Public commit record
61/100 · Adequate
What the developer wrote
Authored by Marko Bencun
releases: add v9.25.0
Since 011c8aa893dcf48e47268de0f52a839ee8fbc4eb we don't tag and release the
bitcoin-only variant separately anymore, so in the releases folder we
also consolidate both into one folder for consistency. This way we can
link to one folder from the release page, which now contains both variants.
✓ Subject identifies a change✓ Names a concrete action or component✓ Provides detailed explanatory context
What changed, and why it matters
This commit is a routine release packaging update. It adds the signed build reproducibility assertions for BitBox02 firmware version 9.25.0 (both the multi-coin and Bitcoin-only variants) and updates the helper script and documentation to handle a new naming scheme where the product name is included in the assertion filename. There is no code change to the firmware itself and no security vulnerability is introduced or fixed.
Recommended action
No security action required. This is a release packaging and documentation update. Reviewers may optionally verify the GPG signatures and reproducible build hashes if performing release auditing.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit adds release artifacts under releases/firmware-v9.25.0/: assertion-bitbox02-multi.txt, assertion-bitbox02-btconly.txt, and detached GPG signatures by benma for each. It also updates .ci/check-release-sigs to verify signatures against assertion*.txt files matching assertion-
Changed components
releases/firmware-v9.25.0/assertion-bitbox02-multi.txtreleases/firmware-v9.25.0/assertion-bitbox02-btconly.txtreleases/firmware-v9.25.0/assertion-bitbox02-multi-benma.sigreleases/firmware-v9.25.0/assertion-bitbox02-btconly-benma.sig.ci/check-release-sigsreleases/README.mdInspect captured patch +49 / −11
diff --git a/.ci/check-release-sigs b/.ci/check-release-sigs
index c2ce0a0..1b4360e 100755
--- a/.ci/check-release-sigs
+++ b/.ci/check-release-sigs
@@ -6,8 +6,14 @@ set -x
# Import all keys
find ./releases/pubkeys -name '*.asc' -exec gpg --quiet --import {} \;
-# Verify all sigs.
-find ./releases -name '*.sig' |
- while read file; do
- gpg --verify $file $(dirname $file)/assertion.txt 2>/dev/null
+# Verify all sigs. Find all assertion files - both old formats (just assertion.txt until v9.24.0)
+# and new formats (assertion-<product>.txt from v9.25.0)
+find ./releases -name 'assertion*.txt' | while read assertion_file; do
+ assertion_name=$(basename "$assertion_file" .txt)
+ dir=$(dirname "$assertion_file")
+
+ # Find all corresponding signature files
+ find "$dir" -name "${assertion_name}-*.sig" | while read sig_file; do
+ gpg --verify "$sig_file" "$assertion_file" 2>/dev/null
done
+done
diff --git a/releases/README.md b/releases/README.md
index 3808ff7..a8c9668 100644
--- a/releases/README.md
+++ b/releases/README.md
@@ -40,6 +40,15 @@ gpg --import pubkeys/benma.asc
gpg --verify assertion-benma.sig assertion.txt
```
+From v9.25.0, the assertion filename contains the product name:
+
+```sh
+cd firmware-v9.25.0/
+# import any missing public keys
+gpg --import pubkeys/benma.asc
+gpg --verify assertion-bitbox02-multi-benma.sig assertion-bitbox02-multi.txt
+```
+
A valid signature means that the signer confirms that they could reproduce the binary from the
stated version tag.
@@ -82,8 +91,10 @@ Run `./build.sh <version tag> <make command>`, e.g.:
```sh
./build.sh firmware/v4.1.0 "make firmware"
-# or Bitcoin-only:
-./build.sh firmware-btc-only/v4.1.0 "make firmware-btc"
+# or Bitcoin-only, from v9.25.0:
+./build.sh firmware/v9.25.0 "make firmware-btc"
+# or Bitcoin-only, until v9.24.0:
+./build.sh firmware-btc-only/v9.24.0 "make firmware-btc"
```
This script is very simple and you can review it or run all the steps inside manually.
@@ -101,13 +112,18 @@ shasum -a 256 temp/build/bin/firmware-btc.bin # bitcoin-only firmware
### Contributing your signature
-Please inspect the `assertion.txt` in the relevant subfolder,
-e.g. [firmware-v4.1.0/assertion.txt](firmware-v4.1.0/assertion.txt). If you agree to its contents
-and verified that the sha256 hash therein matches the one you got, please sign the file using:
+Please inspect the `assertion-bitbox02-multi.txt`/`assertion-bitbox02-btconly.txt` in the relevant
+subfolder, e.g.
+[firmware-v9.25.0/assertion-bitbox02-multi.txt](firmware-v9.25.0/assertion-bitbox02-multi.txt). If
+you agree to its contents and verified that the sha256 hash therein matches the one you got, please
+sign the file using:
```sh
-cd firmware/v4.1.0 # go to the relevant subfolder
-gpg -o assertion-YOURNAME.sig --detach-sign assertion.txt
+cd firmware/v9.25.0 # go to the relevant subfolder
+# For BitBox02 Multi
+gpg -o assertion-bitbox02-multi-YOURNAME.sig --detach-sign assertion-bitbox02-multi.txt
+# For BitBox02 Bitcoin-only
+gpg -o assertion-bitbox02-btconly-YOURNAME.sig --detach-sign assertion-bitbox02-btconly.txt
```
Open a PR adding your signature file to this folder. Also add your pgp pubkey to the
diff --git a/releases/firmware-v9.25.0/assertion-bitbox02-btconly-benma.sig b/releases/firmware-v9.25.0/assertion-bitbox02-btconly-benma.sig
new file mode 100644
index 0000000..bc4c5c3
Binary files /dev/null and b/releases/firmware-v9.25.0/assertion-bitbox02-btconly-benma.sig differ
diff --git a/releases/firmware-v9.25.0/assertion-bitbox02-btconly.txt b/releases/firmware-v9.25.0/assertion-bitbox02-btconly.txt
new file mode 100644
index 0000000..9756b86
--- /dev/null
+++ b/releases/firmware-v9.25.0/assertion-bitbox02-btconly.txt
@@ -0,0 +1,8 @@
+By signing this file, the signer confirms that the BitBox02 Bitcoin-only firmware binary built from:
+
+git tag firmware/v9.25.0
+git commit hash cd0c909b8b6788097ec745304d88e28c2aef8ca4
+
+resulted, at the time of signing, in a firmware binary file with the following sha256sum:
+
+865466b1c35eebf0d5c9bb7f38b19ef49355258aa510657776835d2ce5ca42a4
diff --git a/releases/firmware-v9.25.0/assertion-bitbox02-multi-benma.sig b/releases/firmware-v9.25.0/assertion-bitbox02-multi-benma.sig
new file mode 100644
index 0000000..7720609
Binary files /dev/null and b/releases/firmware-v9.25.0/assertion-bitbox02-multi-benma.sig differ
diff --git a/releases/firmware-v9.25.0/assertion-bitbox02-multi.txt b/releases/firmware-v9.25.0/assertion-bitbox02-multi.txt
new file mode 100644
index 0000000..6effbae
--- /dev/null
+++ b/releases/firmware-v9.25.0/assertion-bitbox02-multi.txt
@@ -0,0 +1,8 @@
+By signing this file, the signer confirms that the BitBox02 Multi firmware binary built from:
+
+git tag firmware/v9.25.0
+git commit hash cd0c909b8b6788097ec745304d88e28c2aef8ca4
+
+resulted, at the time of signing, in a firmware binary file with the following sha256sum:
+
+f11b51435ca1a184328d8485bee5af6fdeccefaea80564efa5c80ce65c8404d0
Risk score
Our methodology →Why this scored 15/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.