Ledger

Type consistency in psbt_parse_rawtx, and some other hardenings

This commit hardens a Bitcoin transaction parser in Ledger's app. It changes some numeric fields to safer types, adds bounds checks on transaction counts and sizes, rejects extra trailing bytes after a transaction, checks a previously-igno…

Display total amount of external inputs when reliable

This commit changes what information the Ledger Bitcoin app shows on its screen when signing a transaction that includes 'external inputs'—coins the user did not provide and whose amounts the device cannot independently verify. Previously …

Trustworthy sign_psbt amount/fee display for non-default sighash: snapshots

This commit only updates test screenshot snapshots for the Ledger Bitcoin app. It does not change any application source code, so it cannot directly fix or introduce a security vulnerability in the shipped app. The snapshots reflect new ex…

Trustworthy sign_psbt amount/fee display for non-default sighash: integration tests

This commit only adds and updates automated integration tests for the Ledger Bitcoin app. It does not change the app's actual signing code. The tests verify that the device now shows clearer, more trustworthy on-screen amount and fee infor…

Trustworthy sign_psbt amount/fee display for non-default sighash: unit-tests

This commit only adds new automated unit tests for functions that decide how transaction amounts and fees are displayed on a Ledger device when signing a Bitcoin transaction with non-standard signature hash (sighash) modes. It does not cha…

Trustworthy sign_psbt amount/fee display for non-default sighash: implementation

This commit changes how the Ledger Bitcoin app shows transaction amounts and fees on the device screen when a user signs a transaction that does not use the normal 'sign everything' rule (a so-called non-default sighash). Previously the ap…

Remove initial search for sentinel

This commit is a small code cleanup in the Ledger Bitcoin app. It removes an initial loop that counted commands and instead checks for the end marker directly while processing. The author says the old loop was unnecessary and caused a harm…

Add support for generating PSBTs for MuSig2 in txmaker

This commit adds test-only helper code for creating Bitcoin transaction fixtures that support newer wallet types (MuSig2 multi-signature and several legacy/wrapped SegWit descriptor forms). It is not a change to the Ledger app firmware its…

Link unit tests with speculos implementations of crypto syscalls

This commit is purely about improving the project's automated test setup. It links unit tests to a software simulator (Speculos) so cryptographic code can be tested on a regular computer without a physical Ledger device. It adds tests for …

Get rid of SKIP_FOR_CMOCKA; compile tests with the speculos bridge

This commit is purely a testing infrastructure cleanup. It removes a workaround called SKIP_FOR_CMOCKA that previously hid parts of the code from unit tests, and instead compiles those parts using a more realistic emulator bridge (speculos…

Add utilities to parse serialized PSBTs and mock its maps; added unit tests for extract_bip32_derivation

This commit only adds new unit-test helper code and test cases. It does not change the actual Ledger Bitcoin app that runs on the device, nor does it fix or alter any production security logic. The new files parse PSBT data and mock dispat…

Move some duplicated mocking code to headers

This commit is a routine cleanup of the project's unit-test code. It removes duplicate mock implementations of a small helper function called `pic()` from 14 test files and places a single shared version in a mock header. The change only a…

Improve signing performance in case of several internal keys

This commit is a performance optimization for the Ledger Bitcoin app. It reorders nested loops in two signing-related functions so that the app reads each transaction input's data once and then processes all relevant internal keys, rather …

Ensure the version of the transaction is 2 for all e2e tests

This commit only changes automated test files. It forces the test transactions to use Bitcoin transaction version 2 so that a test helper called combinepsbt works correctly. There is no change to the actual Ledger app code that users run, …

Add account context struct in sign_psbt

This commit is a straightforward internal code cleanup in Ledger's Bitcoin app. It groups several pieces of wallet-policy data into a new 'account context' structure and updates all references accordingly. There is no change to how transac…

Partition sign_psbt.c into smaller submodules

This commit is a large but purely structural code cleanup: it splits the single large sign_psbt.c file into many smaller, focused source files under src/handler/sign_psbt/. The actual logic, function bodies, validation checks, and security…

Partition init_global_state into smaller functions

This commit is a straightforward internal code cleanup: it splits one large function into three smaller, well-documented helper functions and moves one data field into a shared state structure. There is no change to what the code checks, a…

Parse unknown yielded tags in python client for sign_psbt

This is a small defensive update to the Python companion library for Ledger's Bitcoin app. It changes how the client handles unexpected data returned by a future version of the hardware app, so that the data is labeled as 'unknown' rather …

Add sign_psbt test for MuSig round 1 and 2

This commit only adds new test cases for an existing feature (MuSig multi-signature signing) in the Rust client test suite. It does not change any production code, cryptographic logic, or application behavior. The changes are purely in tes…

Generalize return value of sign_psbt in the Rust client

This commit is a routine API update for the Ledger Bitcoin app's Rust client library. It changes what kind of data the library returns when a user signs a Bitcoin transaction (PSBT), so it can also return MuSig2 multi-signature material (p…