0.8.7-plus.3 — SeedSigner Plus (unofficial fork)

⚠️ Unofficial fork — not an official SeedSigner release

This is an unofficial fork of SeedSigner, customized for SeedSigner Plus hardware. It is not produced, endorsed, or supported by the SeedSigner project. Please do not report issues with this image to upstream.

If you have ordinary 240x240 SeedSigner hardware, use the official upstream release instead — this image will boot to the wrong display geometry on that hardware.

Supersedes 0.8.7-plus.2, which carried the display and camera corrections. Those are still here.

---

What's new: replay protection

Bitcoin's mainnet split in August 2026, and a signature made the ordinary way is valid under both sets of rules. A transaction signed on one chain can therefore be replayed onto the other by anyone who sees it.

This release can sign with the unified opt-in signature hash, hash type bit 0x20, added to Bitcoin Knots in PR #357. A signature that opts in commits to a message a pre-fork node cannot reconstruct, so it is invalid there and the transaction cannot be replayed. Nothing that was valid before stops being valid: the device signs the old way unless the PSBT asks for the new one.

You need a wallet that asks for it

The device does not decide this on its own. It signs with whatever hash type the PSBT it is given declares, so a wallet has to build the PSBT asking for the opt-in.

Sparrow (BLAKE2b) 2.5.5 does, once you tell it this device supports it: Settings → Keystores → Replay protection → "Supported by this device". Nothing a signer reports tells a wallet whether its firmware implements the opt-in, which is why that has to be marked by hand. With an earlier image on the device, leave it unticked.

Second image: Raspberry Pi Zero 2 W

This release ships two images where previous ones shipped one.

image	board
seedsigner_os.0.8.7-plus.3.pi0.img	Pi Zero, Pi Zero W
seedsigner_os.0.8.7-plus.3.pi02w.img	Pi Zero 2 W, Pi 3

Flash the one matching your board. They are not interchangeable: the Zero and the Zero 2 W are different architectures, ARMv6 and ARMv8.

Verifying

gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS

Build provenance

The signature hash lives in embit, which SeedSigner OS builds as a system package rather than taking from the app's requirements.txt. So this release is built from three repositories:

• app: paulscode/seedsigner@0.8.7-plus.3
• library: paulscode/embit@50de97a, pinned by commit and checked by sha256
• OS: paulscode/seedsigner-os@unified-sighash

The signature hash is checked against 166 cross-implementation test vectors taken from the reference implementation, covering bare, segwit v0, taproot and tapscript inputs. They are the same vectors Sparrow (BLAKE2b) is checked against, so both halves of the signing path are held to one reference.

Credit

The unified opt-in signature hash was ported from privkeyio/embit and privkeyio/seedsigner under the MIT licence, with thanks. The consensus rule is by the same author.

0.8.7-plus.2 — SeedSigner Plus (unofficial fork)

⚠️ Unofficial fork — not an official SeedSigner release

This is an unofficial fork of SeedSigner, customized for SeedSigner Plus hardware. It is not produced, endorsed, or supported by the SeedSigner project. Please do not report issues with this image to upstream.

If you have ordinary 240x240 SeedSigner hardware, use the official upstream release instead — this image will boot to the wrong display geometry on that hardware.

Supersedes 0.8.7-plus.1, which corrected only the display. This release also corrects the camera orientation. Plus users should flash this one.

---

What's different from upstream 0.8.7

Two SettingsEntry default values in src/seedsigner/models/settings_definition.py, and nothing else:

Setting	Upstream default	This fork
display_config	st7789_240x240	st7789_320x240 — the Plus panel
camera_rotation	180	0 — the Plus camera is mounted 180° from upstream's assumption

- default_value=SettingsConstants.DISPLAY_CONFIGURATION__ST7789__240x240
+ default_value=SettingsConstants.DISPLAY_CONFIGURATION__ST7789__320x240

- default_value=SettingsConstants.CAMERA_ROTATION__180
+ default_value=SettingsConstants.CAMERA_ROTATION__0

On a clean boot that means the large screen renders correctly and the scan preview is right side up, with:

• no persistent settings required — nothing is written to the SD card, at build time or at startup;
• no Settings QR to scan and no trip into the Settings menu;
• a reboot returning to these defaults, since persistence stays disabled.

The 320x240 ST7789 support and the camera rotation setting are both upstream SeedSigner functionality (the display support landed upstream in v0.8.6). This fork adds no display driver, no rendering code, and no camera handling — it only changes which existing values are the defaults.

Both settings remain available in the UI (Settings > Advanced > Hardware > Display type and Settings > Advanced > Camera rotation), and every upstream option is still supported.

Changes since 0.8.7-plus.1

• Default camera_rotation 180 → 0, fixing the upside-down scan preview on Plus hardware. Verified on device.

Note that SeedSigner offers camera rotation only — there is no mirror/vertical-flip option. Camera renders each frame with rotate(90 + camera_rotation), so upstream's 180 gives an effective 270° and this fork's 0 gives an effective 90°.

Intended hardware

Raspberry Pi Zero v1.3 + SeedSigner Plus (320x240 ST7789). Use the pi0 image.

Build record

Source repo	https://github.com/paulscode/seedsigner.git
Source tag	0.8.7-plus.2
Source commit	ef3f17c3548a1d72d011ad9f15c669cfe4a70aba
Upstream base	SeedSigner 0.8.7 (e0a80d4b33b8eb7fb1e9fd14a27b7cd11c7d2cd6)
Builder	SeedSigner/seedsigner-os tag v0.8.7 (buildroot submodule bf2a2858)
Board target	pi0
Image	seedsigner_os.0.8.7-plus.2.pi0.img (52,428,800 bytes)
SHA-256	201bfdfea35201db9096e87b266979261bf1356e2ec0304cf033b0f63c3d9f2c

Built with the upstream reproducible build process, unmodified apart from pointing --app-repo at this fork:

git clone --recursive https://github.com/SeedSigner/seedsigner-os.git
cd seedsigner-os
git checkout v0.8.7
git submodule update --init --recursive

export DOCKER_DEFAULT_PLATFORM=linux/amd64
SS_ARGS="--pi0 --app-repo=https://github.com/paulscode/seedsigner.git --app-branch=0.8.7-plus.2" \
  docker compose up --force-recreate --build

Verify your download

Check the image against the published checksum:

sha256sum -c SHA256SUMS

SHA256SUMS is signed with a detached, armored PGP signature (SHA256SUMS.asc). Verify the signature before trusting the checksum:

gpg --verify SHA256SUMS.asc SHA256SUMS

These artifacts are signed with the paulscode key, not the SeedSigner project's GPG key — deliberately so, because they are not SeedSigner releases. My public key is available on my website at paulscode.com. If you require an image signed by the SeedSigner project, build from source yourself using the command above, or use the official upstream release.

Licensing

MIT, unchanged from upstream. All upstream attribution is intact. See LICENSE.md and docs/seedsigner_plus_fork.md.

0.8.7-plus.1 — SeedSigner Plus (unofficial fork)

⚠️ Superseded by 0.8.7-plus.2

This release corrected only the display default. The scan camera preview is upside down on SeedSigner Plus hardware, which 0.8.7-plus.2 fixes by also defaulting camera_rotation to 0.

Plus users should flash 0.8.7-plus.2 instead. This release is kept for auditability.

---

⚠️ Unofficial fork — not an official SeedSigner release

This is an unofficial fork of SeedSigner, customized for SeedSigner Plus hardware. It is not produced, endorsed, or supported by the SeedSigner project. Please do not report issues with this image to upstream.

If you have ordinary 240x240 SeedSigner hardware, use the official upstream release instead — this image will boot to the wrong display geometry on that hardware.

---

What's different from upstream 0.8.7

Exactly one behavioural change: the default value of the display_config setting is the 320x240 ST7789 panel used by SeedSigner Plus, instead of upstream's 240x240 display.

  src/seedsigner/models/settings_definition.py

- default_value=SettingsConstants.DISPLAY_CONFIGURATION__ST7789__240x240
+ default_value=SettingsConstants.DISPLAY_CONFIGURATION__ST7789__320x240

That means on a clean boot:

• the large screen works immediately — no Settings QR to scan, no trip into the Settings menu;
• persistent settings do not need to be enabled, and no settings.json is created or written;
• with persistence left disabled, a reboot simply returns to the 320x240 default.

The 320x240 ST7789 support itself is upstream SeedSigner functionality, added in v0.8.6. This fork adds no display driver and no rendering code. The display setting remains available at Settings > Advanced > Hardware > Display type, and the 240x240 option is still fully supported.

Intended hardware

Raspberry Pi Zero v1.3 + SeedSigner Plus (320x240 ST7789). Use the pi0 image.

Build record

Source repo	https://github.com/paulscode/seedsigner.git
Source tag	0.8.7-plus.1
Source commit	b9541637cab5da6b3e1e62c8237c02852834b061
Upstream base	SeedSigner 0.8.7 (e0a80d4b33b8eb7fb1e9fd14a27b7cd11c7d2cd6)
Builder	SeedSigner/seedsigner-os tag v0.8.7 (bf2a2858 buildroot submodule)
Board target	pi0
Image	seedsigner_os.0.8.7-plus.1.pi0.img (52,428,800 bytes)
SHA-256	c1f50d2679d5e2a33d92aef776a7b689a2113acb2d30560b17609560d5d35884

Built with the upstream reproducible build process, unmodified apart from pointing --app-repo at this fork:

git clone --recursive https://github.com/SeedSigner/seedsigner-os.git
cd seedsigner-os
git checkout v0.8.7
git submodule update --init --recursive

export DOCKER_DEFAULT_PLATFORM=linux/amd64
SS_ARGS="--pi0 --app-repo=https://github.com/paulscode/seedsigner.git --app-branch=0.8.7-plus.1" \
  docker compose up --force-recreate --build

Verify your download

Check the image against the published checksum:

sha256sum -c SHA256SUMS

SHA256SUMS is signed with a detached, armored PGP signature (SHA256SUMS.asc). Verify the signature before trusting the checksum:

gpg --verify SHA256SUMS.asc SHA256SUMS

These artifacts are signed with the paulscode key, not the SeedSigner project's GPG key — deliberately so, because they are not SeedSigner releases. My public key is available on my website at paulscode.com. If you require an image signed by the SeedSigner project, build from source yourself using the command above, or use the official upstream release.

Licensing

MIT, unchanged from upstream. All upstream attribution is intact. See LICENSE.md and docs/seedsigner_plus_fork.md.