COLDCARD firmware

This commit only updates automated test scripts to navigate a new 'Buried Settings' submenu that was apparently added to the COLDCARD user interface. It does not change any firmware code, cryptography, or security behavior. There is no security issue here.

This commit only adds two lines to an upcoming-release changelog. It describes future user-interface enhancements: showing a BIP-39 passphrase on screen after it takes effect, and adding a new 'Buried Settings' submenu for rarely used settings. There is no code change, no bug fix, and no security patch in the diff itself.

This commit simply reorganizes two existing user-preference settings ('Home Menu XFP' and 'Menu Wrapping') from the main Settings menu into a new submenu called 'Buried Settings'. There is no change to how these settings work, no new functionality, and no security-related code change.

This commit only updates a text file documenting the device's on-screen menu structure and a small test script that prints that menu tree. It adds new menu entries (like 'Restore Seed XOR', 'Key Expression', 'Nuke Device'), reorganizes some settings under a 'Buried Settings' submenu, and updates shortcut labels. There are no firmware code changes, no cryptographic changes, and no changes to how the device protects secrets or handles transactions.

This commit only adds a single line to a test file. It checks that when a user adds a BIP-39 passphrase to create a temporary seed, the COLDCARD device displays the passphrase back to the user on screen. This is a test-only change and does not modify the firmware itself. It is not a security fix or vulnerability.

This change makes the COLDCARD hardware wallet display the user's BIP-39 passphrase on the device's own screen after it is applied. This is a deliberate UX change, not a hidden bug. It could slightly increase the risk that someone physically near the device (or a camera) sees the passphrase, but it only appears after the user has already entered it and only on the local screen. The commit does not introduce a remote or software vulnerability.

This commit only edits the wording of an upcoming-release changelog file. No code, firmware logic, or security behavior was changed. It is a documentation/markdown edit with no security relevance.

This commit adds a new user-facing 'Nuke Device' feature to the COLDCARD hardware wallet. It lets the owner deliberately wipe the seed and permanently brick the secure element, rendering the device unusable. The change also removes some unreachable cleanup code from the existing seed-clearing routine. There is no evidence in the commit of a hidden or malicious trigger; it appears to be an intentional, user-initiated self-destruct function.

This small change lets users cancel out of a 'go to index' prompt in the COLDCARD's transaction explorer instead of being forced to enter a number. It is a minor user-experience fix with no direct security impact visible from the code change.

This commit adds a small user-interface convenience to the COLDCARD transaction explorer: users can now press the '2' key to jump directly to a specific input or output index, instead of paging through items one screen at a time. It also fixes a minor edge case where pressing the left/back key from the first page could produce a negative starting index. There is no security-relevant change here.

This commit adds a new on-device 'Transaction Input Explorer' feature for the COLDCARD hardware wallet. It lets users inspect the inputs (UTXOs) being spent before approving a transaction, alongside the existing output explorer. The change is primarily a user-interface enhancement and does not appear to fix a security vulnerability. It also includes related display improvements and test coverage.

This commit only changes the user-facing message shown after a backup file CRC check. It adds a note explaining that the CRC check only catches accidental corruption, not deliberate tampering, and that a more thorough verification can be done by starting a restore and stopping after decryption. There is no code behavior change, no security fix, and no vulnerability introduced.

This commit fixes a minor bug where entering the Secure Notes menu on a COLDCARD device, while in a restricted 'hobbled' mode with no saved notes, caused a crash ('yikes') instead of showing a friendly 'none saved yet' message. It is a denial-of-service-style UI bug, not a security vulnerability that can be exploited by an attacker.

This update fixes a bug where giving a multisig wallet a name containing a forward slash (like '2/3 me/her/it') would crash the COLDCARD device when exporting wallet files to a microSD card. The slash is now replaced with a dash in the exported filename, preventing the crash. It is a reliability fix rather than a security vulnerability that could be exploited remotely.

This commit fixes a small data-formatting inconsistency in how the COLDCARD firmware reads and writes the transaction version number inside PSBT v2 files. The code now treats the version as a signed 32-bit integer, matching the Bitcoin protocol, instead of an unsigned 32-bit integer. The practical security impact is likely low because the value is still 4 bytes on the wire and the same bits are produced for all common positive version values. It mainly matters if someone deliberately uses a negative version number, which is unusual and would previously have been misinterpreted as a very large positive number.

This commit only adds and updates automated software tests for importing temporary secrets via QR code on the COLDCARD hardware wallet. It does not change any production firmware code, wallet behavior, or security controls. There is no vulnerability or security fix here.

This commit only changes test code in the COLDCARD firmware repository. It expands automated tests for importing secret seed phrases and private keys to cover additional input methods such as QR codes and SeedQR. There are no changes to the actual firmware or wallet code that users rely on, so this commit does not introduce or fix a security vulnerability on its own.

This commit adds a simple 'Generating...' progress message on screen while the COLDCARD device prepares a key expression export file. There is no security-relevant change; it is purely a user experience improvement to reassure the user that the device is busy.

This change adds a small user-interface convenience to the COLDCARD's 'Check Chain Check' (CCC) spending-policy feature. It lets a user reset the stored blockchain block height back to its default value from the 'Last Violation' debug screen. The change is described by the vendor as an 'Enhancement' in the changelog, not as a security fix. There is no indication in the commit that it corrects a vulnerability.

This commit is a user-interface refactor for importing multisignature wallet setups on the COLDCARD. It replaces three separate menu items ('Import from File', 'Import from QR', 'Import via NFC') with a single 'Import' option that then asks the user to choose the source. The underlying import logic is essentially unchanged, and there is no indication this fixes a security bug or introduces a vulnerability.

This commit adds a new convenience feature: after deriving a secret using the BIP-85 standard, the COLDCARD can now type that secret out as USB keyboard keystrokes for all supported secret types (seed words, xprv, WIF, hex, password). Previously this USB typing was only available for password-type secrets. The change also cleans up how the on-screen prompt offers the '(6)' keystroke option. There is no direct evidence in the commit that this fixes a security bug; it appears to be a user-experience feature addition.

This commit removes a local variable called total_out that was being incremented while iterating over transaction outputs in a PSBT (Partially Signed Bitcoin Transaction) parser. The variable was apparently unused and is described as 'unnecessary.' There is no direct evidence in the commit that this change fixes a security vulnerability; it appears to be a minor cleanup or optimization.

This is a tiny code cleanup in the COLDCARD simulator's Unix launcher. It moves the '-e' flag so it always appears before the command to run, instead of being added separately in two branches. There is no security-relevant change.

This is a small cleanup change to the COLDCARD simulator's command-line logging behavior. It makes the `--log` option place its log file in the same per-process directory used by the `--segregate` option, instead of always using a hard-coded `/tmp/cc-simulators/<pid>/` path. The README is updated to match. There is no security-relevant change here.

This commit simply removes the project's Docker-based build instructions and Dockerfile. It also tweaks one git clone command in the README to use shallow submodules. There is no change to the actual COLDCARD firmware code, no bug fix, and no security patch.