Passport firmware

This commit adds a new feature to Foundation's Passport hardware wallet that exports two cryptographic public keys for Casa wallet registration: the master extended public key and a separate Casa-specific key derived at path m/45'. The keys can be exported either as a QR code or saved to a microSD card. The change is a feature addition, not a bug fix, and there is no evidence in the commit that it addresses a security vulnerability. However, exporting additional key material always slightly increases the attack surface if the exported data is mishandled.

This commit adds support for the Unchained wallet to the Passport hardware wallet. Most of the change is normal feature code, but it also introduces a new way to feed already-encoded data into the QR encoder and tightens up the encoder so it won't produce output if it hasn't been started correctly. The simulator also gets clipboard copy/paste tweaks. There is no vendor statement that this fixes a security bug, and the changes look like defensive hardening rather than a patch for an active vulnerability.

This firmware update hardens the way Passport generates random numbers. Previously, a failing or stuck hardware random-number generator could silently produce weak or repeated values, which is dangerous for creating secret keys. The patch makes the device detect bad randomness and either recover or permanently stop with a clear error screen, instead of continuing with potentially guessable secrets. It also routes all MicroPython randomness through the same checked generator.

This firmware update moves the verification of Bitcoin 'change' addresses to happen before the user reviews the transaction on screen. Previously, the device checked whether change outputs truly belonged to the wallet only after the user had already approved the transaction and while it was about to sign. Because the review screen hides change outputs from the user, a malicious or buggy PSBT could have asked the device to send change to an attacker's address, and the user would never see it before approving. The fix ensures the wallet proves it owns every hidden change output before showing the review screen, so a mismatch aborts the transaction before the user is asked to confirm.

This commit changes how the Passport hardware wallet reviews Bitcoin transactions that have no 'change' output. Previously, the wallet would always run a change-verification step that opens the secure key store, even when there was no change to verify. Now it skips that step when there is no change, and updates the on-screen spinner label from 'Validating transaction' to 'Verifying change' so the user knows what is happening. The change is framed by the developer as a user-experience and clarity improvement, not as a fix for a known security vulnerability.

This commit moves a safety check earlier in the process of approving a Bitcoin transaction on the Passport hardware wallet. Previously, the wallet verified that 'change' outputs (money going back to your own wallet) truly belonged to you only after you had already reviewed the transaction and approved signing. Now that ownership proof happens before the transaction details are shown to the user. This prevents a scenario where a malicious or buggy PSBT (the file describing the transaction) hides a change address that actually belongs to an attacker, because the wallet will refuse to show the review screen if it cannot prove the change is yours. The change is defensive: it closes a window where a user might approve a transaction whose change output has not yet been validated.

This commit is a routine development tooling and cleanup change. It adds the Pytest testing framework to the project's Nix development shell, fixes a test runner path, adds a GitHub Actions workflow to run simulator tests automatically, and removes an unused translation system along with its associated tests. There is no indication this change fixes a security vulnerability or introduces a security-relevant behavior.

This commit updates the Python Pillow image-processing library used in host-side developer tooling from version 8.x to 12.3.x and requires Python 3.10 or newer. Pillow 8.x is known to have many publicly disclosed security vulnerabilities, so the change likely removes exposure to those bugs during firmware build and test workflows. The change does not alter the firmware that runs on the Passport device itself, only the tools that run on a developer's computer.

This commit adds support for a new Bitcoin software wallet called 'Bitcoin Safe' to the Passport hardware wallet firmware. It is a straightforward feature addition that registers the wallet in the firmware's list of supported software wallets and defines how to export wallet data to it (via QR code or microSD card). There is no indication of a security bug, vulnerability, or fix in the changed code.

This update changes how the Passport hardware wallet displays Bitcoin transaction outputs that carry data (OP_RETURN outputs). Previously, only the embedded message was shown. Now the device also shows the amount of bitcoin assigned to that output and escapes the message text so a crafted message cannot fake extra user-interface labels (like a fake 'Amount' or 'Destination' section). The included tests demonstrate that an attacker who controls an OP_RETURN message can no longer make the screen look like a real payment destination is being sent funds.

This commit fixes a bug in how the Passport hardware wallet saves its settings to internal flash memory. Previously, the code checked whether the settings data was too large only after it had already picked and erased a flash storage slot. If the data was too big, the code hit a broken 'assert false' statement that would crash the device. The fix moves the size check earlier, before any flash slot is touched, and replaces the crash with a proper error. A new unit test confirms that oversized settings are rejected before any flash operation happens.

This commit tightens a software dependency used only in testing/development tooling. It prevents an automated test environment from installing old, known-vulnerable versions of the Pillow image library when running under Python 3.10. The change does not alter the firmware that runs on the Passport device itself, so end-user funds or device security are not directly at risk. It is a preventive hygiene fix for the developer build/test pipeline.

This firmware update fixes a security issue in the Passport hardware wallet's handling of Bitcoin transaction fees. Previously, when a transaction file (PSBT) only provided a claimed input amount without the full previous transaction to prove it, Passport would calculate and display a network fee as if it were verified. A malicious or buggy companion wallet could lie about input amounts, making the fee look smaller than it actually is and tricking the user into approving a transaction that sends more money to fees or an attacker than shown. The fix marks such fees as 'Unverified' on screen and in warnings, and adds cross-checks when both witness and non-witness input data are present. It also moves key-derivation verification earlier so bogus ownership metadata cannot be recorded in the device's history cache.

This update tightens the checks on SeedQR codes, which are QR codes that encode a wallet's backup seed phrase as numbers. Before, the decoder might accept invalid or oddly-sized numeric strings and either crash or produce an incorrect seed. Now it rejects anything that isn't the right length, isn't all digits, or contains word index numbers that are too high. This protects users from importing a corrupted or attacker-crafted seed that could lead to an unusable or insecure wallet.

This tiny change removes two variables ('pu' and 'skp') from a Python 'del' cleanup statement in the code that signs Bitcoin transactions. The commit message says it fixes an 'excess delete call.' In Python, deleting a name that does not exist raises a NameError, which would crash the signing task. The patch prevents that crash but does not appear to be a security vulnerability itself; it is a bug fix for a runtime error in sensitive code.

This commit adds a single blank line between two test functions to fix code formatting. It makes no functional changes to the firmware or its tests.

This update fixes a validation gap when importing multisig wallets into the Passport hardware wallet. Previously, the device only checked that the public key matched; now it also checks the chain code. Without this check, a tampered extended public key (xpub) could have been accepted as belonging to the wallet, potentially allowing an attacker to silently change the wallet's receiving addresses or make future transactions look valid when they are not. The fix is accompanied by a new test that confirms mismatched chain codes are rejected.

This commit is a routine cleanup and test-infrastructure change. It removes an unused translation system (translation files, imports, and a test), updates linting rules to no longer exclude the now-removed translation folder, and fixes the test runner path and simulator fixture reliability. There is no security-relevant behavior change in the firmware itself.