Skip to content

firmware: append partial sigs to support multisig#165

Merged
benma merged 1 commit intoBitBoxSwiss:masterfrom
guggero:sign-multisig
Apr 1, 2026
Merged

firmware: append partial sigs to support multisig#165
benma merged 1 commit intoBitBoxSwiss:masterfrom
guggero:sign-multisig

Conversation

@guggero
Copy link
Copy Markdown
Contributor

@guggero guggero commented Mar 25, 2026

Currently, even if the BitBox is the last of multiple devices to sign a multisig PSBT, the API just overwrites the partial sigs.
Appending the signature instead makes this work for P2WSH based multisig use cases.

Copy link
Copy Markdown
Contributor

@benma benma left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

case ourKey.segwit != nil:
psbtInput.PartialSigs = []*psbt.PartialSig{
{
psbtInput.PartialSigs = append(
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we to check if the pubkey is already present in the list?

https://github.com/btcsuite/btcd/blob/c47cb8aae0105f0fcb86e39eece00e6e5c8c9772/btcutil/psbt/updater.go#L84 does it too

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, I can add a check. But what would we do in that case? Replace the signature or error out? Would the BitBox even sign an input again if there's already a partial signature present for it (didn't check the firmware code).

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The firmware does not receive the PSBT in the raw PSBT format, and it it will sign when asked.

I was going to say that overwriting makes sense, but the btcd function linked above returns ErrDuplicateKey 🤔 I guess I don't have a strong opinion, but ending up with duplicate keys would be invalid, so that should be avoided.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Okay, I went with the replace approach and documented the behavior in the Godocs.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot!

@benma benma merged commit 27acdb0 into BitBoxSwiss:master Apr 1, 2026
3 checks passed
@guggero guggero deleted the sign-multisig branch April 1, 2026 09:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants