feat(core): implement fingerprint logic for BootloaderV2 image
What the developer wrote
Authored by matejcik
feat(core): implement fingerprint logic for BootloaderV2 image
What changed, and why it matters
This commit updates a small Python helper script used to display a fingerprint (a kind of checksum) for Trezor firmware files. It adds support for a newer bootloader image format (BootloaderV2) so the tool can handle both old and new formats. There is no direct evidence this change fixes a security vulnerability; it appears to be a feature/robustness improvement for a developer tool.
No immediate security action required. Treat as a normal feature/robustness commit. If auditing, verify that BootloaderV2Image.parse and merkle_root() behave correctly and that error messages do not leak sensitive data.
Security signals we found
No security-relevant keywords in commit title or message
No vendor security advisory or CVE referenced
Change is limited to a developer/CLI utility script
No cryptographic algorithm changes; only adds fallback parsing path
No memory safety, authentication bypass, or privilege escalation indicators
Evidence from the diff
The change modifies python/tools/firmware-fingerprint.py to first try parsing the file as a standard firmware image and, if that fails, retry parsing it as a BootloaderV2Image and print its Merkle root. Error handling is adjusted so the original parse error is shown if the BootloaderV2 parse also fails. This is a tool-side parsing enhancement, not a firmware-side security fix.
Changed components
python/tools/firmware-fingerprint.pyInspect captured patch +14 / −1
diff --git a/python/tools/firmware-fingerprint.py b/python/tools/firmware-fingerprint.py
index c75cd06f..bfe4c83f 100755
--- a/python/tools/firmware-fingerprint.py
+++ b/python/tools/firmware-fingerprint.py
@@ -31,10 +31,23 @@ def firmware_fingerprint(filename: BinaryIO, output: TextIO) -> None:
"""Display fingerprint of a firmware file."""
data = filename.read()
+ orig_err = None
try:
click.echo(firmware_headers.parse_image(data).digest().hex(), file=output)
+ return
except Exception as e:
- click.echo(e, err=True)
+ orig_err = e
+
+ try:
+ click.echo(
+ firmware_headers.BootloaderV2Image.parse(data).merkle_root().hex(),
+ file=output,
+ )
+ except Exception as e:
+ if orig_err is not None:
+ click.echo(orig_err, err=True)
+ else:
+ click.echo(e, err=True)
sys.exit(2)
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.