Trezor firmware

This commit only adds '.PHONY' declarations to many Makefiles. These declarations tell the build system that certain target names are not real files, preventing build mistakes if a file with the same name happens to exist. There is no change to the actual firmware, cryptography, or any code that runs on the device.

This commit changes a factory-production testing tool (prodtest) so that the commands for writing and reading the device's MCU attestation certificate also work in the software emulator, instead of returning 'not implemented'. In the emulator, the written certificate is only stored in memory and disappears after reboot. The change removes compile-time guards that previously disabled these commands for emulator builds. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a feature-enablement change for testing/development workflows.

This commit fixes how the Trezor Python library builds an authentication challenge. Previously, the code encoded the length of a header and the length of the challenge as a single byte, which only works for values up to 255. The fix uses a variable-length 'compact size' encoding instead, which can handle larger values. If a challenge or header were ever 256 bytes or longer, the old code would produce an incorrect byte string, which could cause authentication to fail or behave unexpectedly. There is no direct evidence in the commit that this was exploitable as a security vulnerability, but it is a correctness fix in a security-sensitive authentication path.

This commit changes how Trezor hardware wallet firmware handles a special factory-testing mode called 'prodtest'. In prodtest builds, it now uses an empty placeholder certificate for MCU (microcontroller) attestation instead of a real device certificate. This appears to be a development/testing convenience change rather than a fix for a live security vulnerability, because prodtest is not the normal user-facing firmware. However, it touches attestation code, which is security-sensitive, and the commit message gives no security context.

This commit updates Trezor's internal test-only files that simulate a TROPIC01 secure chip. It replaces old self-signed test certificates with a new four-level test certificate chain and embeds keys directly into config files instead of referencing separate PEM files. The change is labeled as a testing chore, touches only test/development artifacts, and does not alter production firmware code. The most notable security-relevant detail is that a hardcoded X25519 private key is included in test data, but it is explicitly a test key already present in the public source tree and used only for the emulator/unix test build.

This commit changes a Trezor firmware function so that, outside of a special factory testing mode (PRODTEST), it refuses to write an MCU attestation certificate. Previously the function accepted and stored such a certificate. The change prevents firmware from installing or overwriting this certificate, likely to reduce attack surface, but the commit message gives no details about any specific security issue.

This commit adds a test-only digital certificate for the T3W1 hardware emulator. It is explicitly labeled as a testing certificate for emulators, lives in a 'unix' emulator directory, and is not used in real Trezor devices. There is no direct evidence it introduces a security vulnerability, but shipping test credentials in source code always deserves a quick check that they cannot accidentally be enabled in production firmware.

This commit is a code cleanup and test reorganization. It moves sanity-check assertions (which verify that hardcoded cryptocurrency addresses and function signatures are correct) out of the main firmware code and into dedicated unit tests. The actual checks still run during development testing, but they no longer get baked into debug firmware builds. There is no security vulnerability being fixed here.

This commit adds metadata for a new Ethereum yield vault called 'Trezor Steakhouse ETH Prime Vault' so that Trezor devices can display a friendly name and token details when users interact with it. It is a product feature addition, not a security fix or vulnerability.

This commit only adds and improves test code. It extends an existing test suite to check more cryptographic algorithms (AES-GCM, AES-CCM, HMAC, PBKDF2) using well-known public test vectors from Project Wycheproof. It also fixes a few small helper functions in the test file so they correctly report failures. There is no change to the actual Trezor firmware or its cryptographic library, so this commit does not introduce or fix a security vulnerability in the product itself.

This commit tightens validation in the hardware wallet's AES-GCM encryption code by rejecting initialization vectors (IVs) of length zero. Previously, a zero-length IV was silently accepted, which violates the NIST standard and can lead to weak or broken encryption. The change also makes the higher-level encrypt/decrypt functions properly report this error instead of ignoring it.

This commit only updates the project's cryptographic test suite to match a newer version of the Wycheproof test-vector submodule. It changes test data file names and field names (for example, 'keyDer' to 'publicKeyDer') and adds a safety check for empty padding data in a test helper. None of these changes affect the actual Trezor firmware code that users rely on for security.

This commit only adds a new test to the Trezor firmware crypto test suite. It checks that multiplying certain special 'low-order' points on the Curve25519 curve by various secret scalars always produces an all-zero result. There is no change to the actual cryptographic code being tested, only a new regression test. By itself, this commit does not fix or introduce a security vulnerability.

This commit only adds new protocol buffer message definitions for an upcoming Ethereum feature (EIP-7702 authorization signing). It does not contain any actual signing logic, device firmware behavior, or user-interface code. It is a schema-only change and therefore does not introduce a security vulnerability by itself.

This is a code-style cleanup commit in the Trezor firmware's Rust code. It replaces plain `as` type casts with explicit conversion methods like `u32::from(...)`, `i16::from(...)`, and `f32::from(...)` to satisfy the Rust Clippy lint `cast_lossless`. These changes do not alter program behavior; they only make the code clearer and avoid compiler warnings. There is no security fix or functional change here.

This commit only adds two new import names (DateFormatter and RawFormatter) to an existing Python file in the Ethereum clear-signing module. It is a test-related change with no functional code modifications, no bug fixes, and no security-sensitive behavior changes.

This commit adds a new way for Ethereum transaction definitions to include fixed text labels (called 'constant values') that are shown to the user during signing. It does not change how transaction data is parsed or signed, but it expands what untrusted display-format definitions can put on the device screen. The change is a feature addition, not a fix for a known bug, and there is no vendor statement that it is security-relevant.

This commit simply removes an unused on-screen message function called show_wait_text() from the Trezor firmware. There is no security fix or behavior change; it is a routine code cleanup.

This commit fixes a bug in the Trezor hardware wallet's user-interface code. Previously, certain simple on-screen messages were wrapped in a Python `with` block, which caused the underlying layout object to be cleaned up (dropped) as soon as the message was drawn. However, the system still held a reference to that layout and its background event-handling tasks were still running. Dropping it early could lead to a crash, a frozen screen, or undefined behavior while the device is showing important prompts such as asking the user to enter their passphrase on a host computer or displaying a 'please wait' message. The fix removes the `with` wrapper so the layout object stays alive until a new screen replaces it.

This commit removes support for a new Ethereum transaction type (EIP-7702) from Trezor hardware wallets. It is described by the developers as a temporary revert of a feature that will be re-added later. There is no indication this is a security fix; it is a feature removal for code organization.

This commit only updates version numbers and translation metadata. It changes no program logic, fixes no bugs, and introduces no security-relevant behavior. There is nothing here that could be exploited or that changes how the device protects data.

This commit fixes a bug in the Trezor hardware wallet's Caesar UI layout where long lists of key-value properties (for example, transaction details shown on the device screen) could either crash debug builds or be silently cut off in production builds. The fix replaces a fixed-size container with a lazy, unbounded one, so all properties are rendered and none are dropped. There is no direct evidence in the commit that this was exploited or treated as a security vulnerability by the vendor.

This is a code cleanup and type-safety refactor for the Monero parts of the Trezor firmware. It adds stricter type hints, asserts that certain values are not missing, and fixes a minor return-value bug in a helper that encrypts data. There is no direct evidence this commit fixes an active security vulnerability, but it reduces the chance of future bugs by making assumptions explicit.

This commit changes how the Trezor firmware build and test tooling handles the Tropic secure-element emulator. Previously, Tropic support was disabled by default in Unix emulator builds and had to be explicitly enabled; now it is enabled by default and the test harness starts the Tropic model automatically. It also refactors port allocation so each emulator worker reserves a wider block of ports. The changes are confined to build scripts, CI workflows, and test/development tooling. There is no direct fix for a runtime vulnerability in shipped firmware, but enabling a hardware-security emulator by default could theoretically expose test-only code paths or secrets if the emulator is misused outside of testing.

This commit is a routine developer tooling change. It turns on stricter Python type checking (Pyright) for the emulator script and some test helper scripts, and makes small code adjustments so those files pass the new checks. There is no change to the security-critical Trezor firmware itself, wallet operations, or cryptographic handling.