Passport firmware

This bootloader patch changes how the result of a security check on the currently-running firmware is stored. Previously, the code immediately converted the secure verification result into a plain true/false boolean. Now it keeps the special secure result value intact and compares it directly later. This is a hardening fix: it reduces the chance that a subtle type-conversion bug or compiler optimization could let a failed firmware check be treated as a pass, which in turn could allow a malicious or corrupted firmware update to proceed.

This commit changes how Passport's bootloader checks firmware updates. Previously, if the currently-running firmware failed validation, the bootloader would skip verifying the new update's signature and could install it anyway. Now the new firmware's signature is always verified before installation, even when the current firmware is invalid. This closes a path where a corrupted or attacker-controlled running firmware might be able to load an unsigned or wrongly-signed update.

This commit tweaks the code that converts a user's BIP39 recovery phrase (mnemonic words) into secret bits inside a hardware wallet. The change removes an 'if' branch during word copying so the loop always writes to the same positions, regardless of how long each word is. The stated goal is to make the copy operation take the same amount of time and perform the same memory accesses for every word length, which can help defend against timing and power-analysis side-channel attacks that might otherwise leak information about the recovery phrase.

This commit only rewrites two code comments in a BIP39 mnemonic parser to be shorter and clearer. It does not change any executable code, logic, or behavior. There is no security-relevant change.

This commit only rewrites comments in a source file that handles BIP39 seed phrases. No code logic, buffer sizes, or function behavior were changed. It is a documentation-only cleanup and does not affect security.

This commit hardens the code that converts a user's BIP39 recovery phrase (seed words) into secret bits. It fixes a bug where 8-character words were wrongly rejected, makes the loop length independent of the number of words to reduce timing clues, adds bounds checks to prevent reading past the end of the input buffer, and clears sensitive buffers before returning on error. The changes are defensive and reduce side-channel and out-of-bounds risks, but the commit message frames them as feedback responses needing testing, so it is not a finished security fix.

This commit hardens the code that converts a user's BIP-39 seed phrase into secret data. It removes timing and loop-behavior clues that an attacker with physical access might measure to learn how many words the phrase has, how long each word is, or where word boundaries fall. The change is defensive: it makes the parsing routine run in constant time and on a fixed-size buffer, reducing side-channel leakage. There is no claim in the commit that an actual exploit exists.

This commit is a defensive hardening change for the BIP-39 seed-word handling code in the Passport hardware wallet firmware. It restructures how the English word list is stored so that a constant-time word comparison function can safely read every entry without accidentally touching memory past the end of a short word. It also removes noisy timing-test thresholds that could fail on shared CI machines and keeps only a stricter statistical correlation check. The change is explicitly described by the developer as an early 'first pass' that still needs testing and evaluation, so it is not a finished security fix.

This commit fixes a consistency issue in the QR-code message-signing flow of the Passport hardware wallet. Previously, when signing a message via QR code, the wallet did not pass the user-confirmed address down to the signing code as an explicit 'expected address' check. The microSD signing path already had this safety check. After the change, the raw, verified address is passed through and used to confirm the signature is for the correct address, while a stylized version is still shown on screen. This reduces the risk that a tricked or confused user signs a message with the wrong address.

This commit fixes a timing side-channel weakness in the code that converts a BIP-39 recovery phrase (a list of words) back into the secret digital bits. Before the fix, the code stopped searching the word list as soon as it found a match and used a normal string comparison, so an attacker measuring tiny time differences might learn which words were entered. The new version always scans the entire word list and compares words in constant time, making the process take the same amount of time regardless of the phrase. A new test checks that timing does not vary with the word positions.

This commit updates several Rust library dependencies used in the Passport hardware wallet firmware and makes small code adjustments to match the new library versions. The most notable change is in the cryptographic signing code, where the code no longer wraps the data in a 'Message' object before creating a Schnorr signature. On its own, this looks like a routine compatibility update, but because it touches security-critical code (digital signatures), it warrants careful review to ensure the new calling pattern is safe and does not bypass any intended message-validation step.

This commit is a bulk update of the company's contact email address in copyright headers and documentation. It replaces 'hello@foundationdevices.com' with 'hello@foundation.xyz' across 728 files. There are no code logic changes, no security fixes, and no functional changes to the firmware.

This commit adds a new menu option that lets users sign a message using a file stored on a microSD card, alongside the existing option to sign by scanning a QR code. It reuses the same internal signing logic that was already used for health checks, just with different on-screen labels and file filters. There is no indication in the code that this weakens security or introduces a vulnerability; it appears to be a normal feature addition.