Trezor firmware

This commit changes how a Trezor hardware wallet starts up when you press its button. Previously, the device would only fully power on after a long button press (about one second) or when in a special factory mode. After this change, a short button press is enough to start the device in normal use. The change also adds a small haptic buzz at 500 milliseconds to give the user feedback. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a user-experience or behavior change in the bootloader.

This commit changes how the Trezor T3W1 hardware wallet enters its bootloader. It shortens the required power-button hold from 3 seconds to 2 seconds, adds a new on-screen progress message telling the user to release the button, and moves the haptic buzz and display initialization to occur only after the user has committed to bootloader mode. The changes appear to be a user-experience and timing refinement rather than a fix for an exploitable security flaw. There is no vendor statement or independent report linking this commit to a security vulnerability.

This commit fixes a subtle bug in the Trezor device's task scheduler where the same exception object was being reused for every timeout. In Python, exception objects carry state (such as a traceback). Reusing the same object across many tasks and timeouts could cause stale traceback or context information to leak between unrelated operations, or trigger unexpected behavior if code catches and inspects the exception. The fix creates a fresh Timeout exception each time one is needed.

This commit only updates expected visual test snapshots (hashes) for one PIN-cancel test on the T2T1 device across several languages. It changes no product code, no firmware logic, and no cryptographic behavior. There is no security issue here.

This commit simply updates an internal dependency (ts-tvl) from version 2.1 to 2.2 and adjusts a CI workflow path to match the new dependency's folder layout. There is no indication of a security fix, vulnerability, or malicious change in the visible diff.

This commit only removes or rearranges blank lines in two C source files to make the code style consistent. No program logic, function calls, variable handling, or security behavior was changed.

This commit adds production-test commands for a new Tropic security chip in Trezor hardware wallets. It also finishes a previously stubbed secure-channel encryption routine and adds commands to read/write device certificates and keys. The changes are intended for the factory-provisioning environment (prodtest), not the end-user firmware, but they handle real cryptographic keys and chip configuration. There is no direct evidence of a vulnerability, but the code touches sensitive key material and includes hard-coded test keys and TODOs, so it warrants careful review.

This commit updates Trezor firmware to match a newer version of an external secure-chip library called libtropic. The main user-visible change is that a cryptographic signing function no longer takes a caller-supplied signature-buffer length; instead the firmware always uses a fixed, library-defined size. The patch also swaps the low-level random-number callback to a different API that the updated library expects. There is no claim in the commit that this fixes a security bug; it reads as a compatibility update after a dependency upgrade.

This commit adds vibration feedback to the 'hold to confirm' animation on a specific Trezor hardware wallet layout (Eckhart). It only introduces haptic effects behind a compile-time feature flag and does not change security logic, transaction confirmation behavior, or access controls.

This commit adds a new low-level keep-alive/ping feature to the Trezor hardware wallet's experimental THP (Trezor Host Protocol) transport. It lets the host send a PING and the device reply with a PONG, echoing back a random 8-byte nonce. The change also updates test tooling to use this new transport-level ping instead of a higher-level application ping. There is no indication this fixes a security vulnerability; it appears to be a feature/refactoring change.

This commit is a simple code cleanup: it replaces a hardcoded number (50) with a named constant (`MAX_RETRANSMISSION_COUNT`) in the Python Trezor library. There is no functional change, no bug fix, and no security relevance visible in the diff.

This commit is a code cleanup: it moves checksum verification and channel usage tracking from one part of the Trezor firmware to another. There is no indication it fixes or introduces a security vulnerability; it is described by the vendor as a refactor with no changelog entry.

This is a test-only change to the Python debug-link helper library. It stops sending a 'Cancel' message to newer Trezor models during a test synchronization step, because only the older T1B1 model needs it. There is no change to device firmware or production behavior.

This commit simply removes a GitHub Actions CI job that compared the firmware's flash size against the master branch. It is a routine build-pipeline change with no effect on the actual Trezor firmware code, device behavior, or user security.

This commit simply doubles the time limit for a CI build step that installs Python dependencies using Poetry. It is a build-infrastructure tweak with no security relevance.

This is a small fix in the Trezor Python command-line library. It stops the software from sending an 'EndSession' message when the secure communication channel (THP) has already been invalidated. Without the fix, the code might try to close a session on a broken or closed channel, which could cause an unnecessary error or warning. It does not appear to be a security vulnerability in the hardware wallet itself.

This commit is a routine user-interface refactor for the Trezor hardware wallet's bootloader screen header. It changes how a battery/charging icon is displayed in the header and tidies up event handling for that icon across several bootloader screens. There is no indication it fixes a security bug or introduces a security-relevant change.

This commit adds a new display mode to the battery indicator on Trezor hardware wallets. It lets the device show only a charging icon (without the battery percentage number) when the device is plugged in. There is no security-relevant change here—only a user-interface tweak.

This commit updates the public keys embedded in the firmware for the Trezor T3W1 hardware wallet model. It adds new boardloader keys and replaces temporary development security-monitor keys with what appear to be production keys. This is a routine key provisioning change, not a fix for an active security flaw. There is no evidence in the commit that this addresses a vulnerability or that any keys were leaked.

This commit simply fills in previously empty lists of official production 'root' public keys used by Trezor's Python library to validate firmware signatures. These are public keys, not private secrets, so adding them does not by itself create a vulnerability. It is a routine configuration update replacing placeholder TODO entries with real key values.

This is a small bug fix in the Bluetooth driver for Trezor hardware wallets. The code had a path where it returned early without unlocking interrupts, which could leave the device in a state where important background tasks stop running. This could cause the device to freeze or behave unpredictably during Bluetooth communication. There is no direct evidence this was exploited or reported as a security vulnerability.

This commit updates Trezor firmware to match a newer version of an external security chip library called libtropic. Most changes are mechanical: renaming internal fields (h->l2_buff to h->l2.buff), adding newly required source files to build scripts, and adjusting function signatures. One function that reads a device certificate is temporarily stubbed out with a TODO comment and always returns success without actually fetching the certificate. The commit is marked [no changelog] and does not describe itself as a security fix.

This commit fixes error handling in a Trezor factory-production test tool for the Tropic chip. Previously, when the chip failed to return a firmware version or chip ID, the tool would print an error but then continue and print a second 'OK' response with whatever leftover data happened to be in memory. The fix makes the function return immediately after the error, and also checks the correct success/failure code and clears the buffers first. It is a bug fix in an internal manufacturing diagnostic command, not a user-facing wallet security flaw.

This commit only changes which Git branch the build system follows for an external library called libtropic. It does not modify any actual firmware code, fix a bug, or change device behavior. There is no visible security relevance in the commit itself.

This commit adds a new production-test command to Trezor hardware wallets that updates the firmware of an internal Tropic security chip. It also speeds up the SPI bus used to talk to that chip. The change is part of the factory/production testing tooling, not the normal user wallet firmware, and there is no claim in the commit that it fixes a security bug. The main things to watch are that the update mechanism only accepts one hard-coded silicon revision ('ABAB') and that the SPI speed increase is reliable.