Release v4.18.0

Release notes

• Fix an occasional app crash after sending a Bitcoin transaction
• Fix a rare sync Bitcoin sync issue which can lead to a corrupt database
• Show also internal transactions in Ethereum
• Bundle BitBox02 Bitcoin-only firmware version 7.0.0
• Bundle BitBox02 Multi firmware version 7.0.0

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import
# or via Tor hidden service
curl http://keybase5wmilwokqirssclfnsqrjdsi7jdir5wy7y7iu3tanwmtp6oid.onion/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.18.0-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.18.0-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.18.0-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.17.2

Release notes

• Bundle BitBox02 Bitcoin-only firmware version 6.1.0
• Bundle BitBox02 Multi firmware version 6.1.0

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.17.2-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.17.2-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.17.2-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.17.1

Release notes

• Disable Safello
• BitBox02 detection / routing bugfix for Android
• Reduce BitBox01 min. recovery password length

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.17.1-macOS.zip.asc

You should something similar to the following output (the info might be arranged differently depending on your platform and gpg tool):

gpg --verify BitBox-4.17.1-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.17.1-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Some tools also display the sort subkey ID 8C37EAE8, which are the last couple of characters of the signing subkey 2D8876810AB092E451DCA894804538928C37EAE8.

Release v4.17.0

Release notes

• Bundle BitBox02 Bitcoin-only firmware version 6.0.0
• Bundle BitBox02 Multi firmware version 6.0.0
• Added new languages: Spanish and Slovenian
• Various UI improvements and bugfixes
• Ethereum out of beta

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.17.0-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.17.0-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.17.0-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.16.1

Release notes

• Bundle BitBox01 firmware version 7.0.4
• Various small UI improvements and bugfixes

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.16.1-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.16.1-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.16.1-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.16.0

Release notes

• Bundle BitBox02 Bitcoin-only firmware version 5.0.0
• Bundle BitBox02 Multi firmware version 5.0.0
• Support to buy Bitcoin with credit card, powered by Safello
• Added ERC20 Tokens: Multi-Collateral Dai (renamed the old Single Collateral Dai to Sai) and USDC

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.16.0-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.16.0-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.16.0-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.15.0

Release notes

• Add app translations for Bulgarian, Chinese, Persian and Turkish
• Restored compatibility with Electrs (pending transactions issue)
• Promo-Code for the BitBox02
• Increased gap limit for legacy Bitcoin change addresses
• Expert feature: command line flags to manually set the gap limits
• Removed legacy LTC address converter (M... addresses to 3... addresses)

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.15.0-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.15.0-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.15.0-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Android - 2019/11/25 Release

Release notes

• fixed spurious BitBox02 failed attestation warning

Release v4.14.1

Release notes

• Tor proxy support
• Bundle BitBox02 Bitcoin-only firmware version 4.2.2
• Bundle BitBox02 Multi firmware version 4.2.1
• Bundle BitBox01 firmware version 7.0.3

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.14.1-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.14.1-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.14.1-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.14.0

Note: This is superseded by v4.14.1, which contains a hot-fix for a connectivity issue of the BitBox02 Bitcoin-only on Windows.