feat(trezorctl): Add --devel option to authenticate command.
What the developer wrote
Authored by Andrew Kozlik
feat(trezorctl): Add --devel option to authenticate command.
What changed, and why it matters
This commit adds a new command-line flag called --devel to the trezorctl authenticate command. Normally, the authentication check rejects devices that use development keys, because those are not production devices and should not be trusted as genuine. The new flag lets a user explicitly opt in to allow such development devices during authentication. This is a feature addition, not a fix for an existing vulnerability. It slightly increases the chance that a user might mistakenly trust a development or counterfeit device if they use the flag incorrectly, but it does not bypass authentication by default.
No immediate security action is required. Users should be educated that --devel reduces authenticity guarantees and should only be used with trusted development devices. Consider adding a warning message when --devel is used to reduce the risk of accidental misuse.
Security signals we found
New CLI option explicitly relaxes an authenticity check for development-key devices
Default authentication behavior is unchanged; bypass requires explicit user opt-in
No evidence of a vulnerability, CVE, or security advisory in the commit or supplied references
Evidence from the diff
The change adds a click option -d/–devel to the authenticate CLI in python/src/trezorlib/cli/device.py and passes its value as allow_development_devices to the underlying authentication.verify() call. Previously, development-key devices were rejected; with the flag, the caller can override that behavior. The default behavior remains unchanged (development devices are still rejected unless the flag is supplied).
Changed components
python/src/trezorlib/cli/device.pytrezorctl authenticate commandInspect captured patch +10 / −0
diff --git a/python/src/trezorlib/cli/device.py b/python/src/trezorlib/cli/device.py
index e8972fe6..a6b6415b 100644
--- a/python/src/trezorlib/cli/device.py
+++ b/python/src/trezorlib/cli/device.py
@@ -413,6 +413,12 @@ def _print_auth_data(signature: bytes, certificates: t.Sequence[bytes]) -> None:
is_flag=True,
help="Do not check intermediate certificates against the online whitelist/CRL.",
)
+@click.option(
+ "-d",
+ "--devel",
+ is_flag=True,
+ help="Allow devices provisioned with development keys.",
+)
@with_session(seedless=True)
def authenticate(
session: "Session",
@@ -422,6 +428,7 @@ def authenticate(
mldsa44_root: t.BinaryIO | None,
raw: bool | None,
offline: bool | None,
+ devel: bool | None,
) -> None:
"""Verify the authenticity of the device.
@@ -431,6 +438,8 @@ def authenticate(
authenticity. By default, it will also check the public keys against a
whitelist or CRL downloaded from Trezor servers. You can skip this check
with the --offline option.
+
+ Development devices are rejected unless the --devel option is given.
"""
if hex_challenge is None:
hex_challenge = secrets.token_hex(32)
@@ -508,6 +517,7 @@ def authenticate(
ed25519_root_pubkey=ed25519_root_bytes,
mldsa44_root_pubkey=mldsa44_root_bytes,
allowlist=allowlist,
+ allow_development_devices=devel,
)
except authentication.DeviceNotAuthentic:
click.echo("Device is not authentic.")
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.