Release v4.20.1

This is Android only release to lift the "Early Access" beta label.
https://play.google.com/store/apps/details?id=ch.shiftcrypto.bitboxapp

It includes correct UI language detection based on system locale.

Release v4.20.0

Release notes

• Bundle BitBox02 Bitcoin-only firmware version 9.0.0
• Bundle BitBox02 Multi firmware version 9.0.0
• Unify all Bitcoin (Litecoin) account types (segwit, native segwit) into one account for the BitBox02
• Add French translation
• Add Hebrew translation (thanks @Sh0ham)
• Various little UI improvements
• macOS app is now notarized and can be opened again without workarounds or warnings on macOS Catalina
• BTC transactions marked as RBF

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import
# or via Tor hidden service
curl http://keybase5wmilwokqirssclfnsqrjdsi7jdir5wy7y7iu3tanwmtp6oid.onion/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.20.0-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.20.0-macOS.zip.asc
gpg: assuming signed data in 'BitBox-4.20.0-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.19.1

Release notes

Hotfix release to BitBoxApp v4.19.0.

• Fix gas limit estimation bug in Ethereum transactions which can lead to an insufficent gas limit

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import
# or via Tor hidden service
curl http://keybase5wmilwokqirssclfnsqrjdsi7jdir5wy7y7iu3tanwmtp6oid.onion/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.19.1-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.19.1-macOS.zip.asc
gpg: assuming signed data in 'BitBox-4.19.1-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.19.0

Release notes

• Bundle BitBox02 Bitcoin-only firmware version 8.0.0
• Bundle BitBox02 Multi firmware version 8.0.0
• Buy crypto with recommended exchanges
• Allow Tor connections to Electrs without TLS
• Add checkpoints for SPV header verification
• Support HiDPI scaling on Windows
• Bugfix: Ethereum transaction creation sometimes failed due to the EtherScan gas limit query failing

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import
# or via Tor hidden service
curl http://keybase5wmilwokqirssclfnsqrjdsi7jdir5wy7y7iu3tanwmtp6oid.onion/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.19.0-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.19.0-macOS.zip.asc
gpg: assuming signed data in 'BitBox-4.19.0-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.18.0

Release notes

• Fix an occasional app crash after sending a Bitcoin transaction
• Fix a rare sync Bitcoin sync issue which can lead to a corrupt database
• Show also internal transactions in Ethereum
• Bundle BitBox02 Bitcoin-only firmware version 7.0.0
• Bundle BitBox02 Multi firmware version 7.0.0

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import
# or via Tor hidden service
curl http://keybase5wmilwokqirssclfnsqrjdsi7jdir5wy7y7iu3tanwmtp6oid.onion/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.18.0-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.18.0-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.18.0-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.17.2

Release notes

• Bundle BitBox02 Bitcoin-only firmware version 6.1.0
• Bundle BitBox02 Multi firmware version 6.1.0

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.17.2-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.17.2-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.17.2-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.17.1

Release notes

• Disable Safello
• BitBox02 detection / routing bugfix for Android
• Reduce BitBox01 min. recovery password length

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.17.1-macOS.zip.asc

You should something similar to the following output (the info might be arranged differently depending on your platform and gpg tool):

gpg --verify BitBox-4.17.1-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.17.1-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Some tools also display the sort subkey ID 8C37EAE8, which are the last couple of characters of the signing subkey 2D8876810AB092E451DCA894804538928C37EAE8.

Release v4.17.0

Release notes

• Bundle BitBox02 Bitcoin-only firmware version 6.0.0
• Bundle BitBox02 Multi firmware version 6.0.0
• Added new languages: Spanish and Slovenian
• Various UI improvements and bugfixes
• Ethereum out of beta

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.17.0-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.17.0-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.17.0-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.16.1

Release notes

• Bundle BitBox01 firmware version 7.0.4
• Various small UI improvements and bugfixes

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.16.1-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.16.1-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.16.1-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)

Release v4.16.0

Release notes

• Bundle BitBox02 Bitcoin-only firmware version 5.0.0
• Bundle BitBox02 Multi firmware version 5.0.0
• Support to buy Bitcoin with credit card, powered by Safello
• Added ERC20 Tokens: Multi-Collateral Dai (renamed the old Single Collateral Dai to Sai) and USDC

Verifying the release

Get benma's public key:

curl https://keybase.io/benma/pgp_keys.asc?fingerprint=2260e48288882c76afaa319d67a2b160f74db275 | gpg --import

Download the app for your platform and the corresponding .asc file and place them in the same folder.

We will verify the signature of the macOS release as an example. The other files are verified in the same way by replacing the filename.

To verify the signature, execute:

gpg --verify BitBox-4.16.0-macOS.zip.asc

You should see the following output:

gpg --verify BitBox-4.16.0-macOS.zip.asc 
gpg: assuming signed data in 'BitBox-4.16.0-macOS.zip'
gpg: Signature made <DATE AND TIME>
gpg:                using RSA key 2D8876810AB092E451DCA894804538928C37EAE8
gpg: Good signature from "Marko Bencun <marko@shiftcrypto.ch>" [ultimate]
gpg:                 aka "Marko Bencun <mbencun+pgp@gmail.com>" [ultimate]

(The [ultimate] could say [unknown] or something else depending on your trust level.)