Trezor firmware

This commit is a code cleanup: it moves checksum verification and channel usage tracking from one part of the Trezor firmware to another. There is no indication it fixes or introduces a security vulnerability; it is described by the vendor as a refactor with no changelog entry.

This is a test-only change to the Python debug-link helper library. It stops sending a 'Cancel' message to newer Trezor models during a test synchronization step, because only the older T1B1 model needs it. There is no change to device firmware or production behavior.

This commit simply doubles the time limit for a CI build step that installs Python dependencies using Poetry. It is a build-infrastructure tweak with no security relevance.

This commit simply removes a GitHub Actions CI job that compared the firmware's flash size against the master branch. It is a routine build-pipeline change with no effect on the actual Trezor firmware code, device behavior, or user security.

This is a small fix in the Trezor Python command-line library. It stops the software from sending an 'EndSession' message when the secure communication channel (THP) has already been invalidated. Without the fix, the code might try to close a session on a broken or closed channel, which could cause an unnecessary error or warning. It does not appear to be a security vulnerability in the hardware wallet itself.

This commit is a routine user-interface refactor for the Trezor hardware wallet's bootloader screen header. It changes how a battery/charging icon is displayed in the header and tidies up event handling for that icon across several bootloader screens. There is no indication it fixes a security bug or introduces a security-relevant change.

This commit adds a new display mode to the battery indicator on Trezor hardware wallets. It lets the device show only a charging icon (without the battery percentage number) when the device is plugged in. There is no security-relevant change here—only a user-interface tweak.

This commit updates the public keys embedded in the firmware for the Trezor T3W1 hardware wallet model. It adds new boardloader keys and replaces temporary development security-monitor keys with what appear to be production keys. This is a routine key provisioning change, not a fix for an active security flaw. There is no evidence in the commit that this addresses a vulnerability or that any keys were leaked.

This commit simply fills in previously empty lists of official production 'root' public keys used by Trezor's Python library to validate firmware signatures. These are public keys, not private secrets, so adding them does not by itself create a vulnerability. It is a routine configuration update replacing placeholder TODO entries with real key values.

This is a small bug fix in the Bluetooth driver for Trezor hardware wallets. The code had a path where it returned early without unlocking interrupts, which could leave the device in a state where important background tasks stop running. This could cause the device to freeze or behave unpredictably during Bluetooth communication. There is no direct evidence this was exploited or reported as a security vulnerability.

This commit adds a new production-test command to Trezor hardware wallets that updates the firmware of an internal Tropic security chip. It also speeds up the SPI bus used to talk to that chip. The change is part of the factory/production testing tooling, not the normal user wallet firmware, and there is no claim in the commit that it fixes a security bug. The main things to watch are that the update mechanism only accepts one hard-coded silicon revision ('ABAB') and that the SPI speed increase is reliable.

This commit fixes error handling in a Trezor factory-production test tool for the Tropic chip. Previously, when the chip failed to return a firmware version or chip ID, the tool would print an error but then continue and print a second 'OK' response with whatever leftover data happened to be in memory. The fix makes the function return immediately after the error, and also checks the correct success/failure code and clears the buffers first. It is a bug fix in an internal manufacturing diagnostic command, not a user-facing wallet security flaw.

This commit only changes which Git branch the build system follows for an external library called libtropic. It does not modify any actual firmware code, fix a bug, or change device behavior. There is no visible security relevance in the commit itself.

This commit updates Trezor firmware to match a newer version of an external security chip library called libtropic. Most changes are mechanical: renaming internal fields (h->l2_buff to h->l2.buff), adding newly required source files to build scripts, and adjusting function signatures. One function that reads a device certificate is temporarily stubbed out with a TODO comment and always returns success without actually fetching the certificate. The commit is marked [no changelog] and does not describe itself as a security fix.

This commit fixes how the Trezor emulator initializes its connection to a simulated Tropic secure chip. Previously, the emulator build likely failed to set up the TCP device address and port before calling the Tropic library's init function, which could cause initialization to fail or behave incorrectly in emulator builds. The change only affects emulator builds and does not alter real hardware behavior.

This commit removes an unused function called tropic.get_certificate() from the Trezor firmware. The function was already a stub that did nothing useful: it returned success without actually fetching any certificate. The change is a cleanup, not a security fix, and does not appear to address any active vulnerability.

This commit adds a new 'lock' feature for a special secret-storage area inside Trezor hardware wallets. It lets factory-test software explicitly lock the secret sector after writing keys, and it makes the secret-write function report failures instead of silently crashing. The change is defensive: it reduces the chance that secrets can be accidentally or maliciously modified after production. There is no direct evidence in the commit that this fixes a known active attack.

This commit adjusts the on-device secret memory layout for the Trezor T3W1 hardware model. It removes unnecessary parentheses from one offset, reserves space for an MCU device certificate, and adds a dedicated 'lock slot' region. The change is preparatory: it allocates memory regions but does not by itself add or change any code that reads or writes these regions. There is no direct evidence in the commit that this fixes an active security bug, though the title mentions 'explicit secret locking' which is a security-hardening concept.

This commit makes a small UI change to the Trezor hardware wallet's loading animation. When animations are disabled (likely during automated testing), the loader is forced to show 0% progress instead of its real value. This is a test/development convenience change, not a security fix.

This commit is a routine user-interface refresh for the Trezor Safe 7 tutorial. It replaces some tutorial text, adds new icons, and extracts the screen background drawing into a reusable component. There is no security-relevant change visible in the code.

This bootloader patch changes how the Trezor device handles a failed USB/communication write. Previously, if sending a packet failed, the bootloader would call an 'ensure' function that effectively halted or panicked the device. Now the function returns a failure status up to the caller instead. This is a hardening improvement that makes the bootloader more resilient to communication errors, but the commit message frames it only as a behavior improvement with no changelog.

This change fixes a subtle bug in the Trezor device's internal task scheduler. Previously, the same exception object was reused every time a background task was closed. Reusing the same exception object can cause unexpected behavior if code catches and re-raises it, or if the exception object is modified. The fix creates a fresh exception object each time, which is safer and more predictable. There is no direct evidence in the commit that this is exploitable as a security vulnerability.

This small firmware patch makes sure a Bluetooth Low Energy (BLE) connection counter is saved before the device goes to sleep and restored when it wakes up. Without this, the device could forget how many peers it thinks are connected after suspend/resume, which might confuse the wallet's Bluetooth state machine and lead to minor glitches or unexpected behavior. There is no direct evidence in the commit that this is an exploitable security vulnerability.

This commit adds on-device user-interface support for SLIP-24 payment requests on the Trezor Model T (Bolt layout). It does not change transaction validation, cryptography, or signing logic. Instead, it wires up new confirmation screens so users can review payment-request details (provider, refund addresses, swap/trade details, fees) before signing. Existing tests that previously skipped Model T are now enabled for it, and new UI test hashes are recorded. There is no direct evidence of a security vulnerability in this patch.

This commit fixes the verification logic for Trezor bootloader version 2 images in the Python firmware library. Previously, the code checked the elliptic-curve (EC) signature against only the Merkle root digest. The fix now hashes that digest together with the post-quantum (SLH) signature first, matching the actual signing procedure. Without this fix, a valid-looking bootloader signature could be accepted even if the SLH signature was wrong or missing, weakening the dual-signature security check.