Passport firmware

This is a routine automated update by Dependabot that changes the version of a GitHub Actions tool used to build and push Docker images, from version 6 to version 7. There is no indication of a security issue in the commit itself, and no security-related context is provided.

This commit tightens how Passport checks that all inputs in a Bitcoin transaction belong to the same wallet account. Previously, the firmware only compared a partial derivation path prefix, which could have allowed mixing inputs from different wallet types (for example, Native SegWit and Taproot) that share the same account keys. The change now explicitly checks whether the wallet 'purpose' numbers differ and only allows that mismatch for known compatible types (84 for SegWit, 86 for Taproot). This is a defensive hardening fix rather than a clear exploit patch, because the commit message and diff do not describe a demonstrated attack.

This firmware update changes how Passport checks whether a Bitcoin transaction's change output looks suspicious. The device previously compared the full beginning portion of the derivation path, which caused false alarms when a user combined Segwit and Taproot accounts under one 'super-account' (where only the first path number, the purpose, differs). The patch ignores that first purpose number when deciding if outputs belong to the same wallet, so legitimate change from mixed-account setups no longer triggers a warning. It is a user-experience fix rather than a clear security bug, but any relaxation of a warning rule deserves review to ensure it cannot hide a real attack.

This firmware update fixes how Passport detects a fully-signed Bitcoin transaction when using Taproot. Previously, the wallet could misjudge whether a Taproot transaction input was already signed, which could lead it to either skip needed signing or misreport the transaction state. The fix explicitly checks for the Taproot key-path signature rather than counting sub-paths.

This commit only adds standard open-source license header comments to a Nix build file. It does not change any code, build logic, or security behavior.

This commit adds a new wallet type option called Taproot (BIP86) to the list of address formats shown in the Passport hardware wallet's wallet summary screen. It is a small user-interface change that lets users see and select Taproot-style Bitcoin addresses. There is no indication in the commit that this fixes or introduces a security vulnerability.

This commit refactors how environment variables are set in the project's Nix development shell. It moves some variables from a dynamic shell script into static declarations and limits others to Linux only. There is no direct security fix or vulnerability patch here; it is a build-environment cleanup.

This commit is a routine cleanup of the project's Nix-based developer environment. It moves the build configuration for a MicroPython cross-compiler tool into a separate file, updates a copyright year, and adjusts how compiler hardening and environment variables are set. There is no indication this change fixes or introduces a security vulnerability.

This commit is a routine code cleanup. It removes an unused 'view_text' parameter from a warning screen and fixes a minor text linting issue. There is no security-relevant change.

This commit changes the on-screen warnings shown to users before they view their wallet recovery seed words. It adds clearer anti-scam language and an extra confirmation step, but does not change how seed words are stored, generated, or protected. There is no security vulnerability in the code change itself.

This commit is a trivial user-facing string change inside an assertion. It merges two separate 'already signed' error messages into one and updates the text. There is no functional change to how the code behaves, no security fix, and no vulnerability introduced.

This commit is a routine user-interface polish change. It adds a new list-style icon for the 'Explore Addresses' menu item in the Passport hardware wallet firmware, replacing the previous verify-address icon. It also makes two minor build-script tweaks (changing the Python interpreter path from /usr/bin/python3 to /usr/bin/env python3) and adds a missing copyright header to one image file. There is no security-relevant change.

This commit adjusts the software build environment (a Nix flake) for the Passport hardware wallet simulator. It adds two helper graphics libraries and forces the Qt user-interface toolkit to use the X11-compatible 'xcb' backend on Linux when no backend is already chosen. The change only affects how the simulator runs on developer machines, not the real firmware or any user funds.

This commit is a routine GitHub Actions CI/CD maintenance change. It simplifies how firmware build artifacts are named and how bootloader build jobs are configured in the automated build pipeline. There is no change to the firmware code itself, no security fix, and no vulnerability introduced.

This commit is a licensing metadata fix. It adds the file 'flake.lock' to a list of project files that are already declared under the GPL-3.0-or-later license in the REUSE/dep5 configuration. There is no code change, no firmware change, and no security relevance.

This commit re-enables the option for BTCPay wallet exports on the Passport hardware wallet to use the newer Taproot (P2TR) address format, in addition to the existing SegWit (P2WPKH) format. It is a feature re-enablement, not a fix for a vulnerability. There is no direct evidence in the commit or supplied references that this change addresses a security flaw.

This commit fixes a timing side-channel weakness in the code that converts a BIP-39 recovery phrase (a list of words) back into the secret digital bits. Before the fix, the code stopped searching the word list as soon as it found a match and used a normal string comparison, so an attacker measuring tiny time differences might learn which words were entered. The new version always scans the entire word list and compares words in constant time, making the process take the same amount of time regardless of the phrase. A new test checks that timing does not vary with the word positions.

This commit removes the ability to create a single-signature (single-sig) wallet for the Theya service in the Passport firmware. Only multisig Theya wallets remain supported. There is no indication of a security vulnerability; this appears to be a product or compatibility change.

This is a one-line fix in the Bitcoin transaction signing code of the Foundation Passport hardware wallet. When signing a Taproot transaction immediately after signing a SegWit transaction, the wallet could reuse cached intermediate hash values that were not fully initialized for Taproot. That could cause the wallet to compute an incorrect transaction fingerprint (sighash), which in rare cases might lead to an invalid signature or, more seriously, a signature that does not protect all the transaction details it should. The fix forces the wallet to rebuild those cached hashes if any of the required Taproot hash fields are missing.

This firmware update fixes a bug in how Passport hardware wallets compute Taproot Bitcoin transaction signatures. Previously, when a transaction contained both SegWit and Taproot inputs, the wallet could accidentally reuse cached SegWit-style hashes for the Taproot signing math instead of computing fresh Taproot-specific hashes. Because Taproot and SegWit use different hashing rules, this could lead to an invalid signature or, in some edge cases, a signature that does not match what the Bitcoin network expects. The fix creates separate Taproot hash fields so the two paths no longer share state.

This commit adds Nix build environment files (a reproducible developer shell setup) for the Passport firmware project. It does not change any firmware code, cryptographic logic, or device behavior. There is no indication this is a security fix or introduces a security vulnerability.

This commit only updates the developer setup guide (DEVELOPMENT.md). It adds instructions for using Nix/NixOS during development, changes the OpenOCD source repository URL from an old fork to the official project, and adds a user to the plugdev group. There is no firmware code change and no security vulnerability is introduced or fixed.

This commit updates the project's Nix development environment files. It adds a lock file, adjusts package names, adds build dependencies, and tweaks compiler flags for a local developer tool called 'cosign'. There is no change to the firmware that runs on the Passport device, no change to cryptographic code, and no indication of a security bug or fix.

This commit suppresses a compiler warning about using the address of a short-lived local variable to track the top of the program's stack. The underlying code behavior is unchanged; only the warning is silenced. There is no direct security fix here, though the pattern itself is a known, long-standing MicroPython idiom for estimating stack usage.

This commit is a documentation-only change. It updates the developer setup instructions to clone a specific, released version (v0.12.0) of the OpenOCD debugging tool instead of the latest development code. There is no change to firmware code, no user-facing change, and no security fix or vulnerability introduced.