jadepy: allow additional_info for sign_psbt
What the developer wrote
Authored by Jon Griffiths
jadepy: allow additional_info for sign_psbt
What changed, and why it matters
This commit updates the Python library that talks to the Blockstream Jade hardware wallet. It lets callers pass an optional extra data dictionary called additional_info when signing a Bitcoin PSBT, matching a feature already available for Liquid transactions. The change itself just forwards the new parameter to the device; it does not appear to fix or introduce a vulnerability on its own.
No immediate action required. If reviewing further, verify that the Jade firmware's sign_psbt handler validates and constrains additional_info appropriately, since the Python client now forwards it unchecked.
Security signals we found
No security-relevant keywords in commit title or message
No validation logic added for additional_info contents
Feature addition only; no bug fix or hardening visible
No references to CVE, advisory, researcher, or security issue
Evidence from the diff
The diff adds an optional additional_info parameter to JadeAPI.sign_psbt() in jadepy/jade.py. If provided, it is included in the RPC params sent to the Jade firmware via the sign_psbt message. The commit message and diff do not describe any security issue; this is a feature/API parity change aligning sign_psbt with sign_liquid_tx. There is no evidence in the commit of input validation, buffer handling, or authorization changes.
Changed components
jadepy/jade.pyJadeAPI.sign_psbt methodInspect captured patch +6 / −1
diff --git a/jadepy/jade.py b/jadepy/jade.py
index 6ade672..3357ba7 100644
--- a/jadepy/jade.py
+++ b/jadepy/jade.py
@@ -1941,7 +1941,7 @@ class JadeAPI:
# Send inputs and receive signatures
return self._send_tx_inputs(base_id, inputs, use_ae_signatures, use_legacy)
- def sign_psbt(self, network, psbt):
+ def sign_psbt(self, network, psbt, additional_info=None):
"""
RPC call to sign a passed psbt as required
@@ -1953,6 +1953,9 @@ class JadeAPI:
psbt : bytes
The psbt formatted as bytes
+ additional_info: dict, optional
+ Extra data about the transaction. See sign_liquid_tx for details.
+
Returns
-------
bytes
@@ -1960,6 +1963,8 @@ class JadeAPI:
"""
# Send PSBT message
params = {'network': network, 'psbt': psbt}
+ if additional_info:
+ params['additional_info'] = additional_info
msgid = str(random.randint(100000, 999999))
request = self.jade.build_request(msgid, 'sign_psbt', params)
self.jade.write_request(request)
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.