Ledger Bitcoin app

This commit adds a memory wipe of a cryptographic hash context after it is used to derive a secret random value in the Ledger Bitcoin app's MuSig multi-signature code. The change is described by the developer as a 'defense-in-depth' measure: once partial signatures are public, the internal randomness used to create them becomes sensitive, and leftover data in memory could theoretically help an attacker if they later gained access to the device's memory. There is no evidence this issue was exploited or publicly disclosed as a security vulnerability.

This commit fixes a bug in Ledger's Bitcoin app that could let a wallet policy slip through registration even when it contained unused or out-of-range public keys. The old code simply looked at the highest key index referenced in the wallet descriptor and assumed every key up to that number was used. That meant an attacker could craft a policy where the user's own key was listed as an unused extra key while the descriptor only required the attacker's key. The fix now explicitly counts which keys are actually referenced and rejects policies with gaps or unreferenced keys.

This commit adds an early safety check in the Ledger Bitcoin app. Before registering a new wallet policy, the app now verifies that each public key is a valid point on the Bitcoin elliptic curve. Previously, an invalid public key would only be caught later when trying to derive addresses. Catching it earlier prevents the device from storing a broken or potentially manipulated wallet policy.

This commit tightens checks in a Ledger Bitcoin app function that converts compressed public keys into full (x,y) public key points. Previously, the code did not verify that the supplied x-coordinate is a valid field element (less than the curve prime p) and did not confirm that the computed y really satisfies the secp256k1 curve equation. The patch adds both checks, rejecting malformed keys. Without these checks, a specially crafted compressed key could cause the function to produce a point that is not actually on the Bitcoin curve, which could then be used in subsequent cryptographic operations in unexpected ways.

This commit only adds new automated tests for an existing cryptography helper function. It does not change the actual app code that runs on Ledger devices, so it cannot by itself introduce or fix a security bug. The commit message notes that some of the new tests check failure cases that will be addressed in a later commit.

This commit fixes a spot in the Ledger Bitcoin app where a function that converts a compressed public key to an uncompressed one was called without checking whether it succeeded. Before the fix, if the conversion failed, the code would keep going with potentially invalid data. After the fix, the function's return value is checked and the operation aborts with an error if something went wrong. The change is small and defensive, but it removes a silent-failure path in cryptographic key derivation.

This commit is a routine code cleanup. It removes an unused SDK include path from the build configuration and deletes several unused header imports in a source file. There is no functional change and no security issue is indicated.

This commit is a straightforward internal code cleanup: it moves a temporary data cache used during Bitcoin transaction signing from a permanent global variable into a local stack variable inside the signing function. The change frees about 2.5 KB of always-reserved RAM and is described by the developer as removing an old workaround for a device stack-size limit that no longer exists. There is no indication in the commit that this fixes a security bug or changes behavior visible to users or attackers.

This commit simply turns on Link Time Optimization (LTO), a standard compiler feature that can make the app smaller and faster. There is no indication of a security bug or fix in the change itself or the commit message.

This commit adds support for using MuSig multi-signature key groups inside taproot multi_a wallet policies on Ledger devices, while deliberately blocking them in sortedmulti_a. It also fixes a subtle parsing bug: previously, key expressions inside multi_a/sortedmulti_a were allocated one-by-one in a memory buffer, which would interleave badly with MuSig's own allocations and corrupt the in-memory layout. The new code parses all the keys into a temporary stack array first, then copies them into one contiguous allocation. Separately, the 'cleartext' human-readable display module now refuses to classify multisig patterns that contain musig keys, so the device falls back to showing the raw descriptor instead of potentially misleading text (for example, showing 'any 1 of two keys' for a musig that actually requires both).

This commit hardens Ledger's Bitcoin app so that when it asks the host computer for Merkle-tree data and the request fails or the data is rejected, the memory buffer that was supposed to receive the data is wiped clean with zeros. Before the change, an attacker-controlled host could leave chosen bytes in that buffer even after the app decided the data was invalid. The patch is a defense-in-depth measure; it does not by itself fix a known exploitable bug, but it removes a class of subtle mistakes where later code might accidentally trust leftover hostile data.

This commit adds a new developer-only fuzzing test framework to the Ledger Bitcoin app. It does not change how the app behaves on a real device; it only adds automated test infrastructure that feeds random or structured inputs to the app in a simulated environment to help find bugs. There is no indication this commit fixes or introduces a security vulnerability in production code.