Trezor firmware

This commit swaps in a new pre-built bootloader binary for the T3W1 hardware model used in QA/testing, and updates the matching cryptographic hashes that the firmware uses to recognize a valid bootloader. The actual source-code changes inside the bootloader are not shown, and the commit message gives no security explanation. On its own, this looks like a routine firmware housekeeping update, not a fix for a known security bug.

This commit only adds translated text strings for a new 'backup needed' message shown on the device home screen. It does not change any code logic, security checks, or cryptographic operations. The signatures.json file is updated to record the new translation bundle hash, which is a normal bookkeeping step for signed translation assets.

This commit adds informational notifications when a Trezor device is wiped or a Bluetooth pairing is removed. It does not change who can perform these actions or how they are authorized. The wipe/unpair logic itself already existed; the change only tells connected software that the event is happening. There is no obvious security vulnerability here.

This commit fixes a bug where a Trezor hardware wallet does not restore certain hardware settings after waking from sleep. Specifically, after the device wakes up, it now reapplies the screen rotation, haptic feedback, and RGB LED settings that the user had configured. Without this fix, those settings could be left in an unintended state following suspend/resume, which could confuse the user or subtly alter the device's behavior.

This commit fixes a production-test tool in Trezor hardware wallets so that it now checks whether writing a device certificate to secure storage actually succeeded. Previously, the tool would silently continue and report success even if the write failed. This is a defensive hardening fix in a low-level manufacturing/QA utility, not a user-facing wallet feature.

This commit adds new notification messages that the Trezor device sends when certain things happen, such as locking/unlocking, changing settings, changing the PIN, or disconnecting from Bluetooth. It is a feature addition, not a fix for a known security bug. The change itself does not appear to introduce a vulnerability, though it slightly increases the amount of internal state information broadcast to other parts of the system.

This commit is a straightforward code cleanup in the Trezor bootloader. It bundles three pieces of firmware information (vendor header, image header, and whether firmware is present) into a single struct and passes that struct around instead of three separate arguments. There is no change to security logic, no bug fix, and no new feature.

This commit adds a new flag called firmware_corrupted to the device's Features message, which is sent to the host computer when the Trezor is in bootloader mode. Previously, the existing firmware_present flag only told the host whether any firmware was loaded, but its comment said 'valid firmware loaded.' The change makes the bootloader explicitly report whether the loaded firmware is corrupted, and it updates the comment on firmware_present to clarify it just means firmware is loaded. This is an informational/UX improvement, not a fix for a vulnerability in the device itself.

This commit adds a 10-second timeout to the Trezor bootloader's firmware update process. Previously, if the host computer stopped sending firmware pieces during an update, the bootloader could wait forever in a special update mode. The fix makes the device give up and show a failure screen if no next message arrives within 10 seconds. This is a hardening change: it reduces the window during which a device is stuck in a firmware-update state, which could matter if an attacker has physical or local access, but the commit itself does not describe a specific attack or vulnerability.

This commit moves a certificate-chain validation check so it runs before a device certificate is permanently stored in secure hardware, rather than after. Previously, an invalid device certificate could be written to the chip before the code noticed and rejected it. The change is in factory production-test tools (prodtest), not normal user wallet firmware, so it mainly affects manufacturing/ provisioning rather than end-user devices in the field.

This commit updates the Trezor production-test firmware to recognize and trust a new set of manufacturer root public keys when validating device certificates. It also refactors where those keys are stored so both certificate checking and the secure provisioning channel use the same key list. The change is a feature addition, not a fix for a known vulnerability, and it only affects the factory/prodtest firmware, not the end-user wallet firmware.

This commit is a routine code cleanup: it moves a small helper module that stores Bluetooth pairing information from one folder to another and adds extra debug logging. There is no change to how the device protects secrets, pairs with phones, or handles untrusted input. It is not a security fix.

This commit tightens a data structure used during Trezor's new host pairing protocol (THP). It makes two text fields—host_name and app_name—mandatory instead of optional, and adds runtime checks that they are present before creating a pairing credential. On its own this is a defensive hardening change, not a fix for an active vulnerability. It reduces the chance that a paired host could be stored or shown to the user without an identifiable name, which could help prevent social-engineering or UI-confusion attacks.

This commit removes a small, unexplained workaround in the hardware wallet's random number generator code. The workaround previously added 4 extra bytes to a temporary buffer when generating randomness. The change makes the code cleaner and slightly more correct, but there is no indication it fixes an active security bug. It appears to be routine cleanup.

This is a routine code cleanup in Trezor firmware. It updates a hardware driver for the Tropic01 secure chip so its function signatures match a newer version of the underlying library API. The actual behavior of the code is unchanged; only the names of internal data structures were updated. There is no indication this fixes or introduces a security problem.

This is a simple variable rename from 'timeout' to 'timeout_ms' in a single function. It does not change any behavior, logic, or security properties of the code. There is no security issue here.

This is a small code cleanup in Trezor's internal production-testing tool. It removes an unused `max_len` argument from two helper functions that read firmware version numbers from a Tropic chip during manufacturing tests. There is no indication this change fixes a security bug or introduces one; it simply follows an updated library API.

This commit updates a third-party vendor library called libtropic from one version to version 1.0.0. The actual code changes are not visible because only a Git submodule reference was updated. There is no information in the commit message or supplied materials indicating this is a security fix or that it addresses any vulnerability.

This commit tightens access permissions in the Trezor production-test firmware for a secure chip feature called 'MAC-and-destroy' slots. It removes Pairing Key 1's ability to use the first 64 of these one-time slots, leaving only Pairing Key 2 (and in some configurations Pairing Key 3) with access. MAC-and-destroy slots are designed to be permanently destroyed after use, so restricting who can reach them reduces the risk that a less-trusted key could waste or misuse them during manufacturing tests.

This is a purely cosmetic code-style change. It removes line breaks inside long C expressions so each expression fits on a single line. The actual values and logic are unchanged, so it has no security effect.

This commit is a visual design tweak for the Trezor hardware wallet's screen border. It changes how the decorative border is drawn so it sits exactly at the screen edges instead of being inset by one pixel. There is no security relevance: no cryptography, authentication, memory handling, or user-confirmation logic is changed.

This commit fixes a security bug in the Trezor hardware wallet's Bluetooth handling. When a user chose 'Forget all' Bluetooth pairings, the device was not clearing a special key used for a feature called THP (Trezor Host Protocol) credential authentication. As a result, after reconnecting, the device might trust the other side without asking the user to confirm again. The fix adds a call to invalidate that key whenever all Bluetooth pairings are erased.

This commit changes how a Trezor hardware wallet handles an internal error condition during user interactions. In debug builds using the new THP (Trezor Host Protocol) communication channel, the device no longer crashes with a 'FirmwareError' when a button-acknowledgment state is still pending. Instead, it logs the issue and continues. The old behavior could cause the THP channel to become desynchronized because the error path might write to the channel twice. The fix prevents a possible communication desync but deliberately suppresses a previously fatal internal-consistency check.

This Trezor firmware fix ensures a background task that handles on-device button prompts is properly shut down when a screen layout finishes. Previously, the signal meant to stop that task might not be delivered, leaving the task running. The patch uses a 'replace' flag to guarantee the stop signal is placed in the queue. A stuck button-request task could cause the device and host software to get out of sync, potentially leading to confusing UI states or unexpected behavior during wallet operations.

This commit only updates automated test files. It renames a test helper class from InputFlowNewCodeCancel to InputFlowNewWipeCodeCancel and adds expected screen-image hashes for a wipe-code cancellation test across many languages and device models. No firmware source code is changed, so this cannot affect real device security.