Ledger Bitcoin app

This commit fixes how Ledger's Bitcoin client libraries convert older PSBTv0 transaction data into the newer PSBTv2 format that Ledger hardware wallets expect. The changes correct several field-handling bugs: the transaction locktime is now written to the right place, missing input sequence numbers are treated as the default final value, and the Rust client now forwards unknown PSBTv2 fields (such as required locktimes) instead of dropping them. It also rejects malformed PSBTs where v0 and v2 fields contradict each other, rather than producing an invalid PSBT that the device would refuse. These are client-side robustness fixes; they do not appear to be a security patch for the device firmware itself.

This commit only updates a version number from 0.6.2 to 0.7.0 in two Rust package files. It is a routine bookkeeping change because the public interface of the PSBT module changed, requiring a minor version bump under semantic versioning rules. No code behavior changes are present in the diff.

This commit only changes hardcoded test data used in JavaScript unit tests. It removes an invalid zero-value locktime field from two PSBT (Partially Signed Bitcoin Transaction) test fixtures so they conform to the BIP-370 standard. No production code, device firmware, or user-facing behavior is changed.

This commit fixes three bugs in a Python helper that converts modern PSBTv2 transaction data into the older PSBTv0 format used by Ledger hardware wallets. The bugs could silently corrupt the transaction's lock time and version fields during conversion, which might alter when a transaction becomes valid or what transaction format the device signs. The fixes ensure the correct values are copied before they are erased. There is no direct evidence this was exploitable as a security attack, but it could cause unexpected or invalid signatures in wallet software relying on this library.

This commit refactors how the Ledger Bitcoin app's Rust client converts a PSBT (Partially Signed Bitcoin Transaction) from version 0 to version 2. Previously, the code manually listed every PSBT field it knew how to serialize, which risked silently dropping newer or unknown fields. The new code lets the rust-bitcoin library do most of the serialization, then only adds, removes, or changes the specific fields that differ between v0 and v2. It also adds checks that reject malformed PSBTs where v2 fields already exist and conflict with the v0 transaction data. The change is a defensive cleanup that reduces the chance of an incomplete or inconsistent PSBT being sent to the hardware wallet.

This commit removes an old memory workaround in Ledger's Bitcoin app. Previously, a large data structure used during transaction signing was stored in global memory instead of on the function's stack, because some Ledger devices were thought to have only 8 KB of stack space. The update increases the allowed stack size for the Nano X and moves that data structure back onto the stack. This is a routine code cleanup, but it changes how memory is allocated during the most memory-intensive signing operation. If the new stack limit is slightly wrong, it could in theory cause stack overflows or memory corruption during signing on a Nano X.

This commit simply renames an internal Python package from `embit` to `_embit` (a common convention indicating it is private/implementation detail) and updates all import statements accordingly. There is no functional code change and no security fix or vulnerability present in the diff.

This commit changes a JavaScript package dependency from allowing any compatible 3.x version of @bitcoinerlab/descriptors to a fixed, exact version (3.1.7). Pinning a dependency is often done to prevent unexpected future changes, but the commit itself does not say whether it fixes a security bug. It is a routine dependency-management change with no direct evidence of a vulnerability being patched.

This commit fixes a boundary-check bug in how the Ledger Bitcoin app parses wallet policies (BIP-388). The app was supposed to reject any hardened derivation step in a specific range expression, but it allowed the value 2147483648 (0x80000000) because the check used 'greater than' instead of 'greater than or equal to'. That value actually represents a hardened step, which is forbidden here. The fix changes the comparison so 0x80000000 is correctly rejected. If accepted, it could later cause address derivation or signing to fail or behave unexpectedly.

This commit simply renames a vendored (internally bundled) copy of the 'embit' library inside the Python client from `embit` to `_embit`. The leading underscore is a Python convention meaning 'private/internal use only.' No code behavior changes; only import paths are updated. There is no security fix or vulnerability here.

This commit adds a memory wipe of a cryptographic hash context after it is used to derive a secret random value in the Ledger Bitcoin app's MuSig multi-signature code. The change is described by the developer as a 'defense-in-depth' measure: once partial signatures are public, the internal randomness used to create them becomes sensitive, and leftover data in memory could theoretically help an attacker if they later gained access to the device's memory. There is no evidence this issue was exploited or publicly disclosed as a security vulnerability.

This commit tightens checks in a Ledger Bitcoin app function that converts compressed public keys into full (x,y) public key points. Previously, the code did not verify that the supplied x-coordinate is a valid field element (less than the curve prime p) and did not confirm that the computed y really satisfies the secp256k1 curve equation. The patch adds both checks, rejecting malformed keys. Without these checks, a specially crafted compressed key could cause the function to produce a point that is not actually on the Bitcoin curve, which could then be used in subsequent cryptographic operations in unexpected ways.

This commit only adds new automated tests for an existing cryptography helper function. It does not change the actual app code that runs on Ledger devices, so it cannot by itself introduce or fix a security bug. The commit message notes that some of the new tests check failure cases that will be addressed in a later commit.

This commit fixes a spot in the Ledger Bitcoin app where a function that converts a compressed public key to an uncompressed one was called without checking whether it succeeded. Before the fix, if the conversion failed, the code would keep going with potentially invalid data. After the fix, the function's return value is checked and the operation aborts with an error if something went wrong. The change is small and defensive, but it removes a silent-failure path in cryptographic key derivation.

This commit is a routine code cleanup. It removes an unused SDK include path from the build configuration and deletes several unused header imports in a source file. There is no functional change and no security issue is indicated.

This commit is a straightforward internal code cleanup: it moves a temporary data cache used during Bitcoin transaction signing from a permanent global variable into a local stack variable inside the signing function. The change frees about 2.5 KB of always-reserved RAM and is described by the developer as removing an old workaround for a device stack-size limit that no longer exists. There is no indication in the commit that this fixes a security bug or changes behavior visible to users or attackers.

This commit hardens Ledger's Bitcoin app so that when it asks the host computer for Merkle-tree data and the request fails or the data is rejected, the memory buffer that was supposed to receive the data is wiped clean with zeros. Before the change, an attacker-controlled host could leave chosen bytes in that buffer even after the app decided the data was invalid. The patch is a defense-in-depth measure; it does not by itself fix a known exploitable bug, but it removes a class of subtle mistakes where later code might accidentally trust leftover hostile data.

This commit adds a new developer-only fuzzing test framework to the Ledger Bitcoin app. It does not change how the app behaves on a real device; it only adds automated test infrastructure that feeds random or structured inputs to the app in a simulated environment to help find bugs. There is no indication this commit fixes or introduces a security vulnerability in production code.

This commit is a hardening and refactor of the code that reads PSBT (Partially Signed Bitcoin Transaction) fields from a host computer into a Ledger hardware wallet. The core security fix is that the device now clearly distinguishes between a field that is genuinely missing in a PSBT map and a field that is present but malformed or failed to verify. Previously, both cases could return the same error code, which could trick the wallet into silently using a default value (for example, default nSequence or default locktime) when the host had actually committed to something else. The commit also adds a guard that refuses to look up values by key unless the map's keys have already been proven to be sorted and unique, preventing a malicious host from supplying two different values for the same key.

This commit fixes a security hygiene issue in Ledger's Bitcoin app when reading PSBT (Partially Signed Bitcoin Transaction) data fields. Previously, if a field was missing or malformed, the memory buffer meant to hold the field value could be left containing leftover or partially written data controlled by the host/device communicating with the Ledger. The change ensures the buffer is explicitly wiped to zero and its reported length is reset in those failure cases, so callers cannot accidentally use stale or incorrect data. The commit message itself states this avoids leaving 'host-controlled bytes in memory in cases of failure.'

This commit changes how on-screen text labels are prepared on Ledger's newer Bitcoin app interface. Previously, only the text fields were updated, leaving other hidden struct fields carrying whatever values were left over from earlier screens. The patch now resets the entire struct each time, preventing stale hidden settings (like centered layout flags or icons) from leaking between different app screens. The risk is mainly that a leftover flag could subtly alter what the user sees or how a confirmation page is rendered, potentially confusing a user at the moment they approve a transaction.

This commit is a code cleanup (refactor) in Ledger's Bitcoin app. It moves the logic for reading PSBT (Partially Signed Bitcoin Transaction) fields into dedicated helper functions with clearer success/error/absent status codes. The author explicitly states there is no behavior change; the patch preserves existing handling of two optional fields exactly as before, with fixes for those edge cases planned in a follow-up commit. The changes add unit tests and improve code clarity, but do not by themselves fix a security bug.

This commit fixes a design bug in how the Ledger Bitcoin app asks a connected computer for data stored in a cryptographic map (used for PSBT transaction fields). Previously, 'key genuinely missing' and 'lookup failed due to a bad proof or communication error' were reported the same way. That meant the app could silently apply a default value when it should have rejected a faulty response. The patch separates the two cases so future callers can tell them apart, though existing callers still use the old '< 0' check and are not changed here. The commit also documents that 'missing key' is only what the host claims, not a cryptographic proof.

This commit fixes several low-level programming bugs in Ledger's Bitcoin app that were found by automated fuzzing. The bugs include a dangerous bit shift, a pointless memory move with zero bytes, and incorrect comparisons between signed and unsigned numbers when parsing transaction data and signing PSBTs. Most fixes are defensive hardening, but one change moves a sanity check earlier so the app rejects absurdly large input amounts before adding them up, which could prevent an overflow. The commit does not claim these are directly exploitable attacks, but they remove undefined behavior that could in theory lead to crashes or incorrect signing.

This commit tightens validation of a Bitcoin transaction signing field. The Ledger app previously accepted any non-error value when reading the PSBT_IN_PREVIOUS_TXID field, even if it was shorter or longer than the required 32 bytes. Now it rejects any length other than exactly 32 bytes. An incorrect txid length could let a malformed or malicious PSBT misrepresent which previous transaction is being spent, potentially leading to signing the wrong transaction data.