Ledger Bitcoin app

This commit swaps the library's standard variable-length integer type for a custom one in Ledger's Bitcoin app client code. The change is needed because a newer version of the rust-bitcoin library started rejecting large varints that the Ledger protocol legitimately uses for non-Bitcoin data. The patch itself is a compatibility fix, not an obvious vulnerability, but it removes a safety boundary and any bugs in the new custom encoder/decoder could affect how the client talks to Ledger devices.

This commit only changes GitHub CI workflow settings. It turns on two build-reporting features: comparing compiled outputs across builds and reporting how much stack memory the app uses during tests. There is no change to the actual Bitcoin app code, no bug fix, and no security patch.

This commit removes two lines from a GitHub Actions CI workflow file. It disables a JFrog deployment step and stops passing a Cargo crate publishing token to that workflow job. There is no change to the actual Bitcoin app code, cryptography, or anything users install on their Ledger devices. It is purely an internal adjustment to how a Rust client library crate is published.

This commit fixes a missing safety check in Ledger's Bitcoin app when handling newer 'V2 wallet policies.' The app was told in advance how long the wallet policy data should be, but it never verified that the actual data matched that length. The fix adds a simple comparison: if the lengths don't match, the app now rejects the request. The commit credits Rob Hamilton for reporting the bug, but no public security advisory or CVE is included in the materials.

This commit adds a new GitHub Actions workflow file that automatically creates a GitHub release whenever a version tag like '1.2.3' is pushed. It calls a reusable release workflow maintained by Ledger. There is no change to the Bitcoin app code, device firmware, or any user-facing security behavior. It is purely a CI/CD automation addition.

This is a tiny consistency fix in the JavaScript client for the Ledger Bitcoin app. It changes one number in a command that resumes interrupted operations so it matches the Python and Rust clients. The app already ignores this version number for this specific command, so the change is unlikely to have any security effect on its own. It mainly removes an unexplained difference between client implementations.

This commit fixes a spelling mistake inside a code comment, removing an unnecessary semicolon. It does not change any executable code, logic, or behavior of the Bitcoin app.

This commit is a large but purely structural code cleanup: it splits the single large sign_psbt.c file into many smaller, focused source files under src/handler/sign_psbt/. The actual logic, function bodies, validation checks, and security-sensitive operations appear to be moved verbatim into the new modules, with only minor header/include adjustments and copyright-notice updates. There is no indication of a behavior change, bug fix, or security patch.

This commit is a straightforward internal code cleanup in Ledger's Bitcoin app. It groups several pieces of wallet-policy data into a new 'account context' structure and updates all references accordingly. There is no change to how transactions are validated, signed, or shown to the user, and no security bug is fixed or introduced in the visible diff.

This commit is a straightforward internal code cleanup: it splits one large function into three smaller, well-documented helper functions and moves one data field into a shared state structure. There is no change to what the code checks, accepts, or rejects. It does not fix a bug or add a security feature.

This is a small defensive update to the Python companion library for Ledger's Bitcoin app. It changes how the client handles unexpected data returned by a future version of the hardware app, so that the data is labeled as 'unknown' rather than being misread as a transaction input number. It is a robustness/future-proofing fix, not a patch for an active security flaw.

This commit changes a single character in a user-facing warning message. It replaces a curly apostrophe (’), which the Ledger NBGL user-interface library was not displaying correctly, with a straight apostrophe ('). There is no security vulnerability here; it is purely a display/rendering fix.

This commit only updates automated test screenshot snapshots for Ledger's Bitcoin app. No application code, firmware, or user-facing behavior was changed. It is not a security fix and does not affect real devices or user funds.

This commit removes a pinned version number from an automated code-style checker used in Ledger's Bitcoin app repository. It only affects how the project runs its internal linting workflow and does not change any application code, cryptographic logic, or user-facing behavior. There is no security relevance.

This commit is a routine API update for the Ledger Bitcoin app's Rust client library. It changes what kind of data the library returns when a user signs a Bitcoin transaction (PSBT), so it can also return MuSig2 multi-signature material (public nonces and partial signatures) in addition to ordinary signatures. The commit message explicitly calls this a breaking change that requires a major release. There is no indication of a security bug being fixed or introduced.

This commit only adds new test cases for an existing feature (MuSig multi-signature signing) in the Rust client test suite. It does not change any production code, cryptographic logic, or application behavior. The changes are purely in test files: extending the test harness to check two new kinds of returned data (public nonces and partial signatures) and adding recorded device communication data for two MuSig signing scenarios. There is no indication of a security fix or vulnerability.

This commit is a routine version number bump for the Rust client package, changing it from 0.5.1 to 0.6.0. There is no code change, no security fix, and no functional change visible in the diff.

This commit fixes a buffer handling bug in the Ledger Bitcoin app's wallet registration code. The app now reserves one extra byte for the wallet policy descriptor string and explicitly writes a null terminator (the 'end of string' marker). Without this fix, code that reads the descriptor as a text string could keep reading past the intended data, potentially leaking nearby memory or behaving unpredictably. The issue was reported by an external party called Cerberus.

This commit fixes a bug in the Ledger Bitcoin app where a flag indicating whether a wallet policy name should be shown could be left in an old/stale state during streaming transaction reviews. In practice, if a user had previously reviewed a transaction with a named wallet policy, a later transaction that should not show that name might incorrectly reuse the old name on screen. This is a user-interface consistency bug that could mislead the user about which wallet policy is authorizing a spend, but it does not directly expose private keys or allow unauthorized signing.

This commit fixes a missing safety check in the Ledger Bitcoin app's wallet policy parser. When reading a 'thresh(...)' policy (a multi-signature rule like '2 of 3 signatures needed'), the app now verifies that the required number of signatures (k) is not greater than the total number of available signers (n). Without this check, a malformed policy could ask for more signatures than keys exist, which could lead to an unusable or non-standard wallet policy being accepted by the device.

This commit only adds two new test cases to the project's unit tests. The tests check that the wallet policy parser correctly rejects 'thresh' descriptors with an invalid threshold number (zero or larger than the number of available sub-policies). It does not change any production code. The commit itself is a test-only change and appears to be preparing the ground for a later fix, but it signals that the developers have identified a parsing edge case that currently fails.

This commit fixes a variable type in Ledger's Bitcoin app used during cross-chain cryptocurrency swaps. The amount attached to an OP_RETURN output was being stored in a `size_t` variable, which on Ledger's embedded device is likely 32 bits, while the actual amount is a 64-bit value. This mismatch could cause the amount to be silently truncated (cut off), potentially allowing a swap to be validated with an incorrect amount. The fix changes the variable to `uint64_t` to match the real data size and prevent truncation.

This commit only updates test screenshot snapshots (expected device screen images used by automated tests). No application code, firmware logic, or user-facing behavior was changed. It is not a security fix and does not introduce a vulnerability.

This commit only changes test code for a Bitcoin descriptor helper. It updates existing test strings to use a newer standard derivation format and adds two new test cases (an empty multi-signature expression and a descriptor containing two separate multi-signature expressions). There is no change to production code, no fix, and no security-relevant behavior change.

This commit adds code to the Ledger Bitcoin app's Rust client that pre-processes wallet descriptors containing 'musig(...)' key groups before computing addresses. It implements a small BIP-327/BIP-328 key aggregation so the existing miniscript library can still parse the descriptor. It is a feature addition, not a reported vulnerability fix, but any new cryptographic code can introduce bugs that could cause wrong addresses or, in the worst case, weaken security if implemented incorrectly.