What the developer wrote
Authored by matejcik
fix(python): fix BLE behavior on macos
* macOS does not have `client.pair()`, as documented in bleak docs. This
way we just ignore the NotImplementedError and everything Just Works(tm)
* installing firmware will fail on macos unless response=True. we don't
want to limit other OSes for that so we configure that with a top level
constant
What changed, and why it matters
This commit fixes two macOS-specific compatibility issues in the Python Trezor library's Bluetooth Low Energy (BLE) transport code. It makes BLE pairing and firmware installation work on Apple computers by handling a missing macOS pairing function and switching to a more reliable write mode on that platform. There is no indication this is a security vulnerability fix.
No security action required. Treat as a normal compatibility/bugfix commit. Users on macOS who install firmware over BLE may benefit from updating the Python library.
Security signals we found
No security-relevant signals in commit message or diff
Change is a platform compatibility bugfix for macOS BLE behavior
No input validation, memory safety, authentication, or cryptographic changes
Evidence from the diff
The patch modifies python/src/trezorlib/transport/ble.py. It adds a platform check (sys.platform == ‘darwin’) to suppress NotImplementedError during BLE pairing, which is expected behavior on macOS because bleak’s client.pair() is not implemented there. It also introduces SHOULD_WRITE_WITH_RESPONSE, forcing response=True on macOS for GATT characteristic writes, which is required for firmware installation on that OS. Other platforms retain response=False. These are portability/bugfix changes, not security patches.
Changed components
python/src/trezorlib/transport/ble.pyTrezor Python library BLE transport layermacOS BLE pairing and GATT write pathsInspect captured patch +10 / −1
diff --git a/python/src/trezorlib/transport/ble.py b/python/src/trezorlib/transport/ble.py
index 558229d2..691ffda1 100644
--- a/python/src/trezorlib/transport/ble.py
+++ b/python/src/trezorlib/transport/ble.py
@@ -18,6 +18,7 @@ from __future__ import annotations
import asyncio
import atexit
import logging
+import sys
import typing as t
from dataclasses import dataclass
from multiprocessing import Pipe, Process
@@ -51,6 +52,8 @@ TREZOR_CHARACTERISTIC_TX = "8c000003-a59b-4d58-a9ad-073df69fa1b1"
SCAN_INTERVAL_SECONDS = 3
SHUTDOWN_TIMEOUT_SECONDS = 10
+SHOULD_WRITE_WITH_RESPONSE = sys.platform == "darwin"
+
class BleTransport(Transport):
@@ -293,6 +296,12 @@ class BleAsync:
except BleakError:
LOG.error("BLE pairing failed - make sure to open system pairing dialog")
raise
+ except NotImplementedError:
+ # expected on macOS
+ if sys.platform != "darwin":
+ LOG.warning(
+ "Failed to initiate pairing. You may need to pair the device manually."
+ )
queue = asyncio.Queue()
@@ -340,7 +349,7 @@ class BleAsync:
async def write(self, address: str, chunk: bytes) -> None:
periph = self.devices[address]
await periph.client.write_gatt_char(
- TREZOR_CHARACTERISTIC_RX, chunk, response=False
+ TREZOR_CHARACTERISTIC_RX, chunk, response=SHOULD_WRITE_WITH_RESPONSE
)
async def shutdown(self) -> None:
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.