What the developer wrote
Authored by Martin Milata
chore(core): sign translations
[no changelog]
(cherry picked from commit 4c4870262b85c04ba235602ba49307015118c3f5)
What changed, and why it matters
This commit adds a new cryptographic signature entry to a JSON file that records approved translation bundles for the Trezor hardware wallet. It does not change any executable code, fix a bug, or alter security logic. The signature appears to be a routine administrative update authorizing a new set of translated strings for firmware version 2.12.4.0.
No security action required. Treat as routine metadata update. Verify the signature was produced by the expected vendor signing key during normal release process if performing audit validation.
Security signals we found
Cryptographic signature present, but used for legitimate data authentication rather than indicating a vulnerability
No executable code modified
No changelog entry, consistent with routine chore commit
Evidence from the diff
The diff appends one object to the ‘history’ array in core/translations/signatures.json. The object contains an ECDSA-style signature (103 bytes, likely secp256k1), version ‘2.12.4.0’, a merkle_root, a timestamp, and a commit hash. This file is used by the device to verify authenticity of translation blobs. The change is additive and consistent with the existing schema; no code paths, verification rules, or key material were modified.
Changed components
core/translations/signatures.jsonInspect captured patch +7 / −0
### core/translations/signatures.json
@@ -5,6 +5,13 @@
"commit": "178950a9d797f29656934c3aa4110acb46b209f1"
},
"history": [
+ {
+ "signature": "03faf0f703f9237ecf13bfe0e013426ca218c18dbafebe168c621547c34c452ea705d220bd2683052598781965698632b65cb517dcead3f3b9a0b7825f7b039703",
+ "version": "2.12.4.0",
+ "merkle_root": "6466cef5291aa768b7cff92fb188e4cc7c1bc4656b88497fa12ee5a89c29f554",
+ "datetime": "2026-08-03T08:42:04.686864+00:00",
+ "commit": "30be4e8c9488eeab68f994af23b3d9c9b7334266"
+ },
{
"signature": "036fef5ad1fbbf06c662e8b0b6e0ac1fd76e94f4aefc3fd59f2b48acf2358ecb6a0f3ae601cb535c6135e7c74cb851b0de7a92bf05d066a82d1d37dafd47c0a107",
"version": "2.12.3.0",Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.