Ledger Bitcoin app

This commit only adds a new automated test and slightly modifies existing test helper functions. It does not change the actual Ledger Bitcoin app code that users run. The new test checks that the app accepts certain extreme but valid relative timelock values when registering a wallet policy. There is no fix or behavior change to the secure firmware itself.

This commit only adds a new automated test file. It does not change the actual Ledger Bitcoin app code. The test checks that the app correctly rejects wallet policies containing relative timelock values that are outside the allowed range. Because no application code is modified, this commit by itself does not introduce or fix a security vulnerability. It is a test-only change that documents expected behavior for an existing validation rule.

This commit adds safety checks to the Ledger Bitcoin app so that the 'older(n)' time-lock feature can only use values that actually have meaning under Bitcoin's consensus rules. Before this fix, a user could be shown a wallet policy with a value like older(65536), which looks like a real time-lock but behaves like no time-lock at all. That could trick a user into believing funds are locked when they are not. The patch rejects such misleading values.

This commit only adds a new unit test to the Ledger Bitcoin app. It does not change any production code. The test checks that a specific type of Bitcoin Miniscript expression is correctly classified as not 'non-malleable' (NONMAL). Because no actual wallet or signing logic is modified, this change by itself does not introduce or fix a live security vulnerability.

This commit fixes a logic bug in the Ledger Bitcoin app's Miniscript policy analyzer. The code that decides whether a Bitcoin spending policy is 'm' (a technical property used during transaction signing) was checking the wrong counter. It now also requires that all sub-policies satisfy the 'm' property, not just the 'e' property. This could have caused the device to incorrectly approve or classify a Bitcoin transaction policy, potentially leading to wrong security assumptions during wallet operations.

This commit simply removes an unused local variable named key_expression_index from a single function. It does not change program behavior, fix a bug, or alter any security logic. There is no security relevance.

This commit shortens a number of internal error messages in Ledger's Bitcoin app so they no longer exceed a 50-character internal limit. The title says the long messages were causing LEDGER_ASSERT failures, which means the app could crash or refuse to proceed simply because a diagnostic string was too long. The change only rewords messages; it does not alter the underlying security checks or fix any vulnerability in the cryptographic logic.

This commit fixes a missing check in the Ledger Bitcoin app. A function that streams a transaction 'preimage' (a piece of data used to authorize Bitcoin transactions) did not reject the case where the caller asks to stream zero bytes. The fix now returns an error if the requested chunk size is zero, preventing possible downstream confusion or unsafe behavior. The change is small and defensive; the commit message does not describe any active exploit or security incident.

This commit is a defensive cleanup for the MuSig2 multi-signature code in Ledger's Bitcoin app. It makes sure that temporary memory holding secret nonce values and randomness is wiped clean even when things go wrong, not just on the happy path. The change reduces the chance that sensitive signing material could be left behind in device memory after an error, but it does not appear to fix an active remote exploit by itself.

This commit fixes a bug in the Ledger Bitcoin app where several functions checked for only one specific error value (-1) instead of treating any negative number as a failure. If the underlying helper can return other negative error codes, the old code would have ignored them, potentially causing the app to keep processing with invalid or missing data. The patch makes the error handling more robust by rejecting any negative return value.

This commit only fixes spelling mistakes and minor formatting in documentation files. There are no code changes, no security fixes, and no behavior changes. It is purely a cleanup of typos like 'comand' to 'command' and 'ore' to 'or'.

This commit only fixes spelling mistakes in source code comments and documentation strings. No executable code, logic, or security behavior was changed. It cannot be exploited and has no security impact.

This commit adds a GitHub Actions workflow that automatically checks for spelling mistakes in source code and documentation folders. It is a code-quality and documentation improvement with no security relevance.

This commit is a routine code cleanup that renames and consolidates helper functions used to send response messages from the Ledger Bitcoin app. It removes a few redundant wrapper functions and updates the documentation comments. There is no indication of a security fix or behavior change.

This commit adds compile-time checks that make sure the app's internal error/status codes match the ones defined by Ledger's standard software development kit. It does not change any behavior of the app; it only adds safety guards so that future mismatches would be caught when building the code. There is no indication this fixes an active security bug.

This commit refactors the Ledger Bitcoin app to use the newer Ledger SDK 'standard app' framework for main I/O loops and swap (exchange) integration. It removes a lot of custom boilerplate code and replaces it with SDK-provided equivalents. The change also enables the SWAP feature by default in the Makefile. There is no direct evidence in the diff of a security vulnerability being fixed; it appears to be a modernization and code-cleanup change. However, because it touches core app lifecycle, I/O, and swap handling code, any mistake in the transition could affect app stability or swap security.

This commit removes a local set of helper functions for reading and writing memory buffers and switches the Ledger Bitcoin app to use equivalent functions now provided by the Ledger SDK. It is a code cleanup and modernization change, not a fix for a known security bug. The only functional code change is removing unnecessary type casts when accessing buffer memory, which does not introduce a vulnerability.

This commit only changes test files for the Ledger Bitcoin app. It adds and updates automated tests to verify that the app correctly accepts derivation paths up to a defined maximum length and rejects paths that are too long. There are no changes to the actual app code that runs on the device, so this commit does not introduce or fix a security vulnerability by itself. It appears to be a follow-up testing patch related to separating two internal constants about path length limits.

This commit renames and splits two related constants for Bitcoin derivation paths. Previously, the same limit was used both for wallet-policy xpub derivations and for full signing paths. The change gives xpub derivations their own smaller limit (8 steps) while keeping the full signing path limit at 10 steps (8 + 2 for change/address index). It also fixes a potential off-by-one check when parsing xpub derivations by changing '>' to '>='. Most of the file changes are cosmetic whitespace removals.

This commit is a routine maintenance change to the project's unit tests. It updates the test build system to use shared utility code from the Ledger SDK instead of local copies, deletes tests for functions that now live in the SDK, and adds a couple of new test cases for wallet policy parsing. There is no change to the actual Bitcoin app code that runs on the device, and nothing in the commit suggests a security fix or vulnerability.

This commit is a large refactoring that replaces many locally-implemented utility files (for parsing APDUs, buffers, base58, BIP32, varints, read/write helpers, etc.) with equivalent files from Ledger's official SDK library (lib_standard_app). It also renames some local files (e.g., io.c -> io_ext.c, buffer.c -> buffer_ext.c) to hold only app-specific extensions. The change itself is not a security patch; it is a code-maintenance / deduplication move. However, any large-scale dependency switch can introduce subtle behavioral differences or regressions, so it warrants careful review rather than alarm.

This commit only changes the project's GitHub Actions workflow file. It replaces an inline CodeQL security-scanning job with a call to a shared, reusable workflow maintained by Ledger. No application source code, cryptographic logic, or user-facing behavior is modified. There is no direct security vulnerability in this change.

This commit only reorganizes how automated unit tests are run in the project's GitHub CI pipeline. It removes the inline unit-test job from one workflow file and replaces it with a call to a shared Ledger reusable workflow. No application code, cryptographic logic, or user-facing behavior was changed. There is no security-relevant change visible in the diff.

This commit only edits the changelog text: it updates a release date and capitalizes some bullet points. No code was changed, so it cannot by itself introduce, fix, or exploit a security issue. The changelog does mention that version 2.4.5 fixes a signing bug and changes a derivation flag, but those actual code changes are not present in this diff.

This commit fixes two bugs in the Ledger Bitcoin app's data-receiving code when large messages are split into multiple chunks. One bug caused the app to hash and copy from the wrong memory location after the first chunk, potentially corrupting a cryptographic proof. The other bug could read corrupted data or behave incorrectly if an empty chunk arrived, or if a taproot PSBT field started with a very large variable-length integer. These are memory/data-integrity issues in security-critical signing code, but the commit does not state they are exploitable for theft.