Trezor firmware

This commit is a simple housekeeping change: it deletes a top-level 'assets' folder and moves the same PNG image files into the resource folders used by each user-interface layout. No code was changed, no functionality was altered, and there is no security relevance.

This commit simply adds a new cryptographic signature to a list that verifies official language translation files for the Trezor hardware wallet. It does not change any code, fix any bug, or introduce any security weakness. It is a routine administrative update so devices can trust the latest translation pack.

This commit is a testing infrastructure change. It makes the software emulator automatically start a separate 'Tropic' hardware-security model on a configurable TCP port during automated tests, so multiple test workers can run in parallel without colliding on the same port. There is no indication this fixes or introduces a security vulnerability in the device firmware itself.

This commit adds a build/test helper script and sample configuration files for simulating a Tropic security chip during automated testing. It does not change any firmware code that runs on real Trezor devices, and the private keys it includes are explicitly test-only artifacts copied from a public vendor example. There is no indication this is a security fix or that it introduces a vulnerability.

This commit only changes the project's automated testing configuration. It adds steps to start a 'Tropic' simulation model during certain CI test jobs for the T3W1 hardware model. There is no change to the firmware code that runs on user devices, no fix for a security flaw, and no indication this is a security-related patch.

This commit only updates expected test result hashes (called 'fixtures') in a single test data file. It does not change any firmware, application, or security code. The changes appear to be routine test snapshot updates, likely because tests were renamed or their expected screen outputs changed. There is no indication of a security fix or vulnerability.

This commit only adds four test-only certificate and private-key files under the tests/tropic_model directory. They are clearly labeled as test fixtures, not used in production firmware, and the commit message explicitly says '[no changelog]'. There is no code change and no indication of a security fix or vulnerability.

This commit only adds and updates automated tests for Trezor's device-authentication feature. It does not change the firmware code that runs on the device, so it cannot introduce a security vulnerability in the product itself. The tests verify that certificate chains and signatures from two hardware security chips (Optiga and Tropic) are accepted correctly.

This commit only adds a CI (continuous integration) option to display the 10 slowest automated user-interface tests during GitHub Actions runs. It does not change any firmware code, cryptography, device behavior, or test logic. There is no security relevance.

This commit updates three pre-built binary files for the T3W1 hardware model (bootloader, security monitor, and Bluetooth firmware) plus the matching bootloader hash header. The actual code inside the binary files is not shown in the diff, and the commit message only describes it as a routine binary update with no changelog. There is no visible security fix or vulnerability indicator in the materials provided.

This commit updates three pre-built binary files for the Trezor T3W1 hardware wallet model: the bootloader, a security monitor, and a Bluetooth Low Energy firmware image. It also updates the corresponding bootloader hash header so the firmware can verify the new bootloader. The commit message calls this a routine chore with no changelog entry. There is no description of any security fix, bug, or functional change in the commit itself, and the binary differences cannot be inspected as source code.

This commit fixes a crash that could occur when setting or changing the Trezor device's wipe code. The fix moves a memory-protection reconfiguration call to happen before user-interface progress is initialized. The crash appears to be a reliability bug rather than a security vulnerability that an attacker could exploit to steal funds or bypass protections.

This commit fixes a crash that could occur when setting or changing the Trezor device's wipe code (a special PIN that wipes the device). The fix moves a memory-protection reconfiguration call earlier, before user-interface progress initialization. The crash appears to be a reliability bug rather than a security vulnerability that would let an attacker steal funds, but a crash during security-sensitive wipe-code setup could disrupt the user experience or potentially be used in a denial-of-service scenario.

This commit restructures how the Trezor firmware initializes and starts secure sessions with the Tropic secure chip. Previously, session startup happened eagerly during device initialization. Now it is deferred until the first actual use of the Tropic chip, and a separate wait-for-ready step is added. The change is framed as a fix for a lazy session-start issue. It is not obviously exploitable by itself, but it touches security-critical pairing/session logic and removes a duplicate tropic_init() call in production-test code, which could matter if the duplicate call had side effects.

This commit removes one line of code that automatically brightened the screen when a Trezor device woke from sleep. The change is described as fixing a 'premature backlight fade-in' after wakeup. There is no indication in the commit that this was a security issue; it appears to be a user-experience or display bug fix.

This commit restructures how the Trezor device starts a secure session with its Tropic security chip. Previously, the device tried to initialize and immediately start a secure session during boot. Now it initializes the chip early but waits until the chip reports ready, and only starts the secure session when a function actually needs it. This is a defensive hardening change that reduces the chance of session-start commands failing or being issued while the chip is still booting. It also removes a duplicate initialization call in production-test code.

This commit removes a single line that automatically brightened the screen when a Trezor device woke up from suspend. The change is described as fixing a 'premature' backlight fade-in. There is no direct evidence in the commit that this is a security fix; it appears to be a user-experience or visual polish change. The security relevance, if any, would be minor: a brief screen illumination could theoretically reveal that the device had woken up or what screen was displayed, but no sensitive data or controls are exposed.

This is a small internal code cleanup in the Trezor firmware's user-interface layer. It moves responsibility for sending on-screen confirmation prompts (ButtonRequest messages) into a single place inside the Layout class, and removes an older helper function. There is no indication this change fixes a security bug or introduces a vulnerability; it is a refactoring to simplify the code.

This is a small defensive fix inside the Trezor hardware wallet's user-interface code. It moves a debug-only sanity check so that it no longer fires when a screen layout simply returns nothing (None). Previously, the check could incorrectly raise a 'FirmwareError' before the code had a chance to notice there was no new button request. The change only affects debug builds and is unlikely to be directly exploitable by an attacker.

This is a small internal cleanup in the Trezor firmware's user-interface code. It removes one of two calls to a function that shuts down other active workflows when a button request is sent. The change is labeled as a refactor with no changelog entry, and there is no direct evidence in the commit that it fixes a security bug.

This commit removes a try-except block that simply caught all exceptions and immediately re-raised them. It is a code cleanup with no functional change to how errors are handled.

This commit wraps two debug-only exception log statements with an `if __debug__:` guard. In Python, `__debug__` is true unless the interpreter is run with the `-O` (optimize) flag. The change prevents exception details from being logged in optimized/production builds. The patch is defensive and reduces information leakage, but the actual security impact is minor because the logged data is not shown to untrusted parties by default and the exceptions themselves are already being caught and suppressed.

This is a minor GitHub Actions workflow change. It ensures that a code-coverage report is uploaded even if earlier test steps failed. It does not change the Trezor firmware code, cryptography, or device behavior, and has no direct security relevance.

This commit only changes a CI (continuous integration) test coverage threshold for one hardware model (T3B1) from 85% to 84%, with a TODO comment linking to an internal issue. It does not modify any firmware code, cryptography, or device behavior. There is no security-relevant change to the product itself.

This commit only changes a test file used during automated testing. It swaps the cryptographic curve and private key used to generate fake payment-request signatures in tests, from Bitcoin's secp256k1 curve to the NIST P-256 curve. There is no change to the actual Trezor firmware or to how real payment requests are validated. It is a testing-only adjustment with no security relevance to end users.