COLDCARD firmware

This commit fixes a small user-interface bug in the COLDCARD hardware wallet. Previously, after signing a transaction that was not yet finalized, the device still offered a menu option to display a QR code of the transaction ID (TXID). Because the transaction ID can only be reliably computed once the transaction is finalized, offering the QR code earlier could mislead the user or show invalid/incomplete data. The fix hides that QR-code option unless the transaction is finalized. There is no direct evidence of funds being stolen or a remote attack.

This commit only edits the wording of an unreleased changelog file. It rephrases descriptions of upcoming features and reclassifies one item from 'Bugfix' to 'Enhancement'. No source code, firmware logic, or security behavior was changed.

This commit is purely cosmetic: it reformats a few lines of Python code in the COLDCARD firmware without changing what the code actually does. There is no security-relevant change.

This commit simply adds a 'debug/' directory to the .gitignore file in the project's testing folder. This tells Git to ignore files placed in that folder. It is a routine development housekeeping change with no visible security relevance.

This commit changes how COLDCARD displays and exports Bitcoin wallet descriptors and key expressions. It shows the descriptor/key expression on the device screen before exporting, and it now cryptographically signs key-expression exports when saved to SD card or virtual disk. The change is a user-experience and anti-tampering improvement, not a fix for an active security flaw.

This commit only changes test helper code that creates fake Bitcoin transactions for automated testing. It makes each fake transaction input use a slightly different placeholder identifier instead of reusing the same dummy identifier. There is no change to the actual COLDCARD firmware or wallet security code, and no indication this fixes a real-world vulnerability.

This is a tiny visual fix for a progress bar shown during a brief on-screen pause. The first frame was previously empty (0%) and the last frame was never reached, so the bar now starts at a small fraction and ends at 100%. There is no security relevance.

This commit fixes a single missing space in a user-facing warning message shown before the COLDCARD device wipes itself and becomes permanently unusable. The text previously read 'purgeall related settings' instead of 'purge all related settings'. There is no security issue, no code behavior change, and no risk to users beyond a slightly awkward sentence.

This commit fixes a bug in the COLDCARD hardware wallet's handling of Bitcoin transaction files (PSBTs). Previously, the wallet only checked the most recent 50 inputs for duplicates, so a malicious transaction with more than 50 inputs could spend the same coin twice without being detected. The fix now checks up to 100 inputs and uses a more reliable data structure. This could have allowed an attacker to trick a user into signing a transaction that moves more money than it appears to.

This is a tiny code cleanup in a Bitcoin transaction serialization helper. It removes an unused bytes-to-hex function and avoids creating an empty COutPoint object before deserializing one. There is no apparent security issue.

This commit only edits the upcoming release changelog file. It reorders two bugfix entries and changes some backtick formatting to quotation marks in feature descriptions. No source code, firmware logic, or security behavior was changed.

This commit fixes a bug in the COLDCARD hardware wallet where a Bitcoin transaction could contain the same input coin twice without being detected. The patch now checks for duplicate inputs while the wallet is reviewing a transaction to sign. However, the fix only remembers the last 50 inputs, so duplicates more than 50 positions apart are still missed. The included test confirms this limitation.

This is a routine automated update by Dependabot that bumps the Python Pillow image-processing library from version 10.3.0 to 12.1.1 inside a small helper tool used to build fonts for the COLDCARD hardware wallet. The change itself is a single line in a requirements file. It is not a fix for a known, actively exploited vulnerability in the COLDCARD firmware, and the affected helper tool is not part of the wallet's runtime security boundary.

This commit only edits the upcoming release changelog file. It fixes two typos ('sesnsitive' to 'sensitive', 'your' to 'you'), capitalizes one bullet point, and adds a documentation link for a new BIP-322 proof-of-reserve feature. No source code, firmware logic, or security behavior was changed.

This commit only changes user-facing text labels in the COLDCARD firmware. It expands the abbreviation 'MSG' to 'Message' on screens that have enough space, and updates the corresponding automated tests to match the new wording. There is no change to security logic, cryptography, or how data is handled.

This commit only adds a one-line note to the upcoming-release changelog announcing a new BIP-322 'Proof of Reserve' signing feature. No source code, tests, build files, or documentation beyond the changelog were changed. There is nothing in the diff that introduces, fixes, or changes any security-relevant behavior.

This commit only edits a Markdown documentation file about BIP-322 Proof of Reserves. It rewords headings, fixes formatting, adds clarifying sentences, and updates a link style. No source code, firmware logic, or security behavior changed.

This commit makes a tiny code change and adds a few test cleanup button presses. It does not appear to fix or introduce any security issue. The code change updates one call to a user-prompt function to include a new 'Electrum' label argument, likely matching a recent refactor in that helper function. The test change presses 'cancel' three extra times after a test step, probably to close leftover menus.

This is a small code cleanup in the COLDCARD firmware that switches BIP-322 message hashing from a software double-SHA256 to a hardware-accelerated tagged-SHA256 function. The change removes a TODO comment and uses a dedicated function (ngu.hash.sha256t) that the hardware can speed up. There is no direct evidence in the commit of a security vulnerability being fixed; it appears to be a performance and maintainability improvement.

This commit makes a small user-interface change in the COLDCARD firmware for BIP-322 proof-of-reserves signing. When the user chooses to type in the human-readable message manually, pressing Cancel on the empty text-entry screen now returns to the signing flow instead of aborting the entire operation. The change is accompanied by new tests that verify the device rejects empty or wrong messages with clear failure screens. There is no direct evidence in the commit that this fixes an exploitable security vulnerability; it appears to be a usability improvement to prevent accidental cancellation.

This commit adds support for BIP-322 Proof of Reserves signing on COLDCARD hardware wallets. It lets users prove they control certain Bitcoin addresses by signing a special non-spending transaction, without actually moving funds. The change also allows transaction version 0 only for these proof-of-reserve transactions, and blocks it for normal payments to prevent potential misuse.

This commit adds a new user-facing verification step for BIP-322 'Proof of Reserves' messages on the COLDCARD hardware wallet. Before signing a proof-of-reserves transaction, the device now asks the user to import or type the original human-readable message, checks that it matches the cryptographic hash embedded in the transaction, and shows it on screen for approval. This is a security-hardening feature: it closes a gap where the user might otherwise sign a proof without seeing what message they are actually attesting to. The commit itself is defensive and does not appear to introduce an obvious vulnerability, but it is a partial implementation (marked with TODOs) and the change is large enough that bugs in the new input paths could affect signing safety.

This commit updates an internal library (libngu) used by the COLDCARD hardware wallet to a newer version that adds hardware-accelerated tagged_sha256. Tagged SHA-256 is a special way of computing cryptographic hashes used in Bitcoin-related operations. The change itself is a one-line version bump of a submodule, with no diff showing what actually changed inside the library. There is no direct evidence this fixes a security vulnerability; it appears to be a performance or capability upgrade.

This commit adds a new menu option that lets COLDCARD users export their public wallet information in a format compatible with Blue Wallet. It reuses the existing Electrum export code and only changes labels and filenames. There is no indication of a security bug or vulnerability.

This commit changes a single line in a test file. The test previously checked that a menu item called 'Menu Wrapping' was not present; it now checks that 'Buried Settings' is not present. This is purely a test-code update matching the test to the current user-interface labels. There is no firmware behavior change and no security relevance visible in the diff.