jade_cli: add required arguments to sign_tx
What the developer wrote
Authored by Valerio Vaccaro
jade_cli: add required arguments to sign_tx
What changed, and why it matters
This commit updates the command-line tool for Blockstream Jade hardware wallets so that its 'sign transaction' command now requires additional pieces of information (the transaction inputs and any change output details) and formats its output as JSON. The change appears to be a normal feature/API update rather than a fix for a security vulnerability. There is no evidence in the commit that this was done to address a security issue.
No immediate security action is indicated. Reviewers may want to verify that the updated JadeAPI.sign_tx() signature is correctly documented and that user-provided JSON inputs are validated before being passed to the hardware wallet library, but this is ordinary hardening rather than a response to a disclosed vulnerability.
Security signals we found
No security-related keywords in commit title or message
No CVE, advisory, or researcher attribution present in commit
Change is a CLI argument/API alignment, not a bounds check, validation, or access-control fix
New helper functions are pure data-format converters (hex/bytes/JSON), not sanitizers
Evidence from the diff
The patch modifies jade_cli.py’s sign_tx CLI command. It adds two new positional arguments, ‘inputs’ and ‘change’, parses them from JSON and converts hex strings to bytes via a new h2b() helper, converts the transaction hex to bytes, and passes tx_bytes, inputs_obj, and change_obj to jade.sign_tx(). The result is then converted back to hex strings with a new b2h() helper and printed as JSON. This aligns the CLI with an updated JadeAPI.sign_tx() signature that now expects structured input data. The commit message and diff do not mention any security bug, vulnerability, or reporter.
Changed components
jade_cli.pysign_tx CLI commandInspect captured patch +36 / −3
diff --git a/jade_cli.py b/jade_cli.py
index 474275a..289564d 100755
--- a/jade_cli.py
+++ b/jade_cli.py
@@ -1,6 +1,7 @@
#!/usr/bin/env python
import base64
+import json
import click
import functools
import logging
@@ -10,6 +11,33 @@ import time
from jadepy.jade import JadeAPI
+def h2b(hexdata):
+ if hexdata is None or isinstance(hexdata, (int, bool)):
+ return hexdata
+ if isinstance(hexdata, list):
+ return list(map(h2b, hexdata))
+ if isinstance(hexdata, dict):
+ return {k: h2b(v) for k, v in hexdata.items()}
+ return bytes.fromhex(hexdata)
+
+
+def b2h_impl(obj, leaf_fn):
+ if isinstance(obj, dict):
+ return {k: b2h_impl(v, leaf_fn) for k, v in obj.items()}
+ if isinstance(obj, list):
+ return [b2h_impl(v, leaf_fn) for v in obj]
+ if isinstance(obj, tuple):
+ return tuple(b2h_impl(v, leaf_fn) for v in obj)
+ return leaf_fn(obj)
+
+
+def b2h(result):
+ return b2h_impl(
+ result,
+ lambda v: bytes(v).hex() if isinstance(v, (bytes, bytearray)) else v
+ )
+
+
class JadeClient:
def __init__(self, device='tcp:localhost:30121'):
self.device = device
@@ -151,11 +179,16 @@ def sign_message(jade, path, message, network):
@cli.command()
@click.argument('tx')
+@click.argument('inputs')
+@click.argument('change')
@click.option('--network', default='testnet')
@with_jade_client
-def sign_tx(jade, tx, network):
- result = jade.sign_tx(network, tx)
- click.echo(base64.b64encode(result))
+def sign_tx(jade, tx, inputs, change, network):
+ tx_bytes = bytes.fromhex(tx)
+ inputs_obj = h2b(json.loads(inputs))
+ change_obj = h2b(json.loads(change))
+ result = jade.sign_tx(network, tx_bytes, inputs_obj, change_obj)
+ click.echo(json.dumps(b2h(result)))
@cli.command()
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.