fix(python): send DebugLinkOptigaSetSecMax via debuglink
What the developer wrote
Authored by tychovrahe
fix(python): send DebugLinkOptigaSetSecMax via debuglink
[no changelog]
What changed, and why it matters
This is a small bugfix in Trezor's Python developer tools. A command that resets an internal hardware counter (Optiga security event counter) was accidentally being sent over the normal device connection instead of the special debug-only connection. The patch corrects it to use the debug connection. It does not appear to introduce a security vulnerability; rather it fixes a tooling mistake so the debug command works as intended.
No security action required. Treat as a normal code-quality/debug-tooling fix. If auditing, verify that `DebugLinkOptigaSetSecMax` is only usable on debug-enabled/unlocked devices.
Security signals we found
Debug-only command moved to debug transport
No privilege escalation or bypass introduced
No changelog entry suggests routine tooling fix
Evidence from the diff
The commit changes the optiga_set_sec_max CLI helper to open the debug transport and pass a DebugLink instance to debuglink_optiga_set_sec_max(). The function in debuglink.py is updated to call debug._call(messages.DebugLinkOptigaSetSecMax()) instead of session.call(...) on a normal session. This aligns the message with the debuglink protocol, which is the correct channel for DebugLink* messages. The change is a functional fix for a debug/test utility and is gated behind debug access.
Changed components
python/src/trezorlib/cli/debug.pypython/src/trezorlib/debuglink.pyInspect captured patch +7 / −3
diff --git a/python/src/trezorlib/cli/debug.py b/python/src/trezorlib/cli/debug.py
index 110b0522d..22e459ba0 100644
--- a/python/src/trezorlib/cli/debug.py
+++ b/python/src/trezorlib/cli/debug.py
@@ -71,7 +71,11 @@ def prodtest_t1(session: "Session") -> None:
@with_session(seedless=True)
def optiga_set_sec_max(session: "Session") -> None:
"""Set Optiga's security event counter to maximum."""
- debuglink_optiga_set_sec_max(session)
+ debug_transport = session.client.protocol.transport.find_debug()
+ debug_transport.open()
+ debug = DebugLink(transport=debug_transport)
+ debuglink_optiga_set_sec_max(debug)
+ debug_transport.close()
@cli.command()
diff --git a/python/src/trezorlib/debuglink.py b/python/src/trezorlib/debuglink.py
index 755c33e0a..689d05b73 100644
--- a/python/src/trezorlib/debuglink.py
+++ b/python/src/trezorlib/debuglink.py
@@ -1837,8 +1837,8 @@ def _is_emulator(debug_client: "TrezorClientDebugLink") -> bool:
return debug_client.features.fw_vendor == "EMULATOR"
-def optiga_set_sec_max(session: "Session") -> None:
- session.call(messages.DebugLinkOptigaSetSecMax(), expect=messages.Success)
+def optiga_set_sec_max(debug: DebugLink) -> None:
+ debug._call(messages.DebugLinkOptigaSetSecMax())
def set_log_filter(debug: DebugLink, filter: str) -> None:
Why this scored 20/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.