Passport firmware

This commit re-enables the option for BTCPay wallet exports on the Passport hardware wallet to use the newer Taproot (P2TR) address format, in addition to the existing SegWit (P2WPKH) format. It is a feature re-enablement, not a fix for a vulnerability. There is no direct evidence in the commit or supplied references that this change addresses a security flaw.

This commit fixes a timing side-channel weakness in the code that converts a BIP-39 recovery phrase (a list of words) back into the secret digital bits. Before the fix, the code stopped searching the word list as soon as it found a match and used a normal string comparison, so an attacker measuring tiny time differences might learn which words were entered. The new version always scans the entire word list and compares words in constant time, making the process take the same amount of time regardless of the phrase. A new test checks that timing does not vary with the word positions.

This commit removes the ability to create a single-signature (single-sig) wallet for the Theya service in the Passport firmware. Only multisig Theya wallets remain supported. There is no indication of a security vulnerability; this appears to be a product or compatibility change.

This firmware update fixes a bug in how Passport hardware wallets compute Taproot Bitcoin transaction signatures. Previously, when a transaction contained both SegWit and Taproot inputs, the wallet could accidentally reuse cached SegWit-style hashes for the Taproot signing math instead of computing fresh Taproot-specific hashes. Because Taproot and SegWit use different hashing rules, this could lead to an invalid signature or, in some edge cases, a signature that does not match what the Bitcoin network expects. The fix creates separate Taproot hash fields so the two paths no longer share state.

This is a one-line fix in the Bitcoin transaction signing code of the Foundation Passport hardware wallet. When signing a Taproot transaction immediately after signing a SegWit transaction, the wallet could reuse cached intermediate hash values that were not fully initialized for Taproot. That could cause the wallet to compute an incorrect transaction fingerprint (sighash), which in rare cases might lead to an invalid signature or, more seriously, a signature that does not protect all the transaction details it should. The fix forces the wallet to rebuild those cached hashes if any of the required Taproot hash fields are missing.

This commit adds Nix build environment files (a reproducible developer shell setup) for the Passport firmware project. It does not change any firmware code, cryptographic logic, or device behavior. There is no indication this is a security fix or introduces a security vulnerability.

This commit only updates the developer setup guide (DEVELOPMENT.md). It adds instructions for using Nix/NixOS during development, changes the OpenOCD source repository URL from an old fork to the official project, and adds a user to the plugdev group. There is no firmware code change and no security vulnerability is introduced or fixed.

This commit updates the project's Nix development environment files. It adds a lock file, adjusts package names, adds build dependencies, and tweaks compiler flags for a local developer tool called 'cosign'. There is no change to the firmware that runs on the Passport device, no change to cryptographic code, and no indication of a security bug or fix.

This commit suppresses a compiler warning about using the address of a short-lived local variable to track the top of the program's stack. The underlying code behavior is unchanged; only the warning is silenced. There is no direct security fix here, though the pattern itself is a known, long-standing MicroPython idiom for estimating stack usage.

This commit is a documentation-only change. It updates the developer setup instructions to clone a specific, released version (v0.12.0) of the OpenOCD debugging tool instead of the latest development code. There is no change to firmware code, no user-facing change, and no security fix or vulnerability introduced.

This commit updates several Rust library dependencies used in the Passport hardware wallet firmware and makes small code adjustments to match the new library versions. The most notable change is in the cryptographic signing code, where the code no longer wraps the data in a 'Message' object before creating a Schnorr signature. On its own, this looks like a routine compatibility update, but because it touches security-critical code (digital signatures), it warrants careful review to ensure the new calling pattern is safe and does not bypass any intended message-validation step.

This commit makes the Passport hardware wallet automatically create a backup after the user renames the device. The change is a functional improvement to ensure the new device name is preserved in backups, not a fix for an exploitable security flaw. There is no indication of a vulnerability or attack scenario.

This commit only updates developer documentation to say Ubuntu 24.04 is required and adds a command-line flag to silence a deprecation warning in a license-checking tool. It does not change any firmware code, build outputs, or security behavior.

This commit changes a Rust build setting so that debug information is no longer removed from the released firmware. On its own, this is a build/debugging convenience change, not a security fix. It does not patch any vulnerability, change runtime behavior, or introduce a known exploit path.

This commit adds compiler debugging symbols to the firmware build and uploads the resulting ELF file as a build artifact. It does not change the shipped firmware binary, runtime behavior, or introduce any security weakness. It is a developer convenience change.

This commit simply updates the project's declared minimum Rust compiler version from 1.70.0 to 1.77.1 in CI configuration files and a Dockerfile. It does not change any firmware source code, fix a vulnerability, or alter product behavior. It is a routine build-environment maintenance change.

This commit is a bulk update of the company's contact email address in copyright headers and documentation. It replaces 'hello@foundationdevices.com' with 'hello@foundation.xyz' across 728 files. There are no code logic changes, no security fixes, and no functional changes to the firmware.

This commit simply updates a GitHub Actions helper used to build Docker images from version 5 to version 6. There is no indication of a security fix or vulnerability in the change itself.

This commit simply updates a GitHub Actions linting tool (fsfe/reuse-action) from version 2 to version 4. It only affects the project's automated license/copyright compliance check and does not change any firmware code, build outputs, or user-facing behavior. There is no security relevance visible in the commit.

This commit adds a new menu option that lets users sign a message using a file stored on a microSD card, alongside the existing option to sign by scanning a QR code. It reuses the same internal signing logic that was already used for health checks, just with different on-screen labels and file filters. There is no indication in the code that this weakens security or introduces a vulnerability; it appears to be a normal feature addition.

This commit updates the project's build environment from Ubuntu 20.04 to Ubuntu 24.04 in its GitHub Actions CI workflow and Docker container. It also switches the 'reuse' license-compliance tool from being installed via Python's pip to being installed as a standard Ubuntu package. This is a routine maintenance change. It does not by itself fix a known security vulnerability, but staying on a newer, supported operating-system base reduces long-term risk from outdated dependencies and avoids the end-of-life status Ubuntu 20.04 will reach in April 2025.

This commit removes one unused Python import (`import passport`) from a UI icon component. It is a routine code cleanup with no functional or security effect.

This commit is a purely cosmetic UI tweak. It adds a tiny one-pixel bottom padding to the Casa icon in the extensions menu on color-screen Passport devices so the icon lines up better visually. There is no security relevance.

This commit simply replaces the Casa logo/icon artwork used in the Passport firmware's user interface. It updates both color and black-and-white versions of the icon and adjusts the image format from 2-bit indexed color to 1-bit indexed color for the monochrome variant. There is no security-relevant change.

This commit is a purely cosmetic UI tweak. It nudges the Casa logo down by one pixel in card headers on color-screen Passport devices so it lines up better visually. There is no security relevance.