Passport firmware

This commit adds a test fixture flag called witness_utxo to a fake PSBT input object used in unit tests, and documents a changelog entry about marking network fees as 'unverified' when a PSBT input's UTXO data cannot be verified. The actual production code that performs this validation is not shown in the diff, so we can only see the test scaffolding and release-note mention. It likely relates to preventing a hardware wallet from trusting a transaction's claimed fee when the input amounts are not provable, which could stop a malicious co-signer or host from hiding or inflating fees.

This firmware update changes how Passport validates Bitcoin transaction files (PSBTs) before signing. It makes two main improvements: it reuses the wallet's secret seed for fewer key-derivation operations, and it verifies that the claimed input amounts are backed by real signing keys before trusting those amounts. The commit message and code comments suggest this closes a gap where a malicious or malformed PSBT could trick the device into recording an incorrect input amount in its history cache, which could later mislead the user about fees or balances. A second change also prevents re-signing a transaction that already has a signature, which could reduce certain replay or state-confusion risks.

This firmware update fixes a bug in the Passport hardware wallet's handling of Bitcoin transaction files (PSBTs). Previously, the wallet could be tricked into reviewing and displaying a transaction fee as verified even when an input the wallet appeared to own was actually controlled by a different key. The fix makes the device cryptographically prove it really owns each input before it tells the user the fee is trustworthy, helping prevent attackers from showing misleading fee amounts.

This firmware update fixes a multisig wallet import check. Previously, the device only verified that the public key portion of an extended public key (xpub) matched what it expected; now it also verifies the chain code. A mismatched chain code could let a malicious or malformed xpub slip through validation, potentially causing the wallet to derive wrong or non-matching addresses and making backups or transaction coordination unreliable. The fix is accompanied by a new unit test that confirms a wrong chain code is rejected.

This update changes how Passport handles multisig wallet setups proposed by a transaction file (PSBT). Previously, if the user declined to import a proposed multisig configuration while using a temporary seed, the device would still sign the transaction and only warn that the config wouldn't be saved. Now it cancels signing instead. Also, when a temporary seed is active, the device now asks the user before using a PSBT-proposed multisig wallet rather than silently skipping that step. The goal is to prevent a user from accidentally signing a transaction with an untrusted or unexpected multisig wallet.

This update hardens the QR-code scanner library (quirc) used in the Passport hardware wallet so it refuses to process impossibly large QR grids and no longer reads past the end of its internal buffer when a malformed QR code is presented. It also fixes an off-by-one bug in grid indexing. The changes are defensive: they prevent memory corruption and crashes when scanning deliberately crafted or corrupted QR codes, rather than changing normal wallet behavior.

This update tightens the checks on Bitcoin transaction amounts inside PSBT files handled by the Passport hardware wallet. Before, the firmware did not fully enforce Bitcoin's rule that no single output or input, and no running total, can exceed about 21 million bitcoins (MAX_MONEY). A malicious or buggy companion app could craft a PSBT with oversized, negative, or zero input amounts. The device might then compute a wrong fee or balance, which could trick a user into approving a transaction that sends more than intended, or that hides a large fee. The patch now rejects such PSBTs immediately.

This commit fixes a low-level programming bug in how the Passport hardware wallet builds a special data format (CBOR) when exporting a public key to the Unchained Capital service. The original code passed raw numbers to a buffer-extension function in a way that could produce incorrect byte sequences. The fix wraps those numbers as explicit byte arrays. The commit also contains unrelated cosmetic changes to the simulator's README and adds clipboard keybindings to the simulator's terminal window.

This commit tightens how Passport retrieves the wallet's fingerprint when exporting data for the Unchained wallet. Previously, if the fingerprint setting was missing, the code would silently fall back to a value of 0. Now it requires the actual fingerprint to be present. This is a hardening change: a missing or corrupted fingerprint setting could have led to an incorrect or invalid export rather than a clearly wrong one, which could confuse wallet software or, in worst-case scenarios, affect how multisig addresses are derived.

This commit hardens the firmware's QR-code encoder used for the Unchained wallet export. It adds a safety flag so that if an invalid export request is rejected, the device won't accidentally reuse or leak a previously encoded QR message. It also fixes a fingerprint byte-order bug and switches from one export format to another for microSD exports. The changes are defensive hardening rather than a clear fix for an active exploit.

This commit adds support for connecting the Passport hardware wallet to the Unchained multisig service. It introduces a new way to pass already-encoded data into the QR/UR encoder, plus a new wallet definition and CBOR encoding helper. The changes are mostly additive feature code; there is no vendor statement that this fixes a security bug, and no independent security disclosure is referenced.

This commit documents and tests a policy for approving multisignature wallets proposed by a PSBT (Partially Signed Bitcoin Transaction). The key functional change is that when a Passport device is using a temporary seed, it now requires explicit user confirmation before importing a multisig wallet proposed by a PSBT, and cancels signing if the user declines. The commit itself is mostly a changelog entry and unit tests; the actual security logic appears to have been implemented elsewhere.

This firmware update changes how Passport handles Bitcoin transactions that come with a new multisig wallet configuration. Previously, if importing that proposed multisig config failed, the device would warn the user but still allow the transaction to be signed. Now it aborts signing instead. It also changes the default behavior so the device always asks before using a temporary multisig config rather than silently skipping the import. The commit does not describe this as a security fix, but the change removes a risky path where a transaction could be signed under an unapproved or failed wallet setup.

This commit adds safety checks to the QR-code scanning library (quirc) used in Passport firmware. It rejects QR grids that are larger than the standard maximum size (version 40, or 177×177 cells) before they can be processed. Without these checks, a malformed or oversized QR code could cause memory corruption or crashes. The commit also fixes an off-by-one bug in grid index validation and adds tests to verify the new limits.

This commit removes several lines of informational text from the Casa wallet pairing file that Passport writes to a microSD card. The deleted text included the blockchain name, coin type, internal symbol, and a generic warning not to deposit funds unless the user's wallet is ready. The remaining file still contains the master extended public key, the Casa derivation extended public key, and the master key fingerprint. There is no code change that alters how keys are derived, stored, or transmitted, and no security vulnerability is visible in the diff.

This commit changes how the Passport hardware wallet exports information for the Casa wallet. Previously, only the master extended public key was written to a microSD card. Now, the file also includes the Casa-specific extended public key at derivation path m/45'. This is a feature enhancement to make Casa multisig setup easier, not a security fix. The change does not appear to introduce a vulnerability, but it does export additional key material to removable storage.

This commit adds a new way for the Passport hardware wallet to export wallet pairing information to Casa, a Bitcoin custody service. Instead of exporting a single key, it now exports a 'crypto-account' QR code containing two related public keys: the wallet's root public key and a separate Casa-specific public key derived from path m/45'. The change is a feature addition; there is no direct evidence in the commit that it fixes a security vulnerability, but it does change what key material is exposed during pairing and how it is encoded.

This firmware update tightens checks on Bitcoin transaction amounts inside PSBT files. Before the patch, input amounts were only checked with a simple 'greater than zero' assertion, and the running total of input value was not capped. A malicious or malformed PSBT could use negative, zero, or absurdly large input amounts to make the wallet miscalculate the transaction fee or bypass sanity checks. The patch rejects any input amount outside the valid Bitcoin range and stops the total from exceeding Bitcoin's maximum money limit, matching protections that already existed for outputs.

This commit adds a safety check to the Passport hardware wallet's Bitcoin transaction parser. Before signing a transaction, the device now rejects any output amount that is negative, larger than the total possible Bitcoin supply (about 21 million BTC), or that would make the whole transaction output more than that total. Without this check, a malicious or malformed transaction could try to use impossible amounts, which might confuse the user or lead the wallet to compute incorrect balances or fees.

This commit updates a single unit test file for Bitcoin PSBT (Partially Signed Bitcoin Transaction) fee handling. It replaces a fake/mock input object with a real parsed PSBT input that includes a BIP32 derivation path, so the test exercises more of the actual production parsing code. There is no change to firmware behavior, no bug fix, and no security patch in the shipped code.

This firmware update changes how Passport classifies SegWit Bitcoin transaction inputs. Previously, the device tried to detect SegWit by inspecting the address type and redeem script, and would reject a PSBT that supplied a witness UTXO for what it thought was a non-SegWit input. Now, if a PSBT includes a witness UTXO, the input is marked SegWit immediately. The patch removes several safety checks, which could allow a malicious or malformed PSBT to bypass fee verification or signature checks. The commit message does not describe a security fix, but the change is in security-relevant code.

This update changes how the Passport hardware wallet handles Bitcoin transaction fees shown during signing. Previously, the wallet could display a network fee even when it could not independently verify the input amounts supplied by another wallet. Now it marks such fees as 'Unverified' and skips fee-based warnings that could mislead the user. It also adds cross-checks when a transaction input provides both witness and non-witness data, ensuring they agree before trusting the amount.

This commit only adds more test cases to an existing unit test file for SeedQR decoding. It does not change any production firmware code. The new tests check that the decoder correctly rejects additional malformed inputs, such as an empty string, an oversized string, and strings containing unusual Unicode digits. This is a routine hardening of test coverage, not a fix for a known security bug.