CommitWatch RSS
BB
← All projectsBitBox

BitBox02 firmware

Firmware and bootloader for BitBox02 signing devices.

BitcoinHardware walletsNormal
Source repository ↗
Repository coverage

647 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

193security candidates127second-pass queue60AI analyses
28commits · 30 days
47commits · 60 days
312commits · 180 days
647commits · 365 days
Backfill bands
Aug 5 → Feb 6335 seen28 candidatesComplete
Feb 6 → Jun 6265 seen19 candidatesComplete
Jun 6 → Jul 619 seen5 candidatesComplete
Jul 6 → Aug 526 seen3 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

59/100 average clarity
65Strong · 80–100
281Adequate · 60–79
230Thin · 40–59
71Opaque · 0–39
23security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Marko Bencun39011735158
Niklas Dusenlund111299059
benma's agent89289062
cedwies1252063
Tomas Vrba943074
Cedric Wiese1231049
Jad810062
thisconnect210072
benma210074
Niklas111035
Yasser Aziza110070
Patrick Steiger110045
Analysis record

Published AI watches

Last scanned 2 minutes ago

Low 39 AI analysisMessage 73 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

rust: initialize C output buffers

This commit fixes a class of low-level memory-safety bugs where Rust code was given buffers containing uninitialized bytes. Rust's rules require every byte of a slice to be initialized, even if the function will overwrite them. Passing uni…

Undefined behavior at C/Rust FFI due to uninitialized buffers being treated as Rust slicesPotential optimizer-dependent behavior from violating Rust slice initialization rulesHardening of cryptographic output paths (SHA-256, HMAC-SHA256, HMAC-SHA512)
511018eaby benma's agent+52−2713 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 69 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Limit SD erase file size

This commit fixes a bug in how the BitBox02 hardware wallet wipes files from its SD card. Before erasing a file, the device now checks the file's reported size against a safe maximum. Without this check, a tampered SD card could claim a fi…

CVE-2026-6682 referenced in commit messageMalformed FAT directory entry could cause excessive overwrite loopDenial-of-service via SD card tampering
2453f528by Marko Bencun+4−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
High 70 AI analysisMessage 66 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Validate mounted FAT geometry

This update adds a safety check when the BitBox02 hardware wallet mounts a microSD card. A malicious or deliberately malformed FAT filesystem could trick the device's file-system library into placing user data inside attacker-controlled bo…

Fixes integer-wrap / geometry confusion in FAT mount logicAdds explicit post-mount validation of filesystem metadataPrevents data area from landing inside attacker-controlled FAT sectors
01c017d6by Marko Bencun+21−01 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader/stage1: fix erase handling for partially erased blocks

This update fixes the BitBox02 bootloader's firmware-erase routine. Previously, when erasing leftover padding after a firmware update, the bootloader started erasing at the exact page where the firmware ended. Because flash memory can only…

Bootloader firmware erase routine could erase a flash block containing both firmware and paddingFix aligns erase start to erase-block boundary and re-checks erased state before erasingChangelog describes the change as a fix for 'partially erased flash blocks'
b31206a8by Marko Bencun+23−83 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

blupgrade: add stage0/stage1 production binaries

This commit adds production bootloader upgrade files for the BitBox02 hardware wallet and updates build scripts to use them. It is a routine asset-management change: replacing placeholder development hashes with real signed production bina…

8db4b0dcby Marko Bencun+26−1720 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 83 · Strong
BB BitBoxBitBox02 firmware BitcoinHardware wallets

blupgrade: keep dev stage1 unsigned

This commit fixes a build script used only for development/testing versions of the BitBox02 bootloader upgrade. It makes the development-stage1 bootloader images unsigned again, while keeping production images fully signature-verified. The…

Signature verification relaxed only for development buildsProduction payload validation still requires signaturesDevelopment stage0 already skipped stage1 signature verification per commit message
476b90e3by Marko Bencun+9−69 files
No security note in commit
Open full analysis →Source commit ↗
Low 46 AI analysisMessage 60 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: allow full sized images

This commit fixes a bootloader bug where the device rejected firmware updates that used the maximum allowed size. The off-by-one check meant legitimate full-sized firmware images could not be installed, potentially blocking updates. The fi…

Off-by-one input validation in firmware-update pathBootloader change affecting firmware chunk count acceptanceCHANGELOG labels the change as a bugfix for full-sized firmware upgrades
f60b93ccby Marko Bencun+5−33 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 28 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Add bootloader update

This is a large firmware commit that adds a new two-stage bootloader update mechanism for the BitBox02 hardware wallet. It replaces the old single bootloader with a small, fixed 'stage0' plus a separately signed 'stage1', and ships a speci…

Bootloader architecture changed from monolithic to two-stage (stage0 + signed stage1).Firmware signature hash now includes a 16-bit product_id, binding firmware to product variant.Root public keys were rotated/replaced with a single set across all products.
3f1f3172by Marko Bencun+5003−52379 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 78 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Bump Rust toolchain to 1.96

This commit is a routine maintenance update for the BitBox02 hardware wallet firmware. It upgrades the pinned Rust compiler toolchain from an older version to Rust 1.96.0, updates the project's Docker build container and related developer …

Routine toolchain and dependency upgradeVendored libc updated across many platform bindingsNo first-party security-relevant code changes
55e3dd30by Niklas Dusenlund+14839−13798360 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 68 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: reduce snprintf

This commit removes the use of the standard snprintf formatting function from the BitBox02 bootloader's developer menu and replaces it with a small, fixed-format helper. The main goal is to reduce the bootloader's binary size and make the …

Removes snprintf/printf usage from bootloader code, reducing binary bloat and eliminating a complex formatting library from a privileged execution contextExtends automated CI check to detect stdio/Rust formatting symbols in regular development and production bootloader outputs, not just production buildsAdds unit test coverage for the new fixed-format helper
2fb9d57fby Marko Bencun+59−106 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 63 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: avoid snprintf formatting

This commit removes the use of standard string-formatting functions (like snprintf and Rust's format!) from the bootloader and related low-level code, replacing them with smaller, fixed-size string builders. The stated goal is to reduce bi…

Removal of stdio formatting (snprintf family) from bootloader codeRemoval of Rust format!/write! formatting from bootloader-linked codeAddition of CI gate rejecting stdio and Rust formatting symbols in production bootloader ELFs
33434fa9by Marko Bencun+298−6314 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 35 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: extract formatting helpers

This commit is a simple code cleanup: it moves a handful of string-formatting helpers (for pairing codes, progress percentages, hash display, timers, and unknown-command messages) out of the main bootloader file into a new dedicated file, …

1a1de3b5by Marko Bencun+147−126 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 58 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

bootloader: render messages directly

This commit removes a 100-character stack buffer and passes bootloader messages straight to the screen-drawing function. The old code used snprintf to copy the message into a fixed-size buffer, which could silently truncate very long strin…

Removal of fixed-size stack buffer in bootloader display pathElimination of snprintf with potentially attacker-influenced format string argumentBootloader code touched, which is a security-sensitive component
c0bc7b92by Marko Bencun+1−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 58 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Use integer progress fractions

This commit replaces floating-point progress calculations with integer math to save firmware space. It removes the use of f32 arithmetic for progress bars in Bitcoin transaction signing and Bluetooth firmware upgrades. There is no direct s…

Removal of floating-point arithmetic reduces attack surface related to soft-float emulation bugsNew integer fraction API introduces denominator-non-zero and numerator-bound assumptionsCall sites use checked arithmetic to prevent overflow in progress computation
17c4947fby Marko Bencun+52−3712 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 80 · Strong
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Enable scope C LTO for firmware

This commit changes the build system to enable Link-Time Optimization (LTO), a compiler technique that shrinks the final firmware size. It also adds safeguards to keep the stack protector security feature working under LTO and deliberately…

Build-system change enabling LTO with explicit stack-protector symbol retentionDeliberate exclusion of bootloader, factory-setup, ASF4, samd51a-ds, and embedded-swd from LTO due to audit complexityToolchain switch to LTO-aware archive utilities to avoid invalid tiny images from missing live objects
0b102fb7by Marko Bencun+29−36 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 60 AI analysisMessage 95 · Strong
BB BitBoxBitBox02 firmware BitcoinHardware wallets

da14531: restore BLE UART backpressure

This update fixes a crash in the BitBox02 hardware wallet when a user lists many backups over a Bluetooth connection. Previously, the device could run out of temporary buffer space while sending a large response, causing it to panic and st…

Denial-of-service via buffer overflow/panic on Bluetooth pathMissing backpressure leading to unbounded queue growth and crashAtomic all-or-nothing enqueue to preserve serial frame boundaries
3201c5d2by Marko Bencun+87−37 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 35 · Opaque
BB BitBoxBitBox02 firmware BitcoinHardware wallets

securechip: port attestation sign

This commit is a code refactoring that moves the device attestation signing function from C code into Rust code. It converts the function to be asynchronous (async/await) and rewrites the parsing of the secure chip's DER-encoded signature …

Removal of C synchronous secure chip signing wrapperAddition of async Rust secure chip ECDSA signing operationRelocation of DER signature parsing from C-API Rust crate into securechip crate
2bccdebfby Marko Bencun+180−14525 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Move protobuf bindings into bitbox-proto

This commit is a build-system and code-organization refactor. It moves the automatically generated Rust protobuf message definitions from inside the main bitbox02-rust crate into a new, separate bitbox-proto crate. It also switches the gen…

06f33ef3by Niklas Dusenlund+2442−236321 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 85 · Strong
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Use HAL random for noise key generation

This commit is a code cleanup in the BitBox02 firmware's Rust code. It changes how random numbers are supplied when creating cryptographic keys for the Noise protocol, moving from a device-specific random type to a more generic hardware ab…

Refactor of cryptographic randomness plumbing for Noise/X25519 key generationRemoval of device-specific RNG trait in favor of HAL random abstractionResponder ephemeral key now generated explicitly before handshake state creation
4e982183by Marko Bencun+75−7311 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
BB BitBoxBitBox02 firmware BitcoinHardware wallets

add new bitbox-core-utils workspace crate

This commit is a routine code reorganization: it moves two small helper modules (one for generating random bytes, one for salting/hashing data) from an existing Rust crate into a new shared workspace crate named bitbox-core-utils. The actu…

e12dae77by Marko Bencun+221−15613 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidateLimit SD erase file sizeby Marko Bencun · 2453f528 · Jul 7, 2026 · 1 fileMessage 69 · AdequateModerate 59Details
Commit message · Marko Bencun

Limit SD erase file size

Reject files larger than SD_MAX_FILE_SIZE before the erase path overwrites them.
The read path already enforced this limit; applying it to erase prevents a
malformed FAT directory entry from causing an excessive overwrite loop.

This mitigates the BitBox impact of CVE-2026-6682 in the stale-backup cleanup
path without changing vendored FatFs code.

69/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
explicit security language
AI analysis · Moderate 59/100

This commit fixes a bug in how the BitBox02 hardware wallet wipes files from its SD card. Before erasing a file, the device now checks the file's reported size against a safe maximum. Without this check, a tampered SD card could claim a file is gigantic, causing the device to get stuck in a long overwrite loop. The fix prevents a denial-of-service style attack where a malicious or corrupted SD card could make the device hang or behave unexpectedly during cleanup of old backups. The commit says it mitigates the impact of CVE-2026-6682 without changing the third-party FAT filesystem code.

Security candidateValidate mounted FAT geometryby Marko Bencun · 01c017d6 · Jul 7, 2026 · 1 fileMessage 66 · AdequateHigh 70Details
Commit message · Marko Bencun

Validate mounted FAT geometry

Reject mounted FAT volumes whose FAT area extends past the computed data area.
This catches crafted FAT32 BPB values where the FatFs mount calculation can wrap
`BPB_FATSz32 * NumFATs` and place the data area inside attacker-controlled FAT
sectors.

Addresses CVE-2026-6682 at the BitBox SD integration boundary without changing
vendored FatFs code.

66/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
explicit security languagedefensive validation
AI analysis · High 70/100

This update adds a safety check when the BitBox02 hardware wallet mounts a microSD card. A malicious or deliberately malformed FAT filesystem could trick the device's file-system library into placing user data inside attacker-controlled bookkeeping sectors, potentially leading to code execution or data corruption when the device later reads or writes files. The fix validates that the filesystem's internal layout is sane before using it, and leaves the third-party library code unchanged.

Security candidateUpdate FatFs to R0.16by Marko Bencun · 9f2b493d · Jul 7, 2026 · 79 filesMessage 69 · AdequateTriage 12Details
Commit message · Marko Bencun

Update FatFs to R0.16

Update the vendored FatFs copy from R0.14b to R0.16 plus upstream
patch 1.

- Base archive: https://elm-chan.org/fsw/ff/arc/ff16.zip
- https://elm-chan.org/fsw/ff/patch/ff16p1.diff

Keep the existing BitBox configuration choices for LFN, tiny mode, mkfs support,
code page 850, fixed timestamps, and disabled exFAT, labels, and LBA64.

69/100 · AdequateMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
boot or update path
Lower-priorityFix some memory handling issuesby Niklas Dusenlund · 3a7143f4 · Jul 6, 2026 · 3 filesMessage 45 · ThinTriage 0Details
Commit message · Niklas Dusenlund

Fix some memory handling issues

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-prioritybb03 ui: navigation icon buttons (Back/Next/Confirm/Cancel)by Jad · facb1e73 · Jul 1, 2026 · 19 filesMessage 73 · AdequateTriage 0Details
Commit message · Jad

bb03 ui: navigation icon buttons (Back/Next/Confirm/Cancel)

- adds navigation buttons for back, next, confirm, and cancel, replacing existing text buttons.
The icons are PNG bitmaps whereas the button borders are vector drawn.

- on press, the frame fills white and the icon color inverts.

- Adds bitbox-lvgl support (LvStyleTransition, ObjExt add_state/add_flag/
child, LvObjFlag),

- icon assets are located in bitbox03/icons/

- adds a demo screen (ui/demo.rs, reachable in the simulator via the set_device_name "__demo_nav__" sentinel)

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI review queuedpy: add BitBoxSyncby Marko Bencun · 851ed04b · Jul 1, 2026 · 12 filesMessage 28 · OpaqueTriage 0Details
Commit message · Marko Bencun

py: add BitBoxSync

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
Security candidateapi: add BitBoxSyncby Marko Bencun · 54cdb54d · Jul 1, 2026 · 30 filesMessage 59 · ThinTriage 15Details
Commit message · Marko Bencun

api: add BitBoxSync

Implements the BitBoxSync firmware API expected by the bitboxsync-client-go raw.Identity interface:

https://github.com/BitBoxSwiss/bitboxsync-client-go/blob/3c0f1462ac0d647285a75c48227eb8d9f567fc67/raw/identity.go#L27-L69

59/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive path
Security candidateblupgrade: update stage1 binaries to v1.2.2by Marko Bencun · 5940a800 · Jun 29, 2026 · 6 filesMessage 45 · ThinTriage 24Details
Commit message · Marko Bencun

blupgrade: update stage1 binaries to v1.2.2

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathboot or update path
Security candidatebootloader/stage1: fix erase handling for partially erased blocksby Marko Bencun · b31206a8 · Jun 28, 2026 · 3 filesMessage 50 · ThinModerate 59Details
Commit message · Marko Bencun

bootloader/stage1: fix erase handling for partially erased blocks

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
update trustboot or update path
AI analysis · Moderate 59/100

This update fixes the BitBox02 bootloader's firmware-erase routine. Previously, when erasing leftover padding after a firmware update, the bootloader started erasing at the exact page where the firmware ended. Because flash memory can only be erased in larger fixed-size blocks, this could leave the final firmware chunk sharing an erase block with padding. That shared block might be erased unintentionally, potentially corrupting the newly written firmware. The fix aligns the erase start to a full erase-block boundary and re-checks whether pages are already erased before acting. The changelog explicitly calls this a fix for 'partially erased flash blocks.'

Security candidateblupgrade: add stage0/stage1 production binariesby Marko Bencun · 8db4b0dc · Jun 25, 2026 · 20 filesMessage 45 · ThinInformational 15Details
Commit message · Marko Bencun

blupgrade: add stage0/stage1 production binaries

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet pathboot or update path
AI analysis · Informational 15/100

This commit adds production bootloader upgrade files for the BitBox02 hardware wallet and updates build scripts to use them. It is a routine asset-management change: replacing placeholder development hashes with real signed production binaries and enabling previously disabled build targets. There is no code change to how the device operates, no reported vulnerability, and no indication of a security incident.

Security candidateblupgrade: keep dev stage1 unsignedby Marko Bencun · 476b90e3 · Jun 25, 2026 · 9 filesMessage 83 · StrongInformational 20Details
Commit message · Marko Bencun

blupgrade: keep dev stage1 unsigned

Regenerate the development stage1 payloads from the unsigned build
outputs so their signature slots stay zeroed.

Keep production payload validation on signature verification while
development payload validation uses the existing unsigned-image path.

This is to make `make bootloader-upgrade-assets-development` work
again after removing the dummy pubkeys from the bootloader_update.py
verification.

83/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
signing boundaryupdate trustdefensive validationcryptography-sensitive pathsigning or wallet pathboot or update path
AI analysis · Informational 20/100

This commit fixes a build script used only for development/testing versions of the BitBox02 bootloader upgrade. It makes the development-stage1 bootloader images unsigned again, while keeping production images fully signature-verified. The change is a build/development tooling fix, not a security patch for shipped devices.

Security candidatesecurity improvementsby Marko Bencun · cbb40634 · Jun 25, 2026 · 21 filesMessage 23 · OpaqueTriage 24Details
Commit message · Marko Bencun

security improvements

23/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names security-relevant behavior explicitly! Too few words to establish purpose! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
signing or wallet pathboot or update path
Security candidatebootloader: allow full sized imagesby Marko Bencun · f60b93cc · Jun 25, 2026 · 3 filesMessage 60 · AdequateLow 46Details
Commit message · Marko Bencun

bootloader: allow full sized images

The erase call disallowed full sized firmware images.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
update trustboot or update path
AI analysis · Low 46/100

This commit fixes a bootloader bug where the device rejected firmware updates that used the maximum allowed size. The off-by-one check meant legitimate full-sized firmware images could not be installed, potentially blocking updates. The fix changes the limit from 'one less than maximum' to 'maximum'. There is no direct evidence this was exploitable as an attack, but any bug in firmware-update verification deserves attention.

Security candidateAdd bootloader updateby Marko Bencun · 3f1f3172 · Jun 24, 2026 · 79 filesMessage 28 · OpaqueModerate 59Details
Commit message · Marko Bencun

Add bootloader update

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body! Opaque security-relevant change
Why it was queued
update trustcryptography-sensitive pathsigning or wallet pathboot or update path
AI analysis · Moderate 59/100

This is a large firmware commit that adds a new two-stage bootloader update mechanism for the BitBox02 hardware wallet. It replaces the old single bootloader with a small, fixed 'stage0' plus a separately signed 'stage1', and ships a special firmware image that can install both stages onto existing devices. The change also updates how firmware signatures are computed so that the product type is included in the hash, which is a security improvement. Because the commit is a major architectural rewrite and includes prebuilt binary blobs whose source is not shown, it carries normal supply-chain and implementation risks, but no specific vulnerability is visible in the diff.

Security candidateAdd flash data backup scriptsby Niklas Dusenlund · 285fa768 · Jun 23, 2026 · 3 filesMessage 73 · AdequateTriage 18Details
Commit message · Niklas Dusenlund

Add flash data backup scripts

Add J-Link helper scripts to back up and restore the BitBox02 flash data
areas: shared data, appdata, and bootdata. The backup records the MCU
serial number but does not include bootloader factory randomness.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
update trust
Lower-priorityRead chunks via typed pointersby Niklas Dusenlund · e21bd6fe · Jun 22, 2026 · 2 filesMessage 78 · AdequateTriage 0Details
Commit message · Niklas Dusenlund

Read chunks via typed pointers

Use typed pointers for read-only memory accessors so firmware builds can read fields directly from flash instead of copying whole chunks first. Keep test builds on the existing fake read hooks.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityDisable ASLR for unit testsby Niklas Dusenlund · a8b013cc · Jun 22, 2026 · 1 fileMessage 78 · AdequateTriage 0Details
Commit message · Niklas Dusenlund

Disable ASLR for unit tests

Run the build-tree CTest invocation through setarch -R when it is
available. This keeps the existing behavior as a fallback on systems
without setarch.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Security candidatebb03 UI: placeholder BTC signing workflowsby Jad · f7b0b082 · Jun 15, 2026 · 1 fileMessage 40 · ThinTriage 18Details
Commit message · Jad

bb03 UI: placeholder BTC signing workflows

Implement placeholder UI for BTC signing demos
in send_message.py.

40/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body! Contains work-in-progress language
Why it was queued
signing boundary
Lower-priorityDisable "readability-implicit-bool-conversion"by Niklas Dusenlund · 788d5894 · Jun 8, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Niklas Dusenlund

Disable "readability-implicit-bool-conversion"

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityBootstrap local Cargo configby Niklas Dusenlund · 0e058d7d · Jun 8, 2026 · 12 filesMessage 58 · ThinTriage 0Details
Commit message · Niklas Dusenlund

Bootstrap local Cargo config

Generate .cargo/config.local.toml with bindgen clang args and cc crate CFLAGS for the firmware Rust targets. Include that file from the repository and Rust workspace Cargo configs so normal cargo invocations pick it up, and wire the bootstrap into Makefile setup.

Use exact target-specific env names such as CFLAGS_thumbv7em-none-eabi and BINDGEN_EXTRA_CLANG_ARGS_thumbv7em-none-eabi. CMake passes its full cross-build cc flags through the same target-specific CFLAGS variable, including the ARM sysroot.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Lower-prioritybb03: fix --preseed in simulatorby Jad · c27a20b2 · Jun 7, 2026 · 1 fileMessage 70 · AdequateTriage 0Details
Commit message · Jad

bb03: fix --preseed in simulator

fixes --preseed in simulator so it actually
loads with preseeded test wallet.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Lower-prioritybb03: placeholder UI for restore from mnemonicby Jad · 472a5964 · Jun 7, 2026 · 4 filesMessage 40 · ThinTriage 0Details
Commit message · Jad

bb03: placeholder UI for restore from mnemonic

Implements AI generated UI for restore
from mnemonic workflow.

40/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body! Contains work-in-progress language
Security candidateBump Rust toolchain to 1.96by Niklas Dusenlund · 55e3dd30 · Jun 3, 2026 · 360 filesMessage 78 · AdequateInformational 17Details
Commit message · Niklas Dusenlund

Bump Rust toolchain to 1.96

Update the pinned Rust toolchain to 1.96.0 and adjust the BTC signtx
tests for clippy's collapsible_match lint on the new toolchain.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive pathsigning or wallet pathauthentication path
AI analysis · Informational 17/100

This commit is a routine maintenance update for the BitBox02 hardware wallet firmware. It upgrades the pinned Rust compiler toolchain from an older version to Rust 1.96.0, updates the project's Docker build container and related developer tools (like clang-format and clang-tidy) from version 21 to 22, and refreshes several vendored Rust library dependencies to newer versions. The only application code change is a small test-only cleanup in the Bitcoin transaction signing tests to satisfy a new Rust linter warning. There is no direct evidence in the commit message or diff that this fixes a specific security vulnerability.

Security candidatebootloader: reduce snprintfby Marko Bencun · 2fb9d57f · Jun 2, 2026 · 6 filesMessage 68 · AdequateInformational 18Details
Commit message · Marko Bencun

bootloader: reduce snprintf

Move the BLE dev menu version formatting to the fixed-format
bootloader formatter and add unit coverage.

Extend the unwanted-symbol check to regular development and production
bootloader outputs.

Reduces binary size.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
update trustboot or update path
AI analysis · Informational 18/100

This commit removes the use of the standard snprintf formatting function from the BitBox02 bootloader's developer menu and replaces it with a small, fixed-format helper. The main goal is to reduce the bootloader's binary size and make the project's automated checks apply to all bootloader builds, not just production ones. There is no direct evidence this fixes an active security vulnerability, but it is a defensive hardening change that reduces attack surface by avoiding a complex formatting library in security-sensitive bootloader code.

Security candidatebootloader: hash BLE firmware in Cby Marko Bencun · 1d82b8a4 · May 30, 2026 · 2 filesMessage 68 · AdequateTriage 18Details
Commit message · Marko Bencun

bootloader: hash BLE firmware in C

Use the existing PUKCC SHA-256 path for the bootloader BLE firmware hash check. Firmware
builds keep using the Rust SHA-256 wrapper.

Saves 1352 bytes in bb02p-bl-multi-production.bin.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
update trust