CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 15 Bitcoin

undo-gold-rc

CK8d6ce99c View source ↗
Public commit record

What the developer wrote

Authored by Peter D. Gray

28/100 · Opaque
undo-gold-rc
✓ Subject identifies a change! No meaningful explanatory body
The short version

What changed, and why it matters

This commit simply removes the digital signatures and file hashes for a previously listed firmware release (version 5.4.4 for Mk4 and 1.3.4Q for Q1) from the project's release signatures file, and updates the PGP signature covering that file. It is a release-management rollback of a 'gold' release candidate, not a code change. There is no firmware source code modification, no bug fix, and no security patch in this commit.

Recommended action

No security action is required for this commit itself. Users who may have already downloaded the retracted v5.4.4 / v1.3.4Q firmware files should follow any guidance Coinkite publishes separately about why the release candidate was undone and whether they should reinstall an earlier signed release.

Security signals we found

No strong security signals were identified.

Risk score

Why this scored 15/100

Our methodology →
Potential impact 0/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 0/15
Confidence 10/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from COLDCARD firmware

Related watches

Moderate 59 AI analysisMessage 28 · Opaque
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Harden PSBTv2 parsing

This commit tightens how COLDCARD reads PSBTv2 (Partially Signed Bitcoin Transaction version 2) files. It now rejects several malformed or ambiguous encodings that could previously be accepted: extra key data attached to fields that should…

PSBT parser hardeningrejection of non-canonical compact-size encodingsenforcement of singleton key-data emptiness
5e0dbd0eby scgbckbone+90−113 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 45 · Thin
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

PSBTv2 per input required lock time calculation

This commit adds support in the COLDCARD firmware for a newer Bitcoin transaction format feature (PSBTv2) that lets each input specify its own required lock time. Before this change, the device did not correctly compute the final transacti…

PSBTv2 per-input locktime parsing and validation addedBIP-370 required locktime computation implementedIncompatible height/time locktime requirements rejected with assertion
2ea2e791by scgbckbone+191−336 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 91 · Strong
CK CoinkiteCOLDCARD firmware BitcoinHardware wallets

Add regression test for non-object JSON message-sign input

This commit only adds a new automated test to the COLDCARD firmware test suite. The test checks that when a user tries to sign a text file containing valid JSON that is not a JSON object (for example, a plain number, string, null, or list)…

Regression test for input validation of JSON message-signingTest comment explicitly references avoiding a device crash on malformed JSON inputTest requested during review of pull request #808, suggesting prior related code change
adb7baa8by copilot-swe-agent[bot]+32−01 file
No security note in commit
Open full analysis →Source commit ↗