Passport firmware

This commit fixes a low-level programming bug in how the Passport hardware wallet builds a special data format (CBOR) when exporting a public key to the Unchained Capital service. The original code passed raw numbers to a buffer-extension function in a way that could produce incorrect byte sequences. The fix wraps those numbers as explicit byte arrays. The commit also contains unrelated cosmetic changes to the simulator's README and adds clipboard keybindings to the simulator's terminal window.

This commit tightens how Passport retrieves the wallet's fingerprint when exporting data for the Unchained wallet. Previously, if the fingerprint setting was missing, the code would silently fall back to a value of 0. Now it requires the actual fingerprint to be present. This is a hardening change: a missing or corrupted fingerprint setting could have led to an incorrect or invalid export rather than a clearly wrong one, which could confuse wallet software or, in worst-case scenarios, affect how multisig addresses are derived.

This commit hardens the firmware's QR-code encoder used for the Unchained wallet export. It adds a safety flag so that if an invalid export request is rejected, the device won't accidentally reuse or leak a previously encoded QR message. It also fixes a fingerprint byte-order bug and switches from one export format to another for microSD exports. The changes are defensive hardening rather than a clear fix for an active exploit.

This commit adds support for connecting the Passport hardware wallet to the Unchained multisig service. It introduces a new way to pass already-encoded data into the QR/UR encoder, plus a new wallet definition and CBOR encoding helper. The changes are mostly additive feature code; there is no vendor statement that this fixes a security bug, and no independent security disclosure is referenced.

This commit documents and tests a policy for approving multisignature wallets proposed by a PSBT (Partially Signed Bitcoin Transaction). The key functional change is that when a Passport device is using a temporary seed, it now requires explicit user confirmation before importing a multisig wallet proposed by a PSBT, and cancels signing if the user declines. The commit itself is mostly a changelog entry and unit tests; the actual security logic appears to have been implemented elsewhere.

This firmware update changes how Passport handles Bitcoin transactions that come with a new multisig wallet configuration. Previously, if importing that proposed multisig config failed, the device would warn the user but still allow the transaction to be signed. Now it aborts signing instead. It also changes the default behavior so the device always asks before using a temporary multisig config rather than silently skipping the import. The commit does not describe this as a security fix, but the change removes a risky path where a transaction could be signed under an unapproved or failed wallet setup.

This commit adds safety checks to the QR-code scanning library (quirc) used in Passport firmware. It rejects QR grids that are larger than the standard maximum size (version 40, or 177×177 cells) before they can be processed. Without these checks, a malformed or oversized QR code could cause memory corruption or crashes. The commit also fixes an off-by-one bug in grid index validation and adds tests to verify the new limits.

This commit removes several lines of informational text from the Casa wallet pairing file that Passport writes to a microSD card. The deleted text included the blockchain name, coin type, internal symbol, and a generic warning not to deposit funds unless the user's wallet is ready. The remaining file still contains the master extended public key, the Casa derivation extended public key, and the master key fingerprint. There is no code change that alters how keys are derived, stored, or transmitted, and no security vulnerability is visible in the diff.

This commit changes how the Passport hardware wallet exports information for the Casa wallet. Previously, only the master extended public key was written to a microSD card. Now, the file also includes the Casa-specific extended public key at derivation path m/45'. This is a feature enhancement to make Casa multisig setup easier, not a security fix. The change does not appear to introduce a vulnerability, but it does export additional key material to removable storage.

This commit adds a new way for the Passport hardware wallet to export wallet pairing information to Casa, a Bitcoin custody service. Instead of exporting a single key, it now exports a 'crypto-account' QR code containing two related public keys: the wallet's root public key and a separate Casa-specific public key derived from path m/45'. The change is a feature addition; there is no direct evidence in the commit that it fixes a security vulnerability, but it does change what key material is exposed during pairing and how it is encoded.

This firmware update tightens checks on Bitcoin transaction amounts inside PSBT files. Before the patch, input amounts were only checked with a simple 'greater than zero' assertion, and the running total of input value was not capped. A malicious or malformed PSBT could use negative, zero, or absurdly large input amounts to make the wallet miscalculate the transaction fee or bypass sanity checks. The patch rejects any input amount outside the valid Bitcoin range and stops the total from exceeding Bitcoin's maximum money limit, matching protections that already existed for outputs.

This commit adds a safety check to the Passport hardware wallet's Bitcoin transaction parser. Before signing a transaction, the device now rejects any output amount that is negative, larger than the total possible Bitcoin supply (about 21 million BTC), or that would make the whole transaction output more than that total. Without this check, a malicious or malformed transaction could try to use impossible amounts, which might confuse the user or lead the wallet to compute incorrect balances or fees.

This commit updates a single unit test file for Bitcoin PSBT (Partially Signed Bitcoin Transaction) fee handling. It replaces a fake/mock input object with a real parsed PSBT input that includes a BIP32 derivation path, so the test exercises more of the actual production parsing code. There is no change to firmware behavior, no bug fix, and no security patch in the shipped code.

This firmware update changes how Passport classifies SegWit Bitcoin transaction inputs. Previously, the device tried to detect SegWit by inspecting the address type and redeem script, and would reject a PSBT that supplied a witness UTXO for what it thought was a non-SegWit input. Now, if a PSBT includes a witness UTXO, the input is marked SegWit immediately. The patch removes several safety checks, which could allow a malicious or malformed PSBT to bypass fee verification or signature checks. The commit message does not describe a security fix, but the change is in security-relevant code.

This update changes how the Passport hardware wallet handles Bitcoin transaction fees shown during signing. Previously, the wallet could display a network fee even when it could not independently verify the input amounts supplied by another wallet. Now it marks such fees as 'Unverified' and skips fee-based warnings that could mislead the user. It also adds cross-checks when a transaction input provides both witness and non-witness data, ensuring they agree before trusting the amount.

This commit only adds more test cases to an existing unit test file for SeedQR decoding. It does not change any production firmware code. The new tests check that the decoder correctly rejects additional malformed inputs, such as an empty string, an oversized string, and strings containing unusual Unicode digits. This is a routine hardening of test coverage, not a fix for a known security bug.

This commit tightens how Passport firmware decodes SeedQR codes—QR codes that encode a wallet recovery phrase as numbers. Before the fix, the decoder would try to look up BIP-39 words using raw 4-digit indices before confirming the input was valid. The new code first checks that the payload length is a multiple of 4, that the number of words is a supported seed length, that every character is a digit, and that each index is within the valid BIP-39 word range. This prevents malformed or out-of-range SeedQR payloads from being partially processed or causing unexpected behavior during word lookup.

This change tightens how Passport's bootloader validates a new firmware update. Previously, if the currently-running firmware failed validation, the bootloader would skip signature checks on the incoming update and jump straight to installing it. The patch moves the signature verification outside that 'only if current firmware is valid' branch, so the new firmware is always signature-checked before installation. It also moves a check about whether the current firmware was user-signed so it is computed earlier. In short: the bootloader now refuses to install unsigned updates even when the existing firmware looks broken.

This bootloader patch changes how the result of a security check on the currently-running firmware is stored. Previously, the code immediately converted the secure verification result into a plain true/false boolean. Now it keeps the special secure result value intact and compares it directly later. This is a hardening fix: it reduces the chance that a subtle type-conversion bug or compiler optimization could let a failed firmware check be treated as a pass, which in turn could allow a malicious or corrupted firmware update to proceed.

This commit tightens the allowed versions of a Python image-processing library called Pillow used only in developer tooling. It caps Pillow below version 13 and requires Python 3.10 or newer. There is no indication this fixes a security flaw in the firmware itself; it appears to be a build/maintenance compatibility change.

This commit changes how Passport's bootloader checks firmware updates. Previously, if the currently-running firmware failed validation, the bootloader would skip verifying the new update's signature and could install it anyway. Now the new firmware's signature is always verified before installation, even when the current firmware is invalid. This closes a path where a corrupted or attacker-controlled running firmware might be able to load an unsigned or wrongly-signed update.

This commit adds support for a new Bitcoin wallet app called Bitcoin Safe. It is a straightforward feature addition: a new wallet definition file is created and registered in two lists so the Passport device recognizes Bitcoin Safe during setup. There is no bug fix, no change to cryptographic code, and no indication of a security problem.

This commit updates the required version of the Python imaging library Pillow from 8.x to at least 12.3.0 in the project's host tooling configuration. Pillow 8.x is known to have publicly disclosed security vulnerabilities, so raising the minimum version is a defensive maintenance change. It does not by itself prove the firmware was exploitable, but it removes a risky dependency version from the development/build environment.

This commit simply adds a new Bitcoin wallet integration file named 'coconut.py' to the firmware build list. It is a one-line manifest change with no visible security implications on its own.

This commit adds support for a new Bitcoin wallet app called Coconut Wallet to the Passport hardware device. It lets users export their single-signature wallet setup to Coconut Wallet via an animated QR code, using the same data format already used for Sparrow Wallet. There is no indication of a security bug or fix in the change.