Trezor firmware

This commit fixes how the Trezor emulator initializes its 'monotonic counters'—security counters that only ever increase and are used to prevent downgrades to older, possibly vulnerable firmware. Before this fix, the emulator did not explicitly initialize these counters before running the boot emulator, which could lead to uninitialized or incorrect counter values during emulator-based testing. The fix adds a dedicated initialization routine and calls it in every relevant firmware component. On real hardware the initialization is currently a no-op, so this primarily affects the Unix/emulator build used for development and testing.

This commit fixes a bug in Trezor's AES encryption/decryption code where a negative length value could be passed to low-level AES functions. Previously, those functions treated the signed length as a large unsigned number, which could cause them to read or write far beyond the intended memory buffer. The patch makes every AES mode reject negative lengths and adds error handling so callers fail safely instead of silently producing bad results or touching memory they shouldn't.

This commit simply moves the list of contributors from two places (a package metadata file and the README) into a single dedicated AUTHORS file. It is a routine housekeeping change with no security relevance.

This change fixes a build script that was ignoring copy errors. Previously, the script would silently ignore any failure when copying public binary files, which could hide real problems. Now it only skips the copy when the file genuinely doesn't exist for known cases (the kernel, and secmon when built as a dependency), and will report actual copy failures.

This commit is a small internal cleanup in Trezor's Ethereum signing code. It changes how two special 'magic' bytes (the transaction type markers for newer Ethereum transaction formats) are fed into the cryptographic hash. Previously the code used the general RLP encoder to write the single-byte marker; now it appends the raw byte directly. The commit message says this avoids relying on the assumption that RLP encodes small integers as a single byte. There is no direct evidence in the commit or supplied references that this fixes an exploitable vulnerability, but it removes a fragile assumption in security-critical hashing code.

This commit only adds a new unit test to the Trezor firmware codebase. It verifies that very short Ethereum RLP-encoded byte strings and small positive integers encode to themselves, which is a known property of the RLP specification. No production code was changed, and there is no security fix or vulnerability present in the diff.

This commit only fixes broken or awkward documentation links inside the project's user guide. It replaces relative links that point outside the documentation folder with internal placeholder files or direct GitHub URLs. There is no change to any firmware, software, or cryptographic code, and no security impact.

This commit removes the SHA-1 hashing function from the regular Trezor firmware. SHA-1 is an old, weak hash algorithm that is no longer considered secure for sensitive uses. The change deletes the code that exposes SHA-1 to apps running on the device, along with related tests and benchmarks. It is a hardening/cleanup change rather than a fix for an active bug or exploit.

This commit changes how a cryptographic library sets up secure connections. Previously, the code automatically calculated the public key from the private key. Now, the caller must provide the public key directly. This is a code-quality refactor that reduces the risk of using mismatched keys, but the commit itself does not claim to fix a specific security bug and no exploit is described.

This commit simply reorders the arguments of an internal function called dh() and updates every place that calls it. The actual math and security behavior are unchanged; it is a code cleanup with no security effect.

This commit simply renames two groups of internal status labels (called enums) in the Trezor firmware's cryptographic code. The old names like WAITING_FOR_REQUEST1 were shared between two different parts of the code, so the developer gave them longer, unique names that include which part they belong to. The actual numeric values and program behavior are unchanged. There is no security fix or vulnerability here.

This commit fixes three places in the Trezor firmware's cryptographic code where a memory-clearing function could be called with a NULL pointer. In practice, passing NULL to memzero is harmless on Trezor's platform (it does nothing), but it is undefined behavior in C and could cause a crash or unpredictable results on other systems. The change adds simple NULL checks before clearing plaintext output and before wiping responder/initiator objects during cleanup.

This commit is a code cleanup (refactor) for the cryptographic handshake code used in Trezor devices. It changes how the other party's long-term public key is returned to the caller: instead of storing it inside an internal state structure, the function now writes it into a buffer supplied by the caller. The commit message explicitly calls it a refactor and includes '[no changelog]', indicating it is not being presented as a security fix. There is no direct evidence in the diff that this change fixes an active vulnerability, but it does reduce the amount of sensitive key material kept in internal state and gives callers explicit control over the output buffer, which is generally a defensive improvement.

This commit is a simple rename from 'ProjectProfile' to 'ProjectConfig' in two Rust source files. It only changes variable names, struct names, and error messages. There is no change to program logic, security behavior, or how data is handled.

This commit is a straightforward internal code refactor in Trezor's build tooling. It introduces a new ResolvedBuildArgs structure that centralizes default values for command-line build options before they are used. There is no change to user-facing behavior, no fix for a bug, and no security-related change.

This commit is a straightforward internal refactor of the Trezor firmware build tool's command-line argument handling. It changes many on/off flags from plain booleans to optional booleans so they can explicitly be set to true, false, or left unset. There is no security-relevant behavior change: when a flag is not provided, it still defaults to false, exactly as before.

This commit is a straightforward internal code reorganization in Trezor's build tooling. It moves build-option definitions from one Rust source file to a new module and adds the ability to load those options from a configuration file. There is no change to the actual firmware behavior, no bug fix, and no security-related change.

This commit is a developer tooling change for the Trezor firmware build system. It introduces 'build presets'—named configuration bundles stored in TOML files—so developers can select common build settings with a single command-line flag instead of typing many options. It does not change how the device works, how funds are protected, or any cryptographic code. There is no indication this is a security fix or vulnerability patch.

This commit is a routine update to a build-system manifest file used by Trezor's internal tooling. It reorganizes and re-labels feature flags (for example, moving options between 'Features', 'Debugging', and 'Signing' groups and simplifying some multi-state options to checkboxes). There is no change to the actual firmware code, cryptographic logic, or security behavior of Trezor devices.

This commit adds a single configuration file for a Trezor developer tool (a VS Code extension). It only points the tool to existing folders in the repository and contains no executable code, no secrets, and no changes to firmware behavior. There is no security issue visible in the diff.

This commit is a simple internal code cleanup: it renames a Rust data structure called ResolvedBuild to ResolvedBuildFeatures and updates the places that use it. There are no functional changes, no security fixes, and no changes to how the software behaves or protects secrets.

This is a tiny code cleanup commit that replaces two calls to `ptr::null()` with Rust's `unwrap_or_default()` to silence automated Clippy lint warnings. It does not change what value is produced (still a null pointer when no salt is provided) and has no functional or security effect.

This commit is a straightforward internal code cleanup in Trezor's build tooling. It moves a data structure and two helper methods from one Rust source file to another and updates callers accordingly. There is no change to user-facing behavior, no change to cryptographic or security-sensitive code, and no indication of a vulnerability fix.

This commit only adds documentation. It updates the table of contents and adds a new markdown page plus a diagram explaining the project's 'xtask' build helper. No code, build scripts, or firmware logic was changed, so it cannot introduce a security vulnerability or fix one.

This commit is a build-system refactoring for Trezor firmware. It moves the mapping of command-line build options to Rust/cargo features out of hard-coded Rust logic and into per-project TOML files. It also adds a small change so debug builds automatically enable the 'debug-link' option. There is no direct vulnerability in the diff, but any mistake in the new TOML mappings could accidentally enable or disable security-relevant features in a shipped firmware image.