Trezor firmware

This commit moves a safety check earlier in the process of setting up a cryptographic seed on a Trezor device. The check ensures the device is properly initialized before it proceeds. By running the check earlier, it prevents a situation where a seed might already be cached or a passphrase accepted before the initialization check happens. This is a defensive hardening change, not a confirmed exploitable vulnerability, because the commit message does not describe a security issue and no exploit path is shown in the diff.

This commit is a simple code cleanup: it renames a Rust function from Frame::new() to Frame::with_header() and updates every place that called it. There is no change to what the code does, no bug fix, and no security-relevant behavior.

This is a small user-interface cleanup change for the Trezor hardware wallet's Delizia layout. It makes warning screens hide their top title bar when the title is empty, and explicitly rejects 'danger' warnings that have no title. There is no direct evidence this fixes a security vulnerability; it appears to be a UI consistency improvement.

This is a small internal code cleanup in the Trezor firmware's user-interface code. It changes a variable used for screen layout margin from a larger integer type (`usize`) to a smaller one (`u8`). The actual behavior is unchanged because the value is immediately converted to the same screen-coordinate type (`i16`) used before. There is no security-relevant change visible in the commit.

This commit rearranges how different pieces of the Trezor firmware are placed in the device's flash memory. It moves frozen Python data and the main code sections into one flash region, while moving the bootloader into a separate flash region. The stated purpose is to support linking Rust static libraries (rlib). There is no direct evidence in the commit that this fixes a security vulnerability.

This commit removes the 'ipc' feature flag from three build scripts by default, and only enables it when external app loading is supported on the T3W1 model. IPC stands for inter-process communication, and these particular system calls were reportedly unused. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a cleanup or hardening change to reduce unused attack surface.

This is a massive Trezor firmware commit that replaces the old SCons-based build system with Cargo (Rust's build tool) for compiling the embedded C code. It adds many new Cargo.toml files, build.rs scripts, and a custom xbuild helper crate, but does not change the actual security logic of the wallet. The main risk is that a build-system change of this size could accidentally alter compiler flags, included source files, or linker settings, which might affect the produced binary. There is no direct vulnerability shown in the diff, and the commit message explicitly says it is a feature with no changelog entry.

This commit only changes how long hexadecimal fingerprints and hashes are displayed to users. It inserts spaces every four characters so the strings are easier to read and compare visually. There is no change to security logic, cryptography, or how firmware is verified.

This commit only updates documentation links inside the Trezor firmware repository. It fixes broken links, replaces GitHub URLs with relative links, and removes a symlinked documentation file. There are no code changes and no security impact.

This commit adds a new optional sanity-check layer to the Python code that parses Trezor firmware files. It verifies that re-encoding a parsed firmware image produces the exact same bytes, and that any 'reserved' fields are all zeroes. The change is defensive: it can help detect malformed or tampered firmware images during analysis, but the strict mode is off by default, so existing behavior is preserved unless a caller explicitly opts in.

This commit is a straightforward internal code cleanup in the Trezor firmware's user interface code. It moves header-related helper methods (like title alignment, cancel/menu buttons, and styling) from the Frame component to the Header component. All existing call sites are updated to build a Header first and then pass it into a Frame. There is no change to user-visible behavior or security logic.

This commit adds a new Trezor feature: signing and verifying Solana off-chain messages. It is a feature implementation, not a fix for a known vulnerability. The code introduces new message types, parsing logic, user confirmation screens, and client helpers. There is no direct evidence in the commit of a security bug, but any new signing path increases the attack surface and must be reviewed carefully for parsing mistakes or user-interface spoofing.

This commit updates the Trezor firmware's Solana support so that the standard 'Transfer' instruction can be used with multi-signature accounts. Previously, the firmware treated this instruction as non-multisig, which likely caused it to reject or mis-handle legitimate Solana transactions that required multiple signers. The change is a feature/fix to broaden supported transaction shapes, not a patch for an active vulnerability.

This commit adds new regulatory certification screens for Brazil, Ghana, and Nigeria to the Trezor hardware wallet's user interface. It is purely a compliance/labeling change: new image files are included and a list of regulatory regions is updated. There is no indication of any security bug, vulnerability, or behavior change affecting funds or device security.

This is a routine Python code change in Trezor's firmware handling library. It adds support for a new Nordic (NRF) firmware header type and helper methods to insert cryptographic signatures into firmware image structures, plus a minor formatting tweak. There is no indication of a security vulnerability or fix.

This commit fixes how Trezor's Python library validates signatures for a new bootloader image format (BootloaderV2). Before the fix, the code ignored the signature bitmask and simply checked every signature against every public key in order. This could let an invalid or mismatched signature slip through, or cause validation to fail incorrectly. The patch makes the library read the bitmask, count signatures correctly, and only verify the signatures the image actually claims to have signed with. It also adds a missing signature-status line to the printed header. The change is in developer/CLI tooling, not the device firmware itself, so a direct attack on a real device is unlikely, but the library is used to inspect and validate firmware files.

This is a minor user-interface cleanup for the Trezor hardware wallet's Eckhart layout. It removes the warning header from a screen when the title text is empty, so users don't see a blank header. There is no security-relevant change.

This commit changes the Trezor hardware wallet so that a large secondary device-attestation proof (the MCU attestation) is only sent when the caller explicitly requests streaming support. The goal is to avoid sending one oversized response. It is a defensive hardening change rather than a fix for an active vulnerability, and the commit message does not claim it resolves a security issue.

This commit adds a new optional 'streaming' mode for retrieving device authenticity proofs on Trezor hardware wallets. Instead of sending all attestation data (certificates and signatures) in one large message, the device can now send it in smaller chunks. This is intended to improve reliability over lossy transports like Bluetooth Low Energy. The old one-shot mode is kept for backward compatibility. There is no direct evidence in the commit that this fixes a security vulnerability; it reads as a reliability/feature improvement.

This commit re-enables a security feature called 'MCU device attestation' for the T3W1 hardware wallet model. It is not a vulnerability fix; it restores a previously removed capability that lets the device cryptographically prove its microcontroller is genuine using a modern quantum-resistant signature scheme (ML-DSA-44).

This commit only adds and reorganizes automated tests for the device-authentication feature on Trezor hardware wallets. It does not change the firmware code that runs on the device, so it cannot introduce a security vulnerability or fix one in the shipped product. The changes make the test suite exercise both the Optiga and Tropic authentication flows, test chunking sizes, and verify that invalid requests are rejected with proper error messages.

This commit only changes the protocol definitions (the 'language' the Trezor device and apps use to talk to each other). It adds a new optional streaming mode for requesting device-authenticity proofs, so large proofs can be sent in smaller chunks instead of one big message. There is no actual device firmware logic shown here—only generated message bindings—so it is not a security fix or vulnerability by itself. It is a feature addition that could, in theory, introduce new attack surface once the corresponding firmware code is implemented, but that code is not present in this commit.

This is a code cleanup (refactor) of the on-screen button drawing and touch/hold logic for the Trezor hardware wallet's Caesar UI layout. It removes unused style-sheet abstractions, simplifies how buttons are described, and makes the hold-to-confirm component always assume it sits on the right side of the screen. The commit is tagged [no changelog] and contains no explicit security claims. The only behavior-visible change is a small simplification in the page component: when the left button is triggered on the first page, it now always returns a Cancel message instead of first checking whether a cancel button was configured. That change is a simplification based on an existing invariant, not a fix for a known vulnerability.

This commit only changes test files so that ten unit tests are skipped when running against the Bitcoin-only firmware variant. It does not modify the actual Trezor firmware code that users run, so it cannot directly affect device security or user funds.

This commit adds support for a new Ripple transaction type called AccountDelete to Trezor hardware wallets. It is a feature addition, not a security patch. The change lets users sign transactions that delete a Ripple account and send any remaining balance to a chosen destination. The code adds user-facing confirmation screens and enforces that a transaction cannot be both a payment and an account deletion. There is no direct evidence in the commit of a security vulnerability, but any new signing path deserves careful review because bugs could let an attacker trick a user into deleting an account or signing an unintended transaction.