COLDCARD firmware

This commit removes one line from the .gitignore file, so a folder named 'firmware' is no longer ignored by Git. It is a routine repository housekeeping change with no direct security impact on the COLDCARD firmware itself or its users.

This commit only updates the README.md build instructions. It removes the recommended 'fast' git clone command that used shallow submodules, because one submodule (lwIP) does not support shallow cloning. It leaves only the full recursive clone command. There is no firmware code change and no security fix or vulnerability introduced.

This commit adds an optional --log command-line flag to the COLDCARD simulator. When used, it creates a per-process log directory under /tmp and records an xterm session log. By default, logging is now disabled unless the flag is provided. There is no security vulnerability here; it is a minor developer/debugging convenience change.

This commit is purely a developer convenience change. It adds a Dockerfile and README instructions for building the Coldcard simulator inside Docker, plus a small tweak so the simulator writes an xterm log file to /tmp with normal permissions. There is no change to how real Coldcard hardware handles private keys, transactions, or security checks, and no vulnerability is introduced.

This commit updates the COLDCARD Bitcoin hardware wallet firmware to accept and sign transactions that use version 3 of the Bitcoin transaction format. Previously, the wallet only allowed versions 1 and 2. The change is framed as a new feature, not a security fix. It adds parsing and test support for v3 transactions, including a special case for 'ephemeral anchor' outputs that have a zero value and are expected to trigger a warning.

This commit only changes a user-facing help message in the COLDCARD firmware. It adds a reminder that the phone must not be in airplane mode when using the NFC PushTx feature. There is no code behavior change, no bug fix, and no security patch.

This commit only updates the release signature file. It adds hashes for two new firmware files (v6.4.1X for MK4 and Q1 models), updates the hash for the Next-ChangeLog.md file, and refreshes the PGP signature that covers the file. There are no code changes and no security vulnerability is present in the diff.

This commit only updates the signed release checksum file (signatures.txt). It adds hashes for two new firmware files and updates hashes for four changelog files, then re-signs the file with a PGP signature. There are no code changes, no bug fixes, and no security-relevant modifications visible in the diff.

This commit adds a small user-interface convenience: after splitting a secret backup phrase into XOR parts on a COLDCARD hardware wallet, users can now view those parts as QR codes by pressing the '4' key (in addition to the existing QR key on Q models). It is a feature enhancement, not a security fix or vulnerability.

This commit only updates test code for the COLDCARD hardware wallet simulator. It adds missing device.close() calls after simulator shutdowns and adjusts one expected on-screen message for the Q1 model when a device is bricked. There are no changes to the actual firmware or wallet code that users rely on, so this does not create or fix a security vulnerability in the product itself.

This commit adds a new wallet-export feature to COLDCARD firmware: it lets users export a BIP-380 "key expression" (a compact text string containing the master fingerprint, derivation path, and extended public key). The change is a user-facing feature addition, not a bug fix. There is no indication in the commit or supplied references that this resolves a security vulnerability. The export is marked as privacy-sensitive but not secret, consistent with normal public-key export behavior.

This commit only reorganizes and updates the project's release notes (changelogs). It moves the description of features and bug fixes from the current release section into the historical release notes, and updates version numbers and dates. No actual firmware code was changed, so this commit cannot by itself introduce or fix any security vulnerability.

This commit only updates the release signatures file for the COLDCARD Mk4 hardware wallet. It adds cryptographic hashes (SHA-256) and a PGP signature for two new firmware files (version 5.4.5). There are no code changes, bug fixes, or feature modifications in this commit.

This commit only updates the file releases/signatures.txt. It refreshes SHA-256 hashes for two changelog files and adds hashes for two new Q1 firmware release files, then re-signs the file with a PGP signature. No source code, executable logic, or security-sensitive behavior changed.

This commit only updates an auto-generated timestamp and version string for a COLDCARD Q1 firmware build. The actual code change is a single constant in a function that returns the current date/time for FAT filesystem timestamps. There is no security-relevant change.

This commit simply updates a minimum block height number in the Bitcoin mainnet configuration from 916,210 to 922,061. This is a routine date/height adjustment, not a security fix. It affects when a COLDCARD feature (likely related to a protocol or service activation) becomes available, but does not patch any vulnerability.

This commit only updates a generated timestamp and version number in a firmware build file. It changes the date from 2025-09-18 to 2025-10-30, the version from 5.4.4 to 5.4.5, and adjusts a corresponding FAT filesystem timestamp constant. There is no security-relevant code change.

This commit is a routine version bump and changelog cleanup. It changes two Makefile version strings from 5.4.4 to 5.4.5 and from 1.3.4Q to 1.3.5Q, and edits the release notes for grammar and formatting. No code behavior changes are present, and there is no security relevance in the diff itself.

This change only adds a new testing option to two fake transaction builders used in the project's test suite. It lets tests optionally set a Bitcoin transaction's nLockTime field and adjusts the first input's sequence number accordingly so the locktime is actually enforced in test scenarios. There is no change to production firmware code, no fix for a real bug, and no security relevance in the commit itself.

This is a bugfix for the COLDCARD's 'SSSP' (a spending-policy/velocity-limit feature). Previously, when a user was operating with a temporary seed, the device could not update the stored 'last signed block height' after signing a transaction. That meant a temporary-seed session could not advance the anti-rollback counter, so later signing attempts could be wrongly rejected as 'rewound' or could, in some configurations, leave the velocity-limit tracking stale. The fix lets the block-height update be saved to the shared settings area even when the current active key is a temporary seed, rather than requiring the master seed's settings area.

This commit only adjusts automated test scripts for the COLDCARD hardware wallet firmware. It skips one display test on non-Q1 devices, adds small timing delays and a confirmation step in ephemeral seed tests, and updates an expected menu item label. There are no changes to the actual firmware code that runs on the device, so this cannot affect real user security.

This change adds a confirmation screen when loading a backup file onto a COLDCARD hardware wallet. Before the wallet actually restores the seed from the backup, it now shows the backup's master fingerprint and asks the user to confirm or cancel. This helps prevent users from accidentally or maliciously loading the wrong backup. The change also refactors how the raw secret is extracted so the confirmation screen can compute the fingerprint before the restore happens. Clone operations skip this extra prompt because the user already sees what is being loaded on the source device.

This is a one-line bug fix in the COLDCARD firmware's backup restore code. The developer accidentally checked the wrong variable (`pwd` instead of `ipw`) when deciding whether the user cancelled the custom backup password entry screen. Because `pwd` is a list that is always truthy, the code never returned early when the user exited the password form, which the commit message describes as causing a 'yikes' error. The fix makes the code check the actual user input variable instead.

This commit is a user-interface improvement, not a security fix. When restoring a COLDCARD backup on the Q-series device, the screen now shows the backup filename above the password-entry prompt so the user knows which file they are unlocking. No code behavior that protects secrets was changed.

This commit simply adds a menu item that displays the device's firmware version in a restricted ('hobbled') mode. It is a user-interface enhancement with no security-relevant behavior change.