Trezor firmware

This commit fixes undefined behavior in the Rust-based protobuf codec inside Trezor firmware. The code was reading multi-byte integers from data files that were not guaranteed to be properly aligned in memory, which can cause crashes or unpredictable behavior on some hardware. The patch ensures the data files are loaded with correct memory alignment and removes the use of 'packed' structs that forced unaligned access. It is a defensive hardening fix rather than a confirmed remote exploit.

This commit is purely a documentation update: it gathers individual changelog fragments into the main CHANGELOG.md file for the Python trezorlib package version 0.20.0-dev0. No program code was changed, so it cannot by itself introduce or fix a security vulnerability.

This commit only adds a new test case and updates expected test screenshots. It does not change the actual Trezor firmware code that users run. The new test verifies that a payment request without a memo or nonce behaves as expected and does not trigger a nonce-reuse error. There is no security fix or vulnerability here.

This commit adds a user-facing warning in Trezor hardware wallets when signing a Ripple transaction that does not include a destination tag. Destination tags are often required by exchanges to credit the correct account, so missing one can lead to lost funds. The change only shows an extra warning screen; it does not alter how transactions are validated or signed.

This is a minor internal cleanup change in the Trezor hardware wallet firmware. It removes explicit button-request type labels from two warning screens in the Ripple and Stellar cryptocurrency apps, letting them default to a generic 'Warning' category instead of 'ConfirmOutput'. There is no visible security bug or vulnerability being fixed.

This commit changes how payment-request amounts are encoded in Trezor firmware. Previously amounts were 8-byte numbers; now they can be 8 or 32 bytes, with 32 bytes used for Ethereum/EVM transactions. The change is a feature update to support larger EVM token amounts, not a clearly disclosed security fix. It does add length checks and an overflow guard, which reduces risk, but the change touches the trusted payment-request verification path, so any bug there could affect what amount the user is asked to approve.

This commit only adds new automated tests. It checks that Trezor devices correctly reject payment-request amounts encoded with the wrong number of bytes (for Bitcoin) or values that are too large (for Ethereum). There is no change to the actual firmware or production code, and the commit message explicitly marks itself as a test-only chore with no changelog.

This commit is a routine translation and localization update for the Trezor firmware. It updates translated user-facing strings in several languages, fixes a typo ('minumum' to 'minimum'), adjusts some strings to be device-layout-specific, and refreshes the corresponding UI test fixture hashes. There is no code behavior change and no security impact.

This commit simply adds a new cryptographic signature to a list that verifies official language translation files for the Trezor hardware wallet. It does not change any code, fix any bug, or introduce any security weakness. It is a routine administrative update so devices can trust the latest translation pack.

This commit only adds four test-only certificate and private-key files under the tests/tropic_model directory. They are clearly labeled as test fixtures, not used in production firmware, and the commit message explicitly says '[no changelog]'. There is no code change and no indication of a security fix or vulnerability.

This commit fixes a crash that could occur when setting or changing the Trezor device's wipe code. The fix moves a memory-protection reconfiguration call to happen before user-interface progress is initialized. The crash appears to be a reliability bug rather than a security vulnerability that an attacker could exploit to steal funds or bypass protections.

This commit fixes a crash that could occur when setting or changing the Trezor device's wipe code (a special PIN that wipes the device). The fix moves a memory-protection reconfiguration call earlier, before user-interface progress initialization. The crash appears to be a reliability bug rather than a security vulnerability that would let an attacker steal funds, but a crash during security-sensitive wipe-code setup could disrupt the user experience or potentially be used in a denial-of-service scenario.

This commit is a routine cleanup of translation strings in the Trezor firmware. It changes how some text labels are stored so that different device screen layouts (Bolt, Caesar, Delizia, Eckhart) can have their own versions of the same string, often leaving unused layouts with an empty string. There is no indication this fixes or introduces a security vulnerability.

This commit only updates translated user-interface text strings for Bluetooth-related screens in several language files. It adds labels like 'Apps connected', 'Host info', 'MAC Address', and 'Waiting for host' in Czech, German, Spanish, French, Italian, and Portuguese, and refreshes the translation signature metadata. There is no executable code change, no security fix, and no vulnerability introduced.

This commit only changes user-facing text strings. It adds an ellipsis (three dots) to progress messages like "Please wait" and "Processing" for the new "Eckhart" device layout, while keeping the old wording for older layouts. It also updates the translation files and their cryptographic signature metadata. There is no code behavior change and no security relevance.

This commit adds a new device state flag so the Trezor hardware wallet can tell a connected computer: 'this session replaced an existing channel, so the user does not need to confirm again.' The host-side library is updated to recognize the new state. It is a feature change, not an obvious vulnerability fix, but it touches the authentication/authorization boundary between device and host.

This commit simply shortens a French translation string used on the device screen. It changes 'Effacer les données de l'appareil' to 'Effacer l'appareil' and updates the corresponding translation signature file and UI test snapshots. There is no code behavior change and no security relevance.

This commit is a small hotfix in Trezor's factory production-test tool (prodtest), which is used during manufacturing, not in normal end-user wallets. It changes how a certificate read from the Infineon OPTIGA secure chip is parsed. Previously, the code carefully checked a multi-certificate chain format; now it simply skips 9 bytes and assumes there is only one certificate. The change removes safety checks and could make the tool accept malformed or unexpected certificate data, but it only affects an internal manufacturing diagnostic command, not the wallet firmware users rely on for funds.

This commit only adds on-screen progress indicators to several cryptocurrency signing flows (EOS, Ethereum, Stellar). It does not change any security logic, cryptography, or transaction validation. The large diff is mostly updated test screenshot fingerprints (fixtures.json) because the new progress screens change the device's displayed images during automated UI tests.

This commit adds a new cryptographic signature entry to a JSON file that records approved translation bundles for the Trezor hardware wallet. There is no code change and no visible security defect. It appears to be a routine administrative step to authorize a new set of translated strings.

This commit only adds translated text strings for a new 'backup needed' message shown on the device home screen. It does not change any code logic, security checks, or cryptographic operations. The signatures.json file is updated to record the new translation bundle hash, which is a normal bookkeeping step for signed translation assets.

This commit moves a certificate-chain validation check so it runs before a device certificate is permanently stored in secure hardware, rather than after. Previously, an invalid device certificate could be written to the chip before the code noticed and rejected it. The change is in factory production-test tools (prodtest), not normal user wallet firmware, so it mainly affects manufacturing/ provisioning rather than end-user devices in the field.

This commit is a routine synchronization of translated user-interface text strings for the Trezor hardware wallet firmware. It updates wording in several language files (Czech, German, Spanish, French, Italian, Portuguese) and refreshes the corresponding digital signature and UI test snapshot records. There are no code logic changes, no security fixes, and no changes to how the device protects private keys or signs transactions.

This commit changes how the Trezor hardware wallet handles low-level communication errors in its new THP (Trezor Host Protocol) code. Previously, certain malformed or unexpected low-level packets would cause the device to raise a ThpError, which gets sent back to the host as a Failure message. The patch makes the device silently ignore many of these low-level problems instead—such as unexpected control bytes, wrong sequence bits, bad checksums, invalid broadcast lengths, and reassembly overruns. Some internal argument checks are also converted from raising errors to assert statements, which only run in debug builds and are removed in production firmware. The stated intent is to make the protocol more robust against noisy or malformed traffic, but it also reduces the device's visibility into potential attacks or protocol fuzzing.

This commit simply removes an unused error code named INVALID_DATA from the Trezor hardware wallet's new THP (Trezor Host Protocol) code. It deletes the numeric constant, the matching Python exception class, and the mapping that translated the error number into that exception. There is no change to how data is validated or how errors are handled; it only cleans up code that was never referenced.