What the developer wrote
Authored by M1nd3r
chore: adjust tropic model config
- Changed: Simplified usage of `riscv_fw_version` - used string 1.0.0 with implicit encoding instead of explicit encoding.
- Added: Specified `spect_fw_version` to be 1.0.0, instead of the default 1.2.0.
[no changelog]
What changed, and why it matters
This is a routine configuration cleanup for the Tropic secure-element model used in Trezor hardware wallets. It changes how firmware version numbers are written into a test/tooling config file (from a manually encoded binary blob to a plain version string) and explicitly pins a second firmware version to 1.0.0. There is no indication this fixes or introduces a security vulnerability.
No security action required. Review as normal tooling/config maintenance if desired.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies core/tools/generate_tropic_model_config.py and tests/tropic_model/config.yml. It removes manual little-endian byte encoding of a RISC-V firmware version (major/minor/patch) and instead emits the string "1.0.0", which the tooling presumably encodes implicitly. It also adds an explicit spect_fw_version: 1.0.0 entry, overriding a previous default of 1.2.0. The YAML test fixture is updated to match. The change is cosmetic/tooling-only and does not alter runtime firmware behavior or cryptographic parameters.
Changed components
core/tools/generate_tropic_model_config.pytests/tropic_model/config.ymlInspect captured patch +4 / −15
diff --git a/core/tools/generate_tropic_model_config.py b/core/tools/generate_tropic_model_config.py
index d85fe670..052e0fff 100755
--- a/core/tools/generate_tropic_model_config.py
+++ b/core/tools/generate_tropic_model_config.py
@@ -30,11 +30,6 @@ EXTRA_FILES = [
VENDOR_CONFIG_DIR / "tropic01_ese_public_key_1.pem",
]
-# Version of the RISCV Firmware (also know as Application FW)
-RISCV_FW_MAJOR = 1
-RISCV_FW_MINOR = 0
-RISCV_FW_PATCH = 0
-
@click.command()
@click.option("--check", is_flag=True)
@@ -97,13 +92,6 @@ def generate_config(check: bool) -> None:
data += b"\x00" * (SLOT_LEN - len(data))
user_data[TROPIC_DEVICE_CERT_FIRST_SLOT + i] = {"value": data}
- # Set RISC-V FW version
- riscv_fw_version = (
- b"\x00"
- + RISCV_FW_PATCH.to_bytes(1, "little")
- + RISCV_FW_MINOR.to_bytes(1, "little")
- + RISCV_FW_MAJOR.to_bytes(1, "little")
- )
config_dict = {
"s_t_priv": "tropic01_ese_private_key_1.pem",
"s_t_pub": "tropic01_ese_public_key_1.pem",
@@ -118,7 +106,8 @@ def generate_config(check: bool) -> None:
"origin": 2, # imported key
}
},
- "riscv_fw_version": riscv_fw_version,
+ "riscv_fw_version": "1.0.0", # Version of the RISCV Firmware (also know as Application FW) used in TS7 devices
+ "spect_fw_version": "1.0.0",
}
config = yaml.dump(config_dict)
diff --git a/tests/tropic_model/config.yml b/tests/tropic_model/config.yml
index c9d1a1a1..0a5014b0 100644
--- a/tests/tropic_model/config.yml
+++ b/tests/tropic_model/config.yml
@@ -30,8 +30,8 @@ r_user_data:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-riscv_fw_version: !!binary |
- AAAAAQ==
+riscv_fw_version: 1.0.0
s_t_priv: tropic01_ese_private_key_1.pem
s_t_pub: tropic01_ese_public_key_1.pem
+spect_fw_version: 1.0.0
x509_certificate: tropic01_ese_certificate_1.pem
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.