What changed, and why it matters
This commit only updates the release signature file. It adds two new cryptographic hashes for recently built firmware files and refreshes the PGP signature that covers the whole file. There are no code changes, no bug fixes, and no security-relevant behavior changes in the firmware itself.
No action required; verify the new PGP signature and hashes if performing supply-chain audit of release artifacts.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies releases/signatures.txt: it appends SHA-256 hashes for 2026-v5.6.3-mk-coldcard.dfu and 2026-v5.6.3-mk-coldcard-factory.dfu, and updates the detached PGP signature over the file. This is a routine release-signing/attestation commit with no source or binary changes beyond the signature manifest.
Changed components
releases/signatures.txtInspect captured patch +10 / −8
### releases/signatures.txt
@@ -9,6 +9,8 @@ Hash: SHA256
a8b437624c9ac551b3be2161879a697bfc606ced856926a37e21fefeed8f570c History-Mk3.md
084861194d74568648220ec312e8d6505beaa53c8ef33f78f052b4815daeac41 History-Mk.md
59b14359f5feab409b292902512b63f5ceaf1cf16d001e7d39365f1e0211a3b5 ChangeLog.md
+b3a284309d878c489c1233697e0096c0a328e67f2efc3390aaaf494a359c865b 2026-09-30T2026-v5.6.3-mk-coldcard.dfu
+5c05c0b84893fdcd384c59f3124682e915e370dc8dbd44c96b239254216f2fb2 2026-09-30T2026-v5.6.3-mk-coldcard-factory.dfu
66aa6a76ffe17ee53adb7a3278e095da39d32decb71f44e1b20a2ee642a1c74d 2026-09-30T2025-v1.5.3Q-q1-coldcard.dfu
8ecd640fe97d373c2002b5035ae9ba07deb2f9ff50d5291d4fa1500541e4b4b9 2026-09-30T2025-v1.5.3Q-q1-coldcard-factory.dfu
49eb41b6b06c97f2622bc9a7496f9d5d792c0b0906e619ba0ddaf6333b561398 2026-09-03T1541-v5.6.2-mk-coldcard.dfu
@@ -152,12 +154,12 @@ f05bc8dfed047c0c0abe5ed60621d2d14899b10717221c4af0942d96a1754f33 2021-03-29T192
bea27f263b524a66b3ed0a58c16805e98be0d7c3db20c2f7aab3238f2c6a6995 2019-12-19T1623-v3.0.6-coldcard.dfu
-----BEGIN PGP SIGNATURE-----
-iQEzBAEBCAAdFiEERYl3mt/BTzMnU06oo6MbrVoqWxAFAmq9cDsACgkQo6MbrVoq
-WxB2Twf8DOuTYtEQXu7YBa9RgIyp26yn+DgeI70+57WF5bHrWwT6fNTIf0PESSD6
-xeM763VXu8hjSiHo55DZB1OCVhW2kj2DcXmy9cNl2I1dPT411clv5GQLv5pwSW4f
-qyNs2F1PzS/MrcI9ciP/sHOy66H5lfek7t1G3EdOYandx5aWzmZS4slLMQGP7jzC
-wh5QwvQlOs+seqC0SrVMLpW5Fp8EK8nI71bB0SxUgj3odX+qcZc7SsPsNg4NXBAD
-h5F2rLfDshD2UVXDAiqUM73vM0qjvy8fSRbhv8rUdH5spyF2zhvenbpiqeMNnHcl
-PUSWGqXq78XOI0U0jCc+xn5hYUOwqQ==
-=BfV7
+iQEzBAEBCAAdFiEERYl3mt/BTzMnU06oo6MbrVoqWxAFAmq9cJQACgkQo6MbrVoq
+WxDr1AgAn1XEf3RG7k0Bq7uSHOOkylGcpLXbSmE6LA+Gc8zAy9HaE6HeZzlHU1Pk
+A//lkyM0FwIm6YoZ8+Iw1zpucYVFIwf3jl/hdZ2PXFcnhlq5RrxK17KtWyRaOBc3
++JoihQrl2ep7pDqCZTMv3LmdZ8gxyVOPx7f1DYle6JyLQtKejMg5eRJCQ0aQbJIb
+tAzeZAIF3jxkBz8mILV0lzzTxQ9Sxi3Pat2j2JaLUDg143AyNPUeE9TzURyAhLBr
+j2LErQyP0zrQ3aeX2OkuEKyAK+3IHYM2j21TEvHle1vd1zJnYt7gdCWDVTNjHPgA
+PxNst+ZB6Np1kz5MJmbaM39SegatRw==
+=lZF7
-----END PGP SIGNATURE-----Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.