chore(python): allow ignoring xpub magic in trezorctl
What the developer wrote
Authored by Roman Zeyde
chore(python): allow ignoring xpub magic in trezorctl
Output descriptors don't use ypub/zpubs.
[no changelog]
What changed, and why it matters
This commit adds a new command-line option to the Trezor Python tool (trezorctl) that lets users request a public key (xpub) without the usual version/magic bytes being adjusted for the specific coin and script type. This is described as a convenience for working with 'output descriptors', a modern Bitcoin wallet format. There is no direct security bug here; it is a feature change in a client-side utility.
No security action required. Treat as a normal feature addition. If reviewing, confirm the underlying `ignore_xpub_magic` parameter in the library/device protocol is intentional and documented, which is outside the scope of this diff.
Security signals we found
New CLI flag relaxes a previously enforced xpub-version check/formatting rule
No bounds checking, parsing, or cryptographic code is modified
No firmware or privileged code is changed
Commit is marked as a chore and explicitly skips changelog
Evidence from the diff
The patch adds an --ignore-xpub-magic / -i flag to the get_public_node CLI command in python/src/trezorlib/cli/btc.py and passes it through to the underlying btc.get_public_node() API call as ignore_xpub_magic. The commit message states the reason: ‘Output descriptors don’t use ypub/zpubs.’ This exposes an already-existing device/protocol option in the CLI. No device firmware code is changed.
Changed components
python/src/trezorlib/cli/btc.pytrezorctl get_public_node commandInspect captured patch +3 / −0
diff --git a/python/src/trezorlib/cli/btc.py b/python/src/trezorlib/cli/btc.py
index 48e0f35a..d5646601 100644
--- a/python/src/trezorlib/cli/btc.py
+++ b/python/src/trezorlib/cli/btc.py
@@ -254,6 +254,7 @@ def get_address(
@click.option("-e", "--curve")
@click.option("-t", "--script-type", type=ChoiceType(INPUT_SCRIPTS))
@click.option("-d", "--show-display", is_flag=True)
+@click.option("-i", "--ignore-xpub-magic", is_flag=True)
@with_session
def get_public_node(
session: "Session",
@@ -262,6 +263,7 @@ def get_public_node(
curve: Optional[str],
script_type: Optional[messages.InputScriptType],
show_display: bool,
+ ignore_xpub_magic: bool,
) -> dict:
"""Get public node of given path."""
address_n = tools.parse_path(address)
@@ -275,6 +277,7 @@ def get_public_node(
coin_name=coin,
script_type=script_type,
unlock_path=get_unlock_path(address_n),
+ ignore_xpub_magic=ignore_xpub_magic,
)
return {
"node": {
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.