Ledger Bitcoin app

This commit changes the Ledger Bitcoin app's Makefile to add two extra allowed derivation paths alongside the standard Bitcoin paths. One path (4541509') appears to be a special Electrum wallet path, and the other (45') is the BIP-45 whole-tree path for multi-signature wallets. This is a configuration change that widens which key derivation paths the app can use, but it does not by itself look like a vulnerability fix or an exploit. It is more like a compatibility/permission update.

This commit is a routine packaging update for the JavaScript client library of Ledger's Bitcoin app. It bumps the version number, refreshes the package-lock.json dependency manifest, and makes two tiny configuration cleanups (removing an unused word from the spell-check dictionary and a redundant Prettier ESLint preset). There are no code changes that handle user data, cryptographic operations, or device communication, and nothing in the commit describes a security fix or vulnerability.

This commit updates the JavaScript client for Ledger's Bitcoin app so it also recognizes an app named 'Bitcoin Recovery' as the main Bitcoin network app. Previously, only 'Bitcoin' and 'Bitcoin Test' were accepted. This is a small compatibility change and does not appear to be a security fix.

This commit only changes a test file. It re-enables a previously skipped automated test for the Speculos simulator because the simulator now correctly blocks an insecure key-derivation operation that the real Ledger hardware already blocked. It also adds a comment explaining another test case. There is no change to the actual app code that users run on their devices.

This commit adds a new build variant called 'bitcoin_recovery' to the Ledger Bitcoin app. Unlike the normal Bitcoin app, this variant allows all BIP32 derivation paths and is intended for recovery scenarios. The commit itself does not change runtime code; it only adds a Makefile option to compile a special recovery version of the app. Because it permits all paths, if this variant were loaded onto a device and used normally, it could weaken the usual path-restriction protections, but the commit explicitly frames it as a recovery tool and blocks the dangerous AUTOAPPROVE_FOR_PERF_TESTS flag for this variant.

This commit updates a single test automation JSON file used in JavaScript tests. It changes a regular expression that matches on-screen text during automated device testing, replacing the keyword 'Key' with 'Our' and 'Their'. This is a test-only adjustment with no effect on the actual Ledger Bitcoin app firmware or its security.

This commit only updates screenshot files used for automated testing of the Ledger Bitcoin app. No application code, firmware, or user-facing behavior was changed. It is not a security fix and does not introduce a vulnerability.

This commit only changes the on-screen text shown when registering a Bitcoin wallet policy on a Ledger device. It rewords labels like 'ours' to 'Our' and shortens the format so the text fits on the device's small screen. There is no security-relevant change.

This commit adds a compiler flag (-Werror) that turns all build warnings into errors. It is a build-hardening change, not a fix for a specific security bug. There is no evidence in the commit of any vulnerability, exploit, or affected code path.

This commit replaces a custom Bitcoin amount-formatting routine used during Ledger's cryptocurrency swap feature with a shared, simpler utility. The old code converted an 8-byte big-endian amount into a human-readable decimal string with a coin ticker. The new code uses the project's generic `format_sats_amount()` function. The change removes about 120 lines of low-level bit-manipulation code. On its own, the commit does not claim to fix a security bug, and the diff does not show an obvious vulnerability. However, any change to amount display logic in a swap context is security-sensitive because a bug could mislead a user about how much value is being exchanged.

This commit adds a safety check in the Ledger Bitcoin app's code that parses previous transaction outputs. Before copying a scriptPubKey (the part of a Bitcoin output that locks funds) into a fixed-size buffer, the code now verifies the copy won't exceed the buffer's maximum length when combined with how much has already been written. Without this check, a malformed or oversized scriptPubKey could overflow the buffer, potentially corrupting memory and affecting the device's behavior. The commit also fixes two nearby variables from 'bool' to 'int' so parser error codes are preserved instead of being collapsed to true/false.

This commit only edits the project's CHANGELOG.md file, removing an empty '### Added' heading and merging its bullet points into the preceding release section. There are no code changes, no functional changes, and no security fixes or features introduced.

This commit only updates three test snapshot images used by an automated testing tool called Ragger. These snapshots are reference screenshots of device screens during tests. There are no code changes, no application logic changes, and nothing that affects the security of the Bitcoin app running on Ledger devices.

This commit only bumps the app version number from 2.4.2 to 2.4.3 and updates the changelog. No code changes to security logic are present in the diff. The changelog mentions prior security-related UI and derivation-path hardening work, but those changes were made in earlier commits, not here.

This commit adds a single type definition (`cx_err_t`) to a unit-test mock header so the test code compiles. It does not change any actual application code, cryptographic operations, or device behavior. There is no security relevance.

This commit only updates test screenshot images used by the Ragger testing framework. No application code, firmware logic, or user-facing behavior was changed. It is not a security patch and does not fix or introduce any vulnerability.

This commit changes how the Ledger Bitcoin app reports failures when deriving public keys from a BIP32 path. Previously, almost any derivation failure was reported as a generic 'bad state' error. Now, the app distinguishes between different underlying error codes, specifically mapping two SDK error codes (0x4212 and 0x4215) to a 'not supported' status word instead of 'bad state'. This is a defensive hardening change: it gives callers more accurate error information and avoids misleading 'bad state' responses for permission or policy-related derivation failures. There is no direct evidence in the commit of an exploitable vulnerability being fixed.

This commit only changes automated test files. It updates test cases so they use correct hardened Bitcoin derivation paths and expect the app to reject non-standard or root-level key derivation requests. There is no change to the actual app code that runs on Ledger devices, so this commit does not introduce or fix a security vulnerability by itself. It appears to be a follow-up to a real security hardening in the app firmware that happened elsewhere.

This commit removes a special 'derive master key' permission from the Ledger Bitcoin app and replaces direct master-key derivation with a safer OS-provided fingerprint. It also enforces BIP-44 coin-type restrictions (mainnet 0' or testnet 1') at app-load time, closing a path where the app could previously be asked to derive keys outside those intended coin types. The change is defensive: it reduces the app's privileges and makes path enforcement stricter.

This commit changes how the Bitcoin app on Ledger hardware wallets obtains the wallet's master fingerprint. Previously, the app derived the master public key and computed the fingerprint itself. Now it calls a dedicated operating-system API, os_perso_get_master_key_identifier, which returns the fingerprint directly. This is a refactoring that reduces the app's own cryptographic surface and likely improves consistency with other apps, but the commit message and diff alone do not indicate a security bug was fixed.

This commit only updates test screenshot snapshots (PNG images) used by the Ragger automated testing framework. No application source code, firmware, or cryptographic logic was changed. It is not a security patch and does not affect users' devices or funds.

This commit fixes a coding bug in the Ledger Bitcoin app where a variable that tracks whether cryptographic operations succeeded was not initialized before use. Because the function is marked as unsafe for secret data (it is vulnerable to timing attacks) and is now also made private to the file, the patch both removes a potential source of incorrect error handling and limits how widely the unsafe helper can be called. The actual security impact is moderate: on its own this is a defensive fix rather than a demonstrated exploit, but uninitialized error variables can in principle lead to wrong decisions downstream if an error path is taken before the variable is set.

This commit fixes a buffer-size mismatch in the Ledger Bitcoin app. A function that derives secret keys was being asked to write 64 bytes of output into a caller-supplied 32-byte buffer. The patch now provides a 64-byte temporary buffer and copies only the needed 32 bytes afterward, then securely wipes the temporary buffer. The original bug could have caused memory corruption or leaked key material, depending on how the SDK behaves when given an undersized buffer.

This commit only updates test screenshot images used by an automated testing tool called Ragger. No actual application code, firmware, or security logic was changed. It is not a security fix and does not affect users' devices or funds.

This commit only updates documentation. It fixes a typo in an error-code table and clarifies that the Ledger device can display the full text of a Bitcoin message being signed if it is short enough and contains only printable ASCII characters plus line feeds; otherwise it shows a hash. There is no code change and no security fix.