Trezor firmware

This commit simply fills in previously empty lists of official production 'root' public keys used by Trezor's Python library to validate firmware signatures. These are public keys, not private secrets, so adding them does not by itself create a vulnerability. It is a routine configuration update replacing placeholder TODO entries with real key values.

This commit removes an unused function called tropic.get_certificate() from the Trezor firmware. The function was already a stub that did nothing useful: it returned success without actually fetching any certificate. The change is a cleanup, not a security fix, and does not appear to address any active vulnerability.

This commit is a routine user-interface refresh for the Trezor Safe 7 tutorial. It replaces some tutorial text, adds new icons, and extracts the screen background drawing into a reusable component. There is no security-relevant change visible in the code.

This bootloader patch changes how the Trezor device handles a failed USB/communication write. Previously, if sending a packet failed, the bootloader would call an 'ensure' function that effectively halted or panicked the device. Now the function returns a failure status up to the caller instead. This is a hardening improvement that makes the bootloader more resilient to communication errors, but the commit message frames it only as a behavior improvement with no changelog.

This commit adds on-device user-interface support for SLIP-24 payment requests on the Trezor Model T (Bolt layout). It does not change transaction validation, cryptography, or signing logic. Instead, it wires up new confirmation screens so users can review payment-request details (provider, refund addresses, swap/trade details, fees) before signing. Existing tests that previously skipped Model T are now enabled for it, and new UI test hashes are recorded. There is no direct evidence of a security vulnerability in this patch.

This commit fixes the verification logic for Trezor bootloader version 2 images in the Python firmware library. Previously, the code checked the elliptic-curve (EC) signature against only the Merkle root digest. The fix now hashes that digest together with the post-quantum (SLH) signature first, matching the actual signing procedure. Without this fix, a valid-looking bootloader signature could be accepted even if the SLH signature was wrong or missing, weakening the dual-signature security check.

This is a routine test-infrastructure change. It moves a helper that clicks menu items in automated tests into a shared debug-link action and updates many test scripts to use it. There is no change to the firmware's security behavior, no fix for a vulnerability, and no user-facing feature.

This is a large internal refactoring of how Trezor's user-interface passes key-value display data from Python apps to the Rust firmware. It replaces two-element string tuples with a new three-element 'PropertyType' that adds a flag indicating whether a value is raw data. The change touches many coin apps and UI layouts but is described by the vendor as a routine chore with no changelog entry. There is no direct evidence in the commit of a security vulnerability or fix.

This is a routine code cleanup in the Trezor hardware wallet's user interface layer. It moves default font and spacing choices for a UI component called PropsList into each device's theme file, so callers can use a simpler constructor. There is no change to security logic, cryptography, or how user data is handled.

This commit is a user-interface layout tweak for Trezor hardware wallets. It adds configurable vertical spacing between key/value property pairs shown on device screens. There is no security-relevant change, no bug fix, and no handling of secrets or memory.

This commit is a cosmetic/user-interface change. It updates the text and styling shown on the hardware wallet's red error screens (RSOD), such as when a wipe code is entered or too many PIN attempts occur. The messages are rewritten in sentence case instead of all capitals, and some fonts/layouts are adjusted. There is no indication this fixes or introduces a security vulnerability.

This commit is a cosmetic UI change for the Trezor hardware wallet's Eckhart design. It makes the device's RGB LED light up with specific colors on the homescreen and during red-screen error states, matching the screen's theme. There is no security-relevant change to how data is protected, how keys are handled, or how the device communicates.

This commit adds a new optional 'app_name' field to Trezor's Trusted Host Pairing (THP) credentials. It lets the device display both the application name and the host/browser name during pairing and connection prompts, making it clearer to users which app is requesting access. There is no direct evidence in the commit that this fixes an active security vulnerability; it reads as a user-experience and metadata improvement.

This is a routine cleanup commit that removes unused code from a bootloader UI header component in the Trezor firmware. It deletes an unused left-button feature and switches one screen to use a standard close-button helper. There is no security fix or behavior change visible in the diff.

This commit simply removes an unused compiler flag named USE_SVC_SHUTDOWN from the firmware build script. There is no functional code change, no bug fix, and no security-relevant behavior altered. It is a routine cleanup.

This is a large internal code reorganization in Trezor's embedded firmware. It moves flash/storage headers and build flags around so different firmware images (bootloader, kernel, production test, etc.) declare more explicitly which features they need. There is no obvious security bug introduced, but the change touches low-level memory-layout and storage code, so any mistake could in principle affect how secrets are stored. The commit itself is labeled a refactor and includes no changelog.

This commit is a code cleanup and refactoring change in Trezor firmware. It replaces the old storage_init() function, which required callers to fetch their own random entropy (salt), with a new storage_setup() helper that fetches entropy internally. It also removes the direct entropy_get() system call from the non-secure kernel interface. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be architectural preparation for future initialization changes.

This commit is a code cleanup: it renames the 'entropy' module to 'storage_salt' and moves it into the storage subsystem. The same device-unique salt logic (CPU ID plus one-time-programmable randomness block, or a master-key-derived salt on newer devices) is preserved, just called at a different point during storage setup rather than at boot. There is no indication this fixes a security bug or changes cryptographic behavior.

This commit is a routine developer tooling refactor. It renames and generalizes an internal Python helper script used to upload firmware to Trezor hardware over a USB serial port, so it can handle both nRF chip updates and boardloader updates. There is no change to device firmware, no user-facing feature, and no security fix or vulnerability indicated in the diff or commit message.

This commit is a code cleanup that merges two nearly identical firmware-update helpers into one shared function. There is no indication it fixes or introduces a security bug; it is a routine refactoring in an internal production-testing tool.

This commit only updates a README documentation file for an internal production-testing tool. It adds a sentence telling users which helper scripts to run when updating bootloader and nRF firmware binaries. No code, build scripts, firmware logic, or security behavior was changed.

This commit fixes a subtle bug where the same error object was reused every time a forbidden key path was accessed. In Python/MicroPython, reusing a single exception instance can cause problems if something later modifies or inspects the raised error, because the same object carries state from one error site to another. The fix creates a fresh exception object each time, which is safer and more correct, but the commit message and diff do not clearly describe an active security vulnerability.

This commit is a minor cleanup in Trezor's test code. It fixes a spelling mistake in a helper function name and changes how debug logging is silenced during automated tests. It does not affect the actual device firmware or any user-facing security behavior.

This commit adjusts when a firmware feature called 'ui_debug_overlay' is enabled during the build process. Previously, it was enabled for all optimized builds (PYOPT), which likely includes production releases. Now it is only enabled alongside other debug features when debug mode (PYOPT='0') is active. The change prevents a debug UI overlay from being compiled into production firmware.

This commit fixes Bluetooth Low Energy (BLE) pairing behavior in the Trezor hardware wallet firmware. It changes how the device advertises itself, handles pairing requests, disconnects existing connections before pairing, and resets the advertising name after pairing ends. The changes are framed as a functional bug fix rather than a security fix, but they touch on sensitive pairing state management that could affect whether an attacker could trick the device into pairing unexpectedly or stay connected when it should not.