What changed, and why it matters
This commit only updates a signed release manifest file (signatures.txt). It refreshes cryptographic hashes for release notes and adds a new firmware file entry, then re-signs the file with PGP. There is no code change and no security vulnerability is present in the diff.
No action required; this is a routine release-signature update.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies releases/signatures.txt: it updates SHA-256 hashes for History-Mk3.md and ChangeLog.md, adds one new firmware entry (2026-07-31T1248-v4.2.0-coldcard.dfu), and replaces the detached PGP signature. This is a normal release-signing administrative commit with no source-code or firmware-logic changes.
Changed components
releases/signatures.txtInspect captured patch +11 / −10
diff --git a/releases/signatures.txt b/releases/signatures.txt
index 12514e3..70687a1 100644
--- a/releases/signatures.txt
+++ b/releases/signatures.txt
@@ -6,9 +6,10 @@ c0652d1253e5817d1911f2bdc147f53dac764c88d8663d7a446a1a2864853fef Next-ChangeLog
b0e668d3a1b8b202863d178979cdfa059ca5177e91d81edb92c71bccce7ac59d History-Q.md
de6e4d9ea237300cebe7d83510507c76feb2633a39ff22771b5bd64226399f75 History-Mk5.md
de6e4d9ea237300cebe7d83510507c76feb2633a39ff22771b5bd64226399f75 History-Mk4.md
-b93aadf4c12ae853c2eec4f8acf37ab39fdf4064257624d4bb865ce06797988a History-Mk3.md
+a8b437624c9ac551b3be2161879a697bfc606ced856926a37e21fefeed8f570c History-Mk3.md
de6e4d9ea237300cebe7d83510507c76feb2633a39ff22771b5bd64226399f75 History-Mk.md
-dfffd09bf975fa53fc16d288ceda4c3d48abd044efaa31e069de4327b9bb254e ChangeLog.md
+65730de8566e0f55beceb98692a1c664633532d3787c78d7d68d24618599bb10 ChangeLog.md
+a84666a5ca33293c7f633721c2e1d43a00ed6bcb10968acaa63821e725601b7f 2026-07-31T1248-v4.2.0-coldcard.dfu
79e4e7a7dd3facc35f6e96ba5a5e80511cba2b5363e6d5a91553a20e1c579d86 2026-07-31T0518-v5.6.0-mk-coldcard.dfu
6733b600c351b8db2ab85fb27e9e217b161127508609cede4aa1336e3d8a8fa0 2026-07-31T0518-v5.6.0-mk-coldcard-factory.dfu
05de7e0e5ae549bbbb751579562d8f8501451c086d9a669c9c77dbc6c9389171 2026-07-31T0517-v1.5.0Q-q1-coldcard.dfu
@@ -137,12 +138,12 @@ f05bc8dfed047c0c0abe5ed60621d2d14899b10717221c4af0942d96a1754f33 2021-03-29T192
bea27f263b524a66b3ed0a58c16805e98be0d7c3db20c2f7aab3238f2c6a6995 2019-12-19T1623-v3.0.6-coldcard.dfu
-----BEGIN PGP SIGNATURE-----
-iQEzBAEBCAAdFiEERYl3mt/BTzMnU06oo6MbrVoqWxAFAmpsMEsACgkQo6MbrVoq
-WxAYBAgAk7x7NBB6YyFPLs27rX/36T0kAuB2HwxOj2tFmMDNekbtkta8eEx/b4ej
-AmN0yQNxyquv+sAB7pvMuGiJwB41mIMuR5RR5tryx5qTzU8kzyViwOAfQjA0L6lr
-c0i7kXQtQ6t7BEwEk2yHL0kwyPNF73hJnU/D/TCFiJ2xDEnv+WNJJYobFEynZuhG
-CzF7Y1lgPguAGHhCml03wH5h4GIvbIlpV2G1u+WMC1kUmIs+yWvke9KbRIAsDsQj
-c15GU7ICboak0cJ0Qx0cl4XYIuUau533EKXCiwMDb0EEOQAqWniUhI4aHfGIxB8r
-z9bZYaLWolJaxcHO3AMrMWd6LIHtVA==
-=2tP+
+iQEzBAEBCAAdFiEERYl3mt/BTzMnU06oo6MbrVoqWxAFAmpsonYACgkQo6MbrVoq
+WxAfYgf/Z6JQ4TArz2PDBCkD73hpgvM4lq1uQs6okwGYdufe6SXSBq/7F+BITsYy
+rH88geEdEUnn2m3Fk0OYZQziKxeAVm+6FQUFnYFwH7uIY2V7T5kcHaZwhaKp20Oa
+0iy41DaTkHgNGm6+xFjwN7xbtxW7eaTdPIVwRf7NUFHMdVI7PeZAIzgaFsd1MwMM
+qZQFrBNDE5VQyX2MyRv9r8OAdnuIJwaFo30KujxDr68onTwQ+ipR8QR6MirlN5/a
+b/4ZsR0QvzWwDdnr8UiATmN/mwR8A8Uu1C8eJM7eGIbTTeVmHkuwVgdBmU6coPYv
+NdbDgcfP4qiO34QaVDtJu2rjXMYVNg==
+=koqD
-----END PGP SIGNATURE-----
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.