Ledger Bitcoin app

This commit only adds new automated unit tests for the wallet-registration feature of the Ledger Bitcoin app. It does not change any production code, fix bugs, or alter app behavior. There is no security issue here.

This commit tightens error handling in a unit-test helper that reads TOML configuration files. Previously, the helper treated any non-string value the same as a missing value, silently returning false. Now it explicitly distinguishes 'field is missing' (still returns false) from 'field exists but is the wrong type' (now logs an error and aborts). This is a hardening change in test infrastructure, not a fix for a demonstrated vulnerability in the Ledger app itself.

This commit only adds and improves unit tests for the Ledger Bitcoin app. It records what the user-interface confirmation function receives during wallet registration tests, then checks that the app correctly labels each key as internal (ours), external (someone else's), or unspendable. It also adds a new test case for a fingerprint-collision scenario. There is no change to the actual app code that runs on the device, so this is a testing/quality improvement rather than a security fix.

This commit turns on a safety feature called the 'stack protector' in the Ledger Bitcoin app's build settings. The stack protector is a compiler guard that helps detect and block certain types of low-level memory attacks (stack buffer overflows) before they can take control of the device. The change itself is a hardening improvement, not a fix for a specific reported bug. It makes future exploitation of stack overflow flaws harder, but it does not remove any underlying vulnerability by itself.

This commit only changes a code-formatting configuration file (.clang-format). It removes an invalid separator and adds a setting that lets clang-format automatically guess where asterisks should go in pointer declarations. It does not change any executable code, cryptographic logic, or security behavior of the Bitcoin app.

This commit adds one previously existing code-formatting commit hash to a file that tells Git to ignore that commit when showing who last changed each line. It does not change any executable code, app behavior, or security settings.

This commit is purely a code-style and formatting update to make the project compile cleanly with the newer clang-21 compiler. It adds or removes spaces inside braces (for example, changing `{0, -1, 0}` to `{ 0, -1, 0 }`) and re-wraps a few long function signatures so they fit on multiple lines. No program logic, security checks, or behavior were changed.

This commit cleans up how a special debug-only printing mode is enabled in the Ledger Bitcoin app. It only affects builds where DEBUG=10 is set, which is intended for use in the Speculos emulator and not on real hardware. The change moves a macro redefinition from the Makefile into a header file and removes an unused HAVE_PRINTF flag. There is no direct security vulnerability visible in the diff, but it touches debug infrastructure that could historically be misused if left enabled in production firmware.

This is a one-line change adding a missing standard C header file (#include <string.h>) to a header file used for the MuSig multi-signature protocol. On its own, the change does not alter program behavior or fix a security flaw; it simply ensures the compiler has access to string-related standard definitions wherever this header is included. It may be a companion to a larger fix, but the diff itself contains no security-relevant logic.

This commit is a small code cleanup in the Ledger Bitcoin app. It removes an initial loop that counted commands and instead checks for the end marker directly while processing. The author says the old loop was unnecessary and caused a harmless false-positive warning in a static analysis tool. There is no indication this fixes a real security bug or changes app behavior in a user-visible way.

This commit adds two safety checks in the Bitcoin app's policy-handling code. The developer says these checks 'can never happen' in normal operation and were added mainly to satisfy a static-analysis tool (clang analyzer). In theory, if the impossible did happen, the code could have used an invalid array index; the patch now returns an error instead. There is no evidence this is exploitable in practice.

This commit only fixes a documentation/declaration inconsistency in a C header file. The function parameter name in the comment is changed from `in_len` to `inlen` to match the actual declaration, and the output pointer is annotated with a fixed-size array hint (`out[static 20]`) instead of a plain pointer. There is no change to executable code or behavior.

This commit adds a new developer-only testing tool called a 'playground' for the Ledger Bitcoin app. It includes a command-line interface (CLI) and a text-based user interface (TUI) that let developers send test commands to either a software emulator (speculos) or a real Ledger device. The code is entirely in a new dev-tools/ directory, does not change the app itself, and is not part of any production build or shipped firmware. There is nothing in the commit that fixes, introduces, or discusses a security vulnerability.

This commit is a routine code cleanup. It removes an unused test helper that set Bitcoin output amounts to zero, and consolidates duplicate placeholder-parsing code into a shared utility module. There is no indication it fixes or introduces a security vulnerability.

This commit adds test-only helper code for creating Bitcoin transaction fixtures that support newer wallet types (MuSig2 multi-signature and several legacy/wrapped SegWit descriptor forms). It is not a change to the Ledger app firmware itself, but to Python utilities used in automated tests. There is no obvious security bug introduced, and the commit does not claim to fix a vulnerability.

This commit only adds unit tests and test infrastructure for Bitcoin Taproot cryptographic helpers. It does not change the actual app code that runs on the hardware wallet, so it cannot introduce a security vulnerability in shipped firmware. The changes make the test mock more complete by wiring it to the Speculos emulator's real cryptographic functions instead of crashing with a stub.

This commit is purely a build-system and test-harness cleanup. It refactors CMakeLists.txt, updates comments, simplifies the speculos test bridge, and removes a workaround in a test file. Nothing here changes the actual Ledger Bitcoin app that runs on the device, so it cannot directly affect user funds or device security.

This commit adds a new third-party C library (tomlc17) for parsing TOML configuration files, but only inside the project's unit-test directory. It is not a change to the actual Ledger Bitcoin app that runs on the hardware wallet. There is no indication this is a security fix or introduces a vulnerability in the shipped product.

This commit only adds new automated unit tests for existing cryptographic functions in the Ledger Bitcoin app. It does not change any production code, fix bugs, or alter behavior. There is no security issue here.

This commit is a test-only refactoring: it removes a set of local mock SDK headers and a software SHA-256 implementation used by unit tests, and instead makes those tests run against the real Ledger SDK headers through the existing Speculos emulator bridge. No production application code is changed, and there is no indication this fixes or introduces a security vulnerability.

This commit only adds new unit tests and renames some existing test functions. It does not change any production code behavior, so it cannot introduce a security vulnerability or fix one on its own.

This commit only adds unit tests and test-support code. It does not change the actual Bitcoin app that runs on Ledger devices, so it cannot introduce a security vulnerability in shipped firmware. The changes make the test harness able to simulate BIP32 key derivation using the Speculos emulator's own implementation, with a fixed public test seed.

This commit only adds unit tests and a test-only bridge implementation for cryptographic signing functions. It does not change the actual device application code that users rely on, so it cannot introduce a security vulnerability in the shipped product. The changes make the test suite more complete by exercising an existing signing function with a known, precomputed signature.

This commit is purely about improving the project's automated test setup. It links unit tests to a software simulator (Speculos) so cryptographic code can be tested on a regular computer without a physical Ledger device. It adds tests for a Bitcoin key-derivation function and re-enables an existing test file. There is no change to the actual app code that runs on the device, and nothing in the commit suggests a security vulnerability or fix.

This commit only adds helper functions for unit tests to convert Bitcoin extended public keys (xpubs) between base58 string form and raw binary form. It does not change the actual Ledger app code that runs on the device, nor does it fix or introduce any security-relevant behavior. It is a test-code cleanup that replaces hard-coded hex byte arrays with readable xpub strings.