Ledger Bitcoin app

This commit removes a leftover debugging include from the build and adds a missing standard header to one source file. It is a cleanup/fix for build hygiene, not a security patch for an exploitable vulnerability. There is no evidence in the commit or supplied references that this fixes a security issue.

This commit only adds new automated unit tests for the wallet-registration feature of the Ledger Bitcoin app. It does not change any production code, fix bugs, or alter app behavior. There is no security issue here.

This commit only adds and improves unit tests for the Ledger Bitcoin app. It records what the user-interface confirmation function receives during wallet registration tests, then checks that the app correctly labels each key as internal (ours), external (someone else's), or unspendable. It also adds a new test case for a fingerprint-collision scenario. There is no change to the actual app code that runs on the device, so this is a testing/quality improvement rather than a security fix.

This commit is a test-only refactoring change. It moves existing test data from a private unit-test file into shared TOML files in a new test_vectors/ directory so the same test cases can be reused by Python, C, and future Rust test suites. No application code that runs on the Ledger device was changed, and no security behavior of the app was modified.

This commit only adds and reorganizes unit tests for the get_extended_pubkey feature. It does not change the actual app code that runs on the Ledger device, so it cannot introduce a security vulnerability or fix one in shipped software.

This commit only removes periods at the end of sentences in a test documentation file (test_vectors/README.md). It is a cosmetic formatting change with no effect on code, security, or functionality.

This commit only adds new unit tests for the existing sign_message feature in Ledger's Bitcoin app. It does not change the actual signing code that runs on the device, so it cannot introduce a security vulnerability or fix one by itself. The tests exercise the handler with known test vectors and mock UI approval, and include one extra test for an over-long message length.

This commit only updates test data and documentation for the Bitcoin app's message-signing feature. It documents how the device displays messages (full text versus a hash) and adds matching test expectations. There is no code change and no security fix or vulnerability present in the diff.

This commit turns on a safety feature called the 'stack protector' in the Ledger Bitcoin app's build settings. The stack protector is a compiler guard that helps detect and block certain types of low-level memory attacks (stack buffer overflows) before they can take control of the device. The change itself is a hardening improvement, not a fix for a specific reported bug. It makes future exploitation of stack overflow flaws harder, but it does not remove any underlying vulnerability by itself.

This commit is purely a code-style and formatting update to make the project compile cleanly with the newer clang-21 compiler. It adds or removes spaces inside braces (for example, changing `{0, -1, 0}` to `{ 0, -1, 0 }`) and re-wraps a few long function signatures so they fit on multiple lines. No program logic, security checks, or behavior were changed.

This commit cleans up how a special debug-only printing mode is enabled in the Ledger Bitcoin app. It only affects builds where DEBUG=10 is set, which is intended for use in the Speculos emulator and not on real hardware. The change moves a macro redefinition from the Makefile into a header file and removes an unused HAVE_PRINTF flag. There is no direct security vulnerability visible in the diff, but it touches debug infrastructure that could historically be misused if left enabled in production firmware.

This is a one-line change adding a missing standard C header file (#include <string.h>) to a header file used for the MuSig multi-signature protocol. On its own, the change does not alter program behavior or fix a security flaw; it simply ensures the compiler has access to string-related standard definitions wherever this header is included. It may be a companion to a larger fix, but the diff itself contains no security-relevant logic.

This commit is a routine code cleanup. It removes an unused test helper that set Bitcoin output amounts to zero, and consolidates duplicate placeholder-parsing code into a shared utility module. There is no indication it fixes or introduces a security vulnerability.

This commit only adds new unit tests and test-support code for Bitcoin address generation. It does not change the app that runs on the Ledger device, nor does it fix or introduce any security-relevant behavior. It is a testing/infrastructure change with no direct security impact.

This commit only updates comments and removes a stale TODO marker. No executable code, logic, or security behavior changed.

This commit removes a single line from a GitHub Actions CI workflow file. The removed line disabled a JFrog deployment option for a Python package publishing job. It is a routine build/pipeline configuration fix with no apparent security relevance.

This commit removes a PyPI (Python package publishing) API token from a public GitHub Actions workflow file. The change itself is a cleanup step, likely after the token was exposed or no longer needed. It does not show whether the token was ever valid, leaked, or misused, but removing exposed credentials is a standard security hygiene measure.

This commit is a small performance refactor inside the Ledger Bitcoin app. It moves the calculation of a Taproot tree hash (used for advanced multi-signature scripts) so it only runs when actually needed, rather than once per input unconditionally. There is no direct evidence this fixes a security bug; it appears to be an optimization, though it slightly reduces the chance of unnecessary computation or state errors.

This commit is a straightforward code cleanup: it extracts a repeated block of code into a shared helper function. Two existing functions that previously each had their own nearly identical loop now call the helper instead. There is no change to what the code does, only to how it is organized.

This commit only adds a GitHub CODEOWNERS file that assigns the embedded-apps-bitcoin team as the default reviewer for all changes. It does not modify any application code, build scripts, or security-sensitive configuration.

This commit swaps the library's standard variable-length integer type for a custom one in Ledger's Bitcoin app client code. The change is needed because a newer version of the rust-bitcoin library started rejecting large varints that the Ledger protocol legitimately uses for non-Bitcoin data. The patch itself is a compatibility fix, not an obvious vulnerability, but it removes a safety boundary and any bugs in the new custom encoder/decoder could affect how the client talks to Ledger devices.

This commit removes two lines from a GitHub Actions CI workflow file. It disables a JFrog deployment step and stops passing a Cargo crate publishing token to that workflow job. There is no change to the actual Bitcoin app code, cryptography, or anything users install on their Ledger devices. It is purely an internal adjustment to how a Rust client library crate is published.

This commit fixes a spelling mistake inside a code comment, removing an unnecessary semicolon. It does not change any executable code, logic, or behavior of the Bitcoin app.

This commit only updates automated test screenshot snapshots for Ledger's Bitcoin app. No application code, firmware, or user-facing behavior was changed. It is not a security fix and does not affect real devices or user funds.

This commit fixes a variable type in Ledger's Bitcoin app used during cross-chain cryptocurrency swaps. The amount attached to an OP_RETURN output was being stored in a `size_t` variable, which on Ledger's embedded device is likely 32 bits, while the actual amount is a 64-bit value. This mismatch could cause the amount to be silently truncated (cut off), potentially allowing a swap to be validated with an incorrect amount. The fix changes the variable to `uint64_t` to match the real data size and prevent truncation.