Blockstream Jade

This commit is a cleanup of the device attestation code in Blockstream Jade, which is the cryptographic proof that the device is genuine. The changes fix a memory-management bug where sensitive key data could be cleared in the wrong order, correct a logic issue when debug mode is enabled, avoid repeatedly reloading attestation data from storage, ensure cryptographic keys are initialized before being freed, and move a large attestation data structure from the stack to the heap to prevent a possible stack overflow. Most changes are defensive hardening, but the SENSITIVE_POP ordering and the debug-mode logic fix are genuine security-relevant corrections.

This commit changes a helper function that turns numeric Bitcoin key paths (like 0/1/2) into human-readable text. It adds an option to leave off the leading 'm/' so callers that only want the raw path can get it. All existing callers are updated to keep the old behavior (with the 'm/'), so there is no immediate change in behavior. It appears to be a code cleanup or preparation for a future feature rather than a fix for an active security problem.

This commit only adds a new test data file containing a sample Bitcoin transaction (PSBT) for a multi-signature wallet scenario. It does not change any actual wallet code, cryptography, or security logic. There is no indication of a vulnerability or security fix.

This commit simply adds more information to an existing device status report (the 'get_version_info' RPC). It now reports whether tamper-evident attestation is active, the battery voltage, and whether the battery is charging. There is no change to security logic, access control, or cryptography. It is a routine telemetry/informational enhancement.

This commit moves when a special device private key (used for PIN server authentication) is created. Previously it was generated at every boot if missing; now it is created only when actually needed during a PIN operation. This is a code-quality and reliability change that reduces unnecessary key creation at startup, but it does not appear to fix an active security vulnerability.

This commit adds support for a new hardware variant called Jade Core (jade_v2c), which is a Jade Plus device without a camera or battery. The changes are purely build, configuration, release-script, and documentation updates to recognize the new board type. There is no indication of any security vulnerability being fixed or introduced.

This commit changes how Blockstream Jade hardware wallets sign Bitcoin transactions in a specific multi-signature setup called Green 2of3. It lets Jade act as the 'recovery signer' by deriving a special recovery key from the user's key when the first key in the transaction looks like a Blockstream Green server key. The change is a feature addition to support a previously unsupported signing scenario, not a fix for a known exploit. There is no evidence in the commit or supplied references that this is a security patch or that it addresses a disclosed vulnerability.

This commit updates the code that signs Bitcoin transactions for Blockstream Jade's Green multisig wallets. It specifically adds support for '2-of-3 recovery signing,' where the Jade device acts as the recovery key rather than the regular user key. The change lets Jade recognize and sign recovery transactions it previously would have rejected. There is no clear security bug being fixed; it appears to be a feature addition to support a missing signing scenario.

This commit changes how Blockstream Jade handles a private key used for PIN server authentication. Previously, the device kept the same private key even when the user changed or removed their PIN server settings. Now it deletes that key whenever the PIN server settings change, so a fresh key is generated the next time it is needed. This reduces the risk that an old or compromised key could be reused across different PIN server configurations.

This commit is a small internal code cleanup in a Bitcoin hardware wallet library. It replaces an if/else branch that chose between two similar key-lookup functions with a single function pointer. There is no change to what data is read, what keys are used, or what is returned to the caller. It is a stylistic refactor, not a security fix.

This commit is a pure variable rename inside a single function. The local variable `key_index` is renamed to `found_index` to make the code easier to read. No logic, behavior, or security properties change.

This commit fixes the direction of PIN-entry wheel navigation on TTGO hardware variants of the Blockstream Jade hardware wallet so it matches the rest of the device's user interface. It is a device-specific usability fix, not a cryptographic or network security fix. There is no indication it allows an attacker to steal funds, bypass the PIN, or access private keys.

This commit fixes a boundary check in code that walks through parts of a Bitcoin transaction (PSBT). The old check allowed an index equal to the number of items, which is one too high. The commit message calls it 'harmless,' meaning it should not cause a real security problem in practice. It is a defensive correction to an assert that guards internal iteration.

This commit adds a new experimental developer/testing feature called libjade that lets the Jade hardware-wallet firmware be compiled and run as a normal Linux software library or daemon. It is explicitly marked as incomplete, not for real funds, and for development/testing only. There is no indication this is a security fix or that it addresses any vulnerability.

This is a tiny build-script change that replaces a silent failure with a clear error message when required signing key files are missing. It does not change what the script does, only what it prints when it fails. There is no security vulnerability here.

This commit lets a Blockstream Jade hardware wallet automatically detect whether a transaction file is for Bitcoin or the Liquid sidechain (including test networks) when signing via QR codes or USB. Before, the wallet always assumed Bitcoin, which could cause it to fail or behave incorrectly when signing a Liquid transaction through those offline methods. The change itself is a feature fix and does not appear to introduce a security vulnerability.

This commit hardens the firmware signing script used when releasing Blockstream Jade hardware wallet firmware. It adds `set -e` so the script stops immediately if any command fails, and explicitly checks that the public and private key files exist before proceeding. Without these changes, the script could silently continue past errors (for example, if a key file was missing or a signing command failed), potentially producing or releasing firmware that was not properly signed. Proper signing is important because users rely on firmware signatures to verify that the software running on their device is authentic and has not been tampered with.

This commit only fixes spelling mistakes inside code comments (for example, changing 'sufficent' to 'sufficient' and 'Explcitly' to 'Explicitly'). No actual program instructions were changed, so it cannot affect security or functionality.

This commit is a code cleanup in the user-interface layer of the Blockstream Jade hardware wallet. It removes repeated 'if timeout' checks around button-waiting loops and lets the shared helper handle the timeout case instead. The commit message explicitly says there are no functional changes, and the diff shows only structural simplification—no security-sensitive logic was altered.

This commit is a code cleanup: it pulls the logic for waiting on a button press into a single shared helper function so the same code isn't repeated in many places. The behavior is essentially unchanged. The only functional difference is that one screen (the mnemonic setup) now explicitly treats a timeout as an error in normal builds, whereas before it would have hit a generic assertion. This is a minor hardening improvement, not a security vulnerability.

This commit reverts a previous change that made the Jade Plus (ESP32-S3) camera use a higher VGA resolution. It returns all hardware variants to the lower QVGA resolution because QVGA was found to scan QR codes faster and more accurately on Jade Plus. It also removes the larger VGA test images and simplifies the output-message buffer size logic. There is no security fix or vulnerability here.

This commit fixes a bug in how Blockstream Jade signs Liquid Bitcoin transactions. When extra data ('additional_info') was provided for a transaction input, the hardware wallet was not updating its internal running totals of input amounts per asset. This could cause the device to miscalculate whether a transaction is balanced—potentially allowing a malicious or buggy host to trick the wallet into approving a transaction that silently moves more value than the user expects. The fix makes the wallet explicitly require and record the input's asset and amount in this code path.

This commit blocks PSET (a privacy-enhanced Bitcoin transaction format) parsing on Blockstream Jade hardware wallets that lack extra RAM (SPIRAM). The change prevents the device from running out of memory while handling complex PSET data. It is a hardening/defensive fix rather than a clear exploit patch, because the commit message and diff do not describe an actual vulnerability—only a known resource limitation.

This commit is a code cleanup in the transaction signing logic for Blockstream Jade hardware wallets. It splits one function into two: one that gathers output information and another that validates it. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a refactoring to make the code clearer and to allow future reuse in PSBT signing.

This commit fixes how Blockstream Jade signs Liquid (Elements) Taproot transactions. Previously, the device used Bitcoin-style signature hashing for all networks, which is incorrect for Liquid Taproot. The fix passes a special 'Elements' flag when signing on Liquid so the signature hash matches Liquid's rules. Without this, signatures produced for Liquid Taproot transactions would be invalid or could potentially be produced using the wrong cryptographic formula, which in hardware wallets can sometimes lead to security issues like key leakage or signature-forgery attacks.