COLDCARD firmware

This commit fixes two typos in a comment inside a build Makefile. It changes no code, commands, or build behavior. There is no security relevance.

This commit is a trivial documentation edit. It expands the abbreviation 'WIF' to 'Wallet Import Format' in an upcoming release changelog. No code, cryptographic logic, or security behavior was changed.

This commit only edits the wording of an unreleased changelog file. It rephrases descriptions of upcoming features and reclassifies one item from 'Bugfix' to 'Enhancement'. No source code, firmware logic, or security behavior was changed.

This commit is purely cosmetic: it reformats a few lines of Python code in the COLDCARD firmware without changing what the code actually does. There is no security-relevant change.

This commit simply adds a 'debug/' directory to the .gitignore file in the project's testing folder. This tells Git to ignore files placed in that folder. It is a routine development housekeeping change with no visible security relevance.

This commit fixes a bug in the COLDCARD hardware wallet's handling of Bitcoin transaction files (PSBTs). Previously, the wallet only checked the most recent 50 inputs for duplicates, so a malicious transaction with more than 50 inputs could spend the same coin twice without being detected. The fix now checks up to 100 inputs and uses a more reliable data structure. This could have allowed an attacker to trick a user into signing a transaction that moves more money than it appears to.

This is a tiny code cleanup in a Bitcoin transaction serialization helper. It removes an unused bytes-to-hex function and avoids creating an empty COutPoint object before deserializing one. There is no apparent security issue.

This commit only edits the upcoming release changelog file. It reorders two bugfix entries and changes some backtick formatting to quotation marks in feature descriptions. No source code, firmware logic, or security behavior was changed.

This commit fixes a bug in the COLDCARD hardware wallet where a Bitcoin transaction could contain the same input coin twice without being detected. The patch now checks for duplicate inputs while the wallet is reviewing a transaction to sign. However, the fix only remembers the last 50 inputs, so duplicates more than 50 positions apart are still missed. The included test confirms this limitation.

This is a routine automated update by Dependabot that bumps the Python Pillow image-processing library from version 10.3.0 to 12.1.1 inside a small helper tool used to build fonts for the COLDCARD hardware wallet. The change itself is a single line in a requirements file. It is not a fix for a known, actively exploited vulnerability in the COLDCARD firmware, and the affected helper tool is not part of the wallet's runtime security boundary.

This commit only edits the upcoming release changelog file. It fixes two typos ('sesnsitive' to 'sensitive', 'your' to 'you'), capitalizes one bullet point, and adds a documentation link for a new BIP-322 proof-of-reserve feature. No source code, firmware logic, or security behavior was changed.

This commit only adds a one-line note to the upcoming-release changelog announcing a new BIP-322 'Proof of Reserve' signing feature. No source code, tests, build files, or documentation beyond the changelog were changed. There is nothing in the diff that introduces, fixes, or changes any security-relevant behavior.

This commit only edits a Markdown documentation file about BIP-322 Proof of Reserves. It rewords headings, fixes formatting, adds clarifying sentences, and updates a link style. No source code, firmware logic, or security behavior changed.

This commit makes a tiny code change and adds a few test cleanup button presses. It does not appear to fix or introduce any security issue. The code change updates one call to a user-prompt function to include a new 'Electrum' label argument, likely matching a recent refactor in that helper function. The test change presses 'cancel' three extra times after a test step, probably to close leftover menus.

This commit adds a new menu option that lets COLDCARD users export their public wallet information in a format compatible with Blue Wallet. It reuses the existing Electrum export code and only changes labels and filenames. There is no indication of a security bug or vulnerability.

This commit changes a single line in a test file. The test previously checked that a menu item called 'Menu Wrapping' was not present; it now checks that 'Buried Settings' is not present. This is purely a test-code update matching the test to the current user-interface labels. There is no firmware behavior change and no security relevance visible in the diff.

This commit only updates automated test scripts to navigate a new 'Buried Settings' submenu that was apparently added to the COLDCARD user interface. It does not change any firmware code, cryptography, or security behavior. There is no security issue here.

This commit only adds two lines to an upcoming-release changelog. It describes future user-interface enhancements: showing a BIP-39 passphrase on screen after it takes effect, and adding a new 'Buried Settings' submenu for rarely used settings. There is no code change, no bug fix, and no security patch in the diff itself.

This commit simply reorganizes two existing user-preference settings ('Home Menu XFP' and 'Menu Wrapping') from the main Settings menu into a new submenu called 'Buried Settings'. There is no change to how these settings work, no new functionality, and no security-related code change.

This commit only updates a text file documenting the device's on-screen menu structure and a small test script that prints that menu tree. It adds new menu entries (like 'Restore Seed XOR', 'Key Expression', 'Nuke Device'), reorganizes some settings under a 'Buried Settings' submenu, and updates shortcut labels. There are no firmware code changes, no cryptographic changes, and no changes to how the device protects secrets or handles transactions.

This commit only edits the wording of an upcoming-release changelog file. No code, firmware logic, or security behavior was changed. It is a documentation/markdown edit with no security relevance.

This commit fixes a small data-formatting inconsistency in how the COLDCARD firmware reads and writes the transaction version number inside PSBT v2 files. The code now treats the version as a signed 32-bit integer, matching the Bitcoin protocol, instead of an unsigned 32-bit integer. The practical security impact is likely low because the value is still 4 bytes on the wire and the same bits are produced for all common positive version values. It mainly matters if someone deliberately uses a negative version number, which is unusual and would previously have been misinterpreted as a very large positive number.

This commit is a user-interface refactor for importing multisignature wallet setups on the COLDCARD. It replaces three separate menu items ('Import from File', 'Import from QR', 'Import via NFC') with a single 'Import' option that then asks the user to choose the source. The underlying import logic is essentially unchanged, and there is no indication this fixes a security bug or introduces a vulnerability.

This commit removes a local variable called total_out that was being incremented while iterating over transaction outputs in a PSBT (Partially Signed Bitcoin Transaction) parser. The variable was apparently unused and is described as 'unnecessary.' There is no direct evidence in the commit that this change fixes a security vulnerability; it appears to be a minor cleanup or optimization.

This is a tiny code cleanup in the COLDCARD simulator's Unix launcher. It moves the '-e' flag so it always appears before the command to run, instead of being added separately in two branches. There is no security-relevant change.