bitbox02: Implement register_descriptor
What the developer wrote
Authored by Ava Chow
bitbox02: Implement register_descriptor
What changed, and why it matters
This commit adds a new feature to the BitBox02 hardware wallet driver in HWI that lets users register a Bitcoin output descriptor (a recipe for wallet addresses) on the device. The change itself is a straightforward feature implementation and does not appear to fix a security bug. There is no evidence in the commit or supplied references that this is a security patch or that it addresses any disclosed vulnerability.
No immediate security action required. Treat as a normal feature commit. If reviewing for security, verify that _bip388_script_config correctly handles malformed descriptors and that the bitbox02 library validates the policy template and key origins before registering on the device, but this is outside the scope of the diff evidence.
Security signals we found
No security-relevant signals in commit message or diff
Feature addition: register_descriptor support for BitBox02
No bug fix, bounds check, input validation, or privilege change evident
No references to CVEs, advisories, or security disclosures
Evidence from the diff
The patch implements register_descriptor for the bitbox02 device class. It adds a helper _bip388_script_config that converts a generic Descriptor into a bitbox02.btc.BTCScriptConfig using BIP-388 policy templates, and a register_descriptor method that registers the resulting script config on the device via _maybe_register_script_config. _maybe_register_script_config is also updated to accept an optional name parameter, with an empty string preserving the prior behavior of prompting the user on the device. The change is additive and does not modify existing security-critical logic beyond passing a name through.
Changed components
hwilib/devices/bitbox02.pyBitBox02 hardware wallet driverDescriptor registration workflowInspect captured patch +27 / −3
### hwilib/devices/bitbox02.py
@@ -23,7 +23,11 @@
from functools import wraps
from .._base58 import decode_check, encode_check
-from ..descriptor import MultisigDescriptor
+from ..descriptor import (
+ Descriptor,
+ MultisigDescriptor,
+ RegisteredDescriptor,
+)
from ..hwwclient import HardwareWalletClient
from ..key import ExtendedKey
from .._script import (
@@ -423,7 +427,7 @@ def get_pubkey_at_path(self, bip32_path: str) -> ExtendedKey:
return xpub
def _maybe_register_script_config(
- self, script_config: bitbox02.btc.BTCScriptConfig, keypath: Sequence[int]
+ self, script_config: bitbox02.btc.BTCScriptConfig, keypath: Sequence[int], name: str = ""
) -> None:
bb02 = self.init()
is_registered = bb02.btc_is_script_config_registered(
@@ -434,7 +438,7 @@ def _maybe_register_script_config(
coin=self._get_coin(),
script_config=script_config,
keypath=keypath,
- name="", # enter name on the device
+ name=name, # Default empty string means enter name on the device
xpub_type=bitbox02.btc.BTCRegisterScriptConfigRequest.AUTO_XPUB_TPUB,
)
@@ -962,3 +966,23 @@ def can_sign_taproot(self) -> bool:
:returns: False, always
"""
return False
+
+ def _bip388_script_config(self, descriptor: Descriptor) -> bitbox02.btc.BTCScriptConfig:
+ desc_keys = []
+ for pk in descriptor.get_pubkey_providers():
+ desc_keys.append(bitbox02.common.KeyOriginInfo(
+ root_fingerprint=pk.origin.fingerprint if pk.origin else b"",
+ keypath=pk.origin.path if pk.origin else None,
+ xpub=util.parse_xpub(pk.pubkey)
+ ))
+ policy = bitbox02.btc.BTCScriptConfig.Policy(
+ policy=descriptor.get_bip388_template(),
+ keys=desc_keys,
+ )
+ return bitbox02.btc.BTCScriptConfig(policy=policy)
+
+ @bitbox02_exception
+ def register_descriptor(self, name: str, descriptor: 'Descriptor') -> RegisteredDescriptor:
+ script_config = self._bip388_script_config(descriptor)
+ self._maybe_register_script_config(script_config, [], name)
+ return RegisteredDescriptor(name=name, descriptor=descriptor, device_type="bitbox02", registration=b"")Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.