Krux

This is a routine release merge for Krux firmware (version 26.08.0). It includes several genuine security fixes: a heap buffer overflow in camera-based entropy generation for a discontinued device, stricter fee calculation when signing Bitcoin transactions, and a warning when a transaction's input amounts cannot be verified. It also swaps the QR-code encoding library for a faster native one, removes support for the discontinued Maix Bit device, and makes various reliability improvements. The commit itself is a large merge, so the exact code changes are spread across many files and not all visible in the supplied diff.

This commit appears to be a routine version bump of a component called 'cUR' inside the MaixPy firmware build. No actual code changes are visible in the provided diff, and the commit message gives no indication of a security fix or vulnerability. There is nothing here that can be independently assessed as a security issue.

This commit fixes a build-time font-generation script so that a newly supported device ('embed_fire') is recognized. Before the fix, the script printed an error but still produced the same font files. There is no security issue.

This commit appears to update a submodule or dependency called MaixPy to a newer version that includes updated visual glyphs (small icons/symbols). The title and message describe it as a routine maintenance chore, not a security fix. No actual code changes are visible in the supplied diff, and no security references were provided.

This commit only updates the project's CHANGELOG.md to document earlier fixes related to PSBT (Partially Signed Bitcoin Transaction) fee and amount handling. It does not contain any code changes itself. The changelog entries describe security-relevant bugs where incorrect fee/amount calculations could be shown or confirmed during Bitcoin signing, which could trick a user into approving a bad transaction. However, because the actual fixes are not in this commit, we cannot inspect or verify them here.

This commit fixes a bug in Krux, a Bitcoin signing device, where a malformed transaction whose outputs spend more than its inputs could be loaded and shown to the user. Normally such a transaction is impossible on the Bitcoin network, but Krux would display it with a tiny negative fee and skip the high-fee warning, potentially tricking a user into approving a transaction that can never be mined. The fix now rejects these PSBTs immediately when loading them.

This commit fixes a security flaw in Krux, a Bitcoin signing device. Before the fix, an attacker could trick the device into showing a low transaction fee on screen while actually signing a much higher fee. The fix makes the device verify that any attached previous transaction really matches the input being spent, and forces legacy (non-Segwit) inputs to include that previous transaction. It also makes sure the amount shown to the user is always the same amount the signature commits to. A small residual risk remains for multi-input Segwit transactions where previous transactions are not required.

This commit adds a warning screen to Krux, a hardware signing device, when it is asked to sign a multi-input Bitcoin transaction where the amounts of some inputs cannot be independently verified. The risk is that a malicious transaction coordinator could trick a user into paying a much higher fee than shown, or into signing away more money than intended, by lying about input amounts during separate signing sessions. The patch does not block signing; it only warns the user and asks whether to proceed. It also does not fix the underlying cryptographic gap in older SegWit (BIP143) signatures, which is why the warning is needed.

This commit updates a bundled firmware component called MaixPy. The commit message says it fixes a 'Shannon heap overflow,' removes an unused random-number binding, and drops support for one hardware variant (Maix Bit). A heap overflow is a memory corruption bug that can sometimes be exploited to run attacker-controlled code, but the actual code change is just a one-line version bump of a submodule, so we cannot verify the fix from the diff alone.

This commit removes support for an old, discontinued hardware device called the Maix Bit from the Krux Bitcoin wallet firmware. The commit message says the Maix Bit's camera resolution (CIF) was the only one that fed frames larger than QVGA into a 'shannon entropy' module, overflowing that module's scratch buffer by 49,152 bytes. In plain terms, this is a fix for a buffer overflow bug, but the fix is to delete the only hardware configuration that triggered it rather than enlarge the buffer. Because the device was already discontinued and reportedly has no users, the practical risk is low, but the underlying overflow condition is a real memory-safety issue.

This commit is a routine engineering cleanup: it removes a Python-only compatibility layer (a 'shim') used for testing and simulation, and makes the test environment use the same C-language UR encoder/decoder module that the real hardware device uses. There is no security bug being fixed here; the change is about making tests more realistic and reducing duplicated code.

This commit refactors how Krux handles animated QR codes in the 'UR' format. It swaps an older decoder API for a newer state-machine API. The visible change is that transient decoding errors are now ignored while scanning, and only terminal errors stop capture. The commit itself is described as a refactor, but the change in error handling could affect security if it hides or delays detection of malformed or malicious QR frames.

This commit only changes how automated tests are run. It builds a C cryptography library during testing so the test environment matches the real firmware more closely. There is no change to the actual Krux firmware or wallet code, and no security vulnerability is being fixed.

This commit only changes a test file to make it run faster by faking the system clock. It does not modify any production code, so it has no direct security impact on users of the Krux device or software.

The commit title says it is a routine maintenance update ('chore') for two internal items named cUR and k_quirk in the MaixPy firmware file. No diff content is available, and no verified references were supplied, so there is no visible evidence of any security change.

This change locks the Docker build to one specific, unchangeable version of the GCC compiler image by adding a cryptographic fingerprint (SHA digest). Without this, an attacker who compromises the GCC image registry could silently replace the 'gcc:12-bookworm' image with a malicious one, potentially injecting backdoors into Krux firmware builds. Pinning by digest prevents the build from accepting a substituted image, but it does not fix any already-known vulnerability in the code itself.

This commit only updates developer documentation, replacing instructions that mentioned the Poetry Python tool with instructions for the uv Python tool. No code, dependencies, or security behavior changed.

This change removes third-party web scripts (MathJax and require.js loaded from a content delivery network) from the project's documentation and replaces them with self-hosted, pre-rendered math images. That eliminates a supply-chain risk similar to the polyfill.io incident, where a compromised or malicious CDN could inject harmful code into documentation pages viewed by users or developers.

This commit updates two bundled dependencies (Embit and MaixPy) to their latest versions. No source code diff is available, and the commit message describes it as a routine maintenance chore with no security claims.

This commit appears to be a routine maintenance update that bumps the MaixPy firmware submodule to a newer version and updates another component (uUC). The title describes it as a cleanup chore. No actual code changes are visible in the provided diff, and no security-related information is present in the commit message or materials.

This commit swaps out the pure-Python QR code encoding/decoding libraries used by the Krux hardware wallet for a new C module called uUR. The stated goal is faster scanning and lower memory use. The change touches code that handles Bitcoin wallet descriptors, seed phrases, and signed transactions (PSBTs). There is no direct evidence in the commit of a security vulnerability, but any rewrite of code that parses cryptographic data deserves careful review because a bug could in theory cause the wallet to misread a transaction or seed. The commit does not describe itself as a security fix.

This commit removes the visual grid lines drawn on camera scans of TinySeed metal backup plates. It is a user-interface improvement to make the punched holes easier to see; it does not change security logic, cryptography, or data handling.

This commit fixes four security weaknesses in Krux, a Bitcoin hardware-wallet project. The changes prevent: (1) encrypted backups from declaring zero or very low password-stretching effort, which would make them easy to brute-force; (2) multi-signature wallet descriptors from silently accepting multiple cosigners whose identity cannot be verified; (3) a malicious or corrupted SD card from tricking the file manager into leaving its intended folder; and (4) repeated wrong password attempts on encrypted backups by adding growing delays between attempts. All four are hardening fixes rather than a single critical vulnerability.

This commit fixes two denial-of-service weaknesses in Krux, a Bitcoin hardware-wallet firmware. First, it caps how much data can come out of compressed (deflated) QR codes and encrypted backups, preventing a maliciously crafted 'zip bomb' from exhausting the device's memory. Second, it rejects QR-code part counts that are zero or absurdly high, preventing an attacker from tricking the wallet into reserving unbounded memory while scanning multi-part QR codes.

This commit adds a warning screen to Krux's message-signing feature when the user is about to sign a raw 32-byte hash or a 64-character hex string. Previously, the device would silently treat such inputs as already-hashed values and sign them directly. Because a Bitcoin transaction's signature hash (sighash) is also a 32-byte value, an attacker could trick a user into signing what looks like a harmless message but is actually a transaction hash, effectively authorizing a transaction. The fix asks the user to confirm before proceeding.