Passport firmware

This firmware update fixes a bug where the Bitcoin address shown on the Passport hardware wallet screen before signing could differ from the address actually used to create the signature. The fix makes the signing task verify that the address it computes matches the address previewed to the user, and aborts if they don't match. This prevents a user from being tricked into approving a signature for one address while the device signs with another.

This commit simply removes an unused feature that let users sign a text file from a microSD card. There is no indication of a security bug being fixed; it appears to be dead-code cleanup.

This commit removes one blank line to satisfy a code linter. It does not change any executable code, logic, or behavior of the Passport firmware.

This commit is a routine automated update by Dependabot that changes the version of a GitHub-provided action used to check out source code during automated build and lint workflows. There is no indication of a security issue in the commit itself, and no security relevance is disclosed.

This is a routine automated update by Dependabot that changes the version of a GitHub Actions helper used to store build outputs. There is no indication this change fixes or introduces a security problem in the firmware itself.

This is a routine automated update by Dependabot that bumps the version of a GitHub Action used to check software licensing (REUSE compliance) from version 4 to version 6. It only affects the project's linting workflow and does not change any firmware code, build outputs, or security-sensitive behavior. There is no indication of a security issue.

This is an automated dependency update by Dependabot that bumps the GitHub Actions 'docker/setup-buildx-action' from version 3 to version 4 in the project's build workflow file. It is a routine maintenance change with no visible security-relevant code modifications.

This is a routine automated update by Dependabot that changes the version of a GitHub Actions tool used to build and push Docker images, from version 6 to version 7. There is no indication of a security issue in the commit itself, and no security-related context is provided.

This commit tightens how Passport checks that all inputs in a Bitcoin transaction belong to the same wallet account. Previously, the firmware only compared a partial derivation path prefix, which could have allowed mixing inputs from different wallet types (for example, Native SegWit and Taproot) that share the same account keys. The change now explicitly checks whether the wallet 'purpose' numbers differ and only allows that mismatch for known compatible types (84 for SegWit, 86 for Taproot). This is a defensive hardening fix rather than a clear exploit patch, because the commit message and diff do not describe a demonstrated attack.

This firmware update changes how Passport checks whether a Bitcoin transaction's change output looks suspicious. The device previously compared the full beginning portion of the derivation path, which caused false alarms when a user combined Segwit and Taproot accounts under one 'super-account' (where only the first path number, the purpose, differs). The patch ignores that first purpose number when deciding if outputs belong to the same wallet, so legitimate change from mixed-account setups no longer triggers a warning. It is a user-experience fix rather than a clear security bug, but any relaxation of a warning rule deserves review to ensure it cannot hide a real attack.

This firmware update fixes how Passport detects a fully-signed Bitcoin transaction when using Taproot. Previously, the wallet could misjudge whether a Taproot transaction input was already signed, which could lead it to either skip needed signing or misreport the transaction state. The fix explicitly checks for the Taproot key-path signature rather than counting sub-paths.

This commit only adds standard open-source license header comments to a Nix build file. It does not change any code, build logic, or security behavior.

This commit is a trivial user-facing string change inside an assertion. It merges two separate 'already signed' error messages into one and updates the text. There is no functional change to how the code behaves, no security fix, and no vulnerability introduced.

This commit re-enables the option for BTCPay wallet exports on the Passport hardware wallet to use the newer Taproot (P2TR) address format, in addition to the existing SegWit (P2WPKH) format. It is a feature re-enablement, not a fix for a vulnerability. There is no direct evidence in the commit or supplied references that this change addresses a security flaw.

This commit removes the ability to create a single-signature (single-sig) wallet for the Theya service in the Passport firmware. Only multisig Theya wallets remain supported. There is no indication of a security vulnerability; this appears to be a product or compatibility change.

This is a one-line fix in the Bitcoin transaction signing code of the Foundation Passport hardware wallet. When signing a Taproot transaction immediately after signing a SegWit transaction, the wallet could reuse cached intermediate hash values that were not fully initialized for Taproot. That could cause the wallet to compute an incorrect transaction fingerprint (sighash), which in rare cases might lead to an invalid signature or, more seriously, a signature that does not protect all the transaction details it should. The fix forces the wallet to rebuild those cached hashes if any of the required Taproot hash fields are missing.

This firmware update fixes a bug in how Passport hardware wallets compute Taproot Bitcoin transaction signatures. Previously, when a transaction contained both SegWit and Taproot inputs, the wallet could accidentally reuse cached SegWit-style hashes for the Taproot signing math instead of computing fresh Taproot-specific hashes. Because Taproot and SegWit use different hashing rules, this could lead to an invalid signature or, in some edge cases, a signature that does not match what the Bitcoin network expects. The fix creates separate Taproot hash fields so the two paths no longer share state.

This commit updates the project's Nix development environment files. It adds a lock file, adjusts package names, adds build dependencies, and tweaks compiler flags for a local developer tool called 'cosign'. There is no change to the firmware that runs on the Passport device, no change to cryptographic code, and no indication of a security bug or fix.

This commit adds Nix build environment files (a reproducible developer shell setup) for the Passport firmware project. It does not change any firmware code, cryptographic logic, or device behavior. There is no indication this is a security fix or introduces a security vulnerability.

This commit adds support for exporting wallet data to a new software wallet called Bull Bitcoin. It is a straightforward feature addition with no visible security-relevant changes. There is no indication of a vulnerability, bug fix, or security patch.

This commit simply deletes a README file that described a factory testing feature. No code, firmware, or security controls were changed. The file itself was documentation and appears to have been added by mistake. There is no direct security impact from removing it.