COLDCARD firmware

This commit updates a signed release manifest file (signatures.txt). It removes the file hashes for firmware versions 5.4.4 (Mk4) and 1.3.4Q (Q1) and replaces the ChangeLog.md hash. The commit title 'undo-rc' suggests this is reverting a release-candidate or release that was previously added to the manifest. There is no code change, no vulnerability fix, and no security-relevant behavior change visible in the diff.

This commit is a minor code cleanup in the COLDCARD firmware's file picker. It moves the validation of filename suffixes earlier in the function and slightly changes the wording of an on-screen message shown when no matching files are found. There is no indication this fixes a security bug or introduces a vulnerability.

This commit fixes a file-picker bug in the COLDCARD hardware wallet firmware. Previously, callers passed file extensions without a leading dot (e.g., 'txt' or 'psbt'), so the picker would match any filename ending in those characters, not just proper dotted extensions. A file named 'backuptxt' could be treated as a .txt file, and 'backup7z' as a .7z backup. The patch forces every extension to start with a dot and updates all callers. The main risk is that a maliciously named file on the SD card could be offered to the user as if it were a valid PSBT, backup, text message, or other sensitive file type, potentially tricking the user into signing or restoring from the wrong data.

This commit is a small cleanup and user-experience improvement for the COLDCARD's spending-policy settings. It renames an internal function and parameter, adds 'Saving...' progress messages so users know the device is busy, and simplifies a couple of checks. There is no direct evidence in the diff of a security vulnerability being fixed.

This commit only edits a changelog text file. It rewords a description of an existing product feature (a 'forever calculator' mode that activates after too many failed PIN attempts) and removes a mention of 'bricked' devices. No source code, firmware logic, or security behavior was changed.

This commit only updates the release signature file (signatures.txt) for the COLDCARD Mk4 hardware wallet. It adds SHA-256 hashes for two new firmware files (normal and factory versions of v5.4.4) and refreshes the PGP signature that covers the file. There are no code changes, no bug fixes, and no security-relevant behavior changes in this commit.

This commit only updates the release signature file (releases/signatures.txt). It refreshes SHA-256 hashes for several changelog files and adds hashes for two new Q1 hardware firmware files (v1.3.4Q), plus a new PGP signature over the whole file. There is no source code change, no bug fix, and no security patch in the diff itself.

This commit only edits documentation and release notes. It moves changelog entries from an upcoming-release file into the published changelog and history files, and rewords a BIP-21 extension description. No source code, firmware logic, or security behavior is changed.

This commit adds a single 'Wait...' loading screen while the COLDCARD searches its ownership cache for a Bitcoin address. It is purely a user-interface improvement to indicate that work is happening; there is no security-relevant code change.

This commit updates a single configuration number in the COLDCARD firmware that tells the device the earliest Bitcoin block height at which a certain feature (likely related to 'ccc' or CoinJoin-style coordination) should be considered active. It is a routine date/height bump, not a code change that fixes a vulnerability. By itself it does not appear to introduce or patch a security flaw.

This commit only changes one word in a documentation file. It rephrases a sentence about how COLDCARD handles PSBT warnings under a policy rule. There is no code change, no behavior change, and no security fix or vulnerability introduced.

This commit only updates test files in the COLDCARD firmware repository. It adjusts test cases to use new internal constants, skips some secure-notes/password checks on non-Q1 hardware, replaces a slow wallet-creation helper with a faster import helper, updates menu navigation labels in a test, and adds a missing assertion for a classic P2PKH address format. There are no changes to firmware source code, no security fixes, and no disclosed vulnerability.

This commit is titled 'ckcc bump' and changes one line in one file: external/ckcc-protocol. No diff content is available, and no verified references were supplied. There is no visible information about what was changed, why it was changed, or whether it has any security relevance.

This commit only edits a documentation file (docs/limitations.md). It updates descriptions of product limitations, such as noting that a previously reserved PIN code is now available, explaining backup file timestamps, adding a note about unsupported pay-to-pubkey transactions, and renaming a feature section. There are no code changes, no bug fixes, and no security-relevant behavior changes in the firmware itself.

This commit only adds explanatory comments to two source files and makes a tiny, non-functional cleanup in a USB error handler (removing an unused exception variable). It also adds one line to the changelog noting a separate multisig address-format bugfix. The code changes themselves do not alter program behavior or fix any security issue.

This commit fixes how COLDCARD handles different Bitcoin address formats in multisig transactions. Previously, the wallet could be tricked into treating inputs or change outputs as belonging to the wrong address type (for example, treating a classic P2SH multisig input as if it were a wrapped SegWit P2SH-P2WSH input, or vice versa). The patch makes the device strictly check that the script type matches the wallet's configured address format and verifies that the script in the transaction actually produces the expected on-chain scriptPubKey. This prevents attackers from deceiving the device about which coins are being spent or where change is going.

This commit only changes test code for the COLDCARD firmware. It adjusts how a test sets up a 'hobbled' Teleport signing scenario by importing wallet data before hobbled mode is enabled, and removes an unused test parameter. There is no change to the actual firmware or wallet behavior, and no security issue is present in the diff.

This commit hides the 'Spending Policy' menu item when the COLDCARD wallet does not actually have a real secret key loaded. Previously, the menu item was always shown, even though it would be empty or non-functional without a real secret. This is a minor UI cleanup rather than a serious security fix.

This is a tiny test-only change. It removes an unused function argument (`only_q1`) from a test and adds a short delay (`time.sleep(0.1)`) during a test that simulates user button presses. There is no change to the actual COLDCARD firmware code that users run, and nothing here affects security.

This is a tiny cleanup commit. It fixes a wording error in the changelog ('after 13 PIN failures, when device is bricked' becomes 'after 13 PIN failures or when device is bricked') and removes an unused local import inside a calculator feature. There is no security-relevant code change.

This commit fixes a security bug in the COLDCARD firmware where the 'SSSP' (a spending-limit / hobbled mode feature) settings were being saved under the current temporary seed instead of the master seed. That meant switching to a different temporary seed could bypass or corrupt the spending policy. The patch forces SSSP settings to be read from and written to the master seed only, and hides the 'Destroy Seed' menu item when only a temporary seed is loaded.

This commit updates a linked external component (ckcc-protocol) to its latest master version. No actual code changes are shown, and no security-related description is provided. There is not enough information to assess whether this update fixes or introduces any security issue.

This commit only adjusts test files and removes a couple of unused imports from production code. There is no security fix or vulnerability being patched.

This tiny code change fixes a likely bug in the COLDCARD's NFC feature. Previously, after an NFC operation finished and the device wiped sensitive data, the code continued running in a loop instead of stopping. The added 'break' makes it exit the loop immediately after wiping. This could prevent repeated or unnecessary NFC transmissions of sensitive wallet data, reducing the chance of leaking secrets or leaving the device in an unexpected state.

This commit is a routine test update and build timestamp refresh. It adds a new test parameter to exercise wallet-name handling with both short and long names (including spaces), and bumps the firmware build date and version. There is no security-relevant code change.