Krux

This is a routine release merge for Krux firmware (version 26.08.0). It includes several genuine security fixes: a heap buffer overflow in camera-based entropy generation for a discontinued device, stricter fee calculation when signing Bitcoin transactions, and a warning when a transaction's input amounts cannot be verified. It also swaps the QR-code encoding library for a faster native one, removes support for the discontinued Maix Bit device, and makes various reliability improvements. The commit itself is a large merge, so the exact code changes are spread across many files and not all visible in the supplied diff.

This commit only updates three date lines in the CHANGELOG.md file, changing '2025' to '2026' for three release entries. It does not modify any source code, build scripts, or documentation with security implications. The change is purely cosmetic/correctional and introduces no security risk.

This commit fixes Krux's QR code scanner so that when it reads a series of animated BBQr codes, every later frame must match the encoding and file type announced by the first frame, must agree on the total number of frames, and cannot overwrite an already-scanned frame with different data. It also caps how much data the scanner will accumulate, preventing a malicious or malformed stream from making the device run out of memory. The change is defensive hardening against QR stream confusion and memory exhaustion.

This commit only updates the project's CHANGELOG.md file. It adds text describing several bug fixes and improvements that were apparently made in prior code changes, but no actual code is changed in this commit. By itself, this documentation edit does not alter software behavior or introduce any security issue.

This commit appears to be a routine version bump of a component called 'cUR' inside the MaixPy firmware build. No actual code changes are visible in the provided diff, and the commit message gives no indication of a security fix or vulnerability. There is nothing here that can be independently assessed as a security issue.

This commit is a routine version bump from 26.04.0 to 26.08.0. It only updates version strings in documentation, build files, and source metadata. No code behavior changes. The changelog text mentions a previously fixed heap buffer overflow, but that fix is not part of this diff.

This commit appears to update a submodule or dependency called MaixPy to a newer version that includes updated visual glyphs (small icons/symbols). The title and message describe it as a routine maintenance chore, not a security fix. No actual code changes are visible in the supplied diff, and no security references were provided.

This commit fixes a build-time font-generation script so that a newly supported device ('embed_fire') is recognized. Before the fix, the script printed an error but still produced the same font files. There is no security issue.

This commit only updates the project's CHANGELOG.md to document earlier fixes related to PSBT (Partially Signed Bitcoin Transaction) fee and amount handling. It does not contain any code changes itself. The changelog entries describe security-relevant bugs where incorrect fee/amount calculations could be shown or confirmed during Bitcoin signing, which could trick a user into approving a bad transaction. However, because the actual fixes are not in this commit, we cannot inspect or verify them here.

This commit fixes a security flaw in Krux, a Bitcoin signing device. Before the fix, an attacker could trick the device into showing a low transaction fee on screen while actually signing a much higher fee. The fix makes the device verify that any attached previous transaction really matches the input being spent, and forces legacy (non-Segwit) inputs to include that previous transaction. It also makes sure the amount shown to the user is always the same amount the signature commits to. A small residual risk remains for multi-input Segwit transactions where previous transactions are not required.

This commit fixes a bug in Krux, a Bitcoin signing device, where a malformed transaction whose outputs spend more than its inputs could be loaded and shown to the user. Normally such a transaction is impossible on the Bitcoin network, but Krux would display it with a tiny negative fee and skip the high-fee warning, potentially tricking a user into approving a transaction that can never be mined. The fix now rejects these PSBTs immediately when loading them.

This commit only adds translations for two existing warning messages in the Krux Bitcoin hardware wallet software. It does not change any code logic, security behavior, or fix any vulnerability. The messages warn users that displayed fees may be understated and that input amounts are unverified, but those warnings already existed in English; this change just makes them available in more languages.

This commit adds a warning screen to Krux, a hardware signing device, when it is asked to sign a multi-input Bitcoin transaction where the amounts of some inputs cannot be independently verified. The risk is that a malicious transaction coordinator could trick a user into paying a much higher fee than shown, or into signing away more money than intended, by lying about input amounts during separate signing sessions. The patch does not block signing; it only warns the user and asks whether to proceed. It also does not fix the underlying cryptographic gap in older SegWit (BIP143) signatures, which is why the warning is needed.

This commit fixes a display bug in how Krux formats negative Bitcoin amounts. Previously, a value like -1000 satoshis was shown incorrectly as roughly -1.99 bitcoins instead of -0.00001 bitcoins, because the code split the number before handling the minus sign. The fix simply removes the sign, formats the absolute value, then reattaches the minus sign. It is a user-interface bug, not a wallet-security vulnerability.

This commit is a documentation update to the project's changelog. It describes two security-related changes that were apparently made in earlier code: a heap buffer overflow in the camera-based entropy (randomness) module that could only be triggered on a discontinued device called the Maix Bit, and the removal of an unused deterministic random function from the firmware. The commit itself only edits the changelog text; it does not contain the actual code fixes.

This commit updates a bundled firmware component called MaixPy. The commit message says it fixes a 'Shannon heap overflow,' removes an unused random-number binding, and drops support for one hardware variant (Maix Bit). A heap overflow is a memory corruption bug that can sometimes be exploited to run attacker-controlled code, but the actual code change is just a one-line version bump of a submodule, so we cannot verify the fix from the diff alone.

This commit removes support for an old, discontinued hardware device called the Maix Bit from the Krux Bitcoin wallet firmware. The commit message says the Maix Bit's camera resolution (CIF) was the only one that fed frames larger than QVGA into a 'shannon entropy' module, overflowing that module's scratch buffer by 49,152 bytes. In plain terms, this is a fix for a buffer overflow bug, but the fix is to delete the only hardware configuration that triggered it rather than enlarge the buffer. Because the device was already discontinued and reportedly has no users, the practical risk is low, but the underlying overflow condition is a real memory-safety issue.

This commit is a routine engineering cleanup: it removes a Python-only compatibility layer (a 'shim') used for testing and simulation, and makes the test environment use the same C-language UR encoder/decoder module that the real hardware device uses. There is no security bug being fixed here; the change is about making tests more realistic and reducing duplicated code.

This commit tightens error handling in Krux's wallet parsing. Previously, the code used bare 'except:' clauses that would catch everything, including KeyboardInterrupt and SystemExit. Those special exceptions should normally be allowed to propagate so a user can cancel an operation or the program can shut down cleanly. The change replaces the bare catches with 'except Exception:', which still handles ordinary parsing errors but lets KeyboardInterrupt and SystemExit through. A new test confirms KeyboardInterrupt now propagates from all three parsing fallback paths.

This commit only removes historical changelog-style comments from the code and rewrites the remaining comments to describe the current behavior. No code logic was changed, so there is no security impact.

This fix closes a hole where a Bitcoin address that looks valid (correct checksum) but belongs to no known network could be accepted by Krux's address parser. Before the patch, the parser only caught thrown errors; because the underlying library quietly returns nothing for an unknown address version, such an address slipped through as valid. The patch now checks that a real script output was produced and rejects the address otherwise. This could matter if a user scanned a malformed or wrong-network address and the device treated it as valid.

This change fixes a bug where pressing a device's cancel/back button during address parsing could be ignored or misreported as an 'invalid address' instead of letting the user exit. The code previously caught every possible error (including user interrupts) and treated them all as address validation failures. Now it only catches actual address-format errors from the embit library, allowing legitimate user interrupts to propagate normally.

This commit refactors how Krux handles animated QR codes in the 'UR' format. It swaps an older decoder API for a newer state-machine API. The visible change is that transient decoding errors are now ignored while scanning, and only terminal errors stop capture. The commit itself is described as a refactor, but the change in error handling could affect security if it hides or delays detection of malformed or malicious QR frames.

This commit only changes how automated tests are run. It builds a C cryptography library during testing so the test environment matches the real firmware more closely. There is no change to the actual Krux firmware or wallet code, and no security vulnerability is being fixed.

This change simply adds 'perf' to the list of allowed commit message types in a GitHub Actions workflow that checks whether commit messages follow a conventional format. It has no effect on the Krux software users run, on private keys, wallets, or any security-sensitive behavior.