Trezor firmware

This commit fixes a bug in the Trezor firmware's code that reads BIP32 extended keys (the xpub/xprv strings used by wallets). Previously, if the function encountered an invalid key string, it returned an error immediately without wiping a temporary 78-byte buffer that held decoded key material. That leftover data could remain on the device stack and potentially leak small pieces of secret key information to later code. The fix ensures the buffer is always cleared before the function returns, even on error paths.

This commit only adds explanatory comments to two generated/mocked source files describing the history and future plans for two internal type aliases (`PropertyType` and `StrPropertyType`). No code behavior changes, no bug fixes, and no security-related modifications are present.

This is a small user-interface cleanup for the Trezor hardware wallet's Delizia layout. It makes confirmation screens skip drawing an empty footer button label when no button text is provided. There is no indication this fixes a security bug; it appears to be a visual polish change.

This commit is a user-interface cleanup in the Trezor firmware's 'Caesar' layout. It replaces several hard-coded 'i' text labels with a shared 'info icon' helper and adds support for a down-arrow icon. There is no change to cryptographic operations, memory safety, authentication, or data handling. It appears to be a non-security refactor.

This commit adds a new secure communication layer to the Trezor hardware wallet's Rust protocol library. It introduces encrypted channels, handshake logic, and credential handling. The change is a feature implementation rather than a documented security fix, but it touches sensitive cryptography and transport code, so correctness matters for device security.

This commit adds example code and development tooling for the Trezor THP (Trezor Host Protocol) Rust library. It is a feature addition containing example clients, generated protobuf bindings, and a renamed example. There is no indication this commit fixes or introduces a security vulnerability in the firmware itself.

This commit improves how Trezor's Python library handles the list of trusted certificate authorities used to verify a device is genuine. Previously, if the online allowlist could not be downloaded, the tool might fail in an uncontrolled way. The change adds proper error handling and renames 'whitelist' to the more general 'allowlist' to support both approved and revoked (blacklisted) public keys. It also renames the user-facing option from --skip-whitelist to --offline. There is no direct evidence in the commit that this fixes an active security vulnerability, but it hardens the device-authentication process.

This commit tightens device authentication checks in Trezor's Python library. Previously, if a hardware wallet returned a Tropic signature, it was verified. Now, the library also raises an error if a Tropic signature is expected (because an Ed25519 root public key is configured) but missing. This prevents a device from skipping a required signature check and being accepted as authentic.

This is a code cleanup in the Python Trezor library that reorganizes how device authenticity checks handle public keys and signatures. It does not change the security behavior visible to users; it only moves existing logic into new helper classes to make future cryptography upgrades easier. There is no indication this fixes a security bug or introduces a vulnerability.

This commit updates the list of trusted public keys used by Trezor's Python library to authenticate genuine Trezor hardware. It adds the official production key for a new device model (T3B1, sold as Trezor Safe 3) and renames an older internal model name (T3W1) to its marketed name (Trezor Safe 7). There is no indication of a security vulnerability; it is routine key inventory maintenance for a new product variant.

This commit is a large but purely cosmetic refactor of on-screen text labels across Trezor firmware. It removes trailing colons from many prompts (e.g., changing 'New fee rate:' to 'New fee rate') and adjusts capitalization for consistency. There is no change to security logic, cryptography, transaction validation, or how user confirmations work.

This commit changes how the Trezor hardware wallet displays a single property on screen. Previously, passing one property as a list used a different screen layout than passing the same property as a plain string. Now both cases use the same ConfirmValue screen. This is a UI consistency fix with no obvious security impact, though any UI change can in principle affect what the user sees and approves.

This commit adds a back button (swipe-down gesture) to the transaction summary screen on Trezor's Delizia and Eckhart UI layouts. Previously, the summary screen only allowed swiping up to proceed to the hold-to-confirm step. Now, when the caller requests it, users can swipe down to go back. This is a user-interface feature change, not a security fix or vulnerability.

This commit refactors how the Trezor hardware wallet changes its PIN. Previously, the storage layer itself re-checked the old PIN while changing it. Now the device must already be unlocked before changing the PIN, and the change-PIN function only sets the new PIN. The change is described as removing a redundant 'double check.' It also adds more detailed error codes so the firmware can tell the user exactly what went wrong. There is no direct evidence in the commit that this fixes an active security bug, but it is a meaningful change to a security-critical function.

This commit removes an unused error code named Failure_BufferError from the Trezor firmware's protocol definitions and generated code. It is a cleanup change with no security relevance: the code was not being used, and the protobuf field number is now marked as reserved to prevent future accidental reuse.

This commit adds a new error code called Failure_InProgress to the Trezor firmware's communication protocol. It does not change any security logic; it simply gives the device a standardized way to tell a connected computer that a non-interruptible task is currently running. The actual behavior of blocking or allowing interruptions is not part of this change.

This is a tiny fix in the Trezor Python library that stops an incorrect error message. When a Trezor device is in bootloader mode, it legitimately does not return a session ID, but the library was wrongly logging a scary 'session management is now broken' error. The patch simply skips that warning when the device reports it is in bootloader mode. There is no sign this is a security vulnerability or that it changes any actual security behavior.

This commit refactors how the Trezor Python command-line tool (trezorctl) manages device sessions and unlocking. It aims to avoid creating duplicate sessions when unlocking the device and to handle passphrases more cleanly. The changes are framed by the developer as an improvement/fix to session handling, not as a response to a known security vulnerability. There is no public evidence that this fixes an exploitable bug.

This is a large internal refactoring of the Python trezorlib client API. It reworks how sessions are created, managed, and closed, moves session classes out of the transport layer, adds a credential/keyring helper for the new THP pairing flow, and updates many CLI commands and tests to use the new API. There is no obvious malicious backdoor or simple vulnerability introduced, but the sheer size of the change means small bugs in session lifecycle, passphrase handling, or pairing credential storage could have security consequences. It is best treated as a high-risk refactor that needs careful review rather than an identified exploit.

This commit refactors how Trezor's command-line tool stores and looks up pairing credentials. It changes the way secrets are labeled in the system keyring, adds new lookup methods, and adds a 'forget' command to remove remembered device keys. The changes appear to be a defensive improvement to credential management rather than a fix for an active vulnerability.

This is a small code cleanup in Trezor's Python library. It changes how a new Bluetooth-style pairing flow is started so that it no longer asks the device for a 'credential' during setup. The commit message says the credential could not be returned to the caller anyway, so it was being discarded. There is no direct evidence in the commit that this fixes a security vulnerability; it reads as a refactor to avoid a useless step.

This commit fixes a logic bug in the Trezor Python library's pairing flow. Previously, the library would skip pairing whenever the device allowed it, even when the caller also asked for a security credential. Skipping pairing moves the protocol straight to a finished state where credential requests cannot succeed. The change makes the library only skip pairing when no credential is requested, preventing a likely functional failure or error condition during setup.

This is a small internal code cleanup in Trezor's test tooling. It replaces several direct checks for the string 'EMULATOR' with a single shared property, `is_emulator`. There is no change to the firmware's security behavior, no fix for a vulnerability, and no user-facing effect.

This commit fixes a user-interface labeling bug in Trezor's Tron (TRC-20) token support. Previously, when a user was about to send a normal token transfer, the device screen incorrectly showed 'Approve' wording and labels, which could mislead the user into thinking they were approving a spender rather than sending funds. The fix adds a new 'transfer' confirmation screen and uses it for token transfers, while keeping the old 'approve' screen for future use. The actual transaction logic and signatures were not changed—only what the user sees on screen.

This commit only fixes whitespace in documentation comments and makes a minor type annotation change (using a more general AnyBytes type alias instead of bytes). There is no change to actual program logic, no bug fix, and no security relevance.