CommitWatch RSS
SI
← Developer activityStrong match

Salvatore Ingala

Public commit activity attributed with strong match confidence. This page describes observable work, not personal trustworthiness.

@bigspider on GitHub ↗
169 commits2 monitored projects48 candidates1 high-risk analyses
Project constellation

Where the commits appear

Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.

Monitored External sample
Projects connected to Salvatore IngalaA visual map of monitored and externally discovered repositories.SIdeveloper167Ledger Bitcoin app2Hardware Wallet Inter…
Monitored evidence

CommitWatch projects

Ledger Bitcoin appLedger167 commits48 candidates1 high riskHardware Wallet InterfaceBitcoin Core2 commits0 candidates0 high risk
External discovery

Other public projects

No external sample loaded yet.

Authenticated GitHub discovery can enrich this profile.
Analyzed activity

Recent published watches

Message quality and risk characterize commits, never the person.

Moderate 59 AI analysisMessage 73 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Type consistency in psbt_parse_rawtx, and some other hardenings

This commit hardens a Bitcoin transaction parser in Ledger's app. It changes some numeric fields to safer types, adds bounds checks on transaction counts and sizes, rejects extra trailing bytes after a transaction, checks a previously-igno…

Integer type narrowing and sentinel change from -1 to SIZE_MAXBounds checks before uint64_t to unsigned int castsReturn value of parser_consolidate_buffers now checked
1af86279by Salvatore Ingala+66−173 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 78 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Display total amount of external inputs when reliable

This commit changes what information the Ledger Bitcoin app shows on its screen when signing a transaction that includes 'external inputs'—coins the user did not provide and whose amounts the device cannot independently verify. Previously …

UI/UX hardening: additional contextual data shown for transactions with unverified external inputsNo change to cryptographic checks, sighash validation, or input verificationExternal inputs warning is preserved; new data is displayed only when the input set is closed (no ANYONECANPAY)
26f631c5by Salvatore Ingala+126−174 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 65 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Add support for generating PSBTs for MuSig2 in txmaker

This commit adds test-only helper code for creating Bitcoin transaction fixtures that support newer wallet types (MuSig2 multi-signature and several legacy/wrapped SegWit descriptor forms). It is not a change to the Ledger app firmware its…

No security-relevant signal: change is in test utilities onlyAdds cryptographic helper for MuSig2 key aggregation in test fixturesAdds P2SH/P2SH-P2WPKH/P2SH-P2WSH script generation in test fixtures
13d84acaby Salvatore Ingala+211−112 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Get rid of SKIP_FOR_CMOCKA; compile tests with the speculos bridge

This commit is purely a testing infrastructure cleanup. It removes a workaround called SKIP_FOR_CMOCKA that previously hid parts of the code from unit tests, and instead compiles those parts using a more realistic emulator bridge (speculos…

c098c659by Salvatore Ingala+37−8210 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Link unit tests with speculos implementations of crypto syscalls

This commit is purely about improving the project's automated test setup. It links unit tests to a software simulator (Speculos) so cryptographic code can be tested on a regular computer without a physical Ledger device. It adds tests for …

53a997c6by Salvatore Ingala+747−296 files
No security note in commit
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 60 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Add utilities to parse serialized PSBTs and mock its maps; added unit tests for extract_bip32_derivation

This commit only adds new unit-test helper code and test cases. It does not change the actual Ledger Bitcoin app that runs on the device, nor does it fix or alter any production security logic. The new files parse PSBT data and mock dispat…

No production code changesNo device-side code changesNo cryptographic or parsing logic changes in the shipped app
e7453297by Salvatore Ingala+890−07 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Move some duplicated mocking code to headers

This commit is a routine cleanup of the project's unit-test code. It removes duplicate mock implementations of a small helper function called `pic()` from 14 test files and places a single shared version in a mock header. The change only a…

3ac25325by Salvatore Ingala+4−9415 files
No security note in commit
Open full analysis →Source commit ↗
Informational 13 AI analysisMessage 73 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Improve signing performance in case of several internal keys

This commit is a performance optimization for the Ledger Bitcoin app. It reorders nested loops in two signing-related functions so that the app reads each transaction input's data once and then processes all relevant internal keys, rather …

No security-relevant behavior change identified in commit message or diffRefactoring only: loop reordering with identical helper invocationsPer-input taptree hash now computed once instead of once per key, reducing redundant computation
1d2a4341by Salvatore Ingala+128−891 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 60 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Partition sign_psbt.c into smaller submodules

This commit is a large but purely structural code cleanup: it splits the single large sign_psbt.c file into many smaller, focused source files under src/handler/sign_psbt/. The actual logic, function bodies, validation checks, and security…

Large-scale code movement only; no new security checks or relaxed validationsFunctions moved verbatim; logic preservedCopyright year updated from 2025 to 2025, 2026
64c53b1aby Salvatore Ingala+2912−214228 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Partition init_global_state into smaller functions

This commit is a straightforward internal code cleanup: it splits one large function into three smaller, well-documented helper functions and moves one data field into a shared state structure. There is no change to what the code checks, a…

b0b6a1adby Salvatore Ingala+145−922 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Add account context struct in sign_psbt

This commit is a straightforward internal code cleanup in Ledger's Bitcoin app. It groups several pieces of wallet-policy data into a new 'account context' structure and updates all references accordingly. There is no change to how transac…

b7061e13by Salvatore Ingala+104−823 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Add sign_psbt test for MuSig round 1 and 2

This commit only adds new test cases for an existing feature (MuSig multi-signature signing) in the Rust client test suite. It does not change any production code, cryptographic logic, or application behavior. The changes are purely in tes…

a3120ecaby Salvatore Ingala+1103−492 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 85 · Strong
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Generalize return value of sign_psbt in the Rust client

This commit is a routine API update for the Ledger Bitcoin app's Rust client library. It changes what kind of data the library returns when a user signs a Bitcoin transaction (PSBT), so it can also return MuSig2 multi-signature material (p…

dd9e3409by Salvatore Ingala+469−708 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 80 · Strong
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Add support for "musig()" in the rust client

This commit adds code to the Ledger Bitcoin app's Rust client that pre-processes wallet descriptors containing 'musig(...)' key groups before computing addresses. It implements a small BIP-327/BIP-328 key aggregation so the existing minisc…

New cryptographic key aggregation implementation (BIP-327 KeyAgg)Parsing of untrusted descriptor strings with manual `musig(...)` extractionUse of a hardcoded BIP-328 chain code constant
244d6027by Salvatore Ingala+212−04 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 45 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Guard against sizes that do not fit in an int

This commit adds a safety check in the Ledger Bitcoin app's code that handles BIP32 derivation paths extracted from a PSBT (Partially Signed Bitcoin Transaction). The change prevents a very large, attacker-chosen data length from being sil…

Integer truncation / signedness issue between size_t and intMemory safety hardening in PSBT parsing pathDefensive bounds check added in callback
e4012c72by Salvatore Ingala+10−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 45 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Add missing bound check in fpt_der_data_callback

This commit fixes a missing safety check in the Ledger Bitcoin app when reading BIP32 derivation data from a PSBT (Partially Signed Bitcoin Transaction). For non-Taproot transactions, the app was not verifying that the derivation data was …

Missing bounds check on externally supplied length fieldPotential buffer overflow in fixed-size output buffer during PSBT parsingFix adds explicit length validation before memory copy preparation
e92bc067by Salvatore Ingala+7−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 50 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Validate output index (if given) in psbt_parse_rawtx

This commit adds a safety check in the Ledger Bitcoin app's code that parses raw transactions from PSBT data. Before finalizing, it now verifies that if the caller asked for a specific transaction output by index, that output actually exis…

Missing bounds check on attacker-influenced indexOut-of-range array/index access in transaction parsingPSBT input parsing path reachable during transaction signing
2330334bby Salvatore Ingala+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 58 AI analysisMessage 45 · Thin
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Zero output buffer for signatures on errors

This commit fixes a security-sensitive cleanup bug in the Ledger Bitcoin app's signing code. When a cryptographic signing operation failed, the output buffer that would normally hold the signature was not being cleared. That means a partia…

explicit_bzero used to clear sensitive output buffer on error pathpreviously returned -1 without sanitizing out buffercomment explicitly states intent: 'never produce a valid signature on errors'
1509119cby Salvatore Ingala+1−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 83 · Strong
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Fix overflow check in parse_unsigned_decimal

This commit fixes a bug in how the Ledger Bitcoin app reads large numbers from wallet policy strings. The old overflow check could miss some values that are too large to fit in a 32-bit unsigned integer, causing the app to silently accept …

Integer overflow in a parser that validates wallet policiesSilent truncation could alter the semantics of a parsed policyAffects miniscript/policy expressions such as `older(...)`
e9925b44by Salvatore Ingala+17−52 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 35 · Opaque
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Validate boundaries before assigning

This commit fixes a boundary-check ordering bug in the Ledger Bitcoin app's wallet policy parser. Previously, the code stored an untrusted length value into a data structure before checking whether that length was too large. The fix moves …

Out-of-bounds length stored before validationWallet policy header parsing on a security devicePotential memory corruption or information leak from malformed policy
4f93090eby Salvatore Ingala+3−21 file
No security note in commit
Open full analysis →Source commit ↗
Wrong identity?Names can collide and public author strings can be misleading.Contact commitwatch@karma-x.io →