fix(python): `trezorctl` should use recent THP credentials first
What the developer wrote
Authored by Roman Zeyde
fix(python): `trezorctl` should use recent THP credentials first
Otherwise, it may get stuck using an invalidated one (#6575).
What changed, and why it matters
This commit fixes a minor bug in the Trezor command-line tool (trezorctl) used to manage paired device credentials. Previously, when listing saved credentials, the tool would try the oldest saved credential first. If that older credential had been invalidated on the device, the tool could get stuck trying to use it instead of a newer, still-valid one. The fix simply reverses the order so the most recently added credential is tried first. It is a usability/reliability fix rather than a security vulnerability that allows an attacker to steal funds or keys.
Treat as a routine bug-fix release; no urgent security response required. Users relying on THP pairing via trezorctl should update when convenient. Reviewers may want to confirm that credential invalidation handling is robust and that stale credentials are properly removed rather than merely deprioritized.
Security signals we found
Fixes a functional bug that could cause the CLI to use an invalidated THP credential
Change is limited to credential iteration order in the Python CLI helper
No cryptographic, firmware, or transport security changes present in diff
Evidence from the diff
In python/src/trezorlib/cli/credentials.py, the CredentialStore.list() method now returns credentials in reverse order (reversed(app_data)) so the most recently stored THP (Trezor Host Protocol) credential is preferred. The changelog fragment says this fixes pairing after credential invalidation. The change is one line and addresses a local state-ordering issue in the CLI credential store; it does not change cryptography, authentication logic, or device firmware.
Changed components
trezorctl CLI credential storepython/src/trezorlib/cli/credentials.pyInspect captured patch +4 / −1
diff --git a/python/.changelog.d/6575.fixed b/python/.changelog.d/6575.fixed
new file mode 100644
index 00000000..acd50a4d
--- /dev/null
+++ b/python/.changelog.d/6575.fixed
@@ -0,0 +1 @@
+Fix THP pairing after credential invalidation.
diff --git a/python/src/trezorlib/cli/credentials.py b/python/src/trezorlib/cli/credentials.py
index 820cdefb..359a26c2 100644
--- a/python/src/trezorlib/cli/credentials.py
+++ b/python/src/trezorlib/cli/credentials.py
@@ -149,8 +149,10 @@ class CredentialStore:
def list(self) -> t.Collection[Credential]:
with self._with_app() as app_data:
+ # Use recent credentials first (in case older credentials were invalidated)
return [
- KeyringCredential(self.app_name, id).as_credential() for id in app_data
+ KeyringCredential(self.app_name, id).as_credential()
+ for id in reversed(app_data)
]
def add(self, credential: Credential) -> None:
Why this scored 24/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.