Blockstream Jade

This update fixes a check in the Blockstream Jade hardware wallet's attestation setup. Before the fix, the code did not verify that an externally-provided signature was small enough to fit into its storage buffer. A too-large signature could overflow that buffer during verification, potentially corrupting memory or crashing the device. The patch adds a size check before calling the signature verification routine.

This commit increases the stack memory given to the device's on-screen user-interface task. The change is described as fixing a 'stack overflow' that could happen while verifying a special backup phrase called a 'BIP85 mnemonic.' A stack overflow in the screen task could crash the user interface or, in the worst case, be abused to disrupt the device during a sensitive wallet operation.

This commit is a user-interface refactor for the Blockstream Jade hardware wallet. It replaces a PIN-only digit-entry screen with a shared 'digit entry' widget that can also accept shorter numeric indices (for things like BIP85 child mnemonic indexes or account indexes). The PIN entry behavior itself is preserved: PINs still require all six digits. The main functional change is that index entry can now be shorter than six digits, which is a usability improvement rather than a security fix. There is no vendor statement that this change addresses a security vulnerability.

This commit only adds a new test case and updates a description of an existing test. It does not change any production code. The new test documents that when a recovery key is provided with a full derivation path (from the master key), a Blockstream Jade device will still sign the transaction, but a helper function called is_green_multisig_signers() will return false, meaning some extra Green 2of3 validation is skipped. Because no actual signing logic is changed, this commit by itself is not a security fix or vulnerability.

This commit only adds a code comment explaining an existing limitation in how Blockstream Jade detects Green multisignature transactions. No code behavior changes. The comment documents that for a specific 2-of-3 recovery wallet setup, the device may skip extra Green-specific validation and fall back to treating the transaction as a standard 2-of-3 multisig, but signing still works correctly.

This commit changes a helper function that turns numeric Bitcoin key paths (like 0/1/2) into human-readable text. It adds an option to leave off the leading 'm/' so callers that only want the raw path can get it. All existing callers are updated to keep the old behavior (with the 'm/'), so there is no immediate change in behavior. It appears to be a code cleanup or preparation for a future feature rather than a fix for an active security problem.

This commit simply adds more information to an existing device status report (the 'get_version_info' RPC). It now reports whether tamper-evident attestation is active, the battery voltage, and whether the battery is charging. There is no change to security logic, access control, or cryptography. It is a routine telemetry/informational enhancement.

This commit only adds a new test data file containing a sample Bitcoin transaction (PSBT) for a multi-signature wallet scenario. It does not change any actual wallet code, cryptography, or security logic. There is no indication of a vulnerability or security fix.

This commit is a cleanup of the device attestation code in Blockstream Jade, which is the cryptographic proof that the device is genuine. The changes fix a memory-management bug where sensitive key data could be cleared in the wrong order, correct a logic issue when debug mode is enabled, avoid repeatedly reloading attestation data from storage, ensure cryptographic keys are initialized before being freed, and move a large attestation data structure from the stack to the heap to prevent a possible stack overflow. Most changes are defensive hardening, but the SENSITIVE_POP ordering and the debug-mode logic fix are genuine security-relevant corrections.

This commit is a pure variable rename inside a single function. The local variable `key_index` is renamed to `found_index` to make the code easier to read. No logic, behavior, or security properties change.

This commit moves when a special device private key (used for PIN server authentication) is created. Previously it was generated at every boot if missing; now it is created only when actually needed during a PIN operation. This is a code-quality and reliability change that reduces unnecessary key creation at startup, but it does not appear to fix an active security vulnerability.

This commit adds support for a new hardware variant called Jade Core (jade_v2c), which is a Jade Plus device without a camera or battery. The changes are purely build, configuration, release-script, and documentation updates to recognize the new board type. There is no indication of any security vulnerability being fixed or introduced.

This commit changes how Blockstream Jade hardware wallets sign Bitcoin transactions in a specific multi-signature setup called Green 2of3. It lets Jade act as the 'recovery signer' by deriving a special recovery key from the user's key when the first key in the transaction looks like a Blockstream Green server key. The change is a feature addition to support a previously unsupported signing scenario, not a fix for a known exploit. There is no evidence in the commit or supplied references that this is a security patch or that it addresses a disclosed vulnerability.

This commit updates the code that signs Bitcoin transactions for Blockstream Jade's Green multisig wallets. It specifically adds support for '2-of-3 recovery signing,' where the Jade device acts as the recovery key rather than the regular user key. The change lets Jade recognize and sign recovery transactions it previously would have rejected. There is no clear security bug being fixed; it appears to be a feature addition to support a missing signing scenario.