KeepKey Firmware v7.14.3

Verification

Source commit: f58ba5d47548b865a2332f9de113c2f7f5fda1ee (tag v7.14.3, on master)

v7.14.3 is a Bitcoin-only release: the attached firmware.keepkey.bitcoin-only.bin is the Bitcoin-only image. Multi-coin devices stay on v7.14.2.

To verify this release

git clone https://github.com/keepkey/keepkey-firmware
cd keepkey-firmware
git checkout v7.14.3
git submodule update --init --recursive
docker run -t -v $(pwd):/root/keepkey-firmware:z \
  kktech/firmware@sha256:7438e53933d47d53157ed6d96d864cb208597e62dce26235ace09d1063427fa2 \
  /bin/sh -c "mkdir /root/build && cd /root/build && \
    cmake -C /root/keepkey-firmware/cmake/caches/device.cmake /root/keepkey-firmware \
      -DCMAKE_BUILD_TYPE=MinSizeRel -DKK_BITCOIN_ONLY=ON && make && \
    mkdir -p /root/keepkey-firmware/bin && cp bin/*.bin bin/*.elf /root/keepkey-firmware/bin/"
tail -c +257 bin/firmware.keepkey.bin | shasum -a 256

This is the same pinned container and command as scripts/build/docker/device/release.sh, with -DKK_BITCOIN_ONLY=ON added.

Expected hash: 4cf84bfe977d00ca18d871791f3308206649c88b681ed9ad09c5081787488f64

Hash the downloaded release file the same way: tail -c +257 firmware.keepkey.bitcoin-only.bin | shasum -a 256.

See https://keepkey.com/blog/verifying_keepkey_firmware for full verification workflow.

Note: The build embeds the source commit in the firmware binary, so verification must check out the tag (which points to f58ba5d).

The attached binary is signed by firmware key slots 1, 2, 3 (3-of-5).

What's new

7.14.3 builds on 7.14.2 for Bitcoin-only devices.

• Taproot signing.
• Stronger setup, storage and entropy handling.
• Cancellation stops active work cleanly.
• Clearer address and message review.