Drop Python 3.9, use 3.10 for dist, bump Ledger

.containerignore

@@ -0,0 +1,11 @@
+# Exclude local build artifacts and any symlinks outside the context
+build*
+
+# Local documentation files (can be symlinks outside the context)
+*.md
+
+# Common Python / tooling artifacts
+__pycache__/
+*.pyc
+.venv/
+dist/

.dockerignore

@@ -0,0 +1,11 @@
+# Exclude local build artifacts and any symlinks outside the context
+build*
+
+# Local documentation files (can be symlinks outside the context)
+*.md
+
+# Common Python / tooling artifacts
+__pycache__/
+*.pyc
+.venv/
+dist/

.github/workflows/device-test.yml

@@ -18,7 +18,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.9', '3.10', '3.11', '3.12']
+        python-version: ['3.10', '3.11', '3.12']
         device:
           - ${{ inputs.device }}
         test:

.github/workflows/ledger-app-builder.yml

@@ -11,14 +11,17 @@ jobs:
   build:
     name: Build Bitcoin App
     runs-on: ${{ inputs.runs-on }}
-    # Pin to 4.23.0 for SDK v25.9.0 compatibility with Speculos v0.25.10
-    container: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:4.23.0
+    # Pin to 5.3.2 for SDK compatibility with app-bitcoin-new v2.4.6
+    container: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:5.3.2
     steps:
       - run: |
-          # Pin to v2.4.1 - last version that worked with HWI CI (PR #795 merged Sept 2025)
-          git clone --branch 2.4.1 --depth 1 https://github.com/LedgerHQ/app-bitcoin-new.git
+          # Pin to v2.4.6
+          git clone --branch 2.4.6 --depth 1 https://github.com/LedgerHQ/app-bitcoin-new.git
           cd app-bitcoin-new
-          make DEBUG=1 BOLOS_SDK=$NANOX_SDK
+          # Work around register-wallet policy parsing/display bugs fixed after v2.4.6.
+          git fetch --depth 2 origin 24bd597ee9c60fe58b522360011437d6a8679d33 a2ba8560c9306c53bd30840bd2333cecd7f47ae4
+          git -c user.name="HWI CI" -c user.email="hwi-ci@example.invalid" cherry-pick 24bd597ee9c60fe58b522360011437d6a8679d33 a2ba8560c9306c53bd30840bd2333cecd7f47ae4
+          make DEBUG=1 COIN=bitcoin_testnet BOLOS_SDK=$NANOX_SDK
       - uses: actions/upload-artifact@v4
         with:
           name: ledger_app

.github/workflows/ledger-legacy-app-builder.yml

@@ -11,7 +11,7 @@ jobs:
   build:
     name: Build Bitcoin Legacy App
     runs-on: ${{ inputs.runs-on }}
-    # Pin to 4.23.0 for SDK v25.9.0 compatibility with Speculos v0.25.10
+    # Pin to 4.23.0 for SDK v25.9.0 compatibility with Speculos v0.26.9
     container: ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:4.23.0
     steps:
       - run: |

.python-version

@@ -1 +1 @@
-3.9
+3.10.20

README.md

@@ -1,6 +1,6 @@
 # Bitcoin Hardware Wallet Interface
 
-[![Build Status](https://api.cirrus-ci.com/github/bitcoin-core/HWI.svg)](https://cirrus-ci.com/github/bitcoin-core/HWI)
+[![CI](https://github.com/bitcoin-core/HWI/actions/workflows/ci.yml/badge.svg)](https://github.com/bitcoin-core/HWI/actions/workflows/ci.yml)
 [![Documentation Status](https://readthedocs.org/projects/hwi/badge/?version=latest)](https://hwi.readthedocs.io/en/latest/?badge=latest)
 
 The Bitcoin Hardware Wallet Interface is a Python library and command line tool for interacting with hardware wallets.

ci/py310.Dockerfile

@@ -1,4 +1,4 @@
-# Cache break (modify this line to break cirrus' dockerfile build cache) 1
+# Cache break (modify this line to break the dockerfile build cache) 1
 
 FROM python:3.10
 

ci/py311.Dockerfile

@@ -1,4 +1,4 @@
-# Cache break (modify this line to break cirrus' dockerfile build cache)
+# Cache break (modify this line to break the dockerfile build cache)
 
 FROM python:3.11
 

contrib/build-wine.Dockerfile

@@ -1,7 +1,5 @@
 FROM debian:bookworm-slim
 
-SHELL ["/bin/bash", "-c"]
-
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update
 RUN apt-get install -y \

contrib/build.Dockerfile

@@ -1,7 +1,5 @@
 FROM debian:bookworm-slim
 
-SHELL ["/bin/bash", "-c"]
-
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update
 RUN apt-get install -y \
@@ -36,9 +34,9 @@ ENV PATH="$PYENV_ROOT/bin:$PATH"
 
 COPY contrib/reproducible-python.diff /opt/reproducible-python.diff
 ENV PYTHON_CONFIGURE_OPTS="--enable-shared"
-ENV BUILD_DATE="Jan  1 2019"
+ENV BUILD_DATE="Jan  1 2026"
 ENV BUILD_TIME="00:00:00"
-RUN eval "$(pyenv init --path)" && eval "$(pyenv virtualenv-init -)" && cat /opt/reproducible-python.diff | pyenv install -kp 3.9.19
+RUN /bin/bash -c 'eval "$(pyenv init --path)" && eval "$(pyenv virtualenv-init -)" && cat /opt/reproducible-python.diff | pyenv install -kp 3.10.20'
 
 ENV LC_ALL=C.UTF-8
 ENV LANG=C.UTF-8

contrib/build_bin.sh

@@ -6,8 +6,11 @@ set -ex
 
 ARCH=$(uname -m | tr '[:upper:]' '[:lower:]')
 
+PYTHON_VERSION=3.10.20
+
 eval "$(pyenv init --path)"
 eval "$(pyenv virtualenv-init -)"
+export PYENV_VERSION="$PYTHON_VERSION"
 pip install -U pip
 pip install poetry
 
@@ -21,8 +24,8 @@ else
 fi
 
 # We also need to change the timestamps of all of the base library files
-lib_dir=$(pyenv prefix)/lib/python3.9
-TZ=UTC find ${lib_dir} -name '*.py' -type f -execdir touch -t "201901010000.00" '{}' \;
+lib_dir=$(pyenv prefix)/lib/python3.10
+TZ=UTC find ${lib_dir} -name '*.py' -type f -execdir touch -t "202601010000.00" '{}' \;
 
 # Make the standalone binary
 export PYTHONHASHSEED=42
@@ -45,7 +48,7 @@ fi
 
 target_tarfile="hwi-${VERSION}-${OS}-${ARCH}.tar.gz"
 
-if [[ $gui_support == "--with-gui" ]]; then
+if [[ $gui_support == "--with-gui" && $ARCH == "x86_64" ]]; then
     tar -czf $target_tarfile hwi hwi-qt
 else
     tar -czf $target_tarfile hwi

contrib/build_dist.sh

@@ -4,8 +4,11 @@
 
 set -ex
 
+PYTHON_VERSION=3.10.20
+
 eval "$(pyenv init --path)"
 eval "$(pyenv virtualenv-init -)"
+export PYENV_VERSION="$PYTHON_VERSION"
 pip install -U pip
 pip install poetry
 
@@ -20,5 +23,5 @@ fi
 
 # Make the distribution archives for pypi
 poetry build -f wheel
-# faketime is needed to make sdist detereministic
-TZ=UTC faketime -f "2019-01-01 00:00:00" poetry build -f sdist
+# faketime is needed to make sdist deterministic
+TZ=UTC faketime -f "2026-01-01 00:00:00" poetry build -f sdist

contrib/build_wine.sh

@@ -3,7 +3,11 @@
 
 set -ex
 
-PYTHON_VERSION=3.9.13
+# Note: Python MSIs/EXEs are no longer hosted for 3.10.x on python.org.
+# The NuGet python package currently only goes up to 3.10.11, so Windows builds use that.
+PYTHON_VERSION=3.10.11
+PYTHON_NUGET_URL="https://api.nuget.org/v3-flatcontainer/python/${PYTHON_VERSION}/python.${PYTHON_VERSION}.nupkg"
+PYTHON_NUGET_HASH="7c6f99b160a36a7e09492dfcff2b0a3a60bb5229ca44cdcc3ecb32871a6144d0"
 
 PYTHON_FOLDER="python3"
 PYHOME="c:/$PYTHON_FOLDER"
@@ -19,28 +23,23 @@ WINDOWS_SDK_VERSION=10.0.17763.0
 
 wine 'wineboot'
 
-# Install Python
-# Get the PGP keys
-wget -O pubkeys.txt -N -c "https://keybase.io/stevedower/pgp_keys.asc?fingerprint=7ed10b6531d7c8e1bc296021fc624643487034e5"
-gpg --import pubkeys.txt
-rm pubkeys.txt
-
-# Install python components
-for msifile in core dev exe lib pip tools; do
-    wget -N -c "https://www.python.org/ftp/python/$PYTHON_VERSION/amd64/${msifile}.msi"
-    wget -N -c "https://www.python.org/ftp/python/$PYTHON_VERSION/amd64/${msifile}.msi.asc"
-    gpg --verify "${msifile}.msi.asc" "${msifile}.msi"
-    wine msiexec /i "${msifile}.msi" /qb TARGETDIR=$PYHOME
-    rm $msifile.msi*
-done
+# Install Python from NuGet package
+wget -O python.nupkg -N -c "$PYTHON_NUGET_URL"
+echo "$PYTHON_NUGET_HASH  python.nupkg" | sha256sum -c
+rm -rf python-nupkg
+7z x python.nupkg -opython-nupkg >/dev/null
+rm -rf ~/.wine/drive_c/python3
+mkdir -p ~/.wine/drive_c/python3
+cp -a python-nupkg/tools/* ~/.wine/drive_c/python3/
+rm -rf python.nupkg python-nupkg
 
 # Get and build libusb
 wget -N -c -O libusb.tar.bz2 "$LIBUSB_URL"
 echo "$LIBUSB_HASH  libusb.tar.bz2" | sha256sum -c
 tar -xf libusb.tar.bz2
 pushd "libusb-$LIBUSB_VERSION"
 ./configure --host=x86_64-w64-mingw32
-faketime -f "2019-01-01 00:00:00" make
+faketime -f "2026-01-01 00:00:00" make
 cp libusb/.libs/libusb-1.0.dll ~/.wine/drive_c/python3/
 popd
 rm -r libusb*
@@ -62,7 +61,7 @@ $PYTHON -m pip install poetry
 
 # We also need to change the timestamps of all of the base library files
 lib_dir=~/.wine/drive_c/python3/Lib
-TZ=UTC find ${lib_dir} -name '*.py' -type f -execdir touch -t "201901010000.00" '{}' \;
+TZ=UTC find ${lib_dir} -name '*.py' -type f -execdir touch -t "202601010000.00" '{}' \;
 
 # Install python dependencies
 POETRY="wine $PYHOME/Scripts/poetry.exe"