Coldcard coinjoin firmware — SLIP-19 (Mk4 + Mk5)

Coldcard coinjoin firmware — SLIP-19 remote signing

Unofficial Coldcard firmware that adds the SLIP-19 ownership proofs and HSM policy rules a Coldcard needs to sign WabiSabi coinjoin rounds unattended, for use with Wasabi Preview. Source: branches feature/slip19-coinjoin (Mk line) and feature/slip19-coinjoin-edge (Edge line). Same code is open upstream as Coldcard PR #685.

Not made, endorsed or supported by Coinkite.

Images

file	line	devices	base
firmware-5.6.0-slip19-NODEBUG-mk4.dfu	stable (Mk)	Mk4	5.6.0
firmware-6.6.0X-slip19-NODEBUG-mk4-mk5.dfu	Edge	Mk4 and Mk5	6.6.0X

Both are NODEBUG builds: the USB test/dev commands (EVAL/EXEC/XKEY) and the keypad-injection helper are not reachable — is_devmode is false on these images, and the Edge build additionally does not freeze the dev helper in at all. Coinjoin signing is gated by the on-device HSM policy; the host never sees a key.

• Mk4 users can run either image. The Edge (6.6.0X) build additionally carries the upstream Edge features.
• Mk5 users use the Edge (6.6.0X) build. Its header declares Mk4+Mk5 compatibility.
• The Q is deliberately not released here. See below.

Q status — no image published, and why

The Q ships with the classic HSM command set disabled. Enabling it needs supports_hsm turned on for that board, and an experimental Q build doing exactly that wedged a test device on first boot: it accepted the PIN, stopped on the Edge disclaimer screen, and never reached the main menu or USB, leaving no way to reflash it.

Root cause: hsm.py, hsm_ux.py and users.py are frozen into firmware only via manifest_mk4.py, because HSM was a Mk4-only feature. On a Q build those modules are absent, so flow.py's module-level from hsm import hsm_policy_available raises ImportError during boot, taking down menu construction after login — before USB is enabled. The simulator cannot catch this class of bug at all: it loads shared/*.py from source, while the manifest only governs frozen hardware builds.

Fixed on feature/slip19-coinjoin-q by adding the three modules to manifest_q1.py, plus a guard so a future manifest slip degrades to "HSM unavailable" rather than bricking. No Q image will be published until a corrected build is verified booting on real Q hardware.

The Mk4 and Mk5 images above are not affected. Verified at binary level — both contain the hsm.py / hsm_ux.py / users.py code, and the Edge branch never altered supports_hsm (Mk4/Mk5 have HSM natively). The failure required both the Q-only flag change and the Q manifest omission. Nothing to do if you already flashed them.

Verify before flashing

sha256sum -c SHA256SUMS.txt --ignore-missing
gpg --verify SHA256SUMS.txt.sig SHA256SUMS.txt

PGP key 2536 F69E 9C37 2566 2B6C 146B DCF1 7F7A 0127 2020 (Kevin Ravensberg).

Install (either image)

1. Copy the .dfu to a FAT32 microSD card, keeping the .dfu extension.
2. On the Coldcard: Advanced/Tools → Upgrade Firmware → From SD Card, pick the file, confirm.

Or over USB: ckcc upgrade <file>.dfu.

These are signed with the unofficial developer key, so the device shows a one-time "unofficial firmware" warning. To go back, install Coinkite's official .dfu the same way. This firmware does not change your seed or settings.

⚠️ Experimental. Test with small amounts.