# BitTool Signer: completed local verification

Checked 30 October 2026. These results were prepared with AI assistance for reviewer inspection. They are local automated tests and package checks, not an independent security audit. They apply to Signer, not to BitTool Wallet. No phone, camera, biometric flow, native crypto bridge or companion application was exercised.

## Release-engine rebuild and regression tests

| Release source | Commit | Regression tests | Rebuilt JavaScript bundle |
|---|---|---|---|
| iOS `v1.0.0` | `f621372ddeb6740328af0ccfbdd5e28c3f7c9358` | 210 passed; 0 failed | Matches the bundle tracked in that release |
| Android `android-v1.0.0` | `71af693db0c9e728b906c2112e14bab561ed308c` | 217 passed; 0 failed | Matches the bundle tracked in that release |

The suites overlap; do not add these counts and call them 427 unique tests. The builds used the pinned release sources and lockfiles. Android's build rewrote the bundle-manifest file path from a stale iOS resource path to the Android asset path; the engine bytes and hash remained identical. This is an engine-resource comparison, not a full APK/AAB or App Store executable rebuild.

SHA-256 of the iOS release engine:

`6933d0d8a6f60faa8222506ac0bd7eef80eb884c9f73e31e9f354b4740f21077`

SHA-256 of the Android release engine:

`4b3717599e8ee3ed9d2480e640e7203731543cc8ab0f2c3cec3b78e6f400fa19`

The released engines differ. Android's engine also matches the separately inspected current iOS source snapshot, but that current-source fact is not evidence about the installed iOS release. No App Store IPA was inspected.

Sources: [iOS release source](https://github.com/bitbill/bittool-signer-ios/tree/f621372ddeb6740328af0ccfbdd5e28c3f7c9358), [Android release source](https://github.com/bitbill/bittool-signer-android/tree/71af693db0c9e728b906c2112e14bab561ed308c).

## Official direct-download Android APK

The downloaded package is `com.bittool.signer`, version 1.0.0, version code 1000001, with a minimum SDK of 26 (Android 8). It is 20,791,832 bytes. APK Signature Scheme v2 and v3 verification succeeded, and the signer-certificate fingerprint matched the publisher's reference. The extracted `signer.js` asset matched the Android release-engine hash above. It does not match the iOS v1.0.0 release-engine hash.

APK SHA-256:

`109dbf5c622ee77672904c34a10229df3c9b0eac45b07096c510b1e1e169c2a4`

Signing certificate SHA-256:

`af41ed101765393ae89038eb4c6fc7fa96d930f6fcd76b881437a39b5a9e4631`

No `android.permission.INTERNET` was found in the parsed manifest. This describes the inspected APK's declared permission set; it is not proof of every device/runtime behavior or a measurement of physical isolation. No Google Play package was compared, and no full native application was rebuilt or installed.

Source: [official Signer download page](https://bittool.com/signer/) and [versioned APK](https://bitbill.oss-accelerate.aliyuncs.com/BitToolSigner-1.0.0-1000001.apk).

## Extracted APK engine: eight smoke checks

The APK's JavaScript asset was executed in a Node v20.20.2 VM. Six positive cases passed: native SegWit PSBT v0 and v2, Taproot PSBT v0 and v2, nested SegWit PSBT v0, and legacy PSBT v0. Each exercised request/response UR transport, signature verification, preservation of the unsigned transaction and reference-library finalization. Both negative cases also passed: a Bitcoin testnet request was rejected with `NETWORK`, and a wrong fingerprint was rejected with `FINGERPRINT`.

These are six selected cases across four script profiles, not all PSBT/script/wallet combinations. UR encode/decode in a VM is not a camera QR-scan test. Node's `webcrypto` supplied the host random-number source; the mobile native bridge was not tested. Reference-library finalization does not make fabricated previous outputs real or spendable.

The smoke run completed at `2026-10-29T23:04:42.411Z` (10:04:42 Sydney, 30 October 2026). Machine-readable results are in `verification_summary.json`.

## Fixture use and Bitcoin network constraint

The inspected release source restricts Bitcoin signing to mainnet: [request-network check](https://github.com/bitbill/bittool-signer-android/blob/71af693db0c9e728b906c2112e14bab561ed308c/engine/src/bitcoin.js#L133) and [derivation-path check](https://github.com/bitbill/bittool-signer-android/blob/71af693db0c9e728b906c2112e14bab561ed308c/engine/src/bitcoin.js#L218). Generic key/path utilities accepting another network do not establish transaction-signing support for it.

The six fixtures in `fixtures/public_psbt_ur_fixtures.json` deliberately use public BIP39 test material, mainnet syntax and fabricated inputs. **Never fund the public keys or broadcast these transactions.** They are data for inspecting encoding, review and signatures; they do not spend actual UTXOs. No on-chain claim is made that these public addresses have never received funds; this test used no real funds and referenced no real UTXOs. Their presence does not show that a companion can import them or that a phone has scanned them.

Keep real-device rows in `compatibility_matrix_template.json` marked **Not run** until those exact phone and companion combinations have been tested. These checks leave published unresolved security findings unchanged. They do not establish Wallet behavior, Sparrow/Cove compatibility, recovery correctness, complete app reproducibility or an independent audit.