Trezor firmware

This commit removes an optional build feature called `storage_hw_key` and instead turns on hardware-derived storage key support automatically for one specific chip family (STM32U5) and never for the software emulator. It is a cleanup/refactoring change with no direct security fix or vulnerability visible in the diff.

This is a build-system refactoring commit for Trezor firmware. It moves feature-resolution code into a new module and shifts hard-coded ELF section lists and signing-tool choices into TOML configuration files. There is no direct evidence of a security vulnerability being fixed; it is a code-cleanup and maintainability change.

This commit adds new configuration files describing Trezor hardware models and build targets. It is a build-system feature with no user-facing behavior change and no apparent security relevance.

This commit is a follow-up code cleanup that wraps more on-screen layout calls in Python 'with' blocks. It changes return-type annotations from LayoutObj to LayoutContext and makes several UI helper functions async. There is no direct evidence in the commit that it fixes an exploitable security bug; it appears to be a defensive refactoring to enforce layout scoping consistently.

This is a routine dependency update bumping the Python Mako templating library from version 1.3.10 to 1.3.12. The commit message says the change is meant to avoid false safety warnings, because Mako versions 1.3.11 and earlier have a known vulnerability in code that Trezor firmware does not actually use. Only the lock file (uv.lock) changed; no Trezor source code was modified.

This commit simply deletes an entire internal testing tool called automatic_battery_tester from the repository. It removes Python scripts, configuration files, documentation, and dependency lists used only for hardware battery testing in the lab. No firmware code that ships to users was changed, and nothing in the commit suggests a security fix or vulnerability.

This commit is a code cleanup that changes how user-interface layouts are managed in the Trezor firmware. It wraps more layout objects in explicit context managers (the `with ... as layout:` pattern) so their lifetimes are clearly scoped. There is no direct evidence in the commit that this fixes an exploitable security bug; it appears to be a follow-up refactoring for safer resource handling.

This commit is a code-quality fix in the Cardano app of the Trezor firmware. It removes direct access to the global translation object (TR) at the time the Python module is first loaded, and instead reads the translated strings only when they are actually needed. This avoids a potential startup-time crash or import-order problem if the translation system is not fully initialized when the module is imported. There is no direct evidence in the commit that this is an exploitable security vulnerability.

This commit only adds comments explaining existing behavior in a Trezor firmware source file. No code logic was changed, no bugs were fixed, and no security vulnerability is present in the diff.

This update fixes a bug in how the Trezor device handles on-screen button prompts when communication with the host computer hits errors or timeouts. Previously, an input/output problem during a backup could cause the device to send extra button requests or errors after the workflow should have ended, and the final 'Success' message could fail to send. The fix makes the device ignore further host messages until the backup workflow finishes, and lets users cancel other workflows through a new waiting screen. It is a reliability and defensive fix rather than a clear-cut remote exploit.

This is a tiny user-interface polish change for the Trezor hardware wallet. It changes one footer label from 'swipe up' to 'tap' on warning screens that have no header title. There is no security-relevant behavior change in the diff itself.

This commit fixes a user-interface bug on the Trezor T3W1 hardware wallet. When a FIDO2/U2F security-key operation failed, the error popup was shown with a blank, non-functional button instead of automatically closing after a timeout. The fix makes the error screen close after the intended number of milliseconds (4 seconds in the FIDO2 case), so users are no longer stuck on a dead-end screen.

This commit only changes user-facing text strings and their generated lookup tables in the Trezor firmware. It rewords a message about communication problems and adds a second, milder version of the message. There are no code behavior changes, no fixes to logic bugs, and no security-relevant functionality altered.

This is a small user-interface cleanup in the Trezor hardware wallet firmware. It lets certain on-screen confirmation dialogs omit a large icon and title area when no title is provided, making the layout more flexible. There is no direct evidence in the commit that this fixes a security vulnerability.

This commit adds a safety check to three Trezor device user-interface layouts (Bolt, Caesar, Eckhart). It prevents a 'dangerous' warning screen from being shown without a title/header. The change is defensive: previously the unused `_danger` flag was ignored, so a caller could accidentally or maliciously present a high-risk warning with no context. Now such calls fail with an error. The commit message frames this as a chore, not a security fix, and no changelog entry was added.

This is a user-interface cleanup change for Trezor hardware wallets. It lets the 'show_warning' screen accept 'None' for the title, which means 'hide the header entirely', instead of using an empty string to mean the same thing. It is a refactor with no changelog and no apparent security relevance.

This update fixes a bug in Bitcoin-only Trezor firmware where the device would try to derive a cryptographic seed even when the device had not been set up yet. Now it correctly returns a 'NotInitialized' error instead. A test was added to confirm the behavior.

This commit moves a safety check earlier in the process of setting up a cryptographic seed on a Trezor device. The check ensures the device is properly initialized before it proceeds. By running the check earlier, it prevents a situation where a seed might already be cached or a passphrase accepted before the initialization check happens. This is a defensive hardening change, not a confirmed exploitable vulnerability, because the commit message does not describe a security issue and no exploit path is shown in the diff.

This commit is a simple code cleanup: it replaces many copies of the same 'if device not initialized, raise an error' check with a single shared helper function. There is no change to when or how the error is raised, so it does not fix or introduce any security vulnerability.

This is a small internal code cleanup in the Trezor firmware's user-interface code. It changes a variable used for screen layout margin from a larger integer type (`usize`) to a smaller one (`u8`). The actual behavior is unchanged because the value is immediately converted to the same screen-coordinate type (`i16`) used before. There is no security-relevant change visible in the commit.

This is a small user-interface cleanup change for the Trezor hardware wallet's Delizia layout. It makes warning screens hide their top title bar when the title is empty, and explicitly rejects 'danger' warnings that have no title. There is no direct evidence this fixes a security vulnerability; it appears to be a UI consistency improvement.

This commit is a simple code cleanup: it renames a Rust function from Frame::new() to Frame::with_header() and updates every place that called it. There is no change to what the code does, no bug fix, and no security-relevant behavior.

This commit removes the 'ipc' feature flag from three build scripts by default, and only enables it when external app loading is supported on the T3W1 model. IPC stands for inter-process communication, and these particular system calls were reportedly unused. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a cleanup or hardening change to reduce unused attack surface.

This is a massive Trezor firmware commit that replaces the old SCons-based build system with Cargo (Rust's build tool) for compiling the embedded C code. It adds many new Cargo.toml files, build.rs scripts, and a custom xbuild helper crate, but does not change the actual security logic of the wallet. The main risk is that a build-system change of this size could accidentally alter compiler flags, included source files, or linker settings, which might affect the produced binary. There is no direct vulnerability shown in the diff, and the commit message explicitly says it is a feature with no changelog entry.

This commit rearranges how different pieces of the Trezor firmware are placed in the device's flash memory. It moves frozen Python data and the main code sections into one flash region, while moving the bootloader into a separate flash region. The stated purpose is to support linking Rust static libraries (rlib). There is no direct evidence in the commit that this fixes a security vulnerability.