Trezor firmware

This commit only changes which Git branch the build system follows for an external library called libtropic. It does not modify any actual firmware code, fix a bug, or change device behavior. There is no visible security relevance in the commit itself.

This commit removes an unused function called tropic.get_certificate() from the Trezor firmware. The function was already a stub that did nothing useful: it returned success without actually fetching any certificate. The change is a cleanup, not a security fix, and does not appear to address any active vulnerability.

This commit adds a new 'lock' feature for a special secret-storage area inside Trezor hardware wallets. It lets factory-test software explicitly lock the secret sector after writing keys, and it makes the secret-write function report failures instead of silently crashing. The change is defensive: it reduces the chance that secrets can be accidentally or maliciously modified after production. There is no direct evidence in the commit that this fixes a known active attack.

This commit adjusts the on-device secret memory layout for the Trezor T3W1 hardware model. It removes unnecessary parentheses from one offset, reserves space for an MCU device certificate, and adds a dedicated 'lock slot' region. The change is preparatory: it allocates memory regions but does not by itself add or change any code that reads or writes these regions. There is no direct evidence in the commit that this fixes an active security bug, though the title mentions 'explicit secret locking' which is a security-hardening concept.

This commit makes a small UI change to the Trezor hardware wallet's loading animation. When animations are disabled (likely during automated testing), the loader is forced to show 0% progress instead of its real value. This is a test/development convenience change, not a security fix.

This commit is a routine user-interface refresh for the Trezor Safe 7 tutorial. It replaces some tutorial text, adds new icons, and extracts the screen background drawing into a reusable component. There is no security-relevant change visible in the code.

This bootloader patch changes how the Trezor device handles a failed USB/communication write. Previously, if sending a packet failed, the bootloader would call an 'ensure' function that effectively halted or panicked the device. Now the function returns a failure status up to the caller instead. This is a hardening improvement that makes the bootloader more resilient to communication errors, but the commit message frames it only as a behavior improvement with no changelog.

This change fixes a subtle bug in the Trezor device's internal task scheduler. Previously, the same exception object was reused every time a background task was closed. Reusing the same exception object can cause unexpected behavior if code catches and re-raises it, or if the exception object is modified. The fix creates a fresh exception object each time, which is safer and more predictable. There is no direct evidence in the commit that this is exploitable as a security vulnerability.

This small firmware patch makes sure a Bluetooth Low Energy (BLE) connection counter is saved before the device goes to sleep and restored when it wakes up. Without this, the device could forget how many peers it thinks are connected after suspend/resume, which might confuse the wallet's Bluetooth state machine and lead to minor glitches or unexpected behavior. There is no direct evidence in the commit that this is an exploitable security vulnerability.

This commit adds on-device user-interface support for SLIP-24 payment requests on the Trezor Model T (Bolt layout). It does not change transaction validation, cryptography, or signing logic. Instead, it wires up new confirmation screens so users can review payment-request details (provider, refund addresses, swap/trade details, fees) before signing. Existing tests that previously skipped Model T are now enabled for it, and new UI test hashes are recorded. There is no direct evidence of a security vulnerability in this patch.

This commit fixes the verification logic for Trezor bootloader version 2 images in the Python firmware library. Previously, the code checked the elliptic-curve (EC) signature against only the Merkle root digest. The fix now hashes that digest together with the post-quantum (SLH) signature first, matching the actual signing procedure. Without this fix, a valid-looking bootloader signature could be accepted even if the SLH signature was wrong or missing, weakening the dual-signature security check.

This is a routine test-infrastructure change. It moves a helper that clicks menu items in automated tests into a shared debug-link action and updates many test scripts to use it. There is no change to the firmware's security behavior, no fix for a vulnerability, and no user-facing feature.

This commit only changes a test file and its expected screen-capture hashes. It adds a 0.1-second delay in an automated test to make the test fail less often. There is no change to the actual Trezor firmware or wallet security code, so it does not affect real users or devices.

This commit adds test helper code for reading and interacting with vertical menus on Trezor hardware wallet screens. It only touches the Python test/debugging library and does not change any firmware security logic, cryptography, or user-facing behavior. There is no security issue here.

This commit fixes a test script, not the actual Trezor firmware. The test was performing the wrong on-screen action for a newer Trezor model (Eckhart) when simulating a user cancelling a backup. It now clicks the cancel button instead of navigating through a menu. This is a test-only correction and does not change device security.

This is a routine maintenance update that bumps the version of a third-party GitHub Action used to install the Nix package manager during automated CI builds. There is no indication of a security fix or vulnerability in the commit itself.

This commit is a simple renaming from 'device ID' to 'device serial number' across labels, command names, comments, and a constant. There is no functional code change and no security relevance.

This commit is a user-interface layout tweak for Trezor hardware wallets. It adds configurable vertical spacing between key/value property pairs shown on device screens. There is no security-relevant change, no bug fix, and no handling of secrets or memory.

This is a large internal refactoring of how Trezor's user-interface passes key-value display data from Python apps to the Rust firmware. It replaces two-element string tuples with a new three-element 'PropertyType' that adds a flag indicating whether a value is raw data. The change touches many coin apps and UI layouts but is described by the vendor as a routine chore with no changelog entry. There is no direct evidence in the commit of a security vulnerability or fix.

This is a routine code cleanup in the Trezor hardware wallet's user interface layer. It moves default font and spacing choices for a UI component called PropsList into each device's theme file, so callers can use a simpler constructor. There is no change to security logic, cryptography, or how user data is handled.

This commit fixes a bug in the Trezor hardware wallet's vibration motor (haptics) driver for the T3T1 model. Previously, the standard haptic_play() function checked whether haptics were disabled before running, but the custom haptic_play_custom() function did not. The patch adds the same safety checks to haptic_play_custom(), so it now returns early if the driver is not initialized or if haptics are disabled. This is a consistency/bugfix change rather than a critical security patch; the main risk is that a disabled haptic motor could still be activated unexpectedly, which is primarily a user-experience or device-behavior issue rather than a code-execution or asset-theft vulnerability.

This commit is a cosmetic/user-interface change. It updates the text and styling shown on the hardware wallet's red error screens (RSOD), such as when a wipe code is entered or too many PIN attempts occur. The messages are rewritten in sentence case instead of all capitals, and some fonts/layouts are adjusted. There is no indication this fixes or introduces a security vulnerability.

This commit adds read-only functions that expose Bluetooth Low Energy (BLE) connection and pairing status to Python code running on the Trezor device. It does not change how BLE behaves, how it is paired, or how data is protected. It only makes existing internal state information visible to higher-level software.

This commit only adds a set of named color constants for an LED color palette in a user-interface theme file. It is a straightforward visual design change with no security relevance.

This commit is a cosmetic UI change for the Trezor hardware wallet's Eckhart design. It makes the device's RGB LED light up with specific colors on the homescreen and during red-screen error states, matching the screen's theme. There is no security-relevant change to how data is protected, how keys are handled, or how the device communicates.