Trezor firmware

This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on the device, along with related tests and benchmarks. It is a hardening/cleanup change rather than a fix for an active bug or exploit.

This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality refactor that reduces the risk of using mismatched keys, but the commit itself does not claim to fix a specific security bug and no exploit is described.

This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.

This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave them longer, unique names that include which part they belong to. The actual numeric values and program behavior are unchanged. There is no security fix or vulnerability here.

This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but it is undefined behavior in C and could cause a crash or unpredictable results on other systems. The change adds simple NULL checks before clearing plaintext output and before wiping responder/initiator objects during cleanup.

This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure, the function now writes it into a buffer supplied by the caller. The commit message explicitly calls it a refactor and includes '[no changelog]', indicating it is not being presented as a security fix. There is no direct evidence in the diff that this change fixes an active vulnerability, but it does reduce the amount of sensitive key material kept in internal state and gives callers explicit control over the output buffer, which is generally a defensive improvement.

This commit only updates test data. It corrects the capitalization (checksum) of Ethereum addresses used in automated tests and refreshes the expected screen-shot hashes those tests compare against. There are no changes to the actual Trezor firmware code that users run, so this cannot affect real devices or user funds.

This commit changes the Trezor Python library so that, when setting up a Trezor Model One (the original Trezor 1 device), it now performs an entropy check by default if the device runs firmware 1.13.1 or newer. Previously, the library only enabled this check on newer Trezor models and treated all Model One devices as not supporting it. An entropy check helps verify the device is generating randomness properly during wallet setup. The change is a defensive fix to enable a security feature on a previously excluded device line, not a patch for an active vulnerability.

This commit is a routine cleanup that removes the old SCons build system files from the Trezor Core firmware repository. It deletes Makefiles, SConscripts, and related Python helper scripts, but does not change any firmware source code, cryptographic logic, or runtime behavior. The commit message explicitly says it is a chore with no changelog entry, indicating it is not a security fix.

This commit updates Trezor's embedded MicroPython interpreter from an older version to 1.28.0. It pulls in several upstream MicroPython bug fixes, including stricter buffer-size checks for converting integers to bytes, a new stack-safety API, preventing Ctrl+C from interrupting frozen boot code, fixing a stdout write return value, and blocking accidental creation of bytearrays from plain strings without an encoding. The changes are mostly defensive hardening and compatibility fixes rather than a single known exploit patch. There is no vendor statement that this is a security fix, no CVE, and no credited researcher.

This commit is a simple code cleanup that replaces a common MicroPython string-creation pattern with a new helper function. It does not change what the code does, only how it is written. There is no security issue visible in the change.

This is a large but straightforward internal cleanup: the project switched from using the MicroPython `ubinascii` module's `hexlify`/`unhexlify` functions to the standard Python `bytes.hex()` and `bytes.fromhex()` methods. The change removes the `ubinascii` module from the firmware build and updates many source and test files to use the new built-in methods. There is no security fix or vulnerability being patched here.

This commit is a routine code cleanup in the Trezor firmware's embedded MicroPython modules. It replaces an older, two-step object allocation pattern with a newer helper that allocates memory and sets the object type in one step. The change touches many cryptographic object constructors but does not alter security logic, input validation, or behavior. It is best understood as a maintenance refactor to stay compatible with upstream MicroPython, not a security fix.

This is a code cleanup change in Trezor's firmware that swaps one MicroPython internal helper for another. It replaces calls that create byte or string objects from a vstr buffer with newer, purpose-built helpers. The commit message says the new string helper also does UTF-8 validation, which can be skipped where performance matters. The change itself does not introduce a known vulnerability; it is a refactor to match upstream MicroPython conventions.

This commit is a routine internal cleanup that switches how Trezor's firmware defines built-in MicroPython object types. It replaces older, manually-written type structures with a newer macro provided by the upstream MicroPython project. There is no user-visible change, no bug fix, and no security patch in the diff.

This commit is a large but purely mechanical code cleanup: it replaces the custom STATIC macro with the standard C keyword static across many MicroPython module files. There is no change to program logic, security boundaries, or behavior. It also removes build-system workarounds that were only needed because the old macro was being abused to expose internal functions.

This commit is a routine code cleanup that updates Trezor firmware to match a newer MicroPython version where built-in module names dropped the 'u' prefix (for example, 'uos' became 'os' and 'ustruct' became 'struct'). It renames imports, configuration flags, and source file references, and removes old mock files. There is no security fix or vulnerability here.

This commit only updates the firmware version number from 2.12.4 to 2.12.5 in the source code and translation files. It does not change any security-related logic, fix any bug, or alter any cryptographic behavior. It is a routine release bookkeeping change with no security relevance.

This is a routine build-system cleanup for the Trezor firmware. It switches the internal 'trezor_lib' Rust crate to be built with the project's own 'xbuild' tool, removes transitional feature flags, and reorganizes Cargo.toml files. There is no indication this change fixes or introduces a security vulnerability.

This commit adds Bluetooth Low Energy (BLE) support for the Trezor T3T2 hardware model. It introduces new board configuration files, pin mappings, build scripts, and firmware binaries for the Nordic nRF54LS05A BLE radio used in T3T2. There is no indication in the commit that this fixes a security bug; it appears to be a feature addition enabling BLE functionality on a new device variant.

This commit is a large but straightforward internal refactoring: the cryptographic code is moved from one Rust crate (`rtl`) into a new dedicated crate (`crypto`), and all project dependencies are updated to point to the new crate. The actual cryptographic algorithms, build flags, and source files remain the same. There is no indication of a security bug fix or a vulnerability being introduced.

This commit is a code cleanup that moves how Trezor firmware handles fatal errors and shutdowns between its internal software layers. It does not add new user-facing features or change security protections. The main risk is that reorganizing low-level error paths could accidentally introduce a bug, but the diff itself does not show a vulnerability being fixed or introduced.

This is a cosmetic user-interface change for the Trezor hardware wallet. It adds a trailing colon to labels shown when a user is reviewing Ethereum EIP-7702 authorization or revoke actions. There is no security impact: no code logic, cryptography, transaction parsing, or signing behavior is changed. The only side effect is that on-screen text labels now end with a colon, and the corresponding UI test snapshots (fixtures.json) were updated to match the new appearance.

This commit changes a single on-screen label in the Trezor bootloader from lowercase 'Change fw vendor' to uppercase 'Change FW vendor'. It is purely a cosmetic wording fix with no security relevance.

This commit adds support in Trezor's Ethereum clear-signing feature for transactions that contain multiple embedded subcalls (like a multicall). Previously, only a single embedded call could be clearly displayed. The change lets the device show each subcall separately with labels like "(Subcall #1)" and handles both a single shared recipient address or a parallel list of recipients. It is a feature addition, not a fix for a known vulnerability.