fix(python): use `node.fingerprint` to support older FW
What the developer wrote
Authored by Roman Zeyde
fix(python): use `node.fingerprint` to support older FW
`PublicKey.root_fingerprint` support was added in:
```
* 5728f54b78 Pavol Rusnak: core: return root_fingerprint in PublicKey (5 years ago)
* 4d45a68fd0 Pavol Rusnak: legacy: return root_fingerprint in PublicKey (5 years ago)
```
What changed, and why it matters
This is a small compatibility fix in the Trezor Python library. Older Trezor firmware versions did not return the wallet's 'root fingerprint' in one specific place, so the library was failing or warning users. The change makes the library read the same fingerprint from an older, always-available field instead. It is a bug fix for backward compatibility, not a security vulnerability patch.
No security action required. Treat as a normal compatibility fix. If auditing, verify that `node.fingerprint` is indeed equivalent to `root_fingerprint` for the GetPublicKey response on all supported firmware versions.
Security signals we found
No security-relevant signal in the diff: change is a backward-compatibility refactor.
Removal of a warning about unsupported root fingerprint on older firmware.
No new asserts, no new parsing of untrusted data, no privilege changes.
Evidence from the diff
The commit changes trezorlib to obtain the root fingerprint from resp.node.fingerprint instead of resp.root_fingerprint. The latter was only added in newer firmware (core >= 2.3.5, legacy >= 1.9.4), so using it broke compatibility with older devices. The patch removes a version-gated warning/fallback and an unused models import, unifying the code path across firmware versions. There is no cryptographic change; the same value is read from a different Protobuf field.
Changed components
python/src/trezorlib/client.pypython/src/trezorlib/protocol_v1.pyInspect captured patch +9 / −11
diff --git a/python/.changelog.d/6580.fixed b/python/.changelog.d/6580.fixed
new file mode 100644
index 00000000..1578be6b
--- /dev/null
+++ b/python/.changelog.d/6580.fixed
@@ -0,0 +1 @@
+Fetch root fingerprint from older firmware.
diff --git a/python/src/trezorlib/client.py b/python/src/trezorlib/client.py
index 2fe5fa03..7a7481d6 100644
--- a/python/src/trezorlib/client.py
+++ b/python/src/trezorlib/client.py
@@ -181,8 +181,9 @@ class Session(t.Generic[ClientType, SessionIdType]):
choice of a correct session for this operation.
"""
resp = self.call(GET_ROOT_FINGERPRINT_MESSAGE, expect=messages.PublicKey)
- assert resp.root_fingerprint is not None
- root_fingerprint = resp.root_fingerprint.to_bytes(4, "big")
+ # resp.root_fingerprint is not available on <1.9.4 & <2.3.5
+ assert resp.node.fingerprint is not None
+ root_fingerprint = resp.node.fingerprint.to_bytes(4, "big")
if self._root_fingerprint is None:
self._root_fingerprint = root_fingerprint
assert self._root_fingerprint == root_fingerprint
diff --git a/python/src/trezorlib/protocol_v1.py b/python/src/trezorlib/protocol_v1.py
index 49bb54db..5492e4d9 100644
--- a/python/src/trezorlib/protocol_v1.py
+++ b/python/src/trezorlib/protocol_v1.py
@@ -25,7 +25,7 @@ import warnings
import typing_extensions as tx
-from . import client, exceptions, mapping, messages, models
+from . import client, exceptions, mapping, messages
from .log import DUMP_BYTES
from .thp import pairing
from .tools import enter_context
@@ -198,16 +198,12 @@ class SessionV1(client.Session["TrezorClientV1", t.Optional[bytes]]):
# Looks like the session is already initialized. Bail out.
raise exceptions.PassphraseError("Failed to activate passphrase session")
- # after processing any PassphraseRequest, we should have an Address response
+ # after processing any PassphraseRequest, we should have an PublicKey response
resp = messages.PublicKey.ensure_isinstance(resp)
- # `root_fingerprint` is not available on older models.
- min_version = (1, 9, 4) if self.model is models.T1B1 else (2, 3, 5)
- if self.version >= min_version:
- assert resp.root_fingerprint is not None
- self._root_fingerprint = resp.root_fingerprint.to_bytes(4, "big")
- else:
- warnings.warn("Your Trezor firmware does not support root fingerprint.")
+ # resp.root_fingerprint is not available on <1.9.4 & <2.3.5
+ assert resp.node.fingerprint is not None
+ self._root_fingerprint = resp.node.fingerprint.to_bytes(4, "big")
self.client.refresh_features()
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.