What the developer wrote
Authored by Roman Zeyde
chore(core): sign translations
[no changelog]
(cherry picked from commit 74faaff1c63a545fa5834871639ca7bf89c26ac2)
What changed, and why it matters
This commit adds a new cryptographic signature entry to a JSON file that records approved translations for the Trezor hardware wallet firmware. The signature verifies that the translation data for version 2.9.5.0 is authentic and has not been tampered with. There is no code change and no direct security vulnerability visible in the diff itself.
Verify the new signature against the published Trezor translation signing key and confirm the referenced commit (7d0ae5012dcbeecd038ef1bca6c6d5471ff94c5f) contains only expected translation updates. Treat this as a routine release artifact unless independent evidence links it to a security incident.
Security signals we found
Cryptographic signature added to a trust/integrity file
No executable code or verification logic changed in this commit
Commit title and message give no security context
Cherry-pick from another commit suggests routine release bookkeeping
Evidence from the diff
The change appends one record to core/translations/signatures.json containing an ECDSA signature, version string (2.9.5.0), merkle_root, timestamp, and commit hash. This is part of Trezor’s translation-blob signing mechanism. The diff only adds a signature; it does not modify verification logic, keys, or translation strings. Without the corresponding translation data or public key verification, we cannot assess whether the signature is valid or whether the underlying translation content is malicious.
Changed components
core/translations/signatures.jsonInspect captured patch +7 / −0
diff --git a/core/translations/signatures.json b/core/translations/signatures.json
index 1e0819a0..290d493a 100644
--- a/core/translations/signatures.json
+++ b/core/translations/signatures.json
@@ -5,6 +5,13 @@
"commit": "360e6d479ffa851aee6d401f4d71c5e22c4edd97"
},
"history": [
+ {
+ "signature": "0327225fee7a2696442468aa55c8aaf5514cd438ec277f471969e0e13062097f151c7fa4538c658f5a94f1440d49d00b9f387af4a9d5c30c7d60d7fbb32306e307",
+ "version": "2.9.5.0",
+ "merkle_root": "dc93c27f9b112e8ac015860616c6bd1900514f1dc5bfc76123261bc2c557d16f",
+ "datetime": "2025-11-27T09:36:31.832499+00:00",
+ "commit": "7d0ae5012dcbeecd038ef1bca6c6d5471ff94c5f"
+ },
{
"signature": "03bdb5f1adee3d2e35f805422fb17bc237c626831cf1ce463b75ae78120b40d53d44652176aceec7fdaed5291147e11aecfb782cf962c8f08c0358cf17929f8f00",
"version": "2.9.4.0",
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.