Passport firmware

This firmware update fixes a bug in how Passport checks whether a Bitcoin transaction's 'change' output is safe to send back to the user's own wallet. For modern Taproot-style transactions, the device was skipping an important ownership check on inputs. That could let a malicious or crafted PSBT (Partially Signed Bitcoin Transaction) trick the user into treating someone else's coins as their own change, potentially approving a transaction that sends funds to an attacker while the screen says it is just change.

This commit tweaks the code that converts a user's BIP39 recovery phrase (mnemonic words) into secret bits inside a hardware wallet. The change removes an 'if' branch during word copying so the loop always writes to the same positions, regardless of how long each word is. The stated goal is to make the copy operation take the same amount of time and perform the same memory accesses for every word length, which can help defend against timing and power-analysis side-channel attacks that might otherwise leak information about the recovery phrase.

This commit only rewrites two code comments in a BIP39 mnemonic parser to be shorter and clearer. It does not change any executable code, logic, or behavior. There is no security-relevant change.

This commit only rewrites comments in a source file that handles BIP39 seed phrases. No code logic, buffer sizes, or function behavior were changed. It is a documentation-only cleanup and does not affect security.

This commit hardens the code that converts a user's BIP39 recovery phrase (seed words) into secret bits. It fixes a bug where 8-character words were wrongly rejected, makes the loop length independent of the number of words to reduce timing clues, adds bounds checks to prevent reading past the end of the input buffer, and clears sensitive buffers before returning on error. The changes are defensive and reduce side-channel and out-of-bounds risks, but the commit message frames them as feedback responses needing testing, so it is not a finished security fix.

This commit hardens the code that converts a user's BIP-39 seed phrase into secret data. It removes timing and loop-behavior clues that an attacker with physical access might measure to learn how many words the phrase has, how long each word is, or where word boundaries fall. The change is defensive: it makes the parsing routine run in constant time and on a fixed-size buffer, reducing side-channel leakage. There is no claim in the commit that an actual exploit exists.

This commit is a defensive hardening change for the BIP-39 seed-word handling code in the Passport hardware wallet firmware. It restructures how the English word list is stored so that a constant-time word comparison function can safely read every entry without accidentally touching memory past the end of a short word. It also removes noisy timing-test thresholds that could fail on shared CI machines and keeps only a stricter statistical correlation check. The change is explicitly described by the developer as an early 'first pass' that still needs testing and evaluation, so it is not a finished security fix.

This commit simply moves an existing helper function from inside a method to the top of the same file. The function's behavior and the security limits it enforces are unchanged. There is no security fix or vulnerability introduced.

This commit fixes a security bug in the Passport hardware wallet's microSD message-signing flow. Previously, the firmware checked a file's size in one operation and then read it in another. Because the microSD card could be swapped between those two moments, a malicious file larger than the allowed limit could still be loaded. The fix reads only a bounded number of bytes in a single operation, closing that window.

This is a small build-tool fix in the factory/secrets-injection utility used during Passport device manufacturing. It replaces a non-portable type name (`ulong`) with the standard C type (`unsigned long`) and removes a compiler flag that was suppressing the resulting error. There is no direct evidence this change fixes an exploitable security vulnerability; it appears to be a portability/correctness cleanup that lets the tool compile cleanly across build environments.

This commit fixes a consistency issue in the QR-code message-signing flow of the Passport hardware wallet. Previously, when signing a message via QR code, the wallet did not pass the user-confirmed address down to the signing code as an explicit 'expected address' check. The microSD signing path already had this safety check. After the change, the raw, verified address is passed through and used to confirm the signature is for the correct address, while a stylized version is still shown on screen. This reduces the risk that a tricked or confused user signs a message with the wrong address.

This commit fixes a missing safety limit in the Passport hardware wallet's microSD message-signing feature. Previously, a user could accidentally or maliciously be asked to sign an extremely large file from the microSD card, which could strain memory, cause crashes, or be used in a denial-of-service-style attack. The change restores a maximum file-size check that existed in older code but was lost when two code paths were merged. Health-check files are exempt because they already have their own built-in size limits.

This commit fixes a minor return-value bug in the Passport hardware wallet's health-check flow. When the user cancels message signing, the flow now returns 'None' instead of 'False'. This is a correctness fix that likely prevents a downstream caller from misinterpreting a user cancellation as a failed health check. There is no direct evidence in the commit that this is exploitable for theft, bypass, or denial of service.

This commit is purely cosmetic: it reformats Python code to follow style rules, fixes spacing around '@classmethod' decorators, and adds an auto-formatting tool (autopep8) to the developer environment. No program behavior or security properties change.

This firmware update fixes a bug where the Bitcoin address shown on the Passport hardware wallet screen before signing could differ from the address actually used to create the signature. The fix makes the signing task verify that the address it computes matches the address previewed to the user, and aborts if they don't match. This prevents a user from being tricked into approving a signature for one address while the device signs with another.

This commit simply removes an unused feature that let users sign a text file from a microSD card. There is no indication of a security bug being fixed; it appears to be dead-code cleanup.

This commit removes unused build dependencies from a Nix build script that adds secrets to Passport firmware. The change drops references to pkg-config and OpenSSL that were apparently not actually needed. There is no direct evidence this fixes a security vulnerability; it appears to be a cleanup or build-hardening change.

This commit adds a developer-only build helper called 'add-secrets' to the project's Nix development shell. It does not change the firmware that runs on user devices, nor does it alter how secrets are generated, stored, or protected in production. It simply makes an existing internal tool easier for developers to compile and run during build/test workflows.

This commit removes one blank line to satisfy a code linter. It does not change any executable code, logic, or behavior of the Passport firmware.

This firmware update fixes two issues in the Passport hardware wallet's message-signing feature. First, it adds a user confirmation screen when signing a message from a microSD card in normal (non-health-check) mode, so the user can see the message and the address that will sign it before approving. Second, it corrects the exported message signature text format so wallet software like Sparrow can parse it properly. Previously, the signature block used generic BEGIN/END SIGNATURE labels instead of blockchain-specific ones, which could cause import failures.

This commit is a routine automated update by Dependabot that changes the version of a GitHub-provided action used to check out source code during automated build and lint workflows. There is no indication of a security issue in the commit itself, and no security relevance is disclosed.

This commit is a housekeeping change. It removes an old license metadata file (.reuse/dep5) and replaces it with a newer TOML-format file (REUSE.toml). It also updates a build helper script (Justfile) to remove a now-unnecessary command-line flag from the reuse license-linting tool. There is no change to the firmware code that runs on the Passport device, so it cannot directly affect device security or user funds.

This is a routine automated update by Dependabot that changes the version of a GitHub Actions helper used to store build outputs. There is no indication this change fixes or introduces a security problem in the firmware itself.

This is a routine automated update by Dependabot that bumps the version of a GitHub Action used to check software licensing (REUSE compliance) from version 4 to version 6. It only affects the project's linting workflow and does not change any firmware code, build outputs, or security-sensitive behavior. There is no indication of a security issue.

This is an automated dependency update by Dependabot that bumps the GitHub Actions 'docker/setup-buildx-action' from version 3 to version 4 in the project's build workflow file. It is a routine maintenance change with no visible security-relevant code modifications.