CommitWatch RSS
MP
← Developer activityStrong match

Martin Pastyřík

Public commit activity attributed with strong match confidence. This page describes observable work, not personal trustworthiness.

23 commits1 monitored projects8 candidates1 high-risk analyses
Project constellation

Where the commits appear

Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.

Monitored External sample
Projects connected to Martin PastyříkA visual map of monitored and externally discovered repositories.MPdeveloper23Trezor firmware
Monitored evidence

CommitWatch projects

Trezor firmwareTrezor23 commits8 candidates1 high risk
External discovery

Other public projects

No external sample loaded yet.

A verified GitHub handle is needed before external discovery.
Analyzed activity

Recent published watches

Message quality and risk characterize commits, never the person.

Informational 22 AI analysisMessage 92 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(prodtest): log Tropic initialization errors

This commit changes how the Trezor hardware wallet's production-test firmware initializes the Tropic secure chip. Previously, the chip was initialized automatically at boot and failures were silently ignored. Now, initialization is done on…

Change from silent boolean init failure to explicit error-code reportingRemoval of boot-time Tropic initialization in production-test firmwareDeletion of `tropic_wait_for_ready()` polling loop
9a0ae88aby Martin Pastyřík+313−18114 files
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): make rotation_index optional

This commit loosens a data-format rule for a Trezor feature called Evolu. It changes the `rotation_index` field in an 'EvoluRegistrationRequest' message from 'must be provided' to 'may be omitted'. The stated reason is to fix a compatibili…

Relaxation of a required field to optional in a registration protocol messageRemoval of a presence check in generated Rust message validationNo mention of security impact, CVE, or vulnerability in commit message or diff
01aa1bffby Martin Pastyřík+7−104 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 80 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): set tropic configuration

This commit moves the configuration settings for the Tropic secure chip out of the production-test tool and into the main firmware. At boot, the device now checks whether the Tropic chip's configuration matches the version expected by the …

Boot-time enforcement of expected secure-element configurationVersioned configuration tables for reversible and irreversible Tropic configsUse of a backup slot during configuration update
4a93242cby Martin Pastyřík+9518−53028 files
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): sign rotation index into Evolu sign registration

This commit updates the Trezor firmware's Evolu (delegated identity) registration signing feature so that the device now includes a 'rotation index' in the signed registration request. The rotation index tells the Quota Manager which versi…

Cryptographic signing protocol version bump (V1 -> V2)New required protobuf field in a security/identity messageDelegated identity key rotation logic touched
4db3a69dby Martin Pastyřík+106−288 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): typo in tropic.c

A single-word typo in a Trezor hardware-wallet security file meant a safety check did nothing. The code said 'false;' instead of 'return false;', so when a buffer-limit check failed, the function kept running instead of stopping. This coul…

Missing return statement neutralizes a bounds checkSubsequent memcpy may write beyond intended output buffer limitsLocated in secure-element/tropic driver code (core/embed/sec/tropic/tropic.c)
e473dcc3by Martin Pastyřík+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 94 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(tests): Fix Evolu nightly tests

This commit only changes automated test code for the Evolu feature. It replaces hard-coded cryptographic proof values with dynamically generated ones so the tests pass on real hardware. There is no change to the actual Trezor firmware or a…

80a023aeby Martin Pastyřík+50−542 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): Evolu key rotation

This commit adds a key-rotation feature for the 'Evolu' / 'Suite Sync' delegated identity key used by Trezor. It introduces a rotation index that is mixed into the key derivation, lets users rotate the key on demand, and stores the current…

Changes to hardware-backed key derivation (secret_keys)Adds new wire messages for key rotation and index managementAdds device-storage field for rotation index
8807fec0by Martin Pastyřík+1890−26557 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 77 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(prodtest): Add Tropic random value and Tropic initialize to Tropic stress test

This commit is a routine feature addition to an internal production-test tool used during hardware manufacturing. It expands a stress test for the Tropic secure chip to also exercise chip initialization and random-number generation, and it…

9fe2945fby Martin Pastyřík+60−337 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(tests): update UI fixtures

This commit only updates expected test result fingerprints (called UI fixtures) in a single JSON file. It does not change any firmware, application, or test logic. There is no security-relevant code change here.

8a1128a4by Martin Pastyřík+247−2471 file
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): remove double check when changing pin

This commit refactors how the Trezor hardware wallet changes its PIN. Previously, the storage layer itself re-checked the old PIN while changing it. Now the device must already be unlocked before changing the PIN, and the change-PIN functi…

Removal of internal PIN verification from storage_change_pinAddition of fine-grained unlock and PIN-change result enumsCaller-side enforcement that storage must be unlocked before PIN change
589fd84bby Martin Pastyřík+338−27631 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 85 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(prodtest): enable disabling Tropic sensors in prodtest

This commit adds new factory-test (prodtest) commands for the Tropic secure chip used in some Trezor devices. It lets authorized production-line tools read and change a reversible chip setting called 'sensors configuration,' and also erase…

New privileged CLI commands that can erase all ECC/data/MAC&Destroy slots and rewrite reversible Tropic configurationtropic-set-sensors erases all cryptographic slots before changing the sensors config, which is a destructive operationprivileged_session_start falls back to factory pairing key if privileged pairing key fails, broadening access within prodtest context
860ef85cby Martin Pastyřík+462−304 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(tests): update UI fixtures

This commit only updates expected test screenshots (called UI fixtures) for the Trezor hardware wallet's automated test suite. It adds hashes for two new test cases that check how the device handles invalid or missing credentials for an 'e…

9ddc6510by Martin Pastyřík+12−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core): remove host static public key from protobuf message

This commit changes how a Trezor hardware wallet verifies the computer (host) it is talking to when generating a special delegated identity key. Previously, the host had to send its own public key inside the request message, and the device…

Removal of attacker-controllable public-key field from protobuf messageCredential validation now uses channel-cache-derived host static public keyAddition of negative tests for invalid/missing credentials
379484d6by Martin Pastyřík+122−11411 files
No security note in commit
Open full analysis →Source commit ↗
High 76 AI analysisMessage 100 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(crypto): Fix side-channel vulnerability in BIP-39 mnemonic processing

This commit fixes a timing side-channel flaw in how Trezor hardware wallets convert a user's recovery phrase (BIP-39 mnemonic words) into secret seed bits. The old code used a fast but variable-time binary search over the word list, which …

Side-channel fix: replaces binary search with constant-time linear scanNew constant-time memory comparison helper `constant_time_memeq`Mask-based selection of matched word index to avoid secret-dependent branches
9b1c0620by Martin Pastyřík+137−787 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(tests): update UI fixtures

This commit only updates expected screenshot fingerprints (called UI fixtures) used by automated tests. It does not change any firmware, application, or wallet code that runs on a real Trezor device. There is no user-facing or security-rel…

3612a2cfby Martin Pastyřík+216−1921 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(tests): fix Evolu tests on HW devices

This commit only changes test code for the Trezor hardware wallet. It refactors how tests compute expected cryptographic values so they can run on real hardware devices instead of only on emulators, and moves certificate-verification helpe…

d1d28b86by Martin Pastyřík+375−2877 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(core): functions for Evolu spam protection

This commit adds new Trezor firmware features for an 'Evolu' / 'Suite Sync' service. It introduces a device-bound delegated identity key, a way to export that key after user confirmation, and ways to prove possession of that key to request…

New private-key export message added (EvoluGetDelegatedIdentityKey returns raw nist256p1 private key)New syscall/smcall added to read delegated identity key from secure world into caller bufferNew per-device master key generated in flash OTP and used for deterministic key derivation
d2516f1dby Martin Pastyřík+2455−22860 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 67 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(tests): update UI fixtures

This commit only updates a test data file (fixtures.json) that stores expected screen snapshots for automated UI tests. It adds new expected images for recently added or renamed 'evolu' tests and removes old expected images for a renamed t…

ebc9f60fby Martin Pastyřík+276−241 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(test): update Cardano unit tests to use saved binary mnemonic

This commit only updates Cardano unit tests to convert text seed phrases into binary format before passing them to a cryptographic function. It does not change any production wallet code, user-facing behavior, or security-sensitive logic. …

59aeeb2eby Martin Pastyřík+22−164 files
No security note in commit
Open full analysis →Source commit ↗
Wrong identity?Names can collide and public author strings can be misleading.Contact commitwatch@karma-x.io →