Trezor firmware

This commit only updates automated test scripts for the Trezor hardware wallet. It changes how the test code simulates button presses during a wallet backup flow to match the actual device behavior. There is no change to the firmware or wallet security itself.

This is a small, safe code cleanup. It changes a type annotation from a concrete class to a protocol (an interface definition) and updates two function signatures to return the more general interface type. There is no change to actual program behavior, no bug fix, and no security relevance.

This commit shortens two on-screen text labels in the Trezor bootloader from 'INSTALL FIRMWARE' to 'INSTALL FW' and 'UPDATE FIRMWARE' to 'UPDATE FW'. The change is purely cosmetic, intended to stop the text from overflowing its display area. The commit message notes these screens are not normally seen by users because updates now happen without user interaction. There is no security fix here.

This commit strengthens the Trezor host-side device-authentication check. Previously, the tool verified that each security chip's certificate chain was signed by a trusted root, but it did not compare the device model and serial number written into the different certificates. The patch now extracts the common name (model) and serial number from each certificate and rejects the device if those values disagree across chips or do not match the model the device claims to be. This closes a gap where a malicious or misconfigured device might present otherwise valid but mismatched certificates.

This commit adds support for a new post-quantum digital-signature algorithm (ML-DSA-44) to the Python trezorctl tool's device-authenticity check. It does not change how the hardware wallet itself works; it only lets the desktop companion software recognize and verify a new type of manufacturer signature on some devices. The change also moves hard-coded root public keys into a separate internal module and updates the required cryptography library version. There is no indication in the commit that this fixes a security bug or vulnerability.

This commit is a follow-up code cleanup that wraps more on-screen user-interface helpers in a new 'layout context' pattern. It changes type annotations from LayoutObj to LayoutContext and converts several synchronous-looking wrapper functions into async functions that use Python 'with' blocks. There is no direct evidence in the commit of a fixable security bug; it appears to be a defensive refactoring to make UI resource lifetimes more predictable across Trezor firmware models.

This commit fixes a firmware build problem when a feature called 'extapp support' is enabled. It changes which source files are compiled and adjusts code guards so that certain applet-related code is only included when both applets and kernel mode are active. There is no direct evidence this fixes a security vulnerability; it appears to be a build-system correction.

This commit removes calls to an old, already-deprecated debug-only feature named DebugLinkWatchLayout from the Python test library and test scripts. It is a cleanup change affecting only testing and developer tooling, not the firmware that runs on the Trezor device or any user-facing security behavior.

This commit fixes the CI (continuous integration) bootloader so it correctly hands control over to the main firmware after running. It adds missing security-monitor verification, calls a secret-handoff routine before jumping, and passes startup arguments to the next stage. The change appears to be a bug fix for an internal test/CI bootloader rather than a fix for an exploitable security flaw in production devices.

This commit is a straightforward code cleanup: it moves hard-coded pin, clock, and interrupt settings for the Nordic (NRF) radio chip out of the driver code and into board-specific header files. The actual electrical connections and behavior stay the same for the existing boards (revA, revB, revC). It also fixes one minor interrupt-clearing macro name to match the current HAL convention. There is no user-facing change and no security fix.

This commit is a build-system cleanup for Trezor firmware. It removes repeated lists of hardware-model-specific feature flags from multiple Cargo.toml files and replaces them with a single shared list in a new target.toml file for each project. There is no change to the actual device code or security behavior—only how build features are organized.

This commit is a straightforward internal rename from 'target' to 'project' across build configuration files and the Rust xtask build helper. It does not change what the firmware does, how it behaves, or any security logic. It is purely a code-maintenance refactor.

This commit removes an optional build feature called `storage_hw_key` and instead turns on hardware-derived storage key support automatically for one specific chip family (STM32U5) and never for the software emulator. It is a cleanup/refactoring change with no direct security fix or vulnerability visible in the diff.

This is a build-system refactoring commit for Trezor firmware. It moves feature-resolution code into a new module and shifts hard-coded ELF section lists and signing-tool choices into TOML configuration files. There is no direct evidence of a security vulnerability being fixed; it is a code-cleanup and maintainability change.

This commit is a follow-up code cleanup that wraps more on-screen layout calls in Python 'with' blocks. It changes return-type annotations from LayoutObj to LayoutContext and makes several UI helper functions async. There is no direct evidence in the commit that it fixes an exploitable security bug; it appears to be a defensive refactoring to enforce layout scoping consistently.

This is a routine dependency update bumping the Python Mako templating library from version 1.3.10 to 1.3.12. The commit message says the change is meant to avoid false safety warnings, because Mako versions 1.3.11 and earlier have a known vulnerability in code that Trezor firmware does not actually use. Only the lock file (uv.lock) changed; no Trezor source code was modified.

This commit simply deletes an entire internal testing tool called automatic_battery_tester from the repository. It removes Python scripts, configuration files, documentation, and dependency lists used only for hardware battery testing in the lab. No firmware code that ships to users was changed, and nothing in the commit suggests a security fix or vulnerability.

This commit is a code cleanup that changes how user-interface layouts are managed in the Trezor firmware. It wraps more layout objects in explicit context managers (the `with ... as layout:` pattern) so their lifetimes are clearly scoped. There is no direct evidence in the commit that this fixes an exploitable security bug; it appears to be a follow-up refactoring for safer resource handling.

This is a tiny user-interface polish change for the Trezor hardware wallet. It changes one footer label from 'swipe up' to 'tap' on warning screens that have no header title. There is no security-relevant behavior change in the diff itself.

This commit fixes a user-interface bug on the Trezor T3W1 hardware wallet. When a FIDO2/U2F security-key operation failed, the error popup was shown with a blank, non-functional button instead of automatically closing after a timeout. The fix makes the error screen close after the intended number of milliseconds (4 seconds in the FIDO2 case), so users are no longer stuck on a dead-end screen.

This is a user-interface cleanup change for Trezor hardware wallets. It lets the 'show_warning' screen accept 'None' for the title, which means 'hide the header entirely', instead of using an empty string to mean the same thing. It is a refactor with no changelog and no apparent security relevance.

This commit adds a safety check to three Trezor device user-interface layouts (Bolt, Caesar, Eckhart). It prevents a 'dangerous' warning screen from being shown without a title/header. The change is defensive: previously the unused `_danger` flag was ignored, so a caller could accidentally or maliciously present a high-risk warning with no context. Now such calls fail with an error. The commit message frames this as a chore, not a security fix, and no changelog entry was added.

This is a small user-interface cleanup in the Trezor hardware wallet firmware. It lets certain on-screen confirmation dialogs omit a large icon and title area when no title is provided, making the layout more flexible. There is no direct evidence in the commit that this fixes a security vulnerability.

This commit is a simple code cleanup: it replaces many copies of the same 'if device not initialized, raise an error' check with a single shared helper function. There is no change to when or how the error is raised, so it does not fix or introduce any security vulnerability.

This update fixes a bug in Bitcoin-only Trezor firmware where the device would try to derive a cryptographic seed even when the device had not been set up yet. Now it correctly returns a 'NotInitialized' error instead. A test was added to confirm the behavior.