Trezor firmware

This commit removes a low-level interface that let any software component tell the device what to do on its next reboot. The change makes reboot control a privileged operation only, so unprivileged code can no longer pick arbitrary boot commands. It is a hardening/refactoring change rather than a documented fix for a specific active bug.

This commit is purely legal and administrative housekeeping. It adds missing third-party copyright notices and license texts to the crypto/LICENSE file, fixes a typo in a few license headers, and changes the stated license of some first-party files from GPL to MIT. No executable code was changed, so it cannot introduce a security vulnerability or fix one.

This commit fixes a UI wording mix-up on Trezor devices when a user enters a PIN that doesn't match. Previously, the title and description in the 'PIN mismatch' popup were swapped, which could briefly confuse the user about what went wrong. There is no evidence this affects security beyond a minor user-experience issue.

This commit is a user-interface tweak for the Trezor hardware wallet's Caesar layout. It replaces a static title label with a scrolling 'Marquee' text effect on the homescreen confirmation screen, so long device labels remain readable. There is no security-relevant change here.

This commit is a straightforward user-interface string refactor. It moves the colon that appears after labels like 'Account:' and 'Derivation path:' out of the embedded Rust translation strings and into the Python code that calls the address-details screen. There is no security-relevant change in behavior—only where the colon is appended.

This commit changes the Trezor hardware wallet's PIN entry screen so that long prompt messages scroll horizontally (like a marquee sign) instead of being cut off. It is a user-interface improvement to handle longer text, such as wipe-code prompts. There is no security vulnerability visible in the code change.

This commit fixes a layout bug in the PIN entry screen on Trezor's Eckhart hardware model. Previously, the area showing how many PIN attempts remain was given a fixed width of 85 pixels, which could be too narrow for some languages and cause the text to be cut off or poorly displayed. The patch now dynamically measures the actual text width and reserves space accordingly, with a small gap between the prompt and attempts text. There is no direct security vulnerability here; it is a UI correctness and localization improvement.

This commit is a large internal refactor of the Trezor firmware's third-party application loading system. It replaces the old ELF-based app loader with a new 'app_arena' subsystem that uses a custom binary format, Merkle-tree header verification, and ML-DSA-44 root-of-trust signatures. The change is explicitly marked as a feature ('feat(core): introduce app_arena') with '[no changelog]' and contains no vendor statement that it fixes a security bug. It appears to be a planned architectural redesign, not a security patch.

This commit adds an on-screen confirmation step for the 'space' (data size) parameter when creating new Solana accounts on a Trezor device. Previously, this parameter was hidden from the user during Create Account instructions, even though it was already shown for a related 'Allocate' instruction. The change improves consistency and helps users spot transactions that request unexpectedly large storage allocations, which could be a sign of a malicious or misleading transaction.

This commit only adds new unit tests for an existing Ethereum clear-signing decoder. It does not change any production firmware code, so it cannot introduce a security vulnerability or fix one directly. The tests document how the decoder currently handles various Ethereum ABI data shapes and which malformed inputs it rejects.

This commit adds support for a new Stellar blockchain feature: creating smart contracts (contract deployment) on Trezor hardware wallets. It extends the messages, layouts, serialization, and tests so users can review and sign Stellar 'create contract' transactions and related authorization entries. There is no indication of a security vulnerability in the change itself; it is a feature addition with explicit user confirmation steps and deliberate exclusions of unsupported variants.

This commit is a routine internal code cleanup in the Stellar cryptocurrency support of Trezor firmware. It renames and moves helper functions, extracts reusable pieces, and adds tests. There is no change to user-visible behavior or security boundary, and no security issue is apparent.

This commit fixes a date-handling bug in Trezor hardware wallets. The device converts Bitcoin transaction lock-time timestamps into human-readable dates on its screen. Before the fix, the code used a 32-bit signed integer on real hardware, so any date after the year 2038 (and in practice after about 2068 in this code) would be misread and the wrong date would be shown to the user. The fix switches to a 64-bit timestamp type and adds tests for far-future dates up to the year 2106. The main risk is that a user could be tricked into approving a transaction whose real lock-time date is different from what the device displays.

This change updates how Trezor devices decide whether downloaded Ethereum token/chain definition files are too old to trust. Previously there was one global cutoff date; now each definition format version has its own cutoff. This is a maintenance and correctness improvement, not a fix for an active security bug. It reduces the chance that a future format version could accidentally accept stale or incompatible definition data.

This commit updates the Trezor One (legacy firmware) to use version 2 of the external Ethereum token/network definition format. The key change is that legacy firmware now requires only one valid signature instead of two, and explicitly rejects the older version 1 format. This is a feature update to align legacy devices with the newer definition format, not a fix for an active security bug. The change is documented and includes tests verifying that version 1 definitions are rejected on legacy firmware.

This commit is a code cleanup that moves a small piece of boot-header parsing code out of an STM32-specific folder so it can also be used in emulator and test builds. It changes function arguments from raw flash addresses (uint32_t numbers) to generic pointers, and fixes one accidental use of a security-boolean value where a null pointer was intended. The commit message and diff show no intended behavior change on real devices.

This is a build-system-only change that moves where the NFC feature flag is defined so the emulator compiles correctly. It does not change any runtime behavior, user-facing functionality, or security logic.

This commit fixes a grammar typo in two code comments/docstrings, changing 'Receive a BLE events' to 'Receive a BLE event'. It does not change any executable code, behavior, or security properties.

This commit only changes how a command-line tool prints information about secure-monitor firmware headers. In non-verbose mode it now shows the device model and version instead of dumping every header field. There is no change to security checks, cryptography, or firmware behavior.

This commit adds a runtime check (assert) that ensures a UI function for confirming on-screen properties is never called with an empty list. It also changes the expected input type from a generic iterable to a sequence and converts a couple of generator expressions into lists. The commit message explicitly says it will not affect production builds, because assertions are typically stripped from production firmware. There is no direct evidence this fixes an active security bug; it appears to be a defensive hardening measure for development/debug builds.

This commit fixes a build-time tooling bug in Trezor's firmware build helper. When creating a combined firmware image, the tool was filling unused gaps between sections with 0x00 bytes. One specific gap (the UCB region) is erased by the bootloader on first boot. Because erased flash reads as 0xFF, the device would no longer match the original image after its first boot, causing factory verification to fail. The fix makes the tool fill that gap with 0xFF instead, so the image stays identical after the device boots. This is a manufacturing/verification bug, not a security vulnerability that can be exploited by an attacker.

This commit turns off an internal performance cache for BIP39, the system that converts a recovery seed phrase into cryptographic keys on Trezor hardware wallets. Disabling a cache is usually a defensive change: it can prevent sensitive seed-derived data from lingering in device memory longer than necessary. However, the commit gives no explanation, changelog entry, or linked security report, so we cannot tell whether this fixes a known vulnerability or is just a precautionary hardening measure.

This is a minor bug fix in the Trezor bootloader. When wiping the device, if a step failed, the bootloader always reported the same generic error message ('Could not read BLE status') even when the actual failure was something else, such as failing to erase stored data or issue a Bluetooth command. The fix makes the bootloader report the correct, specific error message. It does not change whether errors happen or how they are handled; it only corrects the message sent to the host computer.

This is a small internal code cleanup in the Trezor firmware's Rust UI layer. It moves some MicroPython-specific code into its own submodule and removes an unused import. There is no visible change to user-facing behavior or security-sensitive logic.

This commit is a minor code cleanup in a test file. It reorganizes Python import statements to follow style guidelines by importing Callable and Sequence from collections.abc instead of typing. There is no functional change and no security relevance.