Skip to content

1.4.0-beta1

Latest
Latest

Choose a tag to compare

View all tags
@Jacksper13 Jacksper13 released this 16 Aug 18:14
1.4.0-beta1
92e579f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.
image

WHAT'S CHANGED

KeyOS 1.4.0 is a major release for Passport Prime, headlined by a fully redesigned launcher. It also introduces multisig exports for Unchained and Casa, connections for Bitcoin Safe and Coconut Wallet, imports from Aegis and Proton Authenticator, and extensive security improvements across Bitcoin signing, multisig validation, apps and storage.

NEW FEATURES

  • The launcher has been fully redesigned, with brand-new app icons, an overhauled light-pattern background and icon dock, customizable app icon placements, and a smoother unlocking animation
  • You can now sideload third-party apps directly from Settings > Apps with a new install button. This feature is available in the new Apps menu and is backed by an "Allowed Publishers" model that puts trust decisions in your hands. In addition, you can pick and choose the permissions for sensitive operations for these apps.
  • You can now export multisig wallet configurations for Unchained and Casa from the Bitcoin app, using both file and UR/QR formats
  • Bitcoin Safe and Coconut Wallet connections added to the Bitcoin app
  • You can now import existing TOTP accounts from Aegis or Proton Authenticator by QR code or file, including password-protected encrypted exports
  • You now have to enter your PIN before Passport Prime shows your seed words, adding an extra safety step to the seed reveal flow

IMPROVEMENTS

  • Passport Prime's entropy stack has been hardened. The ATECC608 secure element's RNG is now mixed into master-seed derivation as a third entropy source. Minor improvement to the statistical quality of random data from the Avalanche Noise Source.
  • Battery life has been improved by putting the fuel gauge chip into its lowest possible power mode on shutdown
  • Battery reserve is now set to 15% by default (up from 5%) as a safeguard against long-tail battery drain
  • Default screen brightness is now 70%, (your existing brightness preference is preserved on update)
  • Recovery now clears stale update state carried over from a previous run, and verifies signed hashes before writing app manifests and assets
  • Text input fields now enforce a sensible default maximum length, and BIP32 index validation has been improved for account creation
  • The on-screen keyboard now automatically scrolls the selected input field into view when it opens
  • QR code encoding has been optimized, meaningfully reducing CPU usage while rendering
  • Board revision is now shown in Settings > About > Device, so you can identify which hardware revision is inside your unit without opening it
  • Authenticator import flow now shows a spinner while decrypting your file
  • Added support for SLIP-132 Ypub-encoded multisig configuration when imported via animated ur:bytes QR
  • Updated multiple dependencies, including upgrading rustc from 1.91.1.1 to 1.96.0.1, upgrading Slint to 1.17, and addressing RUSTSEC 2026-0216 and RUSTSEC 2026-0235

BUG FIXES

  • Fixed a bug where P2WSH and P2SH-P2WSH change output validation could classify an attacker-controlled multisig script as "Change" without verifying the account's registered cosigners or threshold
  • Fixed a bug where a malicious PSBT could label attacker-owned outputs as "Change" by presenting a genuine device key as a decoy in one derivation map while another key constructed the actual output
  • Fixed a bug where KeyOS enabled trust_witness_utxo when signing PSBTs, which re-exposed the multi-round fee attack described by CVE-2020-14199
  • Fixed a bug where repeated cosigner keys in a multisig configuration could silently collapse the effective signing threshold below what you had chosen
  • Fixed a bug where undefined behavior in foundation-arena safe allocations could cause miscompilations
  • Fixed a user-triggerable kernel panic (full device reboot) that could be caused by lending or moving an unmapped buffer through IPC
  • Fixed a bug where U2F APDU dispatch would panic on a short APDU due to an unchecked header slice
  • Fixed a bug where an over-long app name could wedge the GUI server via a panic in the switcher notification path
  • Fixed a bug where the screen capture path built an out-of-bounds slice for the RGB565 camera layer due to a hard-coded bytes-per-pixel constant
  • Fixed a bug where runtime interrupt-disable requests left AIC sources enabled, allowing spurious interrupts after disable
  • Fixed a bug where eMMC transfer failures were acknowledged as successful reads, writes, and flushes back to the filesystem layer
  • Fixed a bug where Seed Vault and Authenticator credential-table writes could fail silently or corrupt the only database copy
  • Fixed a bug where third-party AppData and mapped-file caches had no resource quota, allowing a misbehaving app to exhaust RAM
  • Fixed several bugs in the st25r95 NFC driver, including hardware status errors being treated as successful acknowledgements, non-indexed register writes sending extra bytes, tag-detector calibration underflowing DAC thresholds, and ISO14443A anti-collision filter payloads corrupting UID filters
  • Fixed a bug where Passport Prime held onto the first account index used for message signing when trying to sign for another account
  • Fixed a bug where the Vault app would crash when attempting to import an 18-word seed
  • Fixed a visual bug where the Bitcoin account creation error page rendered incorrectly
  • Fixed a bug where tapping the empty passphrase icon area in the Bitcoin wallet opened the passphrase menu even when no passphrase was applied
  • Fixed a bug where incomplete multisig metadata could panic PSBT validation
  • Fixed a bug where the second keycard would never verify during Magic Backup verify when two keycards happened to share a Shamir share index
  • Fixed a bug where restarting onboarding after an already-established Envoy pairing could trigger a spurious Passport Disconnected modal while scanning the pairing QR
  • Fixed a bug where the FIDO server could initialize state before AppData was mounted
  • Fixed a bug where the QR reader could consume 100% CPU when launched from the launcher
  • Fixed a bug where setting the date and the time together on the Date & Time screen would persist only one of the two changes
  • Fixed a minor visual bug where the GUI server would glitch mid-unlock animation
  • Fixed a minor visual bug where placeholder text had no contrast in dark mode
  • Fixed a minor visual bug where a single seed word could wrap across two lines in some instances
  • Fixed a minor visual bug where the fade-out overlay was visible when scrolling on some Settings pages
  • Fixed a minor visual bug where the control menu background was not seamless with the new launcher

HOW TO UPDATE

  1. Download KeyOS-v1.4.0-beta1-Recovery.bin to an external drive (microSD card or flash drive)
  2. Turn on your Passport Prime
  3. While the Foundation logo is being displayed during boot, tap the power button repeatedly, this should bring you to the Boot Menu
  4. Select "Recovery", this will bring you to the Firmware Recovery menu
  5. Tap Firmware Recovery
  6. Connect the external drive to the USB C port on Passport Prime (you will need a USB C adapter if you saved to microSD or USB A device on step 1)
  7. Select KeyOS-v1.4.0-beta1-Recovery.bin saved during step 1

Note: In order to upgrade to the official 1.4.0 release, you will have to follow the same steps with the 1.4.0 recovery file.

AI security review by Claude Fable Max and ChatGPT 5.6 Sol Extra High found no Critical security issues.

Assets 3
Loading