CommitWatch RSS
CK
← All projectsCoinkite

COLDCARD firmware

Open-source firmware for COLDCARD Bitcoin signing devices.

BitcoinHardware walletsActive incident
Source repository ↗
Repository coverage

468 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

137security candidates209second-pass queue413AI analyses
59commits · 30 days
184commits · 60 days
253commits · 180 days
386commits · 365 days
Backfill bands
Aug 5 → Feb 6148 seen2 candidatesComplete
Feb 6 → Jun 684 seen8 candidatesComplete
Jun 6 → Jul 649 seen4 candidatesComplete
Jul 6 → Aug 525 seen4 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

36/100 average clarity
10Strong · 80–100
45Adequate · 60–79
195Thin · 40–59
218Opaque · 0–39
42security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
scgbckbone2551112271643
Peter D. Gray17020162818
Dmitry Monakhov212173
@Bibo-dochex923042
kdmukai111050
doc-hex111073
Piotr Duszynski111073
tadeubas606051
copilot-swe-agent[bot]504072
Danilo500079
hitechhayekian301081
Copilot300074
Analysis record

Published AI watches

Last scanned 30 minutes ago

Moderate 59 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Harden PSBTv2 parsing

This commit tightens how COLDCARD reads PSBTv2 (Partially Signed Bitcoin Transaction version 2) files. It now rejects several malformed or ambiguous encodings that could previously be accepted: extra key data attached to fields that should…

PSBT parser hardeningrejection of non-canonical compact-size encodingsenforcement of singleton key-data emptiness
5e0dbd0eby scgbckbone+90−113 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

PSBTv2 per input required lock time calculation

This commit adds support in the COLDCARD firmware for a newer Bitcoin transaction format feature (PSBTv2) that lets each input specify its own required lock time. Before this change, the device did not correctly compute the final transacti…

PSBTv2 per-input locktime parsing and validation addedBIP-370 required locktime computation implementedIncompatible height/time locktime requirements rejected with assertion
2ea2e791by scgbckbone+191−336 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 91 · Strong
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add regression test for non-object JSON message-sign input

This commit only adds a new automated test to the COLDCARD firmware test suite. The test checks that when a user tries to sign a text file containing valid JSON that is not a JSON object (for example, a plain number, string, null, or list)…

Regression test for input validation of JSON message-signingTest comment explicitly references avoiding a device crash on malformed JSON inputTest requested during review of pull request #808, suggesting prior related code change
adb7baa8by copilot-swe-agent[bot]+32−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 56 AI analysisMessage 50 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

hygiene: duress wallet activate - wipe before getting slot data

This commit is a defensive hygiene fix in the COLDCARD hardware wallet's 'trick PIN' duress-wallet feature. It moves a memory-wipe routine so that it runs before the device looks up the duress wallet slot. The change reduces the window in …

secret-handling order-of-operations changeDelta Mode coercer/wipe scenarioduress wallet secret loading
aa645247by scgbckbone+3−31 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 41 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

OVC clear stale outputs from new_outputs

This firmware update fixes a cleanup issue in the COLDCARD wallet's transaction signing code. Before finalizing a new Bitcoin transaction, the device now clears out leftover 'change output' records that may have been captured during a prev…

State not reset between signing attemptsStale change-output metadata reused in transaction finalizationOVC (Output Value Check) validation may be affected by leftover data
62163ccdby scgbckbone+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Drop ValueError message string to save flash space

This commit removes a human-readable error message from a ValueError exception to reduce the amount of flash storage used by the firmware. It is a minor code cleanup and does not change the security behavior of the code. The function still…

dc89513cby copilot-swe-agent[bot]+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 60 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add changelog entry for msgsign JSON crash fix

This commit only adds a changelog note saying a previous fix stopped the COLDCARD hardware wallet from crashing when a message-signing request was valid JSON but not a JSON object (for example, a number or string instead of a dictionary). …

Device crash on malformed message-signing inputInput vector includes NFC, QR, and SD card JSON filesValid JSON but wrong type (non-object) bypasses simple format checks
07afee0dby copilot-swe-agent[bot]+3−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Fix uncaught AttributeError on non-object JSON in parse_msg_sign_request

This commit fixes a bug where the COLDCARD firmware's message-signing feature would crash with an uncaught error if a user supplied valid JSON that wasn't a structured object (for example, a plain number, string, list, or null). The fix ch…

uncaught exception in message parsing pathinput validation gap on JSON typepotential denial-of-service via malformed request
d55ddbceby copilot-swe-agent[bot]+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Signed for mk release.

This commit only updates the release signature file (signatures.txt) for the COLDCARD firmware. It adds two new file hashes for a v5.6.2-mk release and refreshes the PGP signature covering the file. There are no code changes, no bug fixes,…

e6d01c36by Peter D. Gray+10−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Signed for q1 release.

This commit only updates a release signature file. It refreshes SHA-256 hashes for changelog files and adds hashes for two new firmware release files, then re-signs the file with a PGP signature. There are no code changes, no bug fixes, an…

a310e1ddby Peter D. Gray+16−141 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update block height

This commit simply updates a stored Bitcoin blockchain height number from 965,337 to 965,338. It is a routine, automatically generated data refresh with no code logic changes and no apparent security relevance.

3caf599eby Peter D. Gray+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

new policy w blank lines

This commit only edits the project's internal release notes file. It replaces a detailed list of upcoming changes with placeholder 'tbd' entries and adds a note asking contributors to leave blank lines between additions. There are no code …

3d8f90f1by Peter D. Gray+9−561 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update for new release

This commit is a release-notes-only update for the COLDCARD hardware wallet firmware. It moves many security-relevant bug fixes and hardening items from the current changelog into the historical release notes for versions 5.6.1 and 1.5.1Q,…

USB protocol encryption upgrade (ncry v3) with direction-separated keys and replay protectionPSBT tampering detection: re-verify staged bytes before signing after Virtual Disk overwriteFirmware update integrity: abort if staged image overwritten, reject images extending past world-checksum region
ea2b89bfby Peter D. Gray+272−1124 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

update block height

This commit simply updates a stored Bitcoin blockchain height number from 963,314 to 965,337, along with its timestamp. It is an automatic, routine data refresh with no code logic changes and no apparent security relevance.

15deb2f6by Peter D. Gray+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 73 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: report staged firmware modification at upgrade approval

This commit fixes a bug in the COLDCARD firmware upgrade process. Previously, if someone tampered with the staged firmware after the user saw the approval prompt but before they confirmed, the device would crash with a bare internal error …

Tamper-detection failure path hardened: assert replaced with user-facing failure storyDefense-in-depth assertion added to PIN-changing flowTest coverage added for tamper-abort message
ef73cf58by scgbckbone+6−64 files
No security note in commit
Open full analysis →Source commit ↗
Informational 2 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bump ckcc to latest master

This commit only updates a linked external code library (a Git submodule called ckcc-protocol) to a newer version. The actual code changes inside that library are not shown in the commit diff, and no security-related information was provid…

ec1c9417by scgbckbone+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 0 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

tweaks

This commit only edits the draft release changelog file. It rewords two upcoming feature descriptions and fixes line wrapping for another entry. No source code, firmware logic, or security behavior was changed.

e166ffddby Peter D. Gray+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: reject non-ASCII BIP-39 passphrases

This update fixes a bug where COLDCARD wallets would accept BIP-39 passphrases containing non-ASCII characters (like accented letters or emojis) or non-printable characters. Because different wallet software normalizes such characters diff…

Behavioral fix that prevents silent derivation of incompatible wallet seedsInput validation added for BIP-39 passphrase across USB, UI, saved-passphrase restore, and note/password lanesRejection of non-printable ASCII and non-ASCII Unicode characters
c1a67660by scgbckbone+155−147 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 74 AI analysisMessage 60 · Adequate
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: capture single-sig segwit change

This commit fixes two related security bugs in the COLDCARD hardware wallet's protection against a known 'BIP-143 amount swap' attack. First, the wallet was recording the claimed amount of a segwit input to its secure cache as soon as a tr…

Fixes deferred persistence of UTXO amount cache until after successful signingFixes missing capture of single-sig segwit change outputs (p2wpkh and p2sh-p2wpkh)Prevents cache poisoning by cancelled/malicious PSBT previews
8979a8a5by scgbckbone+322−806 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 66 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

bugfix: Reject duplicate singleton PSBT keys

This update fixes a bug in how the COLDCARD wallet reads PSBT files (the standard format for passing Bitcoin transactions between devices). Previously, if a PSBT contained the same special 'singleton' key twice in the same section, the dev…

PSBT parser now rejects duplicate singleton keysNew test cases for duplicate keys in global/input/output mapsChangelog labels the change as a bugfix
cb6df8daby scgbckbone+30−13 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidatebugfix: use write counter for firmware approvalby scgbckbone · 11fcadc6 · Aug 27, 2026 · 5 filesMessage 45 · ThinHigh 74Details
Commit message · scgbckbone

bugfix: use write counter for firmware approval

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
authentication path
AI analysis · High 74/100

This update fixes a security bug in the COLDCARD hardware wallet's firmware upgrade process. Previously, an attacker could potentially swap the staged firmware image while the user was still reviewing the upgrade approval screen. The device now uses a write counter to detect if the staged firmware image was overwritten after it was shown to the user, and aborts the upgrade if so. The change log credits Huzaifa Jawaid for the finding.

Security candidatebugfix: restrict HSM BIP322 WIF signingby scgbckbone · fb2f6da7 · Aug 27, 2026 · 3 filesMessage 45 · ThinModerate 62Details
Commit message · scgbckbone

bugfix: restrict HSM BIP322 WIF signing

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
secret or key materialsigning boundary
AI analysis · Moderate 62/100

This commit fixes a bug in the COLDCARD HSM (High-Security Mode) where signing BIP-322 messages using private keys stored in the device's WIF Store could bypass the message-signing policy. Previously, such signatures may have been allowed even when the policy only permitted specific derivation paths. The fix now requires the HSM policy to explicitly allow 'any' path before WIF Store keys can be used for BIP-322 signing. This is a security-hardening bugfix for a niche but sensitive code path.

Security candidatebugfix: bind firmware upgrade approval to staged imageby scgbckbone · 1d01d533 · Aug 26, 2026 · 2 filesMessage 83 · StrongHigh 76Details
Commit message · scgbckbone

bugfix: bind firmware upgrade approval to staged image

FirmwareUpgradeRequest renders the consent screen from a header
snapshot captured at upload time, but hands the flash operation a
live PSRAM window. A second upload is permitted while the approval
is displayed (check_busy allow-lists FirmwareUpgradeRequest), and a
raw image upload without the legacy trailer never re-enters
authorize_upgrade — so the staged bytes can be replaced after review
without any error.

Record a digest of the staged image at approval time and re-verify
immediately before pa.firmware_upgrade(), failing closed on mismatch.
Mirrors the staged-bytes guard ApproveTransaction already has.

Add a regression test that uploads image A, gets the approval screen,
uploads image B as a raw image (no trailer), approves, and asserts
the upgrade aborts.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidenceauthentication path
AI analysis · High 76/100

This commit fixes a security bug in the COLDCARD hardware wallet's firmware update process. Previously, while the user was looking at the approval screen for one firmware file, a second file could be silently uploaded and replace the first one. If the user approved, the second (unreviewed) firmware would be installed instead of the one they saw on screen. The fix records a fingerprint of the staged firmware at approval time and checks it again right before flashing, aborting if anything changed.

Security candidatebugfix: vdisk import bumps txn write countby scgbckbone · 39fa3547 · Aug 26, 2026 · 3 filesMessage 78 · AdequateModerate 67Details
Commit message · scgbckbone

bugfix: vdisk import bumps txn write count

The C VirtDisk importer memcpy's into the PSRAM TXN staging regions without going through PSRAMWrapper.write_at(), so txn_write_count is not bumped and the pre-signing re-hash takes its fast path over possibly-clobbered bytes.

Bump the counter and revoke any PSRAM lease before copy_file, so post-review tampering through the virtual disk is caught and stale staged bytes cannot be downloaded.

Make the simulator model copy_file as a direct PSRAM write, then exercise the real VirtDisk event path during a pending PSBT approval and verify signing aborts.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing boundary
AI analysis · Moderate 67/100

This commit fixes a bug in the COLDCARD hardware wallet's virtual disk (VirtDisk) feature. When a user imported a file via the virtual disk, the firmware's fast C importer copied data directly into a sensitive memory area used to stage pending Bitcoin transactions. Because it bypassed the normal tracking mechanism, the wallet did not realize the transaction data had been touched. An attacker or malicious program with virtual disk access could therefore overwrite a transaction you were about to approve, and the wallet might sign the altered version instead of the one you reviewed on screen. The fix records the write, revokes any pending download lease, and adds a test proving the wallet now aborts signing when this happens.

AI review queuedbugfix: reject incomplete wrapped segwit inputsby scgbckbone · 28182e29 · Aug 26, 2026 · 3 filesMessage 45 · ThinHigh 72Details
Commit message · scgbckbone

bugfix: reject incomplete wrapped segwit inputs

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · High 72/100

This update fixes a bug in the COLDCARD hardware wallet where a malformed Bitcoin transaction file (PSBT) could slip through if it described a wrapped SegWit input but left out a required piece of data called the redeem script. Without that script, the wallet could not correctly calculate the transaction's fee, which might let an attacker trick the user into approving a transaction that sends far more in fees than intended. The fix makes the wallet reject such malformed files outright.

Lower-prioritybugfix: reject cyclic virtual-disk FAT chainsby scgbckbone · d665c6b5 · Aug 26, 2026 · 2 filesMessage 68 · AdequateTriage 0Details
Commit message · scgbckbone

bugfix: reject cyclic virtual-disk FAT chains

A compromised USB host can create a cyclic PSRAM virtual-disk FAT chain and make CREATE_LINKMAP spin until the watchdog fires. Bound the walk across all fragments by fs->n_fatent and return FR_INT_ERR when it is exceeded.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-priorityrefactor: rename VCP gate to REPLby scgbckbone · 3f5a9c97 · Aug 25, 2026 · 9 filesMessage 57 · ThinTriage 0Details
Commit message · scgbckbone

refactor: rename VCP gate to REPL

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Lower-priorityremove CDC from USB modesby scgbckbone · b3ce0133 · Aug 25, 2026 · 3 filesMessage 60 · AdequateTriage 0Details
Commit message · scgbckbone

remove CDC from USB modes

Signed-off-by: scgbckbone <scgbckbone@proton.me>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Security candidateShow TRNG words for verificationby scgbckbone · fda3f15c · Aug 25, 2026 · 3 filesMessage 55 · ThinInformational 15Details
Commit message · scgbckbone

Show TRNG words for verification

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
entropy or randomnessdefensive validationseed or entropy path
AI analysis · Informational 15/100

This commit adds a new menu option that lets users see the 24 secret words representing the device's random seed before any user-provided dice rolls or coin flips are mixed in. It is a transparency/verification feature, not a security fix. The change log explicitly calls it a bugfix for a previously removed ability to view the device-generated seed, and the code adds warnings that these words must be kept secret.

Lower-priorityAddress doc-hex review: reject csize>1 filesystems and spurious trailing fragmentsby copilot-swe-agent[bot] · 03d18513 · Aug 24, 2026 · 2 filesMessage 81 · StrongTriage 8Details
Commit message · copilot-swe-agent[bot]

Address doc-hex review: reject csize>1 filesystems and spurious trailing fragments

Finding 1: CREATE_LINKMAP reports run lengths in clusters, but the code
treats them as 512-byte sectors; a hostile host can rewrite the BPB so
FatFs mounts a filesystem with csize > 1, breaking block_to_ptr() and
capacity math. Reject vfs.fatfs.csize != 1 right after f_mount() in both
psram_mmap_file() and psram_copy_file() (the explicit-reject option).

Finding 2: when preceding fragments exactly cover objsize, the final
branch computed len == 0 and accepted the oversized chain, making
mmap() return a spurious zero-length tuple. Now reject a final fragment
whose remainder is < 1 (covers zero-size files with an allocated chain).

Also merged PR #763 head (dec0158e) into this branch (changelog conflict
resolved, keeping both entries) and updated the changelog wording.

Validated with a python logic harness and a gcc-compiled C harness
replicating both fixed loops: legit shapes pass, all hostile FAT shapes
(csize>1, u16 wrap, oversized chains, trailing fragments, edge clusters)
are rejected.

Co-authored-by: Amiga500 <16525337+Amiga500@users.noreply.github.com>

81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
defensive validation
Lower-prioritychangelog: cover undersized final fragments and OOB reads/mappings tooby Copilot · 91778ebe · Aug 23, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Copilot

changelog: cover undersized final fragments and OOB reads/mappings too

Review nit from scgbckbone.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount
Lower-priorityAddress review: validate fragment count and final-fragment capacityby Copilot · 53f0c4bf · Aug 23, 2026 · 1 fileMessage 73 · AdequateTriage 8Details
Commit message · Copilot

Address review: validate fragment count and final-fragment capacity

Two residual hostile-FAT shapes bypassed the guards:

- num_clusters (DWORD from the link map) was narrowed to uint16_t by
block_to_ptr(); 65536 wrapped to 0 and passed the range check, mapping
fragments outside the PSRAM window. Now validated as u32 (1..BLOCK_COUNT)
before the call in both psram_copy_file() and psram_mmap_file().

- The declared final remainder was not checked against the final fragment's
physical capacity: a 1024-byte directory entry backed by one 512-byte
cluster made the final branch copy/map past the fragment. Now the fragment
capacity is preserved and the final remainder must fit it (checked before
the copy path's align-4).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
defensive validation
Lower-prioritychangelog: keep 5.6.1 packaging, re-add entry under fresh Next-ChangeLogby hitechhayekian · 8eb0e008 · Aug 22, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · hitechhayekian

changelog: keep 5.6.1 packaging, re-add entry under fresh Next-ChangeLog

The master merge resolved Next-ChangeLog.md in favour of the pre-release
content, which re-added entries already published in ChangeLog.md under
5.6.1. Take master's file and put the simulator entry in the empty
Shared section instead.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
Lower-priorityreview: drop AST test, set genuine_led on the moduleby hitechhayekian · c0ee36f1 · Aug 21, 2026 · 2 filesMessage 91 · StrongTriage 0Details
Commit message · hitechhayekian

review: drop AST test, set genuine_led on the module

Per review on #729:

Remove testing/test_led_pipe.py. Scraping byte literals out of the
variant sources with ast checks the spelling of the writers rather than
any behaviour, and it has to be updated whenever one of them moves, so
it costs more than it catches. The one-line framing fix stands on its
own.

Fix the genuine_led assignment while in the same path. `from ckcc import
genuine_led` binds a local, so `genuine_led = True` rebound that local
and left ckcc's module global untouched: greenlighting the firmware did
not actually mark it genuine, and a later ckcc.presume_green() would
still assert. Import the module and set the attribute on it, which is
what ckcc's own method 4 does via `global genuine_led`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Lower-prioritytesting: select USB device by serialby scgbckbone · 5aaffd19 · Aug 20, 2026 · 1 fileMessage 55 · ThinTriage 0Details
Commit message · scgbckbone

testing: select USB device by serial

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Lower-priorityNew release: 2026-08-20T1336-v5.6.1by Peter D. Gray · e33ef922 · Aug 20, 2026 · 0 filesMessage 45 · ThinTriage 0Details
Commit message · Peter D. Gray

New release: 2026-08-20T1336-v5.6.1

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI review queuedSigned for mk release.by Peter D. Gray · fa47dc5c · Aug 20, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Peter D. Gray

Signed for mk release.

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathdocumentation-only discountsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates a release signature file. It adds two new official firmware file hashes for COLDCARD Mk devices and refreshes the PGP signature covering the file. There are no code changes, no bug fixes, and no security-relevant behavior changes in the firmware itself.

Lower-priorityFor 2026-08-20T1336-v5.6.1by Peter D. Gray · 13b2f898 · Aug 20, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Peter D. Gray

For 2026-08-20T1336-v5.6.1

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityNew release: 2026-08-20T1335-v1.5.1Qby Peter D. Gray · 99c0d13a · Aug 20, 2026 · 0 filesMessage 45 · ThinTriage 0Details
Commit message · Peter D. Gray

New release: 2026-08-20T1335-v1.5.1Q

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI review queuedSigned for q1 release.by Peter D. Gray · 0fd05d49 · Aug 20, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Peter D. Gray

Signed for q1 release.

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathdocumentation-only discountsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates a signed release manifest file (signatures.txt). It refreshes SHA-256 hashes for two markdown files and adds hashes for two newly released firmware files, then re-signs the file with PGP. No source code, security logic, or vulnerability fix is present in the diff.

Lower-priorityFor 2026-08-20T1335-v1.5.1Qby Peter D. Gray · bdf5a4e4 · Aug 20, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Peter D. Gray

For 2026-08-20T1335-v1.5.1Q

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI review queuedupdate block heightby Peter D. Gray · 042f3383 · Aug 20, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Peter D. Gray

update block height

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit simply updates a stored Bitcoin blockchain height number from 963,191 to 963,314, along with its timestamp. It is a routine data refresh with no code logic changes and no apparent security relevance.

AI review queuedpackagingby Peter D. Gray · 58c30b5e · Aug 20, 2026 · 2 filesMessage 0 · OpaqueCritical 100Details
Commit message · Peter D. Gray

packaging

0/100 · OpaqueMessage clarity
! Very short subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
documentation-only discountsecond-pass: opaque commit message
AI analysis · Critical 100/100

This commit is a changelog-only update that publicly discloses a severe, long-running security flaw in COLDCARD hardware wallets: for roughly five years, the devices generated cryptographic seeds with far less randomness than intended. On older Mk3 devices, seed entropy may have been as low as about 40 bits, and on Mk4/Mk5/Q devices as low as about 72 bits. That makes generated private keys much easier for an attacker to guess or reproduce, putting any funds secured by those keys at risk. The changelog also lists many other security fixes, including protections against a compromised USB host altering transactions before signing, restrictions on reading sensitive staged data over USB, and hardening of the random-number generator. Users are advised to upgrade immediately and regenerate any seeds created with affected firmware.

Security candidatetest improvementsby scgbckbone · ea083a6e · Aug 20, 2026 · 5 filesMessage 28 · OpaqueInformational 15Details
Commit message · scgbckbone

test improvements

28/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Mentions testing or verification! Too few words to establish purpose! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
cryptography-sensitive pathseed or entropy path
AI analysis · Informational 15/100

This commit only changes test scripts for the COLDCARD hardware wallet firmware. It adds small timing delays, adjusts the order of test assertions, and fills in missing steps in automated UI tests. There are no changes to the actual firmware or wallet code that users rely on, so this cannot affect real device security.

Security candidateClarify dice-only hash secrecy warningby scgbckbone · 61847db8 · Aug 20, 2026 · 3 filesMessage 45 · ThinInformational 15Details
Commit message · scgbckbone

Clarify dice-only hash secrecy warning

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
seed or entropy path
AI analysis · Informational 15/100

This commit only rewords an on-screen user warning about keeping dice-roll hashes secret. It does not change any code behavior, cryptography, or security logic. The change makes the warning more precise: it clarifies that seeing any intermediate hash (not just the final one) could let someone recreate the wallet from the dice rolls entered up to that point. There is no vulnerability or security fix here.