Trezor firmware

This commit strengthens the Trezor host-side device-authentication check. Previously, the tool verified that each security chip's certificate chain was signed by a trusted root, but it did not compare the device model and serial number written into the different certificates. The patch now extracts the common name (model) and serial number from each certificate and rejects the device if those values disagree across chips or do not match the model the device claims to be. This closes a gap where a malicious or misconfigured device might present otherwise valid but mismatched certificates.

This commit is a follow-up code cleanup that wraps more on-screen user-interface helpers in a new 'layout context' pattern. It changes type annotations from LayoutObj to LayoutContext and converts several synchronous-looking wrapper functions into async functions that use Python 'with' blocks. There is no direct evidence in the commit of a fixable security bug; it appears to be a defensive refactoring to make UI resource lifetimes more predictable across Trezor firmware models.

This commit fixes a firmware build problem when a feature called 'extapp support' is enabled. It changes which source files are compiled and adjusts code guards so that certain applet-related code is only included when both applets and kernel mode are active. There is no direct evidence this fixes a security vulnerability; it appears to be a build-system correction.

This commit removes calls to an old, already-deprecated debug-only feature named DebugLinkWatchLayout from the Python test library and test scripts. It is a cleanup change affecting only testing and developer tooling, not the firmware that runs on the Trezor device or any user-facing security behavior.

This is a small cleanup change in the Rust Trezor client library. It removes an unused `script_type` parameter from the `get_public_key()` function and its callers. The parameter was being set in the request to the Trezor device, but the device does not actually need or use it for this operation. There is no security vulnerability here—just code simplification.

This commit fixes the CI (continuous integration) bootloader so it correctly hands control over to the main firmware after running. It adds missing security-monitor verification, calls a secret-handoff routine before jumping, and passes startup arguments to the next stage. The change appears to be a bug fix for an internal test/CI bootloader rather than a fix for an exploitable security flaw in production devices.

This commit is a straightforward code cleanup: it moves hard-coded pin, clock, and interrupt settings for the Nordic (NRF) radio chip out of the driver code and into board-specific header files. The actual electrical connections and behavior stay the same for the existing boards (revA, revB, revC). It also fixes one minor interrupt-clearing macro name to match the current HAL convention. There is no user-facing change and no security fix.

This is a build-system refactoring commit for Trezor firmware. It moves feature-resolution code into a new module and shifts hard-coded ELF section lists and signing-tool choices into TOML configuration files. There is no direct evidence of a security vulnerability being fixed; it is a code-cleanup and maintainability change.

This commit removes an optional build feature called `storage_hw_key` and instead turns on hardware-derived storage key support automatically for one specific chip family (STM32U5) and never for the software emulator. It is a cleanup/refactoring change with no direct security fix or vulnerability visible in the diff.

This commit is a straightforward internal rename from 'target' to 'project' across build configuration files and the Rust xtask build helper. It does not change what the firmware does, how it behaves, or any security logic. It is purely a code-maintenance refactor.

This commit is a build-system cleanup for Trezor firmware. It removes repeated lists of hardware-model-specific feature flags from multiple Cargo.toml files and replaces them with a single shared list in a new target.toml file for each project. There is no change to the actual device code or security behavior—only how build features are organized.

This commit is a follow-up code cleanup that wraps more on-screen layout calls in Python 'with' blocks. It changes return-type annotations from LayoutObj to LayoutContext and makes several UI helper functions async. There is no direct evidence in the commit that it fixes an exploitable security bug; it appears to be a defensive refactoring to enforce layout scoping consistently.

This is a routine dependency update bumping the Python Mako templating library from version 1.3.10 to 1.3.12. The commit message says the change is meant to avoid false safety warnings, because Mako versions 1.3.11 and earlier have a known vulnerability in code that Trezor firmware does not actually use. Only the lock file (uv.lock) changed; no Trezor source code was modified.

This commit simply deletes an entire internal testing tool called automatic_battery_tester from the repository. It removes Python scripts, configuration files, documentation, and dependency lists used only for hardware battery testing in the lab. No firmware code that ships to users was changed, and nothing in the commit suggests a security fix or vulnerability.

This commit is a code cleanup that changes how user-interface layouts are managed in the Trezor firmware. It wraps more layout objects in explicit context managers (the `with ... as layout:` pattern) so their lifetimes are clearly scoped. There is no direct evidence in the commit that this fixes an exploitable security bug; it appears to be a follow-up refactoring for safer resource handling.

This commit is a code-quality fix in the Cardano app of the Trezor firmware. It removes direct access to the global translation object (TR) at the time the Python module is first loaded, and instead reads the translated strings only when they are actually needed. This avoids a potential startup-time crash or import-order problem if the translation system is not fully initialized when the module is imported. There is no direct evidence in the commit that this is an exploitable security vulnerability.

This update fixes a bug in how the Trezor device handles on-screen button prompts when communication with the host computer hits errors or timeouts. Previously, an input/output problem during a backup could cause the device to send extra button requests or errors after the workflow should have ended, and the final 'Success' message could fail to send. The fix makes the device ignore further host messages until the backup workflow finishes, and lets users cancel other workflows through a new waiting screen. It is a reliability and defensive fix rather than a clear-cut remote exploit.

This commit only adds comments explaining existing behavior in a Trezor firmware source file. No code logic was changed, no bugs were fixed, and no security vulnerability is present in the diff.

This is a tiny user-interface polish change for the Trezor hardware wallet. It changes one footer label from 'swipe up' to 'tap' on warning screens that have no header title. There is no security-relevant behavior change in the diff itself.

This commit fixes a user-interface bug on the Trezor T3W1 hardware wallet. When a FIDO2/U2F security-key operation failed, the error popup was shown with a blank, non-functional button instead of automatically closing after a timeout. The fix makes the error screen close after the intended number of milliseconds (4 seconds in the FIDO2 case), so users are no longer stuck on a dead-end screen.

This commit only changes user-facing text strings and their generated lookup tables in the Trezor firmware. It rewords a message about communication problems and adds a second, milder version of the message. There are no code behavior changes, no fixes to logic bugs, and no security-relevant functionality altered.

This commit adds a safety check to three Trezor device user-interface layouts (Bolt, Caesar, Eckhart). It prevents a 'dangerous' warning screen from being shown without a title/header. The change is defensive: previously the unused `_danger` flag was ignored, so a caller could accidentally or maliciously present a high-risk warning with no context. Now such calls fail with an error. The commit message frames this as a chore, not a security fix, and no changelog entry was added.

This is a small user-interface cleanup in the Trezor hardware wallet firmware. It lets certain on-screen confirmation dialogs omit a large icon and title area when no title is provided, making the layout more flexible. There is no direct evidence in the commit that this fixes a security vulnerability.

This is a user-interface cleanup change for Trezor hardware wallets. It lets the 'show_warning' screen accept 'None' for the title, which means 'hide the header entirely', instead of using an empty string to mean the same thing. It is a refactor with no changelog and no apparent security relevance.

This update fixes a bug in Bitcoin-only Trezor firmware where the device would try to derive a cryptographic seed even when the device had not been set up yet. Now it correctly returns a 'NotInitialized' error instead. A test was added to confirm the behavior.