Trezor firmware

This commit fixes a spelling mistake in a code comment ('Chcek' to 'Check'). No program logic, user interface behavior, or security properties were changed.

This is a one-line code cleanup in the user-interface code for a Trezor hardware wallet screen. It changes a mutable borrow (`deref_mut`) to an immutable borrow (`deref`) where the code only reads a value. This is a routine Rust style/refactor change with no visible security effect.

This commit only adds a development dependency called construct-typing to improve type checking and adjusts some type-checker ignore comments. It does not change how the Trezor firmware or tools behave at runtime, and it does not fix or introduce any security issue.

This commit moves the responsibility for closing other on-screen workflows into the ProgressLayout class itself, rather than having each individual feature call a separate 'close others' function. It is a code cleanup (refactor) and does not appear to introduce or fix a security vulnerability. The change makes UI behavior more consistent but does not change what the device ultimately allows.

This commit only changes a test file so that FIDO2/WebAuthn tests are skipped on Bitcoin-only firmware builds. It does not change any production code, wallet logic, or security behavior. There is no vulnerability or security fix here.

This commit fixes the `trezorctl get-session` command in Trezor's Python library. It prevents crashes when an invalid session ID is supplied, ensures a required pairing step is completed when resuming secure (THP) sessions, and changes the meaning of `passphrase=False` from 'always use a standard wallet' to 'do not ask for a passphrase.' These are reliability and state-correctness fixes in the command-line tool, not the hardware wallet firmware itself.

This commit only updates expected test screenshots (called UI fixtures) recorded as cryptographic hashes. The firmware code itself is not changed. The message explains that a helper function called ensure_unlocked() no longer creates a new session, so tests that show a PIN keyboard afterward now produce different screen images. This is a routine test-maintenance change with no direct security impact.

This is a small optimization in the Trezor Python library. The `ensure_unlocked()` helper used to pick or create a wallet session, which forced the hardware wallet to derive the master seed just to check if the device was unlocked. The new code instead sends a harmless 'ApplyFlags(0)' command, which requires the user to enter their PIN but does not need seed derivation. This is a performance and usability improvement, not a security fix. There is no evidence in the commit of a vulnerability being patched.

This commit fixes a regression in the Trezor command-line tool (trezorctl). A recent earlier change accidentally removed a shortcut that skips asking the user for their passphrase when the caller explicitly says it is not needed. Because of that regression, trezorctl could prompt for or require a passphrase even in situations where it should not, such as when running commands that do not need a wallet. The patch restores the intended behavior by adding a `prompt_passphrase` flag and returning an empty passphrase when it is false.

This change improves the Trezor hardware wallet's Solana transaction confirmation screen. When a transaction contains an unknown program (smart contract), the device now shows the actual program ID instead of a generic 'Unsupported program' label. This helps users make a more informed decision before approving a transaction, but it is a user-interface improvement rather than a fix for a code vulnerability.

This is a small internal cleanup in the Python helper library that handles Trezor One firmware files. It removes two exposed fields ('magic' and 'code_length') from a Python class and renames them to private internal names ('_magic' and '_code_length'). The actual binary parsing behavior is unchanged: the 'TRZR' magic bytes are still required, and the code length is still computed and embedded exactly as before. There is no security fix or vulnerability here.

This commit adds new Python code to the Trezor firmware tools for parsing and building Nordic Semiconductor (nRF) style firmware images. It is a feature addition, not a fix. The code handles firmware headers, TLV metadata blocks, SHA-256 digests, Ed25519 signatures, and device model identifiers. There is no indication in the commit that this resolves a security bug or is being released as a security patch.

This commit fixes a small bug in the Python Trezor library that identifies which Trezor hardware model is being used. Previously, the code would crash when it saw a valid but unrecognized model identifier. The fix makes the parser accept any valid model identifier instead of rejecting unknown ones. This is a routine robustness improvement, not a clear security vulnerability, but it could affect how firmware updates or device interactions behave if a new model is introduced.

This is a small code cleanup in Trezor's Python firmware-handling library. It removes an unused firmware header type for Nordic (NRF) chips and renames an internal 'magic' field so it is no longer treated as a user-facing header type. It also fixes two default boolean values from the integers 1 to the Python booleans True. There is no security-relevant change here.

This commit changes how a build reporting tool calculates memory usage for the Trezor bootloader. Previously, the tool counted the zero padding that fills the bootloader image up to its maximum size as 'used' memory, making the bootloader always appear 100% full. The patch lets the linker export the padding size and subtracts it from the reported usage so developers see real content size versus padding. It is a build tooling and reporting improvement, not a fix for a runtime security bug.

This commit updates a bootloader linker script for a new STM32U58-based Trezor variant to support an alternative 'PQ' (post-quantum) bootloader header format. It adds a code-size symbol, a small padding section, and changes how the bootloader image is padded to its maximum size. There is no direct evidence in the commit that this fixes a security vulnerability; it reads as a build/enablement change for a new hardware configuration.

This is a small internal code cleanup in the Trezor firmware's Ethereum transaction confirmation flow. It changes several function parameters from 'Iterable' (a general 'can be looped over' type) to 'Sequence' (a type that supports indexing and has a known length). The commit title says the goal is to 'avoid allocation' because the code no longer needs to convert the items into a list before passing them to the UI. There is no direct evidence in the commit of a security vulnerability being fixed; it reads as a performance or memory-efficiency refactor.

This commit turns off several unused features in the MicroPython interpreter that runs on Trezor hardware wallets. It is a hardening change that reduces the amount of code available to an attacker, but it does not by itself fix a known, exploitable bug. The commit message explicitly calls it a routine cleanup ('chore') and says it needs no changelog entry.

This commit only updates automated test scripts and recorded test snapshots (fixtures) for the Trezor firmware. It adds support for testing a new backup method called N4W1 alongside the existing on-screen display backup method. There are no changes to the actual device firmware, wallet logic, or security-critical code, so this commit does not introduce or fix a security vulnerability.

This commit fixes a bug in the tool that builds Trezor hardware wallet flash images. Previously, when combining the boardloader, bootloader, and firmware into one file, later sections were placed too early because earlier files were smaller than their reserved flash space. The fix pads the gaps with zeros so each piece lands at its correct memory address, preventing the resulting image from failing to boot. It is a build-time tooling fix, not a runtime vulnerability in the device itself.

This commit is a straightforward build-system cleanup. It removes special-case layout feature bundles (like layout_bolt_d001 and layout_bolt_d002) and replaces them with separate, explicit display-type features (display_mono, display_rgb565, display_rgba8888). Model configuration files now list the display type directly alongside the layout type. There is no change to runtime code, no bug fix, and no security-related behavior.

This commit fixes a minor user-interface wording issue in Trezor's Solana app. Previously, the device built the cosigner label by manually combining the word 'Cosigner' with a number, which could cause problems for translations. Now it uses a proper translation template 'Cosigner {0}'. There is no direct evidence this is a security vulnerability, but inconsistent or untranslatable labels could theoretically contribute to user confusion when reviewing multisig signers.

This commit fixes a labeling mistake in the Trezor firmware's protocol definition: eleven Monero request messages were incorrectly marked as traveling from the device to the host, when in reality the host sends them to the device. The change only updates metadata in generated host-side descriptors; the firmware itself does not use this metadata, so on-device behavior is unchanged. It is a correctness fix for host libraries, not a patch for an exploitable device bug.

This commit is a routine cleanup: it removes two old, already-deprecated message types related to passphrase handling from Trezor's protocol definitions and generated code. There is no security fix or vulnerability being patched here; the messages were marked deprecated years ago and are now being deleted entirely.

This commit is a routine cleanup: it removes two old, already-deprecated fields from the messages that Trezor devices and apps use to exchange passphrase information. The fields were marked deprecated in firmware version 2.3.0 and are no longer used. Removing them does not change active behavior and does not fix or introduce a security vulnerability.