Trezor firmware

This commit removes a helper function called random_xor() and replaces its use in the hardware wallet's PIN secret generation with a single, stronger random-number call. There is no direct evidence in the commit that this fixes an active security vulnerability; it reads as a code cleanup that simplifies how random bytes are produced before they are stored on the secure Optiga chip.

This commit is a code cleanup that makes all random-number generation in the Trezor firmware core go through one dedicated secure path (sec/rng). It also moves the old insecure test-only random generator into a separate file so it is only used in emulators and tests, not in real hardware. The change reduces the risk that a real device accidentally uses a weak random source, but the commit itself does not claim to fix a specific active vulnerability.

This commit refactors how Trezor firmware generates random numbers. It adds a new 'strong' randomness path that mixes the device's hardware RNG with entropy from external secure chips (Optiga and/or Tropic), and routes all randomness through a common internal API. It is a feature/cleanup change, not a disclosed security fix, but it touches critical cryptography code and changes how secure chips are used.

This commit removes a flag called USE_INSECURE_PRNG from the production-test firmware build. That flag previously told the device to use a weak or insecure random number generator during factory testing. Removing it means the production-test firmware will now use the microcontroller's true hardware random number generator (TRNG) instead. Using a weak random source in a test environment could, in theory, affect security if any test keys, identifiers, or calibration data generated there were later reused or leaked, but this change is in a specialized factory-only firmware image, not the main wallet firmware users run.

This commit adds a small workaround in the Trezor hardware wallet's random number generator code. The change allocates a slightly larger temporary buffer and only uses the inner portion, leaving unused 'bumper' bytes at the end. The commit message calls this a 'libtropic overwrite bug workaround,' suggesting an external library (libtropic) may write past the requested amount of random data. The patch does not fix the underlying library bug; it only pads the local buffer so any overflow lands in harmless scratch space rather than corrupting adjacent memory. Because this affects the cryptographic random number generator used for keys and secrets, a real overwrite could have security implications, but the diff itself does not show an actual vulnerability in Trezor code or prove the bug is exploitable.

This commit swaps in two new pre-built binary files for the T3W1 hardware model (a QA bootloader and a Bluetooth development firmware blob) and updates the corresponding SHA-256 hashes in a header file. The change is labeled as a routine chore with no changelog entry. There is no description of why the binaries changed, no source diff, and no security context provided, so it is impossible to tell from this commit alone whether the update fixes a bug, adds a feature, or changes security behavior.

This commit only changes the on-screen message shown during firmware installation. If the update is happening over Bluetooth (BLE), the device now tells the user to keep the Trezor close to the host device; if it is happening over USB, it continues to tell the user not to disconnect the cable. There is no change to security logic, cryptography, or data handling.

This commit is a code cleanup that merges two very similar on-screen keyboards in the Trezor firmware into a single shared component. It does not add new features, change security behavior, or fix a bug. The passphrase keyboard and the label keyboard now share one generic 'StringKeyboard' implementation, with separate input logic for passphrases and labels. Test helpers were updated to recognize the new component name.

This commit tightens when a Trezor device lets the user run a 'backup check' (also called a dry-run recovery). Previously, the device allowed the check as long as it was initialized, even if the seed had never been backed up, was marked as not needing a backup, or the backup was unfinished. The change now blocks the backup-check menu item and the RecoveryDevice dry-run command when no real backup exists. This prevents a user from being misled into thinking an unbacked-up seed is safe, and stops a dry-run from being started in states where it has no meaningful purpose.

This commit updates the legal/regulatory information screen shown on a Trezor hardware wallet. It adds Taiwan and an extra Japan certification icon, and restructures the code that decides which labels and icons appear. There is no security-relevant change—only on-screen text and images.

This commit updates two pre-built binary files for the T3W1 hardware model (a QA bootloader and a Bluetooth development firmware blob) and refreshes the recorded cryptographic hash for the new bootloader version. The change is labeled as a routine development chore with no changelog entry. There is no source-code diff, no description of a security fix, and no independent evidence that this update addresses a vulnerability.

This commit is a routine user-interface cleanup for the Trezor hardware wallet. It removes a manual 'marquee' flag and instead makes any long subtext automatically scroll sideways. There is no indication this change fixes or introduces a security problem.

This commit is a routine user-interface feature update for the Trezor hardware wallet. It changes the device menu so that paired Bluetooth-style devices can display both a host name and an application name, and it adds a scrolling (marquee) text effect for long names. There is no security-relevant change, no vulnerability fix, and no indication of a security issue.

This commit adds a new 'Host info' screen to the device menu on Trezor hardware wallets (Eckhart layout only). It lets users view the name and Bluetooth MAC address of each paired host device. There is no security vulnerability here—this is purely a user-interface feature.

This is a routine code-style and type-annotation cleanup in the Python part of the Trezor firmware repository. It updates type hints to satisfy a newer version of the pyright type checker, replaces some manual success checks with a helper, and makes a few small return-type changes (for example, returning bytes instead of bytearray from some transport reads). There is no indication of a security bug being fixed or introduced.

This is a large code-style and type-annotation cleanup. It replaces concrete type hints like `bytes` with broader aliases such as `AnyBytes`, `AnyBuffer`, and `StrOrBytes`, and fixes a few minor type-checker warnings (for example adding an `assert ... is not None` and wrapping a value with `bytes(...)`). There are no runtime logic changes, no security fixes, and no behavior changes visible in the diff.

This commit is a straightforward internal code cleanup for the Trezor hardware wallet's on-device menu system. It renames function parameters, result types, and message identifiers to be clearer and more consistent (for example, 'pin_code' becomes 'pin_enabled' and 'ScreenBrightness' becomes 'SetBrightness'). No security-sensitive behavior appears to change; the same menu options are still presented and handled the same way.

This commit adds a new 'Backup Device' menu item to the Trezor Safe 5 (Eckhart layout) device menu when the device still needs a backup. It is a user-facing feature change, not a security fix or vulnerability. The change wires a new UI button through to the existing backup_device() flow, with no changes to security-critical logic, authentication, or access control.

This commit is a user-interface redesign for the Trezor hardware wallet's 'backup needed' menu on the Eckhart model. It removes the ability to start a backup directly from the device menu and instead shows an informational screen telling the user to open Trezor Suite to create a backup. There is no security vulnerability here; it is a routine product change.

This commit fixes a Bluetooth Low Energy (BLE) crash in Trezor hardware wallets caused by a stack overflow. The patch does two things: it stops placing the device advertising name on the thread stack by using a static buffer instead, and it increases the BLE management thread's stack size from the default to 2048 bytes. The change reduces the chance that a long or specially crafted device name could corrupt nearby memory or crash the BLE subsystem. There is no vendor statement that this is a security vulnerability, and no independent researcher is credited.

This commit changes how the older Trezor One (legacy) firmware displays Ethereum transaction fees on the device screen. Previously, small per-gas fee values could be shown in 'Wei' (the smallest Ethereum unit) instead of always using 'Gwei'. The fix makes per-gas fees consistently display in Gwei, matching the newer Trezor Core firmware. This is a user-interface consistency fix that could have minor security relevance because confusing fee units might lead a user to misread or misapprove a transaction fee, but the commit itself does not change any signing logic or cryptographic checks.

This commit only increases version numbers (patch levels) for four Trezor firmware components: the bootloader, production test tool, security monitor, and Bluetooth Low Energy module. There are no code logic changes, bug fixes, or security-related modifications in the diff itself.

This commit is a small UI cleanup for Trezor hardware wallets. It stops on-screen scrolling text (marquees) from requesting animation frames when the text already fits in its allotted space. This saves battery and avoids unnecessary screen redraws, but it does not fix a security vulnerability.

This commit is a minor visual polish change for the Trezor hardware wallet's user interface. It moves a small downward arrow icon slightly upward so it no longer overlaps menu text, and adds an automated test to ensure that spacing rule stays correct. There is no security-relevant change.

This commit tweaks how menu buttons behave on the Trezor Safe 5 (Eckhart layout). Previously, any menu button that was not fully visible on screen was completely disabled, so you could not tap it. Now only buttons that are fully hidden are disabled; buttons that are partially visible remain active, but their touchable area is trimmed so it does not overlap the top header. This is a user-interface polish change, not a fix for a cryptographic or firmware security flaw. It could slightly reduce the chance of a user accidentally tapping a half-hidden button, but it does not introduce or remove a meaningful security vulnerability on its own.