Passport firmware

This commit adds a new feature to Foundation's Passport hardware wallet that exports two cryptographic public keys for Casa wallet registration: the master extended public key and a separate Casa-specific key derived at path m/45'. The keys can be exported either as a QR code or saved to a microSD card. The change is a feature addition, not a bug fix, and there is no evidence in the commit that it addresses a security vulnerability. However, exporting additional key material always slightly increases the attack surface if the exported data is mishandled.

This commit adds support for the Unchained wallet to the Passport hardware wallet. Most of the change is normal feature code, but it also introduces a new way to feed already-encoded data into the QR encoder and tightens up the encoder so it won't produce output if it hasn't been started correctly. The simulator also gets clipboard copy/paste tweaks. There is no vendor statement that this fixes a security bug, and the changes look like defensive hardening rather than a patch for an active vulnerability.

This firmware update moves the verification of Bitcoin 'change' addresses to happen before the user reviews the transaction on screen. Previously, the device checked whether change outputs truly belonged to the wallet only after the user had already approved the transaction and while it was about to sign. Because the review screen hides change outputs from the user, a malicious or buggy PSBT could have asked the device to send change to an attacker's address, and the user would never see it before approving. The fix ensures the wallet proves it owns every hidden change output before showing the review screen, so a mismatch aborts the transaction before the user is asked to confirm.

This commit changes how the Passport hardware wallet reviews Bitcoin transactions that have no 'change' output. Previously, the wallet would always run a change-verification step that opens the secure key store, even when there was no change to verify. Now it skips that step when there is no change, and updates the on-screen spinner label from 'Validating transaction' to 'Verifying change' so the user knows what is happening. The change is framed by the developer as a user-experience and clarity improvement, not as a fix for a known security vulnerability.

This commit moves a safety check earlier in the process of approving a Bitcoin transaction on the Passport hardware wallet. Previously, the wallet verified that 'change' outputs (money going back to your own wallet) truly belonged to you only after you had already reviewed the transaction and approved signing. Now that ownership proof happens before the transaction details are shown to the user. This prevents a scenario where a malicious or buggy PSBT (the file describing the transaction) hides a change address that actually belongs to an attacker, because the wallet will refuse to show the review screen if it cannot prove the change is yours. The change is defensive: it closes a window where a user might approve a transaction whose change output has not yet been validated.

This commit adds support for a new Bitcoin software wallet called 'Bitcoin Safe' to the Passport hardware wallet firmware. It is a straightforward feature addition that registers the wallet in the firmware's list of supported software wallets and defines how to export wallet data to it (via QR code or microSD card). There is no indication of a security bug, vulnerability, or fix in the changed code.

This update changes how the Passport hardware wallet displays Bitcoin transaction outputs that carry data (OP_RETURN outputs). Previously, only the embedded message was shown. Now the device also shows the amount of bitcoin assigned to that output and escapes the message text so a crafted message cannot fake extra user-interface labels (like a fake 'Amount' or 'Destination' section). The included tests demonstrate that an attacker who controls an OP_RETURN message can no longer make the screen look like a real payment destination is being sent funds.

This tiny change removes two variables ('pu' and 'skp') from a Python 'del' cleanup statement in the code that signs Bitcoin transactions. The commit message says it fixes an 'excess delete call.' In Python, deleting a name that does not exist raises a NameError, which would crash the signing task. The patch prevents that crash but does not appear to be a security vulnerability itself; it is a bug fix for a runtime error in sensitive code.

This commit adds a single blank line between two test functions to fix code formatting. It makes no functional changes to the firmware or its tests.

This update fixes a validation gap when importing multisig wallets into the Passport hardware wallet. Previously, the device only checked that the public key matched; now it also checks the chain code. Without this check, a tampered extended public key (xpub) could have been accepted as belonging to the wallet, potentially allowing an attacker to silently change the wallet's receiving addresses or make future transactions look valid when they are not. The fix is accompanied by a new test that confirms mismatched chain codes are rejected.

This firmware update fixes a multisig wallet import check. Previously, the device only verified that the public key portion of an extended public key (xpub) matched what it expected; now it also verifies the chain code. A mismatched chain code could let a malicious or malformed xpub slip through validation, potentially causing the wallet to derive wrong or non-matching addresses and making backups or transaction coordination unreliable. The fix is accompanied by a new unit test that confirms a wrong chain code is rejected.

This update hardens the QR-code scanner library (quirc) used in the Passport hardware wallet so it refuses to process impossibly large QR grids and no longer reads past the end of its internal buffer when a malformed QR code is presented. It also fixes an off-by-one bug in grid indexing. The changes are defensive: they prevent memory corruption and crashes when scanning deliberately crafted or corrupted QR codes, rather than changing normal wallet behavior.

This commit fixes a low-level programming bug in how the Passport hardware wallet builds a special data format (CBOR) when exporting a public key to the Unchained Capital service. The original code passed raw numbers to a buffer-extension function in a way that could produce incorrect byte sequences. The fix wraps those numbers as explicit byte arrays. The commit also contains unrelated cosmetic changes to the simulator's README and adds clipboard keybindings to the simulator's terminal window.

This commit tightens how Passport retrieves the wallet's fingerprint when exporting data for the Unchained wallet. Previously, if the fingerprint setting was missing, the code would silently fall back to a value of 0. Now it requires the actual fingerprint to be present. This is a hardening change: a missing or corrupted fingerprint setting could have led to an incorrect or invalid export rather than a clearly wrong one, which could confuse wallet software or, in worst-case scenarios, affect how multisig addresses are derived.

This commit hardens the firmware's QR-code encoder used for the Unchained wallet export. It adds a safety flag so that if an invalid export request is rejected, the device won't accidentally reuse or leak a previously encoded QR message. It also fixes a fingerprint byte-order bug and switches from one export format to another for microSD exports. The changes are defensive hardening rather than a clear fix for an active exploit.

This commit adds support for connecting the Passport hardware wallet to the Unchained multisig service. It introduces a new way to pass already-encoded data into the QR/UR encoder, plus a new wallet definition and CBOR encoding helper. The changes are mostly additive feature code; there is no vendor statement that this fixes a security bug, and no independent security disclosure is referenced.

This commit documents and tests a policy for approving multisignature wallets proposed by a PSBT (Partially Signed Bitcoin Transaction). The key functional change is that when a Passport device is using a temporary seed, it now requires explicit user confirmation before importing a multisig wallet proposed by a PSBT, and cancels signing if the user declines. The commit itself is mostly a changelog entry and unit tests; the actual security logic appears to have been implemented elsewhere.

This commit adds safety checks to the QR-code scanning library (quirc) used in Passport firmware. It rejects QR grids that are larger than the standard maximum size (version 40, or 177×177 cells) before they can be processed. Without these checks, a malformed or oversized QR code could cause memory corruption or crashes. The commit also fixes an off-by-one bug in grid index validation and adds tests to verify the new limits.

This commit removes several lines of informational text from the Casa wallet pairing file that Passport writes to a microSD card. The deleted text included the blockchain name, coin type, internal symbol, and a generic warning not to deposit funds unless the user's wallet is ready. The remaining file still contains the master extended public key, the Casa derivation extended public key, and the master key fingerprint. There is no code change that alters how keys are derived, stored, or transmitted, and no security vulnerability is visible in the diff.

This commit changes how the Passport hardware wallet exports information for the Casa wallet. Previously, only the master extended public key was written to a microSD card. Now, the file also includes the Casa-specific extended public key at derivation path m/45'. This is a feature enhancement to make Casa multisig setup easier, not a security fix. The change does not appear to introduce a vulnerability, but it does export additional key material to removable storage.

This commit adds a new way for the Passport hardware wallet to export wallet pairing information to Casa, a Bitcoin custody service. Instead of exporting a single key, it now exports a 'crypto-account' QR code containing two related public keys: the wallet's root public key and a separate Casa-specific public key derived from path m/45'. The change is a feature addition; there is no direct evidence in the commit that it fixes a security vulnerability, but it does change what key material is exposed during pairing and how it is encoded.

This firmware update changes how Passport classifies SegWit Bitcoin transaction inputs. Previously, the device tried to detect SegWit by inspecting the address type and redeem script, and would reject a PSBT that supplied a witness UTXO for what it thought was a non-SegWit input. Now, if a PSBT includes a witness UTXO, the input is marked SegWit immediately. The patch removes several safety checks, which could allow a malicious or malformed PSBT to bypass fee verification or signature checks. The commit message does not describe a security fix, but the change is in security-relevant code.

This commit adds support for a new Bitcoin wallet app called Bitcoin Safe. It is a straightforward feature addition: a new wallet definition file is created and registered in two lists so the Passport device recognizes Bitcoin Safe during setup. There is no bug fix, no change to cryptographic code, and no indication of a security problem.

This commit adds support for a new Bitcoin wallet app called Coconut Wallet to the Passport hardware device. It lets users export their single-signature wallet setup to Coconut Wallet via an animated QR code, using the same data format already used for Sparrow Wallet. There is no indication of a security bug or fix in the change.

This firmware update fixes a bug in how Passport checks whether a Bitcoin transaction's 'change' output is safe to send back to the user's own wallet. For modern Taproot-style transactions, the device was skipping an important ownership check on inputs. That could let a malicious or crafted PSBT (Partially Signed Bitcoin Transaction) trick the user into treating someone else's coins as their own change, potentially approving a transaction that sends funds to an attacker while the screen says it is just change.