Trezor firmware

This commit changes how a Trezor hardware wallet decides whether its battery is dangerously low and when it is safe to turn on again. Previously the device used raw battery voltage thresholds and a smoothed voltage estimate. Now it relies mainly on the fuel gauge's reported state-of-charge (SOC) percentage and whether USB power is connected. The change removes some voltage-based recovery thresholds and a smoothing variable. It is a power-management refinement, not an obvious security fix, but it could affect device availability and safe shutdown behavior.

This commit changes which Trezor firmware variant supports the 'Evolu' messages. Previously, these messages were only available in the full (non-Bitcoin-only) firmware. The patch marks them as available in the Bitcoin-only firmware instead. It is a feature-availability fix rather than a direct security patch, but misclassification of message availability could theoretically affect the attack surface of the Bitcoin-only build.

This commit changes the bootloader's battery-charging LED behavior. When the battery is fully charged, the charging LED effect now turns off instead of continuing to show a charging animation. It also adds a small helper function for the Unix emulator build so it can compile. There is no security issue visible in this change.

This commit only updates translated text strings for the Trezor hardware wallet's user interface. It adds a new message about canceling the setup of a 'wipe code' (a feature that erases the device if a specific code is entered) and updates the digital signature that verifies the translation files. There is no code that handles secrets, cryptography, device communication, or security logic being changed.

This commit fixes a user-interface labeling bug where setting up a 'wipe code' (a special code that erases the device) was incorrectly shown using the same on-screen text and flow as setting up a regular PIN. The change renames the confirmation flow, adds a flag to distinguish wipe-code setup from PIN setup, and shows wipe-code-specific cancellation text on newer Trezor layouts. It is a UI clarity fix, not a cryptographic or access-control flaw.

This commit adds a new feature that displays the version of the nRF Bluetooth chip firmware in the device's About menu. It replaces a previously hardcoded placeholder version number with a real value read from the hardware. There is no security issue visible in this change.

This commit is a routine translation update for the Trezor hardware wallet firmware. It adds and updates translated text strings for a new device model called 'Eckhart' across several language files (Czech, German, Spanish, French, Italian, Portuguese). It also updates the digital signature that verifies the translation files and refreshes the expected visual test snapshots because the on-screen text has changed. There is no code that handles secrets, cryptography, or device security logic in this change.

This commit tightens the rules for pairing a Trezor hardware wallet with its Nordic (nRF) wireless chip during factory production testing. Previously, the production-test tool could try to re-derive the pairing secret even after the device's secure secret storage was locked, which could have allowed unauthorized re-pairing or leaking of the pairing secret. Now the tool first checks whether the devices are already paired, and the secret-derivation function refuses to run if the secrets sector is locked. This is a defensive hardening fix in a manufacturing diagnostic tool, not a user-facing wallet bug.

This update fixes a security gap in how the Trezor hardware wallet protects its most sensitive storage area. Previously, after the device 'locked' its secret memory region, that region might still have remained accessible to running code. Now the code explicitly disables all access to the secret area as soon as it is locked, making it harder for an attacker who has already broken into the device to read protected keys or data.

This commit is a routine synchronization of translated user-interface text strings for the new 'Eckhart' Trezor device model. It adds and updates translations in Czech, German, Spanish, French, Italian, and Portuguese, plus updates translation signatures and UI test snapshot hashes. There are no code logic changes and no security relevance.

This is a tiny UI layout fix for the Trezor hardware wallet's 'Eckhart' design. When a button with two text labels is drawn, the code now uses the absolute value of a negative horizontal offset to correctly figure out how much room the text has. Without the fix, the available width could be calculated as larger than it really is, which might cause long button labels to be split awkwardly or overflow visually. There is no direct security signal here—this is a cosmetic/layout bug fix.

This commit tightens the order in which factory-setup commands must run for Trezor devices that use a Tropic secure chip. It prevents secrets from being initialized or the Tropic chip from being locked if earlier pairing steps were skipped or failed. The changes reduce the chance that a device leaves the factory in an inconsistent or partially-secured state, but they are defensive hardening rather than a fix for a known active attack.

This commit tightens a factory/production testing tool in Trezor firmware so that it refuses to permanently write a device variant code into one-time programmable memory unless the Tropic secure chip is already locked. Previously, the variant could be written before the chip was locked, which could let a misconfigured or tampered device pass through production with an incorrect or attacker-chosen variant setting. The change also improves the lock-check command so it can return an explicit error state instead of silently answering 'NO'.

This small change adjusts when a Trezor device shows that a 'wipe code' is set. Previously, the device menu would display the wipe-code status if the device was initialized, regardless of whether a PIN was set. After the change, the wipe-code status is only shown when both the device is initialized and a PIN is set. This is a UI/logic hardening change: it prevents a user from being misled into thinking a wipe code is active and usable when no PIN is set, because the wipe code feature depends on the PIN entry flow to trigger.

This commit is a user-interface convenience change for the Trezor hardware wallet. It lets users on the new 'Eckhart' model go back from the very first recovery-word screen to re-pick the number of words, instead of being forced to continue or cancel entirely. The code change is small and appears to be a normal UX improvement, not a security fix or vulnerability.

This commit tightens the rules between a Trezor device's PIN and its 'wipe code' (a special code that erases the device). Previously, it was possible to end up in an inconsistent state: for example, you could set a wipe code even when no PIN was set, or remove the PIN while the wipe code was still active. The patch blocks both situations and shows explanatory on-screen messages. It also replaces some internal 'assert False' statements with explicit error raises, which is a defensive cleanup. The change is a hardening fix rather than a remote exploit.

This commit updates the legal/regulatory information screen shown on a Trezor hardware wallet. It adds Japan to the list of regions, includes a new Japan icon, and adds the standard FCC compliance disclaimer text. There is no security-relevant change.

This commit fixes a small inconsistency in the Trezor hardware wallet's startup screen. When a user had not set a PIN, the device's RGB LED (colored status light) was not being configured according to the user's preference. The change makes sure the LED setting is applied in that case too. There is no direct security vulnerability here; it is a user-experience and settings-consistency fix.

This small change moves where the screen backlight fade happens in the Trezor hardware wallet's lock/suspend logic. Previously, the screen dimmed only inside the suspend function. Now it also dims earlier when the device decides it should suspend but is still waiting for a background task (like signing a transaction) to finish. The goal is to avoid leaving the screen bright while the user is waiting for a long operation before the device can lock. This is a user-experience and minor privacy improvement, not a fix for a serious security flaw.

This commit is a code reorganization: it moves device locking, unlocking, homescreen selection, and suspend-related logic out of apps/base.py into a new module called apps/common/lock_manager.py. It also changes how the power button triggers suspend, using a new asynchronous notification mechanism (notify_suspend) instead of immediately locking the device. There is no direct evidence in the diff that this fixes a security vulnerability; it appears to be a feature/refactoring change.

This commit simply moves two small power-management files from one folder to another and updates the build scripts and import paths accordingly. The actual code behavior is unchanged. There is no security fix or vulnerability here.

This is a test-only change that prevents the Trezor emulator (a software version of the hardware wallet used for testing) from entering a low-power suspend state during automated tests. It does not affect real Trezor devices and is not a security fix.

This commit changes how one device setting—the battery-powered auto-lock delay—is stored on a Trezor hardware wallet. Previously it was kept in a private/protected storage area; now it is marked as public so the PIN lock screen can read it before the user has unlocked the device. The change itself is a straightforward bug fix: the lock screen needs this value to decide when to auto-lock, but could not access it while still locked. There is no direct evidence in the commit that this introduces a security vulnerability; it mainly reduces the confidentiality of that single setting.

This commit adds a new battery-specific auto-lock setting to Trezor hardware wallets. Users can now set a separate screen-lock delay for when the device is running on battery power, distinct from the existing USB-powered auto-lock delay. The change wires up the on-device menu, the settings-applier, and the Python companion library. There is no indication this fixes a security bug; it appears to be a missing feature for a new power-management capability.

This commit changes the Trezor hardware wallet's boot screen so that, on devices with a power manager, the screen dims after 30 seconds of inactivity and the device auto-locks after the configured battery autolock delay. It also makes sure these timers are cleaned up when the user finishes the boot screen. There is no direct security bug visible in the diff; it is a power-saving and lock-behavior feature.