chore(core): cargo-vet audits for trezor-thp dependencies
What the developer wrote
Authored by Martin Milata
chore(core): cargo-vet audits for trezor-thp dependencies
[no changelog]
What changed, and why it matters
This commit only updates supply-chain audit records for two Rust dependencies used by Trezor hardware wallets. It adds signed-off statements that the code is safe to deploy, but does not change any actual firmware, cryptographic, or application code. There is no indication of a security bug or fix.
No action required. This is a routine supply-chain bookkeeping commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff modifies cargo-vet supply-chain files (audits.toml and imports.lock). It adds a maintainer self-audit for trezor-noise-protocol v0.2.1 and a delta audit for zeroize_derive 1.4.2→1.4.3, plus imports a Mozilla audit for zeroize_derive 1.4.2. No source code, build scripts, or configuration outside the supply-chain directory is changed.
Changed components
core/embed/supply-chain/audits.tomlcore/embed/supply-chain/imports.lockInspect captured patch +18 / −0
diff --git a/core/embed/supply-chain/audits.toml b/core/embed/supply-chain/audits.toml
index 0061b9d2..34b7242d 100644
--- a/core/embed/supply-chain/audits.toml
+++ b/core/embed/supply-chain/audits.toml
@@ -12,6 +12,12 @@ criteria = "safe-to-deploy"
version = "1.2.1"
notes = "Reviewed at 1.2.0; 1.2.1 diff treated as equivalent."
+[[audits.trezor-noise-protocol]]
+who = "Martin Milata <martin@martinmilata.cz>"
+criteria = "safe-to-deploy"
+version = "0.2.1"
+notes = "I am the maintainer of the crate, which is a fork based on noise-protocol-0.2.0. I am not a cryptography expert. The original crate has no unsafe code, nor filesystem or network access. It closely follows the structure of the Noise Protocol Framework specification."
+
[[audits.ufmt-write]]
who = "matejcik <ja@matejcik.cz>"
criteria = "safe-to-deploy"
@@ -22,6 +28,12 @@ who = ["matejcik <ja@matejcik.cz>", "Martin Milata <martin@martinmilata.cz>"]
criteria = "safe-to-deploy"
version = "1.8.2"
+[[audits.zeroize_derive]]
+who = "Martin Milata <martin@martinmilata.cz>"
+criteria = "safe-to-deploy"
+delta = "1.4.2 -> 1.4.3"
+notes = "There are no semantic changes, only formatting and metadata."
+
[[trusted.regex]]
criteria = "safe-to-deploy"
user-id = 189 # Andrew Gallant (BurntSushi)
diff --git a/core/embed/supply-chain/imports.lock b/core/embed/supply-chain/imports.lock
index 70fc56f4..e052d015 100644
--- a/core/embed/supply-chain/imports.lock
+++ b/core/embed/supply-chain/imports.lock
@@ -1018,6 +1018,12 @@ criteria = "safe-to-deploy"
delta = "0.1.1 -> 0.2.0"
aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+[[audits.mozilla.audits.zeroize_derive]]
+who = "Benjamin Beurdouche <beurdouche@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "1.4.2"
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
[[audits.zcash.audits.autocfg]]
who = "Jack Grigg <jack@electriccoin.co>"
criteria = "safe-to-deploy"
Why this scored 13/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.