Trezor firmware

This commit updates a small Python helper script used to display a fingerprint (a kind of checksum) for Trezor firmware files. It adds support for a newer bootloader image format (BootloaderV2) so the tool can handle both old and new formats. There is no direct evidence this change fixes a security vulnerability; it appears to be a feature/robustness improvement for a developer tool.

This is a small build-tool change that makes a helper script print the correct cryptographic fingerprint for a special 'prodtest' firmware image. It does not change any code that runs on the Trezor device itself, does not introduce any security vulnerability, and is not described by the vendor as a security fix.

This commit removes automatic Debug printing support from several Rust data structures in the Trezor firmware's production builds, keeping it only for unit tests. It is a code hygiene or size-reduction change with no visible security relevance.

This commit removes an unused import (`use std::vec::Vec;`) from a Rust test module in the Trezor firmware codebase. It is a routine code cleanup with no functional or security effect.

This commit is a code cleanup in Trezor's internal production-test tooling. It moves an existing factory-session startup routine into its own reusable function and exposes it through a new header file. No new behavior is added, no new keys are introduced, and no user-facing or wallet security feature is changed. The production factory pairing key remains compiled into the prodtest binary, which is unchanged from before this commit.

This commit increases the memory reserved for the production-test firmware's call stack from 24 KB to 128 KB and moves it from MAIN_RAM to AUX1_RAM. The stated reason is to support ML-DSA (a post-quantum digital-signature algorithm) operations that need more stack space. A stack that is too small can trigger a UsageFault crash; the change prevents such crashes during production testing. There is no direct evidence in the commit that this fixes an exploitable security vulnerability, but running with an undersized stack can in some cases lead to memory corruption or unstable behavior.

This commit changes how secret keys are generated during Trezor device production testing. Previously, randomness came from the device's own RNG and (on some models) an Infineon OPTIGA chip. The patch adds support for also mixing in randomness from a new 'Tropic' secure chip, and ensures a factory secure session with Tropic is started before secrets are generated. This is a feature addition, not a vulnerability fix. It improves entropy quality but introduces a new hardware dependency and a TODO-removal that should be reviewed for correctness.

This commit swaps the cryptographic algorithm used for one of the Trezor hardware wallet's internal device-attestation keys from Ed25519 to ML-DSA-44, a post-quantum NIST-standardized signature scheme. It also enlarges the certificate storage area and doubles the production-test command-line input buffer. There is no direct evidence in the commit of a security vulnerability being fixed; it reads as a planned cryptographic modernization change.

This commit updates Trezor's production-test firmware to accept multiple trusted public keys from secure hardware modules (HSMs) instead of just one. It also adds a helper function in the Noise crypto library that tries each trusted key in turn during a secure handshake. The change itself is a feature addition, not an obvious bug fix. However, the helper function restores a sensitive temporary key from a backup on every retry, which is good practice, and it wipes the backup when done. There is no direct evidence in the commit that this fixes a security vulnerability; it looks like operational hardening for factory testing.

This commit updates the project's build dependency files (poetry.lock, pyproject.toml, shell.nix) to add tools needed for nRF microcontroller work. It is a routine build-environment change, not a fix for a security vulnerability. The only security-relevant note is that it pins several new Python packages, which is good practice, and it removes one unused tool (nrf-command-line-tools) from the development shell.

This commit is a build-script change that adds an optional way to compile firmware for a new Trezor Bluetooth chip (nRF) inside the existing Docker build tool. It does not change any wallet code, cryptography, or device behavior. There is no security issue visible in the diff.

This commit changes a build script for Trezor's Nordic (nRF) hardware so it can automatically detect whether it is running inside a Docker/Nix build environment or a local developer's machine, and then run the build command the appropriate way. It is a build-system convenience change with no visible security relevance.

This is a small internal code cleanup in Trezor firmware. It removes an unnecessary conversion of a byte slice into a mutable bytearray before storing it in a channel cache. The change is described by the developer as a memory-allocation optimization and is not presented as a security fix.

This commit is a purely cosmetic code cleanup: it adds missing spaces before arrow symbols in two lines of Rust source code. There is no functional change, no bug fix, and no security relevance.

This is a minor code cleanup that changes how a helper function's input type is described. It makes no functional change to what the code does and does not affect security.

This commit swaps in two new pre-built binary files for the T3W1 hardware model (a QA bootloader and a Bluetooth development firmware blob) and updates the matching SHA-256 hashes in a header file. The actual code inside the binaries is not shown in the diff, and the commit message gives no reason for the update. There is nothing here that directly demonstrates a security bug or fix.

This commit removes an unfinished 'Connect' button from the Bluetooth device menu on Trezor's upcoming Eckhart hardware model. The feature was only a placeholder (its handler contained a TODO comment and did nothing), so deleting it does not fix any active security bug. It is a routine cleanup change with no security relevance.

This commit removes a Bluetooth on/off button from the Trezor device's settings menu. The button was only a placeholder: it showed a confirmation dialog but did not actually change Bluetooth state. The change is described as a temporary UI cleanup because the underlying Bluetooth control API is not yet available. There is no security fix here.

This commit removes a confirmation prompt that asked the user before disconnecting a Bluetooth device, and instead immediately disconnects if a device is connected. It is a minor user-experience/behavior change on a new hardware model (Eckhart). There is no direct evidence in the commit that this fixes a security vulnerability.

This commit adds the ability for a Trezor hardware wallet to forget (unpair) a specific Bluetooth device by its MAC address, instead of only being able to unpair the currently connected device or all devices. It is a feature-completion change for the new Eckhart model's Bluetooth settings menu. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a routine user-facing feature implementation.

This commit is a routine user-interface tweak for an upcoming Trezor hardware wallet model (codename Eckhart). It changes the Bluetooth pairing limit from 4 to 8 devices, disconnects any active Bluetooth connection before starting pairing, and updates the on-screen warning text and button label shown when the device limit is reached. There is no security-relevant change visible in the code.

This commit adds a new 'Power' menu to the Trezor Safe 7 (Eckhart) device interface, letting the user turn the device off, reboot it, or reboot into bootloader mode. It also adds a low-level 'hibernate' function to the power-management module. The changes are user-facing feature additions and do not appear to fix or introduce a security vulnerability on their own.

This commit makes a small change to the firmware update process for the nRF wireless chip inside some Trezor hardware wallets. It adds a one-second delay after writing the new firmware image, presumably to give the flash memory time to finish saving before rebooting the chip. The change is described as improving reliability, not fixing a security vulnerability. There is no direct evidence in the commit that this is exploitable or that it was caused by a security flaw.

This commit is a simple code cleanup: it moves the definitions of which physical pins control the RGB LED from a shared driver file into the board-specific header files for two Trezor T3W1 hardware revisions. The same pin numbers and ports are used, and no behavior changes. There is no security issue here.

This commit fixes a build configuration problem in the RGB LED code for Trezor hardware wallets. It moves some shared color definitions outside a KERNEL_MODE guard and wraps an effects source file in the same guard, plus adds a missing dependency. There is no direct evidence this is a security vulnerability; it appears to be a build/dependency fix.