Trezor firmware

This change lets non-production firmware builds accept translation files signed with development keys, not just official production keys. It is meant to help QA test translations on unsigned builds. Production builds still require official signatures, so an end-user running official firmware is not directly affected. The main risk is that a misconfigured build could accidentally ship with the relaxed setting enabled.

This commit refreshes the on-device settings menu for the Trezor Safe 7 (Eckhart layout). It lets the menu restart on a specific submenu after actions like disconnecting a Bluetooth device or toggling haptics/LED, and removes the confirmation prompt for some toggle buttons. The changes are almost entirely user-interface plumbing; there is no obvious security bug, but the new loop and direct hardware calls deserve a quick sanity check.

This commit is a routine internal code cleanup for the Trezor firmware's on-device menu screen. It changes some internal number types from usize to u8, adds helper functions for building menu items, and makes the code more readable. There is no indication of a security fix or vulnerability being addressed.

This commit replaces hard-coded English text strings in the Bluetooth pairing user interface with references to the device's translation system. It does not change what the device does, only how the text is loaded, so it can be translated into other languages later. There is no security bug being fixed here.

This commit adds colored LED lighting effects during the Bluetooth pairing process in the Trezor bootloader. It is purely a user-interface change to give visual feedback when the device is in pairing mode. There is no indication it fixes or introduces any security vulnerability.

This change simply turns the device's LED red while the user is confirming a factory wipe, then turns it off afterward. It is a user-experience/visual indicator change in the bootloader and does not alter security logic, data handling, or access controls.

This commit changes the Trezor bootloader's hibernation charging indicator from a solid blue LED to a pulsing 'charging' LED effect. There is no security-relevant change visible in the diff. It is a user-experience/visual feature.

This commit is a user-interface feature change for the Trezor hardware wallet's Eckhart design. It replaces a static text truncation behavior with a scrolling marquee animation for long subtext labels in menu items. There is no security-relevant change visible in the code.

This commit increases a timeout in the Trezor bootloader from 100 to 300 ticks while wiping Bluetooth pairing information ('bonds'). A too-short timeout could cause the wipe operation to fail or behave inconsistently if the Bluetooth chip takes longer to respond. The change is a hardening fix, not a clear-cut vulnerability patch, and the commit message does not describe any security impact.

This commit updates a bundled cryptographic library (secp256k1-zkp) from one version to another. No actual code changes are shown, and the commit message does not describe any security fix. On its own, this looks like a routine dependency maintenance update.

This commit changes two fixed text strings inside the ChaCha20 code from C string literals to explicit character arrays. The strings are public constants used by the ChaCha20 algorithm ('expand 32-byte k' and 'expand 16-byte k'). The commit title says it fixes a CI build error, and there is no evidence in the diff or commit message of any security bug, memory issue, or behavior change beyond how the compiler stores these constants.

This commit swaps in newer pre-built binary files for the T3W1 hardware model's bootloader and Bluetooth firmware, plus updates the recorded cryptographic hashes that the build system expects. The change log says '[no changelog]' and the title calls it a routine chore. There is no visible source-code change, no description of a security fix, and no independent evidence that this update addresses a vulnerability.

This bootloader-only change adds a short wait and a temporary logo screen when a Trezor device has no firmware installed and Bluetooth (BLE) is enabled. The goal is to give the wireless nRF chip time to finish starting up before the user sees the 'Start' setup button. Without this delay, the device could briefly show the start button while the Bluetooth state is still unknown, which might lead to a confusing or inconsistent setup experience. There is no direct evidence in the commit that this fixes an exploitable security vulnerability.

This commit tightens how the Trezor hardware wallet handles passphrase-protected sessions. Previously, a host could supply a passphrase in a message even when the device was configured to require the passphrase only on the device. Now the firmware raises an error in that case, preventing the host from silently overriding the 'always on device' setting. The change also adds a debug-only warning when a session is created with a passphrase while passphrase protection is disabled on the device.

This commit only adds a new automated test for an existing feature. It does not change the actual Trezor firmware or its security behavior. The test checks that when a user enables 'passphrase always entered on device,' the device correctly rejects passphrases sent from the computer and accepts passphrases typed directly on the device. There is no security fix or vulnerability introduced here.

This commit only changes a type annotation in documentation and generated mock files. It replaces `tuple[int, str]` with `tuple[ButtonRequestType, str]` for a function that returns button request information. No actual code behavior changes, and there is no security relevance.

This is a routine code cleanup in the Trezor firmware's user-interface layer. It replaces a custom 'not implemented' error message with Python's standard NotImplementedError and removes some method-specific error strings. There is no security-relevant change: the same functions still fail in the same situations, only the error type and wording differ.

This commit changes how the Trezor hardware wallet displays pairing and connection prompts for its new Bluetooth-like 'THP' protocol. Instead of building the prompt sentence in Python code, it now uses a dedicated Rust UI screen that highlights the app name and host name in yellow. This is a user-experience and anti-phishing improvement, not a fix for a remotely exploitable vulnerability. The change only affects on-screen text formatting and which UI component is used; it does not change cryptographic checks, authorization logic, or data parsing.

This commit is a simple rename of a Rust function from `add_text` to `add_text_with_font` across several UI layout files. It does not change any behavior, logic, or security properties of the code. It is a routine code cleanup with no user-visible or security impact.

This commit is a routine build-system housekeeping change for the Trezor Python library. It replaces the old setup.py/requirements.txt packaging with a modern pyproject.toml and the uv build tool, drops Python 3.8 support, and changes how the package version is read. There is no security-relevant code change and no indication this fixes or introduces a vulnerability.

This commit is purely a code-style update. It reformats Python source files to match the latest version of the Black formatter, changes uppercase hex escapes in byte strings to lowercase, removes unnecessary 'global' declarations, and adjusts some 'with' statements and trailing commas to satisfy updated flake8 rules. There are no functional changes to the firmware, tests, or tooling.

This commit is a straightforward internal code cleanup that reduces the memory used by swipe gesture settings. It replaces a flexible but bulky structure storing animation duration with a simple on/off-style enum that only supports the two durations actually used (normal 333 ms and immediate 0 ms). There is no user-visible behavior change and no security relevance.

This commit changes the build scripts for Trezor hardware wallets so that when building in a non-optimized debug mode (PYOPT=0), a USB debug interface feature is automatically requested. This debug interface is normally used only during development and testing to control and inspect the device. The change itself is small and appears intentional, but enabling debug interfaces in production-like builds can be a security concern if misused. There is no evidence in the commit that this fixes a known security vulnerability; it looks like a build configuration fix.

This commit adjusts how text labels are positioned and rendered on the bootloader screen of a Trezor hardware wallet model. It changes the vertical position of progress text, switches from a low-level text-drawing call to a reusable UI label component that supports multi-line wrapping, and adds explicit line breaks in two user-facing messages. There is no security-relevant change visible in the diff.

This commit only increments version numbers in four header files after an internal release. There are no code, logic, or security changes visible in the diff.