Passport firmware

This firmware update hardens the way Passport generates random numbers. Previously, a failing or stuck hardware random-number generator could silently produce weak or repeated values, which is dangerous for creating secret keys. The patch makes the device detect bad randomness and either recover or permanently stop with a clear error screen, instead of continuing with potentially guessable secrets. It also routes all MicroPython randomness through the same checked generator.

This commit is a routine development tooling and cleanup change. It adds the Pytest testing framework to the project's Nix development shell, fixes a test runner path, adds a GitHub Actions workflow to run simulator tests automatically, and removes an unused translation system along with its associated tests. There is no indication this change fixes a security vulnerability or introduces a security-relevant behavior.

This commit updates the Python Pillow image-processing library used in host-side developer tooling from version 8.x to 12.3.x and requires Python 3.10 or newer. Pillow 8.x is known to have many publicly disclosed security vulnerabilities, so the change likely removes exposure to those bugs during firmware build and test workflows. The change does not alter the firmware that runs on the Passport device itself, only the tools that run on a developer's computer.

This commit fixes a bug in how the Passport hardware wallet saves its settings to internal flash memory. Previously, the code checked whether the settings data was too large only after it had already picked and erased a flash storage slot. If the data was too big, the code hit a broken 'assert false' statement that would crash the device. The fix moves the size check earlier, before any flash slot is touched, and replaces the crash with a proper error. A new unit test confirms that oversized settings are rejected before any flash operation happens.

This commit tightens a software dependency used only in testing/development tooling. It prevents an automated test environment from installing old, known-vulnerable versions of the Pillow image library when running under Python 3.10. The change does not alter the firmware that runs on the Passport device itself, so end-user funds or device security are not directly at risk. It is a preventive hygiene fix for the developer build/test pipeline.

This firmware update fixes a security issue in the Passport hardware wallet's handling of Bitcoin transaction fees. Previously, when a transaction file (PSBT) only provided a claimed input amount without the full previous transaction to prove it, Passport would calculate and display a network fee as if it were verified. A malicious or buggy companion wallet could lie about input amounts, making the fee look smaller than it actually is and tricking the user into approving a transaction that sends more money to fees or an attacker than shown. The fix marks such fees as 'Unverified' on screen and in warnings, and adds cross-checks when both witness and non-witness input data are present. It also moves key-derivation verification earlier so bogus ownership metadata cannot be recorded in the device's history cache.

This update tightens the checks on SeedQR codes, which are QR codes that encode a wallet's backup seed phrase as numbers. Before, the decoder might accept invalid or oddly-sized numeric strings and either crash or produce an incorrect seed. Now it rejects anything that isn't the right length, isn't all digits, or contains word index numbers that are too high. This protects users from importing a corrupted or attacker-crafted seed that could lead to an unusable or insecure wallet.

This commit is a routine cleanup and test-infrastructure change. It removes an unused translation system (translation files, imports, and a test), updates linting rules to no longer exclude the now-removed translation folder, and fixes the test runner path and simulator fixture reliability. There is no security-relevant behavior change in the firmware itself.

This commit adds a test fixture flag called witness_utxo to a fake PSBT input object used in unit tests, and documents a changelog entry about marking network fees as 'unverified' when a PSBT input's UTXO data cannot be verified. The actual production code that performs this validation is not shown in the diff, so we can only see the test scaffolding and release-note mention. It likely relates to preventing a hardware wallet from trusting a transaction's claimed fee when the input amounts are not provable, which could stop a malicious co-signer or host from hiding or inflating fees.

This firmware update changes how Passport validates Bitcoin transaction files (PSBTs) before signing. It makes two main improvements: it reuses the wallet's secret seed for fewer key-derivation operations, and it verifies that the claimed input amounts are backed by real signing keys before trusting those amounts. The commit message and code comments suggest this closes a gap where a malicious or malformed PSBT could trick the device into recording an incorrect input amount in its history cache, which could later mislead the user about fees or balances. A second change also prevents re-signing a transaction that already has a signature, which could reduce certain replay or state-confusion risks.

This firmware update fixes a bug in the Passport hardware wallet's handling of Bitcoin transaction files (PSBTs). Previously, the wallet could be tricked into reviewing and displaying a transaction fee as verified even when an input the wallet appeared to own was actually controlled by a different key. The fix makes the device cryptographically prove it really owns each input before it tells the user the fee is trustworthy, helping prevent attackers from showing misleading fee amounts.

This update changes how Passport handles multisig wallet setups proposed by a transaction file (PSBT). Previously, if the user declined to import a proposed multisig configuration while using a temporary seed, the device would still sign the transaction and only warn that the config wouldn't be saved. Now it cancels signing instead. Also, when a temporary seed is active, the device now asks the user before using a PSBT-proposed multisig wallet rather than silently skipping that step. The goal is to prevent a user from accidentally signing a transaction with an untrusted or unexpected multisig wallet.

This update tightens the checks on Bitcoin transaction amounts inside PSBT files handled by the Passport hardware wallet. Before, the firmware did not fully enforce Bitcoin's rule that no single output or input, and no running total, can exceed about 21 million bitcoins (MAX_MONEY). A malicious or buggy companion app could craft a PSBT with oversized, negative, or zero input amounts. The device might then compute a wrong fee or balance, which could trick a user into approving a transaction that sends more than intended, or that hides a large fee. The patch now rejects such PSBTs immediately.

This firmware update changes how Passport handles Bitcoin transactions that come with a new multisig wallet configuration. Previously, if importing that proposed multisig config failed, the device would warn the user but still allow the transaction to be signed. Now it aborts signing instead. It also changes the default behavior so the device always asks before using a temporary multisig config rather than silently skipping the import. The commit does not describe this as a security fix, but the change removes a risky path where a transaction could be signed under an unapproved or failed wallet setup.

This firmware update tightens checks on Bitcoin transaction amounts inside PSBT files. Before the patch, input amounts were only checked with a simple 'greater than zero' assertion, and the running total of input value was not capped. A malicious or malformed PSBT could use negative, zero, or absurdly large input amounts to make the wallet miscalculate the transaction fee or bypass sanity checks. The patch rejects any input amount outside the valid Bitcoin range and stops the total from exceeding Bitcoin's maximum money limit, matching protections that already existed for outputs.

This commit adds a safety check to the Passport hardware wallet's Bitcoin transaction parser. Before signing a transaction, the device now rejects any output amount that is negative, larger than the total possible Bitcoin supply (about 21 million BTC), or that would make the whole transaction output more than that total. Without this check, a malicious or malformed transaction could try to use impossible amounts, which might confuse the user or lead the wallet to compute incorrect balances or fees.

This commit updates a single unit test file for Bitcoin PSBT (Partially Signed Bitcoin Transaction) fee handling. It replaces a fake/mock input object with a real parsed PSBT input that includes a BIP32 derivation path, so the test exercises more of the actual production parsing code. There is no change to firmware behavior, no bug fix, and no security patch in the shipped code.

This update changes how the Passport hardware wallet handles Bitcoin transaction fees shown during signing. Previously, the wallet could display a network fee even when it could not independently verify the input amounts supplied by another wallet. Now it marks such fees as 'Unverified' and skips fee-based warnings that could mislead the user. It also adds cross-checks when a transaction input provides both witness and non-witness data, ensuring they agree before trusting the amount.

This commit only adds more test cases to an existing unit test file for SeedQR decoding. It does not change any production firmware code. The new tests check that the decoder correctly rejects additional malformed inputs, such as an empty string, an oversized string, and strings containing unusual Unicode digits. This is a routine hardening of test coverage, not a fix for a known security bug.

This commit tightens how Passport firmware decodes SeedQR codes—QR codes that encode a wallet recovery phrase as numbers. Before the fix, the decoder would try to look up BIP-39 words using raw 4-digit indices before confirming the input was valid. The new code first checks that the payload length is a multiple of 4, that the number of words is a supported seed length, that every character is a digit, and that each index is within the valid BIP-39 word range. This prevents malformed or out-of-range SeedQR payloads from being partially processed or causing unexpected behavior during word lookup.

This change tightens how Passport's bootloader validates a new firmware update. Previously, if the currently-running firmware failed validation, the bootloader would skip signature checks on the incoming update and jump straight to installing it. The patch moves the signature verification outside that 'only if current firmware is valid' branch, so the new firmware is always signature-checked before installation. It also moves a check about whether the current firmware was user-signed so it is computed earlier. In short: the bootloader now refuses to install unsigned updates even when the existing firmware looks broken.

This bootloader patch changes how the result of a security check on the currently-running firmware is stored. Previously, the code immediately converted the secure verification result into a plain true/false boolean. Now it keeps the special secure result value intact and compares it directly later. This is a hardening fix: it reduces the chance that a subtle type-conversion bug or compiler optimization could let a failed firmware check be treated as a pass, which in turn could allow a malicious or corrupted firmware update to proceed.

This commit tightens the allowed versions of a Python image-processing library called Pillow used only in developer tooling. It caps Pillow below version 13 and requires Python 3.10 or newer. There is no indication this fixes a security flaw in the firmware itself; it appears to be a build/maintenance compatibility change.

This commit changes how Passport's bootloader checks firmware updates. Previously, if the currently-running firmware failed validation, the bootloader would skip verifying the new update's signature and could install it anyway. Now the new firmware's signature is always verified before installation, even when the current firmware is invalid. This closes a path where a corrupted or attacker-controlled running firmware might be able to load an unsigned or wrongly-signed update.

This commit updates the required version of the Python imaging library Pillow from 8.x to at least 12.3.0 in the project's host tooling configuration. Pillow 8.x is known to have publicly disclosed security vulnerabilities, so raising the minimum version is a defensive maintenance change. It does not by itself prove the firmware was exploitable, but it removes a risky dependency version from the development/build environment.