Merge pull request #2040 from mintlayer/update_trezor_ref_and_docs

Update trezor ref and docs

Author: ImplOfAnImpl

.github/workflows/build.yml

@@ -18,6 +18,11 @@ env:
 jobs:
   build_windows:
     runs-on: windows-latest
+    env:
+        # With the default CARGO_HOME the job will fail due to Windows path length limit when
+        # checking out the trezor firmware repo. E.g. one of the paths looks like this:
+        # C:/Users/runneradmin/.cargo/git/checkouts/mintlayer-trezor-firmware-04bdf62619936e0b/596b3eb/vendor/libtropic/scripts/tropic01_model/provisioning_data/2025-06-27T07-51-29Z__prod_C2S_T200__provisioning__lab_batch_package/cert_chain/tropicsquare_root_ca_certificate_sn_101.der
+        CARGO_HOME: C:\crg
     steps:
       - name: Checkout the repository
         uses: actions/checkout@v5
@@ -218,6 +223,19 @@ jobs:
       TREZOR_TESTS_USE_REAL_DEVICE: false
       TREZOR_TESTS_AUTO_CONFIRM: true
     steps:
+      # Note: THP is the new protocol used by Safe 7, which we do not yet support, so we disable
+      # it by setting THP to 0. This means that we're not emulating the real Safe 7 here, i.e. it's
+      # just a hack to make the CI pass.
+      # TODO:
+      # 1) Remove this after THP support is implemented.
+      # 2) Another thing that is different about Safe 7 is the use of an additional secure element
+      #    called Tropic. Tests on the firmware side build the firmware with DISABLE_TROPIC=0, which
+      #    then requires a Tropic model server to be run alongside the emulator. We might want to do
+      #    the same here, to make the emulator behave more like the real device.
+      - name: Disable THP for T3W1
+        if: ${{ matrix.model == 'T3W1' }}
+        run: echo "THP=0" >> "$GITHUB_ENV"
+
       # Note: cargo-nextest requires the source code to be present when running archived test binaries.
       - name: Checkout the core repository
         uses: actions/checkout@v5
@@ -271,18 +289,18 @@ jobs:
         run: nix-shell --arg fullDeps false --run "true"
         working-directory: ./mintlayer-trezor-firmware
       - name: Setup trezor repo build dependencies, part 2
-        run: nix-shell --arg fullDeps false --run "poetry install"
+        run: nix-shell --arg fullDeps false --run "uv sync"
         working-directory: ./mintlayer-trezor-firmware
 
       - name: Build the firmware
-        run: nix-shell --run "poetry run make -C core build_unix"
+        run: nix-shell --run "uv run make -C core build_unix"
         working-directory: ./mintlayer-trezor-firmware
 
       # Note: since we haven't installed Cargo in this job, we have to execute "cargo-nextest nextest"
       # instead of "cargo nextest".
       - name: Run tests in the emulator
         run: nix-shell --run "
-          poetry run core/emu.py
+          uv run core/emu.py
           --headless --quiet --temporary-profile
           --mnemonic \"abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about\"
           --command env --chdir ../mintlayer-core

.github/workflows/code_checks.yml

@@ -54,6 +54,10 @@ jobs:
 
   static_checks_windows:
     runs-on: windows-latest
+    env:
+        # Same as in build_windows, using the default CARGO_HOME would make the job fail due to Windows
+        # path length limit.
+        CARGO_HOME: C:\crg
     steps:
       # This prevents git from changing line-endings to crlf, which messes cargo fmt checks
       - name: Set git to use LF

.github/workflows/wasm.yml

@@ -54,7 +54,7 @@ jobs:
         run: npm install typescript knip
 
       - name: Install wasm-pack
-        run: cargo install wasm-pack
+        run: cargo install wasm-pack --locked
 
       - name: Build the wasm module
         working-directory: ./wasm-wrappers
@@ -92,7 +92,7 @@ jobs:
             --default-toolchain $(python ./build-tools/cargo-info-extractor/extract.py --rust-version)
 
       - name: Install wasm-pack
-        run: cargo install wasm-pack
+        run: cargo install wasm-pack  --locked
 
       - name: Build the wasm module for nodejs - release
         working-directory: ./wasm-wrappers

Cargo.lock

@@ -280,28 +280,30 @@ zeroize = "1.5"
 
 [workspace.dependencies.ml_primitives]
 git = "https://github.com/mintlayer/mintlayer-core-primitives"
-# The commit "Add CoinType used for Ledger and encode/decode utils".
-rev = "13b10dbc88efdf3b5aa31ece8e34278bc69a5a9b"
+# The commit "Merge pull request #4 from mintlayer/fix_typo".
+rev = "8644bfe06d932d687075939d2d175183ba1c369d"
 package = "mintlayer-core-primitives"
 
 [workspace.dependencies.ledger-lib]
-git = "https://github.com/ImplOfAnImpl/rust-ledger.git"
-rev = "035789ec436d47b938e8a3d2085ffb2fbf6f0559"
+git = "https://github.com/ledger-community/rust-ledger.git"
+# Note: we need this PR - https://github.com/ledger-community/rust-ledger/pull/14
+rev = "c8ed12e89788e78d77cdc0dc9fb8a4bd4dc24b89"
 
 [workspace.dependencies.ledger-proto]
-git = "https://github.com/ImplOfAnImpl/rust-ledger.git"
-rev = "035789ec436d47b938e8a3d2085ffb2fbf6f0559"
+git = "https://github.com/ledger-community/rust-ledger.git"
+# The revision must be the same as for ledger-lib.
+rev = "c8ed12e89788e78d77cdc0dc9fb8a4bd4dc24b89"
 
 [workspace.dependencies.mintlayer-ledger-messages]
 git = "https://github.com/mintlayer/mintlayer-ledger-app"
-# The commit "Move StatusWord to messages crate"
-rev = "dbc41342564b2198037ed4ad41b4cf0c34617870"
+# The commit "Merge pull request #3 from mintlayer/update_ml_primitives_rev"
+rev = "a544449d0c649c7c6b27ec0bd8e03f43861f60a7"
 package = "messages"
 
 [workspace.dependencies.trezor-client]
 git = "https://github.com/mintlayer/mintlayer-trezor-firmware"
-# The commit "Bump ml_primitives and parity scale codec deps"
-rev = "a2e67f6cf804dd905791ec36bff1981871f5321c"
+# The commit "Merge pull request #25 from mintlayer/merge_with_v2.11.0_from_upstream"
+rev = "0e6c4d46ff75a94164f07c9bf0bd95cdba81fea3"
 features = ["bitcoin", "mintlayer"]
 
 [workspace.metadata.dist.dependencies.apt]
@@ -346,10 +348,13 @@ opt-level = 2
 # TODO: investigate this further.
 fontconfig-parser = { git = "https://github.com/Riey/fontconfig-parser", rev = "f7d13a779e6ee282ce75acbc00a1270c0350e0c2" }
 
-# This patch is needed because there is no release of the library and because ledger-lib depends on ledger-proto, so this is the only way to make the former find the latter.
-# Note that the revision specified here must be the same as the one used in the workspace.dependencies section
-ledger-proto = { git = "https://github.com/ImplOfAnImpl/rust-ledger.git", rev = "035789ec436d47b938e8a3d2085ffb2fbf6f0559" }
-# The specific commit is chosen because it contains a fix for the Ledger NanoX,
-# and we use the same version across all Trezor, Ledger and Mintlayerr core primitives repos
-# If a different version is used the tests in Mintlayer core will stop compiling
+# This patch is needed because there is no release of the library and because ledger-lib depends on ledger-proto, so this
+# is the only way to make the former find the latter.
+# Note that the revision specified here must be the same as the one used in the workspace.dependencies section.
+ledger-proto = { git = "https://github.com/ledger-community/rust-ledger.git", rev = "c8ed12e89788e78d77cdc0dc9fb8a4bd4dc24b89" }
+
+# Use a specific commit because we need a fix (github.com/paritytech/parity-scale-codec/pull/751)
+# that has not been released yet (should be part of the release coming after v3.7.5).
+# Note that the fix is needed for the Ledger app, but we have to use the same version of parity-scale-codec
+# across Trezor, Ledger, mintlayer-core and mintlayer-core-primitives repos.
 parity-scale-codec = { git = "https://github.com/paritytech/parity-scale-codec.git", rev = "5021525697edc0661591ebc71392c48d950a10b0" }

Cargo.toml

@@ -44,6 +44,14 @@ db-path = "~/.cargo/advisory-dbs"
 db-urls = ["https://github.com/RustSec/advisory-db"]
 yanked = "warn"
 ignore = [
-    "RUSTSEC-2024-0436", # "paste" is no longer maintained
-    "RUSTSEC-2025-0141", # "bincode" is no longer maintained
+    # "paste" is no longer maintained.
+    "RUSTSEC-2024-0436",
+
+    # "bincode" is no longer maintained.
+    "RUSTSEC-2025-0141",
+
+    # `rand` is unsound.
+    # Note: to fix the error we need to upgrade `rand` to either 0.9.3 or 0.10.1, which is non-trivial
+    # because some of our dependencies still use 0.8.x and earlier versions.
+    "RUSTSEC-2026-0097"
 ]

deny.toml

@@ -713,11 +713,11 @@ version = "0.10.4"
 criteria = "safe-to-deploy"
 
 [[exemptions.ledger-lib]]
-version = "0.1.0@git:035789ec436d47b938e8a3d2085ffb2fbf6f0559"
+version = "0.1.0@git:c8ed12e89788e78d77cdc0dc9fb8a4bd4dc24b89"
 criteria = "safe-to-deploy"
 
 [[exemptions.ledger-proto]]
-version = "0.1.0@git:035789ec436d47b938e8a3d2085ffb2fbf6f0559"
+version = "0.1.0@git:c8ed12e89788e78d77cdc0dc9fb8a4bd4dc24b89"
 criteria = "safe-to-deploy"
 
 [[exemptions.libdbus-sys]]

supply-chain/config.toml

@@ -1430,8 +1430,8 @@ user-login = "cpu"
 user-name = "Daniel McCarney"
 
 [[publisher.rustls-webpki]]
-version = "0.103.10"
-when = "2026-03-20"
+version = "0.103.12"
+when = "2026-04-14"
 user-id = 2751
 user-login = "ctz"
 user-name = "Joe Birr-Pixton"