Trezor firmware

This commit removes an unused Rust helper method that checked whether a passphrase should be entered on the Trezor device. It is a routine cleanup with no visible security effect.

This commit undoes a previous change in the Trezor client Rust library. The original change made the software send an empty passphrase when using standard (non-hidden) wallets. The revert restores older behavior where, if the device is not asking for the passphrase on-device, the client acknowledges the passphrase request without providing an empty string. The practical effect depends on how the Trezor device firmware interprets the two acknowledgment types: one with an explicit empty passphrase and one without a passphrase field. It could affect which wallet derivation path or seed is used, potentially causing users to see a different wallet than expected, but the commit itself does not clearly introduce theft or remote exploitation.

This is a minor code cleanup in the Rust Trezor client. It simplifies how the software responds when a Trezor device asks for a passphrase. The old code checked whether the device wanted the passphrase entered on the device itself; now it always tells the device to enter the passphrase on the host computer. The commit message says the on-device path is deprecated and no longer used. There is no security-relevant change visible in the diff.

This commit fixes an out-of-memory (OOM) crash during Ethereum payment-request signing on the Trezor Safe 3 (T2B1). The fix wraps UI layout construction in a temporary async task so the device's garbage collector can reclaim memory sooner. It is a reliability/DoS-style bug rather than a theft-of-funds vulnerability.

This commit is a code cleanup that changes how user-interface layouts are managed in the Trezor firmware. It wraps layout objects in explicit context managers (using `with ... as layout:`) and converts several synchronous-looking helper functions into proper async functions. There is no direct evidence in the commit that this fixes an exploitable security bug; it appears to be a defensive refactoring to enforce clearer scoping of UI resources.

This commit fixes a bug in the Trezor client library where users with a standard wallet (no passphrase) were still being prompted to enter a passphrase on their Trezor device. The fix ensures that for standard wallets, the client replies with an empty passphrase instead of incorrectly asking the device to handle it. This is a usability and workflow bug rather than a direct theft-of-funds vulnerability, but it could cause confusion or lead users to enter an unintended passphrase.

This update fixes a bug where a Trezor hardware wallet with SD-card protection enabled could not be locked if no PIN was set. The device should be lockable whenever SD protection is active, because the SD card itself acts as a security factor. The change makes the homescreen use a broader 'can lock' check instead of only checking whether a PIN is configured. A new automated test also verifies that pressing and holding the screen can lock the device in this configuration.

This update fixes a bug in Trezor hardware wallets where the device would not properly lock itself when only SD card protection was enabled and no PIN was set. In that configuration, an attacker with brief physical access could potentially keep the device unlocked and use it without needing to enter a PIN or provide the SD card secret, bypassing the intended security protection.

This commit replaces internal programming assertions (which crash the device if they fail) with proper error handling for Ethereum transaction signing when a payment request is involved. It ensures that if someone supplies a payment request verifier, the transaction must have zero data bytes and must actually include a payment request object. Without the fix, a malformed or unexpected input could trigger an assertion failure instead of a clean error, potentially causing the device to crash or behave unpredictably during signing.

This commit fixes a timing weakness in how a Trezor hardware wallet checks the authenticity of a 'credential' used in its Trezor Host Protocol (THP). Previously, the device compared two secret codes with a standard equality check, which can leak information through tiny timing differences. The patch switches to a constant-time comparison function and adds a length check first. This is a defensive hardening change against side-channel attacks, but the commit message does not frame it as a security fix and no exploit is described.

This commit is a routine version bump for a Trezor firmware release. It only changes version numbers in header files and translation metadata, plus updates the signed translation package reference. There are no code changes that affect security or device behavior.

This commit fixes a build configuration issue so that debug builds of Trezor firmware, bootloader, and production-test firmware automatically enable a visual 'ui_debug_overlay' feature. That feature displays a small red square marker in the top-right corner of the screen, making it obvious when a debug/non-production build is running. It is a UI/UX and build-system change, not a fix for an exploitable security vulnerability.

This commit adds a new helper script that lets developers check whether a signed Trezor firmware file truly matches its unsigned counterpart and whether its digital signature is valid. It is a defensive verification tool, not a fix for a security flaw, and introduces no vulnerability in the device code itself.

This commit is a feature addition to Trezor's internal production-test firmware. It replaces generic string-based error messages with a structured, numbered error-code system. There is no direct security vulnerability being fixed or introduced; it is a maintainability and diagnostics improvement for factory testing tools.

This is a small maintenance update to Trezor's Ethereum clear-signing definitions for the LiFi cross-chain swap service. It adds alternative contract addresses for LiFi on four blockchains where the service uses a different address than usual, and tweaks a few on-screen labels (for example changing 'Recipient' to 'Receiver' and adjusting capitalization). There is no indication of a security vulnerability being fixed.

This commit adds human-readable display definitions for 1inch decentralized-exchange swap transactions on Trezor hardware wallets. It tells the wallet how to decode and label 1inch swap parameters (amounts, beneficiary, last pool) so users can verify what they are signing on the device screen. The change is purely a data/configuration addition plus matching tests; it does not alter cryptographic code, transaction validation, or signing logic. There is no indication in the commit that this fixes a security vulnerability.

This commit is a code cleanup that wraps more on-screen UI layouts in a new 'layout context' scoping mechanism. It changes how layout objects are created and awaited, but does not add or remove security checks. The main risk is that any mistake in the refactor could cause a layout to be used outside its intended scope, but the diff itself shows consistent mechanical changes rather than a security fix or vulnerability.

This commit only updates automated test scripts for the Trezor hardware wallet. It changes how the test code simulates button presses during a wallet backup flow to match the actual device behavior. There is no change to the firmware or wallet security itself.

This is a small, safe code cleanup. It changes a type annotation from a concrete class to a protocol (an interface definition) and updates two function signatures to return the more general interface type. There is no change to actual program behavior, no bug fix, and no security relevance.

This commit shortens two on-screen text labels in the Trezor bootloader from 'INSTALL FIRMWARE' to 'INSTALL FW' and 'UPDATE FIRMWARE' to 'UPDATE FW'. The change is purely cosmetic, intended to stop the text from overflowing its display area. The commit message notes these screens are not normally seen by users because updates now happen without user interaction. There is no security fix here.

This commit adds support for a new post-quantum digital-signature algorithm (ML-DSA-44) to the Python trezorctl tool's device-authenticity check. It does not change how the hardware wallet itself works; it only lets the desktop companion software recognize and verify a new type of manufacturer signature on some devices. The change also moves hard-coded root public keys into a separate internal module and updates the required cryptography library version. There is no indication in the commit that this fixes a security bug or vulnerability.

This commit strengthens the Trezor host-side device-authentication check. Previously, the tool verified that each security chip's certificate chain was signed by a trusted root, but it did not compare the device model and serial number written into the different certificates. The patch now extracts the common name (model) and serial number from each certificate and rejects the device if those values disagree across chips or do not match the model the device claims to be. This closes a gap where a malicious or misconfigured device might present otherwise valid but mismatched certificates.

This commit is a follow-up code cleanup that wraps more on-screen user-interface helpers in a new 'layout context' pattern. It changes type annotations from LayoutObj to LayoutContext and converts several synchronous-looking wrapper functions into async functions that use Python 'with' blocks. There is no direct evidence in the commit of a fixable security bug; it appears to be a defensive refactoring to make UI resource lifetimes more predictable across Trezor firmware models.

This commit fixes a firmware build problem when a feature called 'extapp support' is enabled. It changes which source files are compiled and adjusts code guards so that certain applet-related code is only included when both applets and kernel mode are active. There is no direct evidence this fixes a security vulnerability; it appears to be a build-system correction.

This commit removes calls to an old, already-deprecated debug-only feature named DebugLinkWatchLayout from the Python test library and test scripts. It is a cleanup change affecting only testing and developer tooling, not the firmware that runs on the Trezor device or any user-facing security behavior.