Passport firmware

This commit tightens how Passport firmware decodes SeedQR codes—QR codes that encode a wallet recovery phrase as numbers. Before the fix, the decoder would try to look up BIP-39 words using raw 4-digit indices before confirming the input was valid. The new code first checks that the payload length is a multiple of 4, that the number of words is a supported seed length, that every character is a digit, and that each index is within the valid BIP-39 word range. This prevents malformed or out-of-range SeedQR payloads from being partially processed or causing unexpected behavior during word lookup.

This change tightens how Passport's bootloader validates a new firmware update. Previously, if the currently-running firmware failed validation, the bootloader would skip signature checks on the incoming update and jump straight to installing it. The patch moves the signature verification outside that 'only if current firmware is valid' branch, so the new firmware is always signature-checked before installation. It also moves a check about whether the current firmware was user-signed so it is computed earlier. In short: the bootloader now refuses to install unsigned updates even when the existing firmware looks broken.

This bootloader patch changes how the result of a security check on the currently-running firmware is stored. Previously, the code immediately converted the secure verification result into a plain true/false boolean. Now it keeps the special secure result value intact and compares it directly later. This is a hardening fix: it reduces the chance that a subtle type-conversion bug or compiler optimization could let a failed firmware check be treated as a pass, which in turn could allow a malicious or corrupted firmware update to proceed.

This commit tightens the allowed versions of a Python image-processing library called Pillow used only in developer tooling. It caps Pillow below version 13 and requires Python 3.10 or newer. There is no indication this fixes a security flaw in the firmware itself; it appears to be a build/maintenance compatibility change.

This commit changes how Passport's bootloader checks firmware updates. Previously, if the currently-running firmware failed validation, the bootloader would skip verifying the new update's signature and could install it anyway. Now the new firmware's signature is always verified before installation, even when the current firmware is invalid. This closes a path where a corrupted or attacker-controlled running firmware might be able to load an unsigned or wrongly-signed update.

This commit adds support for a new Bitcoin wallet app called Bitcoin Safe. It is a straightforward feature addition: a new wallet definition file is created and registered in two lists so the Passport device recognizes Bitcoin Safe during setup. There is no bug fix, no change to cryptographic code, and no indication of a security problem.

This commit updates the required version of the Python imaging library Pillow from 8.x to at least 12.3.0 in the project's host tooling configuration. Pillow 8.x is known to have publicly disclosed security vulnerabilities, so raising the minimum version is a defensive maintenance change. It does not by itself prove the firmware was exploitable, but it removes a risky dependency version from the development/build environment.

This commit simply adds a new Bitcoin wallet integration file named 'coconut.py' to the firmware build list. It is a one-line manifest change with no visible security implications on its own.

This commit adds support for a new Bitcoin wallet app called Coconut Wallet to the Passport hardware device. It lets users export their single-signature wallet setup to Coconut Wallet via an animated QR code, using the same data format already used for Sparrow Wallet. There is no indication of a security bug or fix in the change.

This firmware update fixes a bug in how Passport checks whether a Bitcoin transaction's 'change' output is safe to send back to the user's own wallet. For modern Taproot-style transactions, the device was skipping an important ownership check on inputs. That could let a malicious or crafted PSBT (Partially Signed Bitcoin Transaction) trick the user into treating someone else's coins as their own change, potentially approving a transaction that sends funds to an attacker while the screen says it is just change.

This commit tweaks the code that converts a user's BIP39 recovery phrase (mnemonic words) into secret bits inside a hardware wallet. The change removes an 'if' branch during word copying so the loop always writes to the same positions, regardless of how long each word is. The stated goal is to make the copy operation take the same amount of time and perform the same memory accesses for every word length, which can help defend against timing and power-analysis side-channel attacks that might otherwise leak information about the recovery phrase.

This commit only rewrites two code comments in a BIP39 mnemonic parser to be shorter and clearer. It does not change any executable code, logic, or behavior. There is no security-relevant change.

This commit only rewrites comments in a source file that handles BIP39 seed phrases. No code logic, buffer sizes, or function behavior were changed. It is a documentation-only cleanup and does not affect security.

This commit hardens the code that converts a user's BIP39 recovery phrase (seed words) into secret bits. It fixes a bug where 8-character words were wrongly rejected, makes the loop length independent of the number of words to reduce timing clues, adds bounds checks to prevent reading past the end of the input buffer, and clears sensitive buffers before returning on error. The changes are defensive and reduce side-channel and out-of-bounds risks, but the commit message frames them as feedback responses needing testing, so it is not a finished security fix.

This commit hardens the code that converts a user's BIP-39 seed phrase into secret data. It removes timing and loop-behavior clues that an attacker with physical access might measure to learn how many words the phrase has, how long each word is, or where word boundaries fall. The change is defensive: it makes the parsing routine run in constant time and on a fixed-size buffer, reducing side-channel leakage. There is no claim in the commit that an actual exploit exists.

This commit is a defensive hardening change for the BIP-39 seed-word handling code in the Passport hardware wallet firmware. It restructures how the English word list is stored so that a constant-time word comparison function can safely read every entry without accidentally touching memory past the end of a short word. It also removes noisy timing-test thresholds that could fail on shared CI machines and keeps only a stricter statistical correlation check. The change is explicitly described by the developer as an early 'first pass' that still needs testing and evaluation, so it is not a finished security fix.

This commit simply moves an existing helper function from inside a method to the top of the same file. The function's behavior and the security limits it enforces are unchanged. There is no security fix or vulnerability introduced.

This commit fixes a security bug in the Passport hardware wallet's microSD message-signing flow. Previously, the firmware checked a file's size in one operation and then read it in another. Because the microSD card could be swapped between those two moments, a malicious file larger than the allowed limit could still be loaded. The fix reads only a bounded number of bytes in a single operation, closing that window.

This is a small build-tool fix in the factory/secrets-injection utility used during Passport device manufacturing. It replaces a non-portable type name (`ulong`) with the standard C type (`unsigned long`) and removes a compiler flag that was suppressing the resulting error. There is no direct evidence this change fixes an exploitable security vulnerability; it appears to be a portability/correctness cleanup that lets the tool compile cleanly across build environments.

This commit fixes a missing safety limit in the Passport hardware wallet's microSD message-signing feature. Previously, a user could accidentally or maliciously be asked to sign an extremely large file from the microSD card, which could strain memory, cause crashes, or be used in a denial-of-service-style attack. The change restores a maximum file-size check that existed in older code but was lost when two code paths were merged. Health-check files are exempt because they already have their own built-in size limits.

This commit fixes a consistency issue in the QR-code message-signing flow of the Passport hardware wallet. Previously, when signing a message via QR code, the wallet did not pass the user-confirmed address down to the signing code as an explicit 'expected address' check. The microSD signing path already had this safety check. After the change, the raw, verified address is passed through and used to confirm the signature is for the correct address, while a stylized version is still shown on screen. This reduces the risk that a tricked or confused user signs a message with the wrong address.

This commit fixes a minor return-value bug in the Passport hardware wallet's health-check flow. When the user cancels message signing, the flow now returns 'None' instead of 'False'. This is a correctness fix that likely prevents a downstream caller from misinterpreting a user cancellation as a failed health check. There is no direct evidence in the commit that this is exploitable for theft, bypass, or denial of service.

This commit is purely cosmetic: it reformats Python code to follow style rules, fixes spacing around '@classmethod' decorators, and adds an auto-formatting tool (autopep8) to the developer environment. No program behavior or security properties change.

This firmware update fixes a bug where the Bitcoin address shown on the Passport hardware wallet screen before signing could differ from the address actually used to create the signature. The fix makes the signing task verify that the address it computes matches the address previewed to the user, and aborts if they don't match. This prevents a user from being tricked into approving a signature for one address while the device signs with another.