fix(nordic): update mcuboot - fixes trezor crypto compatibility

Trezor/Trezor firmware

d6033024 View source ↗

Public commit record

What the developer wrote

Authored by tychovrahe

62/100 · Adequate

fix(nordic): update mcuboot - fixes trezor crypto compatibility

[no changelog]

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body

The short version

What changed, and why it matters

This commit simply updates two configuration files to point the Nordic (nRF) hardware build at newer revisions of Trezor's fork of the MCUboot bootloader. The commit message says it 'fixes trezor crypto compatibility' but gives no details, and the diff itself only changes Git revision hashes. There is no visible security bug in this patch, but it is also impossible to tell from this commit alone what problem the new bootloader revisions solve.

Recommended action

Review the actual changes in the two new MCUboot revisions (3daca2a182073f0c64a4f42b62d6fe78a3dea9a4 and 155694179aa290f0d692a26c1a9a08f5eec0c970) on https://github.com/trezor/mcuboot to determine whether they fix a security-relevant cryptographic incompatibility. Treat this commit as a dependency bump, not as a standalone security patch.

Security signals we found

Bootloader dependency update for hardware wallet firmware

Commit message mentions 'crypto compatibility' but no vulnerability or CVE

No source-code changes visible in the supplied diff

Technical analysis

Evidence from the diff

The diff updates west manifest files (west.yml and west-ncs2.9.yml) to use new commits of https://github.com/trezor/mcuboot for two Nordic Connect SDK configurations. No source code, cryptographic logic, or bootloader behavior is shown. The actual change lives entirely in the referenced mcuboot commits, which are not supplied. Therefore the security relevance of this change cannot be assessed from the provided materials.

Changed components

nordic/trezor/west.ymlnordic/trezor/west-ncs2.9.ymlTrezor fork of MCUboot bootloader (referenced but not diffed)

Inspect captured patch +2 / −2

diff --git a/nordic/trezor/west-ncs2.9.yml b/nordic/trezor/west-ncs2.9.yml
index b621cf1f..6344394d 100644
--- a/nordic/trezor/west-ncs2.9.yml
+++ b/nordic/trezor/west-ncs2.9.yml
@@ -17,5 +17,5 @@ manifest:
       import: true
     - name: mcuboot
       url: https://github.com/trezor/mcuboot
-      revision: 4f72f4eaa6c204f1193231f9695a5d8c3b253730 # trezor-v2.1.0-ncs3
+      revision: 3daca2a182073f0c64a4f42b62d6fe78a3dea9a4 # trezor-v2.1.0-ncs3
       path: bootloader/mcuboot
diff --git a/nordic/trezor/west.yml b/nordic/trezor/west.yml
index 54497ef5..df5d25fe 100644
--- a/nordic/trezor/west.yml
+++ b/nordic/trezor/west.yml
@@ -17,6 +17,6 @@ manifest:
       import: true
     - name: mcuboot
       url: https://github.com/trezor/mcuboot
-      revision: de2be1c9718ccf531ad1d85ce35e4926faabe92e #trezor-ncs3.3.0
+      revision: 155694179aa290f0d692a26c1a9a08f5eec0c970 #trezor-ncs3.3.0
       path: bootloader/mcuboot

Risk score

Why this scored 21/100

Our methodology →

Potential impact 5/30

Exploitability 3/25

Stealth signal 3/15

Affected reach 5/15

Confidence 3/10

Evidence quality 2/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 21/100

Community notes

Related watches

refactor(core): digest EIP-1559/EIP-7702 magic without RLP encoding

test(core): test RLP self-encoding bytestrings

chore(core): remove sha1 from regular FW