not properly handle Liquid assets. The change makes the device ask the user to confirm what is being spent and what fee is being paid before producing a signature. This is a security-hardening improvement rather than an obvious vulnerability fix, but the absence of such confirmation could have allowed malicious software to trick a user into signing an unwanted Liquid transaction.