Ledger Bitcoin app

This commit adds an automated GitHub Actions job to publish the Rust Bitcoin client library to a package registry (including JFrog) when a version tag is pushed. It also changes the package author metadata from an individual contributor to 'Ledger' and adds a README acknowledgement for that contributor. There are no code changes to the library itself and no apparent security implications.

This commit fixes two spelling mistakes: one in the changelog ('jome' to 'home') and one in a code comment ('In te case' to 'In the case'). No program logic, security behavior, or functionality was changed.

This commit changes a single setting in the project's automated CI workflow. It stops GitHub from automatically creating a new GitHub Release every time a new Python package is published to PyPI. This is a workflow/process change, not a code change affecting the app, wallet, or any security-sensitive functionality.

This commit only adds documentation to the README explaining how maintainers should create release tags to trigger automatic publishing of the Python, JavaScript, and Rust client packages. No code, configuration, or security behavior was changed.

This commit adds a new automated GitHub Actions job that builds and publishes a Python package to PyPI whenever a Git tag starting with 'pyclient' is pushed. It is a routine CI/CD configuration change with no apparent security relevance.

This commit is a routine packaging and publishing cleanup for the JavaScript client. It renames the npm package from 'ledger-bitcoin' to '@ledgerhq/ledger-bitcoin', updates the README and package-lock.json accordingly, and moves the JS client deployment from a separate workflow triggered on pushes to the 'develop' branch into the main CI workflow triggered only by tags starting with 'jsclient-'. There is no change to the Bitcoin app firmware, cryptographic code, or any user-facing security behavior.

This commit simply changes a GitHub Actions workflow to point at the correct, stable version of a reusable deployment workflow. It is a normal repository hygiene fix with no security relevance visible in the diff.

This commit is a packaging and publishing workflow change for Ledger's Bitcoin JavaScript client. It adds a GitHub Actions workflow to publish the package to JFrog and npm, renames the package from 'ledger-bitcoin' to '@ledgerhq/ledger-bitcoin', removes ESLint tooling, and adjusts published files. There is no direct evidence of a security vulnerability in the code changes, but the workflow pins to a non-default branch of a reusable workflow ('mbr/reusable-workflow-jfrog-npm') and removes linting tools, which slightly weakens supply-chain assurance.

This commit only updates three test snapshot images used by an automated testing tool called Ragger. These snapshots are expected outputs of UI screens during automated tests. There are no code changes, no application logic changes, and no security-relevant modifications.

This commit is a routine version bump from 2.4.4 to 2.4.5. It only updates the version number in the Makefile and adds a changelog entry describing unrelated feature and bug-fix changes. There is no code change in this commit itself, and nothing in the diff indicates a security vulnerability or security fix.

This commit only updates test snapshot images used by an automated testing framework called Ragger. These are reference screenshots of Ledger device screens during tests. No application code, firmware, or user-facing behavior was changed, so this has no security relevance on its own.

This commit only adds a new automated test case to the project's test suite. It checks that the Ledger Bitcoin app can display and return an extended public key (xpub) for a specific non-standard key path when the user approves on the device screen. There is no change to the actual app code, no security fix, and no vulnerability being introduced.

This small code change fixes how the Bitcoin app builds extended public keys (xpubs) for the very first account level (called 'L1', meaning a BIP32 path with just one number, like m/44'). Before, the code always tried to look up a parent public key one level above the requested path. For a single-level path, there is no usable parent above it except the master key, so that lookup could fail or behave incorrectly. The patch adds a special case: when the path has exactly one element, it uses the master key's fingerprint as the parent fingerprint instead of trying to derive a non-existent parent. This is a correctness/reliability fix rather than an obvious security vulnerability, but a broken xpub could mislead wallet software about which key hierarchy it is dealing with.

This commit fixes the on-screen name shown for a special 'Bitcoin Recovery' version of the Ledger Bitcoin app and removes some old, duplicated menu code. It is a user-interface cleanup, not a fix for a vulnerability that could steal funds or keys.

This commit re-enables a build flag for a special 'bitcoin_recovery' app variant that lets it derive any key path, including non-hardened ones. The change is intentional and limited to a recovery/debug variant, not the main Bitcoin app. It is not a vulnerability by itself, but it removes a restriction on a variant that already had broad permissions, so it slightly increases the risk surface if that variant is misused or compromised.

This commit only updates three test snapshot images used by the Ragger testing framework. These are reference screenshots for automated UI tests on Ledger hardware device simulators. No application code, firmware logic, or security-sensitive files were changed.

This commit is a routine version bump from 2.4.3 to 2.4.4. It only updates the version number in the Makefile and adds a changelog entry describing two newly allowed Bitcoin derivation paths. There are no code changes in the diff, so it does not introduce, fix, or alter any security-relevant behavior on its own.

This commit only adds and updates automated tests for the Ledger Bitcoin app's extended public key feature. It does not change any application code, cryptographic logic, or security behavior. The tests verify that certain Bitcoin derivation paths (including Electrum and BIP-45 style paths) are accepted or rejected as expected. There is no indication of a security fix or vulnerability being patched.

This commit only updates test screenshot images used by an automated testing tool called Ragger. No application code, firmware, or user-facing behavior was changed. It has no security relevance on its own.

This commit changes the Ledger Bitcoin app's Makefile to add two extra allowed derivation paths alongside the standard Bitcoin paths. One path (4541509') appears to be a special Electrum wallet path, and the other (45') is the BIP-45 whole-tree path for multi-signature wallets. This is a configuration change that widens which key derivation paths the app can use, but it does not by itself look like a vulnerability fix or an exploit. It is more like a compatibility/permission update.

This commit updates the JavaScript client for Ledger's Bitcoin app so it also recognizes an app named 'Bitcoin Recovery' as the main Bitcoin network app. Previously, only 'Bitcoin' and 'Bitcoin Test' were accepted. This is a small compatibility change and does not appear to be a security fix.

This commit is a routine packaging update for the JavaScript client library of Ledger's Bitcoin app. It bumps the version number, refreshes the package-lock.json dependency manifest, and makes two tiny configuration cleanups (removing an unused word from the spell-check dictionary and a redundant Prettier ESLint preset). There are no code changes that handle user data, cryptographic operations, or device communication, and nothing in the commit describes a security fix or vulnerability.

This commit only changes a test file. It re-enables a previously skipped automated test for the Speculos simulator because the simulator now correctly blocks an insecure key-derivation operation that the real Ledger hardware already blocked. It also adds a comment explaining another test case. There is no change to the actual app code that users run on their devices.

This commit adds a new build variant called 'bitcoin_recovery' to the Ledger Bitcoin app. Unlike the normal Bitcoin app, this variant allows all BIP32 derivation paths and is intended for recovery scenarios. The commit itself does not change runtime code; it only adds a Makefile option to compile a special recovery version of the app. Because it permits all paths, if this variant were loaded onto a device and used normally, it could weaken the usual path-restriction protections, but the commit explicitly frames it as a recovery tool and blocks the dangerous AUTOAPPROVE_FOR_PERF_TESTS flag for this variant.

This commit only updates screenshot files used for automated testing of the Ledger Bitcoin app. No application code, firmware, or user-facing behavior was changed. It is not a security fix and does not introduce a vulnerability.