Trezor firmware

This commit simply updates a timestamp and a matching numeric version marker used for Ethereum token/chain definitions. It is a routine metadata refresh with no visible security relevance.

This commit adds a new on-screen step to the Bluetooth pairing flow on Trezor hardware wallets. After the user confirms a pairing code, the device now shows a 'Waiting for host...' screen and waits for the host computer or phone to finish the pairing. It is a normal user-interface feature, not a fix for a known security bug.

This is a one-line Rust code cleanup that removes two unused color imports (GREY_LIGHT and an extra comma) to silence a Clippy compiler warning. It does not change any program behavior, user interface, or security logic.

This commit fixes a small bug in how the Trezor hardware wallet shuts down communication with a Tropic secure chip. Previously, after deinitialization, the driver still thought it was initialized. This could allow later code to mistakenly try to use the chip after it was powered off, leading to failed operations or unexpected behavior. The fix simply marks the driver as not initialized during shutdown.

This commit swaps in a new pre-built bootloader binary for the T3W1 hardware model used in QA/testing, and updates the matching cryptographic hashes that the firmware uses to recognize a valid bootloader. The actual source-code changes inside the bootloader are not shown, and the commit message gives no security explanation. On its own, this looks like a routine firmware housekeeping update, not a fix for a known security bug.

This commit only adds translated text strings for a new 'backup needed' message shown on the device home screen. It does not change any code logic, security checks, or cryptographic operations. The signatures.json file is updated to record the new translation bundle hash, which is a normal bookkeeping step for signed translation assets.

This commit adds informational notifications when a Trezor device is wiped or a Bluetooth pairing is removed. It does not change who can perform these actions or how they are authorized. The wipe/unpair logic itself already existed; the change only tells connected software that the event is happening. There is no obvious security vulnerability here.

This commit fixes a bug where a Trezor hardware wallet does not restore certain hardware settings after waking from sleep. Specifically, after the device wakes up, it now reapplies the screen rotation, haptic feedback, and RGB LED settings that the user had configured. Without this fix, those settings could be left in an unintended state following suspend/resume, which could confuse the user or subtly alter the device's behavior.

This commit fixes a production-test tool in Trezor hardware wallets so that it now checks whether writing a device certificate to secure storage actually succeeded. Previously, the tool would silently continue and report success even if the write failed. This is a defensive hardening fix in a low-level manufacturing/QA utility, not a user-facing wallet feature.

This commit adds new notification messages that the Trezor device sends when certain things happen, such as locking/unlocking, changing settings, changing the PIN, or disconnecting from Bluetooth. It is a feature addition, not a fix for a known security bug. The change itself does not appear to introduce a vulnerability, though it slightly increases the amount of internal state information broadcast to other parts of the system.

This commit is a straightforward code cleanup in the Trezor bootloader. It bundles three pieces of firmware information (vendor header, image header, and whether firmware is present) into a single struct and passes that struct around instead of three separate arguments. There is no change to security logic, no bug fix, and no new feature.

This commit adds a new flag called firmware_corrupted to the device's Features message, which is sent to the host computer when the Trezor is in bootloader mode. Previously, the existing firmware_present flag only told the host whether any firmware was loaded, but its comment said 'valid firmware loaded.' The change makes the bootloader explicitly report whether the loaded firmware is corrupted, and it updates the comment on firmware_present to clarify it just means firmware is loaded. This is an informational/UX improvement, not a fix for a vulnerability in the device itself.

This commit adds a 10-second timeout to the Trezor bootloader's firmware update process. Previously, if the host computer stopped sending firmware pieces during an update, the bootloader could wait forever in a special update mode. The fix makes the device give up and show a failure screen if no next message arrives within 10 seconds. This is a hardening change: it reduces the window during which a device is stuck in a firmware-update state, which could matter if an attacker has physical or local access, but the commit itself does not describe a specific attack or vulnerability.

This commit updates the Trezor production-test firmware to recognize and trust a new set of manufacturer root public keys when validating device certificates. It also refactors where those keys are stored so both certificate checking and the secure provisioning channel use the same key list. The change is a feature addition, not a fix for a known vulnerability, and it only affects the factory/prodtest firmware, not the end-user wallet firmware.

This commit moves a certificate-chain validation check so it runs before a device certificate is permanently stored in secure hardware, rather than after. Previously, an invalid device certificate could be written to the chip before the code noticed and rejected it. The change is in factory production-test tools (prodtest), not normal user wallet firmware, so it mainly affects manufacturing/ provisioning rather than end-user devices in the field.

This commit tightens a data structure used during Trezor's new host pairing protocol (THP). It makes two text fields—host_name and app_name—mandatory instead of optional, and adds runtime checks that they are present before creating a pairing credential. On its own this is a defensive hardening change, not a fix for an active vulnerability. It reduces the chance that a paired host could be stored or shown to the user without an identifiable name, which could help prevent social-engineering or UI-confusion attacks.

This commit is a routine code cleanup: it moves a small helper module that stores Bluetooth pairing information from one folder to another and adds extra debug logging. There is no change to how the device protects secrets, pairs with phones, or handles untrusted input. It is not a security fix.

This is a routine code cleanup in Trezor firmware. It updates a hardware driver for the Tropic01 secure chip so its function signatures match a newer version of the underlying library API. The actual behavior of the code is unchanged; only the names of internal data structures were updated. There is no indication this fixes or introduces a security problem.

This is a small code cleanup in Trezor's internal production-testing tool. It removes an unused `max_len` argument from two helper functions that read firmware version numbers from a Tropic chip during manufacturing tests. There is no indication this change fixes a security bug or introduces one; it simply follows an updated library API.

This is a simple variable rename from 'timeout' to 'timeout_ms' in a single function. It does not change any behavior, logic, or security properties of the code. There is no security issue here.

This commit updates a third-party vendor library called libtropic from one version to version 1.0.0. The actual code changes are not visible because only a Git submodule reference was updated. There is no information in the commit message or supplied materials indicating this is a security fix or that it addresses any vulnerability.

This commit removes a small, unexplained workaround in the hardware wallet's random number generator code. The workaround previously added 4 extra bytes to a temporary buffer when generating randomness. The change makes the code cleaner and slightly more correct, but there is no indication it fixes an active security bug. It appears to be routine cleanup.

This commit tightens access permissions in the Trezor production-test firmware for a secure chip feature called 'MAC-and-destroy' slots. It removes Pairing Key 1's ability to use the first 64 of these one-time slots, leaving only Pairing Key 2 (and in some configurations Pairing Key 3) with access. MAC-and-destroy slots are designed to be permanently destroyed after use, so restricting who can reach them reduces the risk that a less-trusted key could waste or misuse them during manufacturing tests.

This is a purely cosmetic code-style change. It removes line breaks inside long C expressions so each expression fits on a single line. The actual values and logic are unchanged, so it has no security effect.

This commit is a visual design tweak for the Trezor hardware wallet's screen border. It changes how the decorative border is drawn so it sits exactly at the screen edges instead of being inset by one pixel. There is no security relevance: no cryptography, authentication, memory handling, or user-confirmation logic is changed.