Ledger Bitcoin app

This commit adds a command-line helper tool to a test utility file. It lets developers create sample Bitcoin PSBT files for testing the Ledger Bitcoin app. There is no change to the actual app code that runs on the Ledger device, no fix for a bug, and no security-sensitive behavior introduced. It is purely a testing/development aid.

This commit only changes how test helper scripts locate and import other test code. It makes the test utilities work regardless of which folder a script is run from. There is no change to the actual Ledger Bitcoin app, wallet logic, or anything end users interact with.

This commit updates a test helper script that builds Bitcoin PSBT test transactions. It makes the generated test PSBTs more standards-compliant by adding missing key origin information, global extended public keys, and setting the transaction version to 2. The change only affects test utilities, not the actual Ledger app code that runs on devices or handles real funds.

This commit only changes code comments to make them clearer and more concise. No actual program logic, checks, or behavior were modified. It is not a security fix.

This commit removes one duplicated line from a code formatting configuration file (.clang-format). It does not change any program code, security logic, or behavior of the Ledger Bitcoin app. There is no security relevance.

This commit only adds a new automated test and slightly modifies existing test helper functions. It does not change the actual Ledger Bitcoin app code that users run. The new test checks that the app accepts certain extreme but valid relative timelock values when registering a wallet policy. There is no fix or behavior change to the secure firmware itself.

This commit adds a new internal utility function that walks through Bitcoin descriptor/miniscript trees node by node, plus unit tests. It does not change any existing behavior or fix a known bug; it simply provides a generic traversal helper that other code can use later. There is no indication this is a security patch.

This commit only adds a new automated test file. It does not change the actual Ledger Bitcoin app code. The test checks that the app correctly rejects wallet policies containing relative timelock values that are outside the allowed range. Because no application code is modified, this commit by itself does not introduce or fix a security vulnerability. It is a test-only change that documents expected behavior for an existing validation rule.

This commit adds safety checks to the Ledger Bitcoin app so that the 'older(n)' time-lock feature can only use values that actually have meaning under Bitcoin's consensus rules. Before this fix, a user could be shown a wallet policy with a value like older(65536), which looks like a real time-lock but behaves like no time-lock at all. That could trick a user into believing funds are locked when they are not. The patch rejects such misleading values.

This commit only adds a new unit test to the Ledger Bitcoin app. It does not change any production code. The test checks that a specific type of Bitcoin Miniscript expression is correctly classified as not 'non-malleable' (NONMAL). Because no actual wallet or signing logic is modified, this change by itself does not introduce or fix a live security vulnerability.

This commit fixes a logic bug in the Ledger Bitcoin app's Miniscript policy analyzer. The code that decides whether a Bitcoin spending policy is 'm' (a technical property used during transaction signing) was checking the wrong counter. It now also requires that all sub-policies satisfy the 'm' property, not just the 'e' property. This could have caused the device to incorrectly approve or classify a Bitcoin transaction policy, potentially leading to wrong security assumptions during wallet operations.

This commit simply removes an unused local variable named key_expression_index from a single function. It does not change program behavior, fix a bug, or alter any security logic. There is no security relevance.

This commit shortens a number of internal error messages in Ledger's Bitcoin app so they no longer exceed a 50-character internal limit. The title says the long messages were causing LEDGER_ASSERT failures, which means the app could crash or refuse to proceed simply because a diagnostic string was too long. The change only rewords messages; it does not alter the underlying security checks or fix any vulnerability in the cryptographic logic.

This commit fixes a missing check in the Ledger Bitcoin app. A function that streams a transaction 'preimage' (a piece of data used to authorize Bitcoin transactions) did not reject the case where the caller asks to stream zero bytes. The fix now returns an error if the requested chunk size is zero, preventing possible downstream confusion or unsafe behavior. The change is small and defensive; the commit message does not describe any active exploit or security incident.

This commit is a defensive cleanup for the MuSig2 multi-signature code in Ledger's Bitcoin app. It makes sure that temporary memory holding secret nonce values and randomness is wiped clean even when things go wrong, not just on the happy path. The change reduces the chance that sensitive signing material could be left behind in device memory after an error, but it does not appear to fix an active remote exploit by itself.

This commit fixes a bug in the Ledger Bitcoin app where several functions checked for only one specific error value (-1) instead of treating any negative number as a failure. If the underlying helper can return other negative error codes, the old code would have ignored them, potentially causing the app to keep processing with invalid or missing data. The patch makes the error handling more robust by rejecting any negative return value.

This commit only fixes spelling mistakes and minor formatting in documentation files. There are no code changes, no security fixes, and no behavior changes. It is purely a cleanup of typos like 'comand' to 'command' and 'ore' to 'or'.

This commit only fixes spelling mistakes in source code comments and documentation strings. No executable code, logic, or security behavior was changed. It cannot be exploited and has no security impact.

This commit adds a GitHub Actions workflow that automatically checks for spelling mistakes in source code and documentation folders. It is a code-quality and documentation improvement with no security relevance.

This commit is a routine code cleanup that renames and consolidates helper functions used to send response messages from the Ledger Bitcoin app. It removes a few redundant wrapper functions and updates the documentation comments. There is no indication of a security fix or behavior change.

This commit adds compile-time checks that make sure the app's internal error/status codes match the ones defined by Ledger's standard software development kit. It does not change any behavior of the app; it only adds safety guards so that future mismatches would be caught when building the code. There is no indication this fixes an active security bug.

This commit refactors the Ledger Bitcoin app to use the newer Ledger SDK 'standard app' framework for main I/O loops and swap (exchange) integration. It removes a lot of custom boilerplate code and replaces it with SDK-provided equivalents. The change also enables the SWAP feature by default in the Makefile. There is no direct evidence in the diff of a security vulnerability being fixed; it appears to be a modernization and code-cleanup change. However, because it touches core app lifecycle, I/O, and swap handling code, any mistake in the transition could affect app stability or swap security.

This commit removes a local set of helper functions for reading and writing memory buffers and switches the Ledger Bitcoin app to use equivalent functions now provided by the Ledger SDK. It is a code cleanup and modernization change, not a fix for a known security bug. The only functional code change is removing unnecessary type casts when accessing buffer memory, which does not introduce a vulnerability.

This commit only changes test files for the Ledger Bitcoin app. It adds and updates automated tests to verify that the app correctly accepts derivation paths up to a defined maximum length and rejects paths that are too long. There are no changes to the actual app code that runs on the device, so this commit does not introduce or fix a security vulnerability by itself. It appears to be a follow-up testing patch related to separating two internal constants about path length limits.

This commit renames and splits two related constants for Bitcoin derivation paths. Previously, the same limit was used both for wallet-policy xpub derivations and for full signing paths. The change gives xpub derivations their own smaller limit (8 steps) while keeping the full signing path limit at 10 steps (8 + 2 for change/address index). It also fixes a potential off-by-one check when parsing xpub derivations by changing '>' to '>='. Most of the file changes are cosmetic whitespace removals.