Trezor firmware

This commit fixes a timing weakness in how a Trezor hardware wallet checks the authenticity of a 'credential' used in its Trezor Host Protocol (THP). Previously, the device compared two secret codes with a standard equality check, which can leak information through tiny timing differences. The patch switches to a constant-time comparison function and adds a length check first. This is a defensive hardening change against side-channel attacks, but the commit message does not frame it as a security fix and no exploit is described.

This update fixes a bug in Trezor hardware wallets where the device would not properly lock itself when only SD card protection was enabled and no PIN was set. In that configuration, an attacker with brief physical access could potentially keep the device unlocked and use it without needing to enter a PIN or provide the SD card secret, bypassing the intended security protection.

This commit replaces internal programming assertions (which crash the device if they fail) with proper error handling for Ethereum transaction signing when a payment request is involved. It ensures that if someone supplies a payment request verifier, the transaction must have zero data bytes and must actually include a payment request object. Without the fix, a malformed or unexpected input could trigger an assertion failure instead of a clean error, potentially causing the device to crash or behave unpredictably during signing.

This commit is a routine version bump for a Trezor firmware release. It only changes version numbers in header files and translation metadata, plus updates the signed translation package reference. There are no code changes that affect security or device behavior.

This commit fixes a build configuration issue so that debug builds of Trezor firmware, bootloader, and production-test firmware automatically enable a visual 'ui_debug_overlay' feature. That feature displays a small red square marker in the top-right corner of the screen, making it obvious when a debug/non-production build is running. It is a UI/UX and build-system change, not a fix for an exploitable security vulnerability.

This commit adds a new helper script that lets developers check whether a signed Trezor firmware file truly matches its unsigned counterpart and whether its digital signature is valid. It is a defensive verification tool, not a fix for a security flaw, and introduces no vulnerability in the device code itself.

This commit is a feature addition to Trezor's internal production-test firmware. It replaces generic string-based error messages with a structured, numbered error-code system. There is no direct security vulnerability being fixed or introduced; it is a maintainability and diagnostics improvement for factory testing tools.

This commit adds human-readable display definitions for 1inch decentralized-exchange swap transactions on Trezor hardware wallets. It tells the wallet how to decode and label 1inch swap parameters (amounts, beneficiary, last pool) so users can verify what they are signing on the device screen. The change is purely a data/configuration addition plus matching tests; it does not alter cryptographic code, transaction validation, or signing logic. There is no indication in the commit that this fixes a security vulnerability.

This is a small maintenance update to Trezor's Ethereum clear-signing definitions for the LiFi cross-chain swap service. It adds alternative contract addresses for LiFi on four blockchains where the service uses a different address than usual, and tweaks a few on-screen labels (for example changing 'Recipient' to 'Receiver' and adjusting capitalization). There is no indication of a security vulnerability being fixed.

This commit is a code cleanup that wraps more on-screen UI layouts in a new 'layout context' scoping mechanism. It changes how layout objects are created and awaited, but does not add or remove security checks. The main risk is that any mistake in the refactor could cause a layout to be used outside its intended scope, but the diff itself shows consistent mechanical changes rather than a security fix or vulnerability.

This commit only updates automated test scripts for the Trezor hardware wallet. It changes how the test code simulates button presses during a wallet backup flow to match the actual device behavior. There is no change to the firmware or wallet security itself.

This is a small, safe code cleanup. It changes a type annotation from a concrete class to a protocol (an interface definition) and updates two function signatures to return the more general interface type. There is no change to actual program behavior, no bug fix, and no security relevance.

This update fixes a bug in the Trezor Python library where reconnecting to a Trezor device could fail if an old, unread response was still waiting in the communication channel. The fix makes the library clear out up to 10 stale responses before it checks whether the device speaks the older protocol v1. A new test simulates a host disconnect mid-operation and verifies that a new client can reconnect successfully.

This commit shortens two on-screen text labels in the Trezor bootloader from 'INSTALL FIRMWARE' to 'INSTALL FW' and 'UPDATE FIRMWARE' to 'UPDATE FW'. The change is purely cosmetic, intended to stop the text from overflowing its display area. The commit message notes these screens are not normally seen by users because updates now happen without user interaction. There is no security fix here.

This commit adds support for a new post-quantum digital-signature algorithm (ML-DSA-44) to the Python trezorctl tool's device-authenticity check. It does not change how the hardware wallet itself works; it only lets the desktop companion software recognize and verify a new type of manufacturer signature on some devices. The change also moves hard-coded root public keys into a separate internal module and updates the required cryptography library version. There is no indication in the commit that this fixes a security bug or vulnerability.

This commit strengthens the Trezor host-side device-authentication check. Previously, the tool verified that each security chip's certificate chain was signed by a trusted root, but it did not compare the device model and serial number written into the different certificates. The patch now extracts the common name (model) and serial number from each certificate and rejects the device if those values disagree across chips or do not match the model the device claims to be. This closes a gap where a malicious or misconfigured device might present otherwise valid but mismatched certificates.

This commit is a follow-up code cleanup that wraps more on-screen user-interface helpers in a new 'layout context' pattern. It changes type annotations from LayoutObj to LayoutContext and converts several synchronous-looking wrapper functions into async functions that use Python 'with' blocks. There is no direct evidence in the commit of a fixable security bug; it appears to be a defensive refactoring to make UI resource lifetimes more predictable across Trezor firmware models.

This commit fixes a firmware build problem when a feature called 'extapp support' is enabled. It changes which source files are compiled and adjusts code guards so that certain applet-related code is only included when both applets and kernel mode are active. There is no direct evidence this fixes a security vulnerability; it appears to be a build-system correction.

This commit removes calls to an old, already-deprecated debug-only feature named DebugLinkWatchLayout from the Python test library and test scripts. It is a cleanup change affecting only testing and developer tooling, not the firmware that runs on the Trezor device or any user-facing security behavior.

This is a small cleanup change in the Rust Trezor client library. It removes an unused `script_type` parameter from the `get_public_key()` function and its callers. The parameter was being set in the request to the Trezor device, but the device does not actually need or use it for this operation. There is no security vulnerability here—just code simplification.

This commit fixes the CI (continuous integration) bootloader so it correctly hands control over to the main firmware after running. It adds missing security-monitor verification, calls a secret-handoff routine before jumping, and passes startup arguments to the next stage. The change appears to be a bug fix for an internal test/CI bootloader rather than a fix for an exploitable security flaw in production devices.

This commit is a straightforward code cleanup: it moves hard-coded pin, clock, and interrupt settings for the Nordic (NRF) radio chip out of the driver code and into board-specific header files. The actual electrical connections and behavior stay the same for the existing boards (revA, revB, revC). It also fixes one minor interrupt-clearing macro name to match the current HAL convention. There is no user-facing change and no security fix.

This commit is a build-system cleanup for Trezor firmware. It removes repeated lists of hardware-model-specific feature flags from multiple Cargo.toml files and replaces them with a single shared list in a new target.toml file for each project. There is no change to the actual device code or security behavior—only how build features are organized.

This commit is a build-system cleanup. It removes separate 'emulator board' configuration files and instead makes the emulator reuse the real hardware board's settings, only swapping in a special emulator header and the Unix display/touch drivers. There is no user-facing change or security fix visible in the diff.

This commit is a straightforward internal rename from 'target' to 'project' across build configuration files and the Rust xtask build helper. It does not change what the firmware does, how it behaves, or any security logic. It is purely a code-maintenance refactor.