COLDCARD firmware

This commit is purely a documentation update. It adds missing entries to the docs index, updates outdated examples and menu trees, fixes a broken filename reference in a code comment, and corrects factual details (such as supported models and key storage page numbers) to match the current firmware. There are no code behavior changes that would affect security.

This commit only adds a thank-you credit to an upcoming release changelog. It does not change any source code, firmware behavior, or fix anything by itself. The actual bugfix it references (ignoring an unexpected 'bkpw' field in backups) was made in some earlier commit not shown here.

This update fixes a security flaw in how the COLDCARD wallet restores its settings from a backup file. Previously, a tampered backup could secretly set the password used for future backups, letting an attacker who later gets physical access predict or control backup encryption. The fix ignores that 'cached backup password' field during restore, so backups cannot smuggle in a chosen password.

This is an automated dependency update by Dependabot that bumps the Python 'requests' library used only in the project's testing environment from version 2.32.4 to 2.33.0. It changes one line in a test requirements file. There is no indication this affects the COLDCARD firmware itself or introduces a security issue.

This commit only updates the README.md file to correct the order of steps for building a reproducible copy of the COLDCARD firmware. It changes documentation text: adding a step to change into the firmware directory, updating the example release tag and binary filename, and moving the directory change to stm32 after the checkout. There are no code changes and no security implications.

This is a large bundle of bug fixes for the COLDCARD hardware wallet firmware. Most changes fix user-interface crashes ('yikes'), incorrect error messages, or policy edge cases rather than a single critical vulnerability. The most security-relevant fixes are: (1) disabling NFC and Virtual Disk before entering HSM mode to reduce the attack surface of the locked-down operating mode; (2) preventing a trick/bypass PIN that has no secrets from completing a Single-Signer Spending Policy unlock; (3) stopping OP_RETURN and non-standard scripts from being hidden or mis-displayed during transaction approval; (4) rejecting malformed JSON/QR message-signing requests and control characters that could be used to trick the user; and (5) preventing duplicate multisig wallets with reordered keys from being imported as if they were only a rename. The commit also adds many regression tests for these behaviors.

This commit fixes a simple spelling mistake in a Markdown documentation file. The word 'colcard.com' was corrected to 'coldcard.com'. It does not change any code, configuration, or security behavior of the COLDCARD firmware.

This commit fixes a user-interface bug in COLDCARD firmware where pressing certain menu keys (like '1' to change account number or '2' to toggle a format option) would accidentally fall through and trigger an export using default settings, instead of waiting for the user to confirm with 'y'. The fix adds 'continue' statements so the device loops back to the menu, and changes the confirmation check to also accept '1' as a valid choice after account entry. It is described by the developer as an unreleased regression, meaning it was caught before reaching users.

This commit fixes a minor user-interface bug in the COLDCARD hardware wallet's NFC 'Verify Address' feature. Previously, if the NFC read was cancelled or returned no address, the code could produce a confusing or wrong error message because it tried to unpack a missing result. The fix checks whether the NFC read actually returned anything before proceeding, and a new test confirms that cancelling the prompt no longer appears to 'crash' or mislead the user. There is no indication this bug could be used to steal funds or bypass security.

This commit fixes a small bug in how COLDCARD reports errors when it tries to verify or decrypt a backup file. In older code, when something went wrong while reading a 7z backup, the error-handling code itself crashed because it tried to read a non-existent property (e.message) on the exception object. That meant the user would see a confusing 'AttributeError' or 'Yikes' screen instead of a helpful message like 'Confused file? Truncated file?'. The fix changes e.message to e so the real error is shown. It also adds more tests for malformed backup headers. This is a user-experience and diagnostic improvement, not a direct theft-of-funds vulnerability.

This commit fixes a UI bug in the COLDCARD address explorer. When a user entered a custom BIP32 path, the device was highlighting the wrong default address format on the selection menu. For example, a path meant for classic Bitcoin addresses (starting with m/44h) might have had Segwit highlighted by default. The fix corrects the menu's default cursor position and adds a warning not to reorder the underlying address-format list. There is no direct security vulnerability here—just a user-experience bug that could, in rare cases, lead a user to confirm an unintended address type.

This update fixes three small but real bugs in the COLDCARD's Notes & Passwords feature. The most important fix corrects a reversed menu setting: the 'Send Password' option was accidentally shown only when USB was disabled, and hidden when USB was enabled. It also prevents the device from storing a blank password as the special value 'None', which could crash the device later when sending a password. Finally, it stops a misleading 'Saving...' message from appearing after a failed import.

This commit fixes two small issues in the Coldcard firmware. First, it changes the on-screen prompt when enabling a high-security 'HSM' policy to put the button name in parentheses, matching how the device normally displays button labels. Second, it corrects a bug in the code that manages saved private key imports (WIFs): the code was treating a list as if it were a dictionary, which could cause the wrong entry to be deleted or an error to be silently ignored. The commit also updates a test to expect the new prompt text.

This commit changes how number-entry prompts behave across the COLDCARD wallet interface. Previously, many prompts did not allow the user to cancel, so pressing the cancel button could be misread as entering '0' and the operation would continue. Now, canceling is explicitly allowed and the code checks for it, returning the user to the previous screen instead of proceeding with a default value. This is a user-experience and safety improvement rather than a remote-exploitable bug, but it prevents accidental or coerced confirmations in security-sensitive flows like exporting xpubs, creating multisig wallets, and signing messages.

This commit fixes a bug in the COLDCARD hardware wallet where cancelling out of the 'Set Nickname' screen would accidentally delete an existing nickname. The nickname is shown on the login screen to help users identify their device. The fix also corrects a related test helper that was not properly reading pre-login settings. There is no direct evidence this was a security vulnerability, but it could be a minor usability/reliability issue.

This commit fixes a bug where COLDCARD backup files in 7z format were not properly checked for the correct file header ('magic bytes'). Because the check was accidentally disabled, the device could accept backup files with wrong or corrupted headers. The fix turns the check back on and adds tests to make sure bad headers are rejected with a clear error message.

This commit fixes a bug where a special security feature called 'Delta Mode Trick PIN' was not being restored when a user restored their Coldcard wallet from a backup. A Trick PIN is a decoy PIN that can do things like show a fake wallet or wipe the device. Delta Mode is a type of Trick PIN that must be very similar to the real PIN. Because of the bug, after restoring from backup, this protection would silently disappear, leaving users who relied on it less protected than they expected. The fix changes the backup-restore code so Delta Mode Trick PINs are correctly recreated, and adds an automated test to check this.

This commit only fixes spelling mistakes in comments and user-facing text strings across nine source files. There are no code logic changes, no security fixes, and no functional behavior differences.

This commit is a small code cleanup in the COLDCARD firmware's USB command handling. It removes a manually duplicated list of commands that were already defined elsewhere (HSM_DISABLE_CMDS) and instead reuses that existing list. There is no direct evidence this fixes an active security bug, but it reduces the risk of future mistakes where the two lists become inconsistent and a restricted command accidentally stays allowed.

This commit fixes a minor Python syntax bug in a test helper file. Two missing commas in a list of command-line arguments for a local Bitcoin test node (bitcoind) were added. Without the commas, Python would accidentally concatenate two strings into one invalid argument, which would cause the test setup to fail. This change only affects internal testing code and has no security relevance for COLDCARD users or real funds.

This commit only changes the on-screen title of a feature from 'Spending Policy' to 'Spend Policy' for older COLDCARD models that lack a full keyboard (non-QWERTY versions). It is a user-interface wording tweak with no security effect.

This commit removes one extra blank line from the on-screen 'Show Version' display text. It is a cosmetic formatting cleanup with no security relevance.

This tiny patch adds a 'Wait...' loading screen while the COLDCARD wallet switches between Bitcoin networks (for example, mainnet to testnet). The change appears aimed at preventing user confusion or accidental interaction during a brief reconfiguration, not at fixing a serious security flaw. There is no direct evidence in the commit that this resolves an exploit.

This commit only updates the signed release manifest file (signatures.txt). It refreshes SHA-256 hashes for changelog files and adds hashes for two new firmware build files, then re-signs the file with a PGP signature. There is no source code change and no security fix or vulnerability present in the diff itself.

This commit is a small code cleanup. It makes the 'regtest' (regression test) Bitcoin network settings inherit from 'testnet' instead of duplicating the same values. The only unique setting kept for regtest is its special Bech32 address prefix ('bcrt'). There is no security issue here.