What changed, and why it matters
This commit only updates the release signature file. It adds two new file hashes for a COLDCARD Mk firmware release and refreshes the PGP signature that covers the file. There is no code change, no bug fix, and no security patch in the diff itself.
No action required; this is a routine release-signing artifact update. Verify the PGP signature with the project’s published release key if you intend to use the new firmware binaries.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies releases/signatures.txt, appending SHA-256 hashes for 2026-07-31T0518-v5.6.0-mk-coldcard.dfu and its factory variant, and replaces the detached PGP signature at the bottom of the file. The signature was made with the same key (fiEERYl3mt/BTzMnU06oo6MbrVoqWxAFAmpsMEs) and covers the updated content. No source code, build scripts, or cryptographic logic were changed.
Changed components
releases/signatures.txtInspect captured patch +10 / −8
diff --git a/releases/signatures.txt b/releases/signatures.txt
index 3f1aad2..12514e3 100644
--- a/releases/signatures.txt
+++ b/releases/signatures.txt
@@ -9,6 +9,8 @@ de6e4d9ea237300cebe7d83510507c76feb2633a39ff22771b5bd64226399f75 History-Mk4.md
b93aadf4c12ae853c2eec4f8acf37ab39fdf4064257624d4bb865ce06797988a History-Mk3.md
de6e4d9ea237300cebe7d83510507c76feb2633a39ff22771b5bd64226399f75 History-Mk.md
dfffd09bf975fa53fc16d288ceda4c3d48abd044efaa31e069de4327b9bb254e ChangeLog.md
+79e4e7a7dd3facc35f6e96ba5a5e80511cba2b5363e6d5a91553a20e1c579d86 2026-07-31T0518-v5.6.0-mk-coldcard.dfu
+6733b600c351b8db2ab85fb27e9e217b161127508609cede4aa1336e3d8a8fa0 2026-07-31T0518-v5.6.0-mk-coldcard-factory.dfu
05de7e0e5ae549bbbb751579562d8f8501451c086d9a669c9c77dbc6c9389171 2026-07-31T0517-v1.5.0Q-q1-coldcard.dfu
821c8fc34d0a1e286ab6eef8924c61232de58fb32e2d98bde49d501eea1efa4a 2026-07-31T0517-v1.5.0Q-q1-coldcard-factory.dfu
f752eade8c7f1d02524549606f429b61f1d792a832fa76f92e735306699fc697 2026-07-01T1729-v5.5.1-mk-coldcard.dfu
@@ -135,12 +137,12 @@ f05bc8dfed047c0c0abe5ed60621d2d14899b10717221c4af0942d96a1754f33 2021-03-29T192
bea27f263b524a66b3ed0a58c16805e98be0d7c3db20c2f7aab3238f2c6a6995 2019-12-19T1623-v3.0.6-coldcard.dfu
-----BEGIN PGP SIGNATURE-----
-iQEzBAEBCAAdFiEERYl3mt/BTzMnU06oo6MbrVoqWxAFAmpsL/IACgkQo6MbrVoq
-WxD/ewgAsxPXKLafdqli2Y/bUbMjVLTJj3o6B5K0ZxAs7NdTQv+KS47BmGPjLc5w
-w/B4APLgjWlxMIzvHTSAxkEEvle71t/wkT9mXJVyBB7vA8KYu65Cbujz+p7mK+mw
-FALXHbh36g2VoC95B8xqcsv/CSwwGbh5pUvxpQk8FGQndeXaf/Aem7Hn4aY17Leo
-U9MY1E1kT0xnCp762a61bK26pgz3B3uXs3UQyBFM/M3AKEjH6+S+4yPZb1F7C3EK
-F6s03NZ9cVfjf2rwHivu3a/S1ObR32xUxYQIq1+RWpLrXGePTDBZje1/r0zQeyKx
-KwDK2ryUuaopIoliR79ZS5urck7DEg==
-=UCFq
+iQEzBAEBCAAdFiEERYl3mt/BTzMnU06oo6MbrVoqWxAFAmpsMEsACgkQo6MbrVoq
+WxAYBAgAk7x7NBB6YyFPLs27rX/36T0kAuB2HwxOj2tFmMDNekbtkta8eEx/b4ej
+AmN0yQNxyquv+sAB7pvMuGiJwB41mIMuR5RR5tryx5qTzU8kzyViwOAfQjA0L6lr
+c0i7kXQtQ6t7BEwEk2yHL0kwyPNF73hJnU/D/TCFiJ2xDEnv+WNJJYobFEynZuhG
+CzF7Y1lgPguAGHhCml03wH5h4GIvbIlpV2G1u+WMC1kUmIs+yWvke9KbRIAsDsQj
+c15GU7ICboak0cJ0Qx0cl4XYIuUau533EKXCiwMDb0EEOQAqWniUhI4aHfGIxB8r
+z9bZYaLWolJaxcHO3AMrMWd6LIHtVA==
+=2tP+
-----END PGP SIGNATURE-----
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.