COLDCARD firmware

This commit only adds a new automated test to the COLDCARD firmware test suite. The test checks that when a user tries to sign a text file containing valid JSON that is not a JSON object (for example, a plain number, string, null, or list), or a JSON object missing the required 'msg' key, the device shows a clean error message instead of crashing. The commit itself does not change any firmware code, so it does not fix or introduce a vulnerability directly. It is a regression test requested during review of an earlier change, likely to make sure a previous fix stays effective.

This firmware update fixes a cleanup issue in the COLDCARD wallet's transaction signing code. Before finalizing a new Bitcoin transaction, the device now clears out leftover 'change output' records that may have been captured during a previous signing attempt that failed or was aborted. If stale records remained, they could potentially confuse the wallet's checks about where money is going, which in rare cases might affect user-facing warnings or transaction validation.

This commit removes a human-readable error message from a ValueError exception to reduce the amount of flash storage used by the firmware. It is a minor code cleanup and does not change the security behavior of the code. The function still raises an exception when invalid JSON input is provided; only the descriptive text is dropped.

This commit only adds a changelog note saying a previous fix stopped the COLDCARD hardware wallet from crashing when a message-signing request was valid JSON but not a JSON object (for example, a number or string instead of a dictionary). The actual code fix is not shown here, so we can only judge the issue from the changelog description. It appears to be a denial-of-service-style crash affecting message signing over NFC, QR, or SD card JSON files.

This commit fixes a bug where the COLDCARD firmware's message-signing feature would crash with an uncaught error if a user supplied valid JSON that wasn't a structured object (for example, a plain number, string, list, or null). The fix checks the parsed JSON type and raises a proper, handled error instead of letting an AttributeError propagate. There is no direct evidence in the commit that this is exploitable for security harm, but unhandled exceptions can sometimes cause unexpected device behavior or denial of service.

This commit only updates the release signature file (signatures.txt) for the COLDCARD firmware. It adds two new file hashes for a v5.6.2-mk release and refreshes the PGP signature covering the file. There are no code changes, no bug fixes, and no security-relevant modifications visible in the diff.

This commit only updates a release signature file. It refreshes SHA-256 hashes for changelog files and adds hashes for two new firmware release files, then re-signs the file with a PGP signature. There are no code changes, no bug fixes, and no security-relevant content in the diff itself.

This commit simply updates a stored Bitcoin blockchain height number from 965,337 to 965,338. It is a routine, automatically generated data refresh with no code logic changes and no apparent security relevance.

This commit only edits the project's internal release notes file. It replaces a detailed list of upcoming changes with placeholder 'tbd' entries and adds a note asking contributors to leave blank lines between additions. There are no code changes and no security relevance in the commit itself.

This commit is a release-notes-only update for the COLDCARD hardware wallet firmware. It moves many security-relevant bug fixes and hardening items from the current changelog into the historical release notes for versions 5.6.1 and 1.5.1Q, and adds a new set of notes for versions 5.6.2 and 1.5.2Q. The actual code changes are not present in the diff, only descriptions of them. The described issues include USB data leaks, PSBT tampering, firmware-update bypasses, virtual-disk file parsing flaws, and duress-wallet exposure in Delta Mode. Because we cannot see the patches themselves, we can only assess the claimed severity, not verify the fixes.

This commit simply updates a stored Bitcoin blockchain height number from 963,314 to 965,337, along with its timestamp. It is an automatic, routine data refresh with no code logic changes and no apparent security relevance.

This commit only updates a linked external code library (a Git submodule called ckcc-protocol) to a newer version. The actual code changes inside that library are not shown in the commit diff, and no security-related information was provided by the project or any verified source. On its own, this single-line submodule bump tells us nothing about whether a security issue was fixed or introduced.

This commit only edits the draft release changelog file. It rewords two upcoming feature descriptions and fixes line wrapping for another entry. No source code, firmware logic, or security behavior was changed.

This commit only adds a plain-language comment ('# 10 years') next to an existing constant that sets how far in the future a transaction's locktime can be. No code behavior changed.

This change adds a warning when a Bitcoin transaction's locktime is set to a block height more than 10 years in the future. It does not block the transaction but alerts the user, helping catch potential tricks where a transaction is made unspendable for a very long time without the user noticing.

This update tightens a recently added safety check in the COLDCARD firmware. For a specific type of Bitcoin address (P2SH-P2WSH), the device now verifies that the redeem script provided in the transaction data exactly matches the expected wrapper around the witness script. Previously, a malformed or junk redeem script could slip past the check, causing the device to sign the transaction while being unable to reliably verify the input amount and thus the fee. That could let an attacker trick a user into approving a transaction with a hidden or excessive fee.

This commit only updates the release signature file. It adds cryptographic hashes for two new firmware files and updates a hash for a changelog file, then re-signs the file with a PGP signature. There are no code changes, no bug fixes, and no security-related content in the commit message or diff.

This is a one-line changelog note, not the actual code fix. It describes a bug where, if the main wallet was empty and a temporary seed was active, importing wallets or restoring backups would incorrectly become permanent changes to the master wallet instead of staying temporary. The note suggests the real fix happened elsewhere, so this commit alone does not show what code changed or how severe the underlying bug is.

This fix corrects a developer-only backup restore feature so that it always creates a temporary wallet when any real wallet secret is already stored on the device. Before the fix, the restore could report success while silently failing to overwrite the active wallet because the operation was treated as a no-op. The change prevents misleading success reports and accidental or malicious overwrites of the real wallet.

This commit fixes a bug in the COLDCARD hardware wallet where importing a permanent private key could incorrectly be allowed while a temporary wallet was still active. The old check only verified that the main secure-element secret was blank, but that condition can be true even when a temporary wallet is loaded. The new check ensures no secret of any kind is active before a permanent key import proceeds. If the bug were triggered, a permanent import might overwrite or coexist unexpectedly with an active temporary wallet, potentially confusing the user about which wallet is in control or causing loss of funds if the wrong wallet is used.

This update fixes a bug in the COLDCARD hardware wallet where a malformed Bitcoin transaction file (PSBT) could slip through if it described a wrapped SegWit input but left out a required piece of data called the redeem script. Without that script, the wallet could not correctly calculate the transaction's fee, which might let an attacker trick the user into approving a transaction that sends far more in fees than intended. The fix makes the wallet reject such malformed files outright.

This commit only updates a release signature file. It adds two new official firmware file hashes for COLDCARD Mk devices and refreshes the PGP signature covering the file. There are no code changes, no bug fixes, and no security-relevant behavior changes in the firmware itself.

This commit only updates a signed release manifest file (signatures.txt). It refreshes SHA-256 hashes for two markdown files and adds hashes for two newly released firmware files, then re-signs the file with PGP. No source code, security logic, or vulnerability fix is present in the diff.

This commit simply updates a stored Bitcoin blockchain height number from 963,191 to 963,314, along with its timestamp. It is a routine data refresh with no code logic changes and no apparent security relevance.

This commit is a changelog-only update that publicly discloses a severe, long-running security flaw in COLDCARD hardware wallets: for roughly five years, the devices generated cryptographic seeds with far less randomness than intended. On older Mk3 devices, seed entropy may have been as low as about 40 bits, and on Mk4/Mk5/Q devices as low as about 72 bits. That makes generated private keys much easier for an attacker to guess or reproduce, putting any funds secured by those keys at risk. The changelog also lists many other security fixes, including protections against a compromised USB host altering transactions before signing, restrictions on reading sensitive staged data over USB, and hardening of the random-number generator. Users are advised to upgrade immediately and regenerate any seeds created with affected firmware.