feat(trezorlib): improve terse headertool output (secmon)
What the developer wrote
Authored by cepetr
feat(trezorlib): improve terse headertool output (secmon)
[no changelog]
What changed, and why it matters
This commit only changes how a command-line tool prints information about secure-monitor firmware headers. In non-verbose mode it now shows the device model and version instead of dumping every header field. There is no change to security checks, cryptography, or firmware behavior.
No security action needed; this is a cosmetic CLI output change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch adds a verbose parameter to format_secmon_header() in python/src/trezorlib/_internal/firmware_headers.py. When verbose is false, the output is shortened to model and version strings; when true, the full header dictionary is printed as before. The code hash, fingerprint, signature status and hash status lines are unchanged and still emitted in both modes. No verification logic, parsing, or trust decisions are modified.
Changed components
python/src/trezorlib/_internal/firmware_headers.pyInspect captured patch +17 / −6
### python/src/trezorlib/_internal/firmware_headers.py
@@ -211,6 +211,7 @@ def format_secmon_header(
code_hash: bytes,
digest: bytes,
sig_status: Status,
+ verbose: bool,
) -> str:
header_dict = asdict(header)
header_out = header_dict.copy()
@@ -232,12 +233,21 @@ def format_secmon_header(
all_ok = SYM_OK if hash_status.is_ok() and sig_status.is_ok() else SYM_FAIL
- output = [
- "SECMON Header " + format_container(header_out),
- f"Code hash: {click.style(chunkify(code_hash), bold=True)}",
- f"Fingerprint: {click.style(chunkify(digest), bold=True)}",
- f"{all_ok} Signature is {sig_status.value}, hash is {hash_status.value}",
- ]
+ if verbose:
+ output = ["Secmon Header " + format_container(header_out)]
+ else:
+ model = str(header_out["hw_model"])
+ version = header_out["version"]
+ output = [
+ f"Secmon Header for {click.style(model, bold=True)} "
+ f"version {click.style(version, bold=True)}"
+ ]
+
+ output.append(f"Code hash: {click.style(chunkify(code_hash), bold=True)}")
+ output.append(f"Fingerprint: {click.style(chunkify(digest), bold=True)}")
+ output.append(
+ f"{all_ok} Signature is {sig_status.value}, hash is {hash_status.value}"
+ )
return "\n".join(output)
@@ -445,6 +455,7 @@ def format(self, verbose: bool = False) -> str:
self.code_hash(),
self.digest(),
check_signature_any(self),
+ verbose,
)
def verify(self, dev_keys: bool = False) -> None:Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.