[obrusvit]

Enrol projects/trezor-firmware

I have verified each of the following before submitting this project (tick each box by changing [ ] to [x]):

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check <name> builds the project, and its tests run in the shell that follows.
• primary_contact must be the email address of the primary security contact.
• There is a Dockerfile that builds the project (required) in one of two places: in the project's repository at the path dockerfile: names, or next to project.yaml in this repo.
• threat_model.md is written for this project (recommended but optional), placed in the same way: in the repository at the path threat_model: names, or next to project.yaml in this repo.

To change an enrolment, edit project.yaml; to pause reports, set disabled: true; to withdraw the project, remove projects/<name>/.

Context (optional): trezor-firmware is the open-source firmware of the Trezor hardware wallets (Model T, Safe 3, Safe 5, Safe 7), developed in the open by SatoshiLabs since 2014. The device holds the user's seed and private keys and must show the true transaction details on its own screen before signing, while the host (Trezor Suite, Trezor Connect or any USB/BLE client) is untrusted. Everything the host sends crosses into the firmware over USB/BLE: protobuf messages, the THP protocol, transactions for many coins, firmware updates and third-party app payloads. The repository also contains the shared C crypto library and the storage layer. I'm a maintainer of the project. The Dockerfile and threat model are in the repository under .oss-scanner/ (added in trezor/trezor-firmware#8099). The Dockerfile sets up the Nix toolchain and Python environment used in development, builds the T3T1 emulator with debuglink and the host crypto tests, and runs the core unit tests plus a device-test smoke test. tools/check builds it from scratch in about 7 minutes, and the emulator, device tests, storage tests and crypto/tests/test_check all run offline in the finished image. Reports should go to security@satoshilabs.com.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[github-actions]

Enrolment triage: projects/trezor-firmware

Repository: trezor/trezor-firmware at main · opened by obrusvit

	Check	Result
✅	Repository	created 7 years ago, last push today
ℹ️	Stars / forks	1,849 stars · 817 forks · 70 watching
ℹ️	Outside participants	14 people from outside the project opened 30 of the last 100 issues and pull requests
ℹ️	Criticality score	0.75 on the OpenSSF scale of 0 to 1 signals created_since 169, updated_since 0, contributor_count 320, org_count 6, commit_frequency 51.1, recent_releases_count 20, closed_issues_count 546, updated_issues_count 638, comment_frequency 3.1, dependents_count 494
ℹ️	Package rank	by downloads: nothing from this repository found in the top 15,000 on PyPI or the top 10,000 on npm or the top 1,000 on crates.io
⚠️	License	GitHub cannot name the license; its file says # License
✅	Opened by an active maintainer	merged 18 of the last 100 pull requests; 100+ commits in the last 12 months; #10 contributor
✅	Contact in SECURITY.md	security@satoshilabs.com is in SECURITY.md
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
✅	.oss-scanner/ in the repository	present (Dockerfile, threat_model.md); Dockerfile at .oss-scanner/Dockerfile
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
✅	Checklist	all 8 ticked

_{Automated, from public data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}

[obrusvit]

I have read the CLA Document and I hereby sign the CLA

[Copilot]

🔵 Needs a closer look

Upstream access restrictions prevented verification of the referenced build and threat-model files, requiring human confirmation.

No open issues 🎉

What changed in this PR

Enrolls Trezor firmware in OSS Scanner using build and threat-model files maintained upstream.

Changes:

• Registers the firmware repository and security contact.
• Enables scanning and references the upstream Dockerfile and threat model.

File	Description
projects/​trezor-firmware/​project.yaml	Adds the Trezor firmware enrollment configuration.

_{Review effort: Balanced}