What changed, and why it matters
This commit only updates the release signature file. It adds two new firmware file hashes for recently built releases and refreshes the PGP signature that covers the file. There is no code change and no indication of a security fix or vulnerability.
No action required; this is a metadata-only release signing commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies releases/signatures.txt, appending SHA-256 hashes for two new DFU files (v6.6.0X and v6.6.0QX) and replacing the detached PGP signature. No source code, build scripts, or documentation content changed. The signature update is consistent with a routine edge release publication.
Changed components
releases/signatures.txtInspect captured patch +10 / −8
diff --git a/releases/signatures.txt b/releases/signatures.txt
index 70687a1..8926f7d 100644
--- a/releases/signatures.txt
+++ b/releases/signatures.txt
@@ -9,6 +9,8 @@ de6e4d9ea237300cebe7d83510507c76feb2633a39ff22771b5bd64226399f75 History-Mk4.md
a8b437624c9ac551b3be2161879a697bfc606ced856926a37e21fefeed8f570c History-Mk3.md
de6e4d9ea237300cebe7d83510507c76feb2633a39ff22771b5bd64226399f75 History-Mk.md
65730de8566e0f55beceb98692a1c664633532d3787c78d7d68d24618599bb10 ChangeLog.md
+7926e52df838f643bb201a5e4be52a3644c0ed78f1708c1ac231a224eaf34a12 2026-07-31T1608-v6.6.0X-mk-coldcard.dfu
+08e2733623581178a095566a52f9ce2b563bbe4cba71d07f99bdd5d6ea8c1cd6 2026-07-31T1605-v6.6.0QX-q1-coldcard.dfu
a84666a5ca33293c7f633721c2e1d43a00ed6bcb10968acaa63821e725601b7f 2026-07-31T1248-v4.2.0-coldcard.dfu
79e4e7a7dd3facc35f6e96ba5a5e80511cba2b5363e6d5a91553a20e1c579d86 2026-07-31T0518-v5.6.0-mk-coldcard.dfu
6733b600c351b8db2ab85fb27e9e217b161127508609cede4aa1336e3d8a8fa0 2026-07-31T0518-v5.6.0-mk-coldcard-factory.dfu
@@ -138,12 +140,12 @@ f05bc8dfed047c0c0abe5ed60621d2d14899b10717221c4af0942d96a1754f33 2021-03-29T192
bea27f263b524a66b3ed0a58c16805e98be0d7c3db20c2f7aab3238f2c6a6995 2019-12-19T1623-v3.0.6-coldcard.dfu
-----BEGIN PGP SIGNATURE-----
-iQEzBAEBCAAdFiEERYl3mt/BTzMnU06oo6MbrVoqWxAFAmpsonYACgkQo6MbrVoq
-WxAfYgf/Z6JQ4TArz2PDBCkD73hpgvM4lq1uQs6okwGYdufe6SXSBq/7F+BITsYy
-rH88geEdEUnn2m3Fk0OYZQziKxeAVm+6FQUFnYFwH7uIY2V7T5kcHaZwhaKp20Oa
-0iy41DaTkHgNGm6+xFjwN7xbtxW7eaTdPIVwRf7NUFHMdVI7PeZAIzgaFsd1MwMM
-qZQFrBNDE5VQyX2MyRv9r8OAdnuIJwaFo30KujxDr68onTwQ+ipR8QR6MirlN5/a
-b/4ZsR0QvzWwDdnr8UiATmN/mwR8A8Uu1C8eJM7eGIbTTeVmHkuwVgdBmU6coPYv
-NdbDgcfP4qiO34QaVDtJu2rjXMYVNg==
-=koqD
+iQEzBAEBCAAdFiEERYl3mt/BTzMnU06oo6MbrVoqWxAFAmpszhEACgkQo6MbrVoq
+WxC55QgAsqhqgKCVfGtccuNRYlF+zn3rdr6ALfvwbFW1YZHq0fG0NTuDD7GNgwCl
+U6+uSL1J1Ujc7Ddp/fMF1J7OzVflFqh1Vz6nfdWuw46ck49S6orpaTh0vYoV1nxN
+R09HUDVtED57ZPAvBoywxpF8BLrUaP90zeW2ESGJM2RTtk6TXJG6bEA1kfBynT2i
+3WR48UggRVnQgPa1kOXVAUf0YwagSRmeLlOGCbTkFkUL68ulIRlFgFvBmEaRMDaJ
+82zS5dvOSSUIbtmvWdZ1dC6wEDUzfg/8+oaxNxFHjYU2D3MBqqlAIbEYW/JiQg55
+T6CnVeDfthDisms4pTpbNvvLdtUckg==
+=muho
-----END PGP SIGNATURE-----
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.