Trezor firmware

This commit removes the option to sign a hash of a Cardano message instead of the message itself. The device now always signs the actual message payload directly, up to a size limit. This is a feature/API change rather than a fix for an active security flaw, but it does eliminate a mode where users might have signed data they could not fully inspect.

This commit adds a new feature to Trezor hardware wallets: the ability to sign arbitrary Cardano messages. It introduces new protocol messages, device firmware code to handle signing, and client libraries to use the feature. The signing process requires user confirmation on the device screen and includes safety checks, such as limiting unhashed payload length and validating ASCII display options. There is no direct evidence in the commit of a security vulnerability, but any new signing feature carries inherent risks if not fully reviewed.

This commit only updates the expected test result hashes (called 'fixtures') for the user-interface test suite. It does not change any firmware, application, or cryptographic code. The changes are test-only data, so they do not create or fix any security vulnerability on their own.

This commit only adds a missing period to two changelog entries describing a new Cardano feature. There are no code changes and no security relevance.

This commit adds the public key to the Cardano message-signing response. It is a feature enhancement for software wallets, not a fix for a vulnerability. There is no security defect in the change itself.

This commit only adds or updates translated text strings for the Cardano cryptocurrency feature. It replaces hard-coded English labels like 'Confirm message' and 'Message text' with references to the device's translation system, and updates the translation files, generated code, and a test marker. There is no change to security logic, cryptography, or how user approvals work.

This commit rewrites how the Trezor device fetches the message payload during Cardano message signing. Instead of the host pushing fixed-size chunks to the device, the device now asks for a specific slice of data by sending a length and offset, and the host replies with exactly that slice. The change also removes the previous 1024-byte maximum payload size limit, so larger messages can now be signed. The code adds bounds checks on both sides, but because the device now requests the entire payload in one go, this could stress limited device RAM. There is no direct evidence in the commit that this fixes a reported security bug; it reads as a feature/refactoring change.

This update makes Trezor's Cardano message-signing feature refuse to sign 28-byte payloads that look like cryptographic hashes. The goal is to prevent users from accidentally signing a hash of an unknown message, which could let an attacker trick them into authorizing something they did not read. The change is a simple heuristic: if the payload is exactly 28 bytes and is not made of ordinary printable text, the device now rejects it with an error.

This commit changes a single test marker so that a Cardano message-signing test runs on Trezor Model T/Core devices instead of being skipped on the older T1B1 model. It is a test-suite maintenance change with no effect on the actual firmware code that users rely on.

This commit fixes a display issue in Trezor's Cardano message signing feature. Previously, very long messages were visually trimmed on the device screen, so the user could not see the full content before approving a signature. The patch removes the trimming limit and adds a test case for a long payload. The risk is that a user might unknowingly sign a message whose full content they did not review, but the signature itself is still produced over the complete message (not a truncated one).

This commit is a simple internal code cleanup in the Cardano app of Trezor firmware. It renames a function parameter from 'payload_first_chunk' to 'payload' and switches from keyword arguments to positional arguments in one call. There is no change to user-visible behavior, security logic, or data handling.

This commit is a routine cleanup after merging (rebasing) other Cardano code changes. It updates the Cardano message-signing flow to use newer internal APIs (sessions instead of raw clients, and a separate SLIP-21 keychain argument) and refreshes automated test snapshots. There is no indication it fixes or introduces a security vulnerability.

This commit changes how Trezor hardware wallets pick which private key to use when signing Ethereum-style transactions on non-Ethereum networks. Previously, only testnet-like or alt-networks could fall back to the standard Ethereum key (the one derived from path m/44'/60'/...). Now every network except Ethereum mainnet itself is allowed to use that same Ethereum key. The stated reason is to support newer networks such as Hyperliquid that share a chain ID with an already-registered network and therefore cannot get their own SLIP-44 coin type. The change is described as a workaround, not as a security fix, and it slightly relaxes the boundary between alt-network keys and the main Ethereum key.

This commit only adds new test cases for the Ethereum signing feature. It does not change any production firmware code, so it cannot introduce a security vulnerability by itself. The tests verify that the Holesky Ethereum testnet can be signed using both a testnet-style and a mainnet-style derivation path.

This commit is a simple code cleanup: it moves the function that displays the on-screen pairing confirmation dialog from one internal file to another. The actual user-facing behavior and security checks remain exactly the same.

This commit fixes the order of arguments in a mock type stub for a timing function. It only changes a Python interface declaration used for testing/type-checking, not the actual device firmware code. The real security risk is minimal, but if the stub had misled developers, it could theoretically contribute to subtle timing bugs in firmware.

This commit removes leftover debug logging from production firmware builds. In non-debug builds, two log messages will no longer be emitted. This is a routine code-quality change with no direct security impact visible in the diff.

This commit is a simple code cleanup: it removes two small helper methods from a class and replaces their calls with direct calls to the underlying user-interface functions. There is no change in behavior, no bug fix, and no security-related change.

This commit removes a debug-only shortcut that could skip the user-visible pairing dialog on a Trezor device. The shortcut was already unused because the flag that enabled it was always set to True, meaning the dialog was always shown. The change is a cleanup with no functional effect on normal or debug builds.

This commit is a routine code cleanup that renames and reorganizes error/exception types used in Trezor's Python library, particularly for the new THP (Trezor Host Protocol) transport. It does not change security behavior; it only makes error handling more specific and easier to maintain. For example, a generic 'device locked' exception is renamed and moved under a new THP error family, and THP error codes now raise distinct exception classes instead of generic strings.

This commit adds a user-facing setting to turn the device's RGB LED on or off. It is a routine feature addition (a 'chore') with no apparent security relevance. There are no changes that introduce memory corruption, bypass authentication, leak secrets, or alter cryptographic behavior.

This commit updates Trezor's Python library so it can recognize and verify digital signatures for a new 'secure monitor' (secmont) firmware component. It fixes a mismatch where the secmon image verifier was accidentally returning bootloader keys instead of secmon keys, and adds the correct public keys and signature-count rules for two development hardware models. There is no direct evidence this is a security vulnerability fix; it reads as a routine key-registry update for a new feature.

This commit is a routine UI code cleanup. It introduces a new medium-length menu size (10 items) and updates the device menu screen to use it instead of the previous short size (5 items). There is no security-relevant change here.

This commit is a routine UI translation update for the Trezor hardware wallet's device menu. It replaces hard-coded English text strings with references to the device's translation system so the menu can be displayed in multiple languages. There are no security fixes or functional behavior changes.

This commit is a routine user-interface update for the Trezor hardware wallet. It changes the 'About' screen in the device menu to show more information—firmware version, firmware type (Bitcoin-only or Universal), and a Bluetooth version number—instead of only the firmware version. There is no security-relevant change; it is purely a display/layout improvement.