COLDCARD firmware

This change fixes how COLDCARD figures out the address format for multisig transactions. Previously it guessed based on the derivation path numbers in the PSBT's XPUB records, which can be misleading or attacker-controlled. Now it looks directly at the actual witness/redeem script in the transaction input, which is harder to fake. A wrong address format could make the wallet think it is signing one type of address while the transaction really pays to another, potentially tricking the user into approving a payment they did not intend.

This commit fixes a bug in the COLDCARD hardware wallet where cancelling out of the 'Custom Backup Password' text-entry screen during a backup restore would cause a crash (internally called a 'yikes'). The fix adds a simple check so that if the user exits without entering a password, the restore process stops gracefully instead of continuing with an empty value and crashing.

This commit simply removes two unused import statements from a menu-building function. It does not change any behavior, fix any bug, or alter security logic. It is a routine code cleanup.

This commit only updates two release dates in the project's changelog file. It does not change any source code, configuration, or documentation that affects how the product works. There is no security relevance.

This commit only updates the release signature file. It adds two new cryptographic signatures for COLDCARD Mk4 firmware version 5.4.4 and refreshes the PGP signature that covers the entire file. There are no code changes, no bug fixes, and no security-relevant behavior changes in the firmware itself.

This commit only updates the release signature file (signatures.txt) for the COLDCARD firmware. It adds two new file hashes for a Q1 hardware model firmware release (version 1.3.4Q) and refreshes the PGP signature that covers the entire file. There are no code changes, no bug fixes, and no security-related content in the commit message or diff.

This commit simply removes the digital signatures and file hashes for a previously listed firmware release (version 5.4.4 for Mk4 and 1.3.4Q for Q1) from the project's release signatures file, and updates the PGP signature covering that file. It is a release-management rollback of a 'gold' release candidate, not a code change. There is no firmware source code modification, no bug fix, and no security patch in this commit.

This commit fixes a bug in COLDCARD's 'deltamode' duress feature. Delta mode is meant to let a thief who knows a slightly wrong PIN sign transactions with corrupted signatures that look valid but don't actually protect any bitcoin. The bug was that the fake signature was produced from a fixed, predictable placeholder instead of from the real transaction data. A security research team claims this predictability could let an attacker who captures two such signatures recover the wallet's private keys, potentially stealing all funds. The patch makes the corrupted signature depend on the real transaction hash, removing that mathematical shortcut.

This commit only fixes two spelling mistakes in the project's release changelog document. It changes 'trival' to 'trivial' and 'Wife' to 'Wipe' in user-facing text. No source code, firmware logic, or security behavior is modified.

This commit only adds tiny 0.1-second delays inside a test file. It does not change any production firmware code, user-facing behavior, or security logic. It is purely a test stability tweak to avoid race conditions during automated testing.

This commit only updates the release signature file for COLDCARD Mk4 firmware. It adds two new signed hashes for version 5.4.4 and refreshes the PGP signature that covers the file. There are no code changes, no bug fixes, and no security-related content in the diff itself.

This commit updates a signed release manifest file (signatures.txt) for the COLDCARD hardware wallet firmware. It adds cryptographic hashes for two new Q1 firmware files and updates the hash and PGP signature for the ChangeLog. There are no code changes, no bug fixes, and no security-related content in the diff itself.

This commit only updates two release dates in the ChangeLog file (from 2025-09-25 to 2025-09-26). It makes no code changes and has no security relevance.

This commit updates a signed release manifest file (signatures.txt). It removes the file hashes for firmware versions 5.4.4 (Mk4) and 1.3.4Q (Q1) and replaces the ChangeLog.md hash. The commit title 'undo-rc' suggests this is reverting a release-candidate or release that was previously added to the manifest. There is no code change, no vulnerability fix, and no security-relevant behavior change visible in the diff.

This commit is a minor code cleanup in the COLDCARD firmware's file picker. It moves the validation of filename suffixes earlier in the function and slightly changes the wording of an on-screen message shown when no matching files are found. There is no indication this fixes a security bug or introduces a vulnerability.

This commit fixes a file-picker bug in the COLDCARD hardware wallet firmware. Previously, callers passed file extensions without a leading dot (e.g., 'txt' or 'psbt'), so the picker would match any filename ending in those characters, not just proper dotted extensions. A file named 'backuptxt' could be treated as a .txt file, and 'backup7z' as a .7z backup. The patch forces every extension to start with a dot and updates all callers. The main risk is that a maliciously named file on the SD card could be offered to the user as if it were a valid PSBT, backup, text message, or other sensitive file type, potentially tricking the user into signing or restoring from the wrong data.

This commit is a small cleanup and user-experience improvement for the COLDCARD's spending-policy settings. It renames an internal function and parameter, adds 'Saving...' progress messages so users know the device is busy, and simplifies a couple of checks. There is no direct evidence in the diff of a security vulnerability being fixed.

This commit only edits a changelog text file. It rewords a description of an existing product feature (a 'forever calculator' mode that activates after too many failed PIN attempts) and removes a mention of 'bricked' devices. No source code, firmware logic, or security behavior was changed.

This commit hides the 'Allow Notes' option from a security feature called SSSP on older COLDCARD devices (mk4) that lack a qwerty keyboard. It is a UI cleanup, not a security fix. The change prevents users from seeing a setting that does not apply to their hardware, but does not alter how notes are actually protected.

This commit only updates the release signature file (signatures.txt) for the COLDCARD Mk4 hardware wallet. It adds SHA-256 hashes for two new firmware files (normal and factory versions of v5.4.4) and refreshes the PGP signature that covers the file. There are no code changes, no bug fixes, and no security-relevant behavior changes in this commit.

This commit only updates the release signature file (releases/signatures.txt). It refreshes SHA-256 hashes for several changelog files and adds hashes for two new Q1 hardware firmware files (v1.3.4Q), plus a new PGP signature over the whole file. There is no source code change, no bug fix, and no security patch in the diff itself.

This commit only edits documentation and release notes. It moves changelog entries from an upcoming-release file into the published changelog and history files, and rewords a BIP-21 extension description. No source code, firmware logic, or security behavior is changed.

This commit adds a single 'Wait...' loading screen while the COLDCARD searches its ownership cache for a Bitcoin address. It is purely a user-interface improvement to indicate that work is happening; there is no security-relevant code change.

This commit fixes a bug in the COLDCARD firmware's 'SSSP test drive' feature. Previously, the code that checks whether the feature is enabled did not properly recognize the special 'test drive' mode, and it called the wrong method when approving transactions. The fix makes the test drive mode correctly activate the feature and uses the intended transaction-approval routine. In practical terms, a user in test-drive mode might have been unable to use the feature as designed, or the wrong internal path could have led to an approval that did not enforce the intended spending policy.

This update prevents a COLDCARD hardware wallet from accepting an empty BIP-39 passphrase when the command comes over the USB connection. A BIP-39 passphrase is an extra word or phrase users can add to their seed to create a separate wallet. Previously, an empty passphrase could be sent through USB, which might let software on the connected computer silently access the user's default/no-passphrase wallet without the user typing anything on the device. Now the device rejects empty passphrases over USB, so the user must intentionally enter a passphrase on the device itself.