Trezor firmware

This commit is a routine text cleanup for the Trezor hardware wallet's on-screen English messages. It fixes punctuation, removes unnecessary line breaks, and makes small wording tweaks (for example, changing 'PIN will be required' to 'A PIN will be required'). There is no change to security logic, cryptography, or how the device protects funds.

This commit adds downgrade protection for a new 'app root packet' system in Trezor firmware. Previously, the code had a TODO note saying downgrade protection needed to be considered. The change makes the device remember the timestamps of previously accepted root packets and reject older or inconsistent ones. It also adds a new Python-exposed state object so the wallet software can persist these timestamps. This is a security-hardening feature rather than a fix for a currently exploitable bug, but it closes a design gap that could have allowed an attacker to roll back trusted application lists to older, potentially vulnerable versions.

This commit fixes a cryptographic edge case in Trezor's THP (Trezor Host Protocol) handshake. It now rejects Curve25519 public keys that are all zeros or that produce an all-zero shared secret. A zero public key can cause the Diffie-Hellman exchange to collapse to a predictable value, which could let an attacker on the USB/bus learn or manipulate session keys. The patch also makes the handshake fail more gracefully for that single channel instead of aborting all channels.

This commit changes one line in a build configuration file for the Trezor hardware wallet firmware. It adds the 'ward' feature to the existing 'miniscript' feature set. There is no direct evidence in the commit that this is a security fix; it appears to be a routine feature-enablement change. Without additional context, the security relevance is unclear and likely low.

This commit adds a new disabled-by-default feature flag called 'ward' to the Trezor firmware build system. It does not change any production firmware behavior; it only wires up a placeholder MicroPython module and build options so that future WARD-related code can be developed safely behind the flag. There is no security vulnerability visible in this change.

This commit turns on a compiler warning (-Wsign-compare) that catches places where signed and unsigned numbers are compared, and fixes the resulting warnings across the Trezor firmware. Most changes are clean-up casts and loop-index type changes. A few spots also fix real logic bugs, such as treating a negative I/O return value as a successful byte count, or using the wrong argument index for an optional offset. These are defensive improvements rather than a single obvious exploit, but in embedded security code they can prevent subtle memory or parsing issues.

This commit is a simple user-interface cleanup. It removes one duplicate translation label ('Access hidden wallet') and makes the device use a single, consistent label ('Access wallet') when asking the user to confirm opening a passphrase-protected wallet. There is no change to security logic, cryptography, or how passphrases are handled.

This commit is a simple user-interface cleanup. It merges two translation labels that both meant 'Passphrase wallet' into a single label, and updates the screens that used the old duplicate label. There is no security-relevant behavior change.

This commit fixes a bug in the Trezor bootloader's firmware-update code. When updating firmware, the first block of data is fetched in two pieces: a small initial 'header prefetch,' then the rest. If a communication error happened and the bootloader tried to retry, it accidentally asked for only the leftover remainder but placed it at the start of the buffer. That produced a corrupted block, the hash check failed, every retry failed, and the firmware update aborted. The fix makes retries request the whole first block again from the beginning. There is no evidence this bug was exploitable by an attacker; it appears to be a reliability defect that could brick or stall legitimate updates, especially over Bluetooth on the T3W1 model.

This commit is a code cleanup in the Trezor bootloader. It moves the generic, image-type-agnostic parts of firmware upload (chunk receiving, retry logic, flash erasing/writing, timeouts) into a new reusable module called wf_image_upload.c, while keeping the firmware-specific checks (signatures, versions, user confirmation, per-chunk hash checks) in wf_firmware_update.c. There is no direct evidence in the diff that this change fixes or introduces a security vulnerability; it appears to be a structural refactor to make the upload code reusable for other image types in the future.

This commit removes an unused Rust Cargo feature flag called 'ui' from the Trezor firmware build configuration. It is a cleanup change: the feature was always enabled in practice, so the code now compiles unconditionally. There is no security-relevant change to runtime behavior, no bug fix, and no vulnerability patch.

This commit changes how users confirm an Ethereum authorization screen on Trezor's 'Caesar' layout. Previously, the user had to hold down a button to approve; now a simple tap is enough. The change only affects the user-interface interaction for one specific screen (EIP-7702 authorizations) and updates the corresponding visual test snapshots. There is no direct evidence in the commit that this fixes a security vulnerability, but it could slightly reduce the chance of an accidental or coerced approval if the hold-to-confirm behavior was considered too easy to bypass or too confusing.

This commit is a routine internal cleanup that merges two separate build packages (one for real hardware firmware and one for the desktop emulator) into a single package. It moves source files into subdirectories and updates build scripts accordingly. There is no user-facing change, no bug fix, and no security-relevant behavior change visible in the diff.

This commit is a minor build/test maintenance change. It adds a feature flag (USE_AES_GCM) so that AES-GCM tests are only run when the feature is actually enabled in a particular firmware build. There is no security fix or vulnerability being patched.

This commit only adds or updates copyright and GNU license header comments in Python test and tooling files. It makes no changes to executable code, so it cannot introduce a security vulnerability or fix one.

This commit is a straightforward code cleanup: it moves the on-screen title for multisig XPUB screens from hard-coded English text into the device's translation system. The visible text remains essentially the same, and there is no security change.

This is a cosmetic code cleanup. It moves punctuation and capitalization out of the Python code and into the translation files so translated strings are shown exactly as written. There is no security-relevant change.

This commit simply removes two unused Rust import statements (called `use` statements). It does not change any actual code behavior, logic, or security properties of the Trezor firmware.

This commit fixes a UI formatting bug in the Tron cryptocurrency flow on Trezor hardware wallets. A missing colon was added to account information labels shown on the device screen. The change is cosmetic and does not appear to affect cryptographic operations, fund safety, or device security.

This commit is a straightforward user-interface refactoring. It bundles an account/path label together with its corresponding value into a single tuple, instead of passing them as four separate arguments. There is no security-relevant change visible in the code.

This commit is a build cleanup, not a security fix. It makes sure the FIDO (WebAuthn/passwordless login) confirmation screen is only compiled into the universal firmware that supports altcoins and FIDO, and is left out of the smaller Bitcoin-only firmware build. Previously the code was included in all builds but returned a 'not implemented' error on Bitcoin-only devices. The change reduces unused code and build size; it does not patch a vulnerability or change runtime behavior in a security-relevant way.

This commit only updates version numbers and translation metadata. It changes no actual code, logic, or security behavior. There is no security issue here.

This is a small build-configuration cleanup in the Trezor firmware. It changes which internal feature flag the 'production' build mode depends on, removing one old reference and switching another. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be routine maintenance to keep production builds using the correct set of features.

This commit is a code cleanup that changes how Trezor firmware internally labels 32-bit versus 64-bit integer fields in its protobuf handling. It does not add or remove security checks by itself, but it makes the type system more precise so that future integer-overflow mistakes are harder to introduce. The change is described by the author as a refactor with no changelog entry.

This commit fixes the way a Trezor hardware wallet's Rust code reads protobuf message field keys. Previously, if reading a field key failed, the decoder silently stopped and treated the message as complete. Now it explicitly checks whether data remains and reports an error if a malformed or truncated field key is encountered. The change prevents an attacker from sneaking invalid or truncated protobuf data past the parser, which could lead to messages being accepted even though they contain garbage or hidden fields.