Ledger Bitcoin app

This commit fixes a type mismatch in the Ledger Bitcoin app's swap verification code. The lengths of Bitcoin addresses were being stored in small signed/char variables instead of the proper unsigned size type. For extremely long strings this could in theory cause the comparison to misbehave, but in practice Bitcoin addresses are short enough that the bug is unlikely to be exploitable. It is a hardening fix rather than a clear vulnerability.

This commit fixes a small coding issue in the Ledger Bitcoin app's transaction-signing code. Two local variables that previously had no starting value are now initialized to zero. In some code paths, these variables could have been used before being set, which might lead to incorrect checks when validating special 'OP_RETURN' outputs used in cryptocurrency swaps. The change is defensive and reduces the risk of unpredictable behavior, but the commit message does not claim it fixes an active security bug.

This commit is mostly a renaming exercise: functions that started with 'io_' in the Ledger Bitcoin app now start with 'ioe_' to avoid clashing with the operating system's own 'io_' functions. Alongside the rename, one small logic fix was made in the response-buffering code. Previously, when adding response data that was too large, the code could pass a negative length to a recursive call, which is unsafe. The new code computes how much space remains, copies only that amount, and then marks the response as too long. This is a defensive improvement, not an active vulnerability fix for a known exploit.

This commit only changes how test helper scripts locate and import other test code. It makes the test utilities work regardless of which folder a script is run from. There is no change to the actual Ledger Bitcoin app, wallet logic, or anything end users interact with.

This commit only changes code comments to make them clearer and more concise. No actual program logic, checks, or behavior were modified. It is not a security fix.

This commit removes one duplicated line from a code formatting configuration file (.clang-format). It does not change any program code, security logic, or behavior of the Ledger Bitcoin app. There is no security relevance.

This commit adds safety checks to the Ledger Bitcoin app so that the 'older(n)' time-lock feature can only use values that actually have meaning under Bitcoin's consensus rules. Before this fix, a user could be shown a wallet policy with a value like older(65536), which looks like a real time-lock but behaves like no time-lock at all. That could trick a user into believing funds are locked when they are not. The patch rejects such misleading values.

This commit adds a new internal utility function that walks through Bitcoin descriptor/miniscript trees node by node, plus unit tests. It does not change any existing behavior or fix a known bug; it simply provides a generic traversal helper that other code can use later. There is no indication this is a security patch.

This commit only adds a new automated test file. It does not change the actual Ledger Bitcoin app code. The test checks that the app correctly rejects wallet policies containing relative timelock values that are outside the allowed range. Because no application code is modified, this commit by itself does not introduce or fix a security vulnerability. It is a test-only change that documents expected behavior for an existing validation rule.

This commit only adds a new automated test and slightly modifies existing test helper functions. It does not change the actual Ledger Bitcoin app code that users run. The new test checks that the app accepts certain extreme but valid relative timelock values when registering a wallet policy. There is no fix or behavior change to the secure firmware itself.

This commit only adds a new unit test to the Ledger Bitcoin app. It does not change any production code. The test checks that a specific type of Bitcoin Miniscript expression is correctly classified as not 'non-malleable' (NONMAL). Because no actual wallet or signing logic is modified, this change by itself does not introduce or fix a live security vulnerability.

This commit fixes a logic bug in the Ledger Bitcoin app's Miniscript policy analyzer. The code that decides whether a Bitcoin spending policy is 'm' (a technical property used during transaction signing) was checking the wrong counter. It now also requires that all sub-policies satisfy the 'm' property, not just the 'e' property. This could have caused the device to incorrectly approve or classify a Bitcoin transaction policy, potentially leading to wrong security assumptions during wallet operations.

This commit simply removes an unused local variable named key_expression_index from a single function. It does not change program behavior, fix a bug, or alter any security logic. There is no security relevance.

This commit fixes a missing check in the Ledger Bitcoin app. A function that streams a transaction 'preimage' (a piece of data used to authorize Bitcoin transactions) did not reject the case where the caller asks to stream zero bytes. The fix now returns an error if the requested chunk size is zero, preventing possible downstream confusion or unsafe behavior. The change is small and defensive; the commit message does not describe any active exploit or security incident.

This commit is a defensive cleanup for the MuSig2 multi-signature code in Ledger's Bitcoin app. It makes sure that temporary memory holding secret nonce values and randomness is wiped clean even when things go wrong, not just on the happy path. The change reduces the chance that sensitive signing material could be left behind in device memory after an error, but it does not appear to fix an active remote exploit by itself.

This commit fixes a bug in the Ledger Bitcoin app where several functions checked for only one specific error value (-1) instead of treating any negative number as a failure. If the underlying helper can return other negative error codes, the old code would have ignored them, potentially causing the app to keep processing with invalid or missing data. The patch makes the error handling more robust by rejecting any negative return value.

This commit only fixes spelling mistakes and minor formatting in documentation files. There are no code changes, no security fixes, and no behavior changes. It is purely a cleanup of typos like 'comand' to 'command' and 'ore' to 'or'.

This commit is a routine code cleanup that renames and consolidates helper functions used to send response messages from the Ledger Bitcoin app. It removes a few redundant wrapper functions and updates the documentation comments. There is no indication of a security fix or behavior change.

This commit refactors the Ledger Bitcoin app to use the newer Ledger SDK 'standard app' framework for main I/O loops and swap (exchange) integration. It removes a lot of custom boilerplate code and replaces it with SDK-provided equivalents. The change also enables the SWAP feature by default in the Makefile. There is no direct evidence in the diff of a security vulnerability being fixed; it appears to be a modernization and code-cleanup change. However, because it touches core app lifecycle, I/O, and swap handling code, any mistake in the transition could affect app stability or swap security.

This commit only changes the project's GitHub Actions workflow file. It replaces an inline CodeQL security-scanning job with a call to a shared, reusable workflow maintained by Ledger. No application source code, cryptographic logic, or user-facing behavior is modified. There is no direct security vulnerability in this change.

This commit only reorganizes how automated unit tests are run in the project's GitHub CI pipeline. It removes the inline unit-test job from one workflow file and replaces it with a call to a shared Ledger reusable workflow. No application code, cryptographic logic, or user-facing behavior was changed. There is no security-relevant change visible in the diff.

This commit only adds documentation to the README explaining how maintainers should create release tags to trigger automatic publishing of the Python, JavaScript, and Rust client packages. No code, configuration, or security behavior was changed.

This commit is a routine packaging and publishing cleanup for the JavaScript client. It renames the npm package from 'ledger-bitcoin' to '@ledgerhq/ledger-bitcoin', updates the README and package-lock.json accordingly, and moves the JS client deployment from a separate workflow triggered on pushes to the 'develop' branch into the main CI workflow triggered only by tags starting with 'jsclient-'. There is no change to the Bitcoin app firmware, cryptographic code, or any user-facing security behavior.

This commit is a routine version bump from 2.4.4 to 2.4.5. It only updates the version number in the Makefile and adds a changelog entry describing unrelated feature and bug-fix changes. There is no code change in this commit itself, and nothing in the diff indicates a security vulnerability or security fix.

This commit only updates test snapshot images used by an automated testing framework called Ragger. These are reference screenshots of Ledger device screens during tests. No application code, firmware, or user-facing behavior was changed, so this has no security relevance on its own.