From 4a60d2040d63f7f2a5b827dda2195867c0d2a29e Mon Sep 17 00:00:00 2001
From: tychovrahe <brunam@seznam.cz>
Date: Sun, 15 Jun 2025 19:36:10 +0200
Subject: [PATCH] chore(core): update vendorheader files and generate changed
 vendorheaders

[no changelog]
---
 .../vendorheader/vendor_dev_DO_NOT_SIGN.json  |   1 +
 .../D001/vendorheader/vendor_unsafe.json      |   1 +
 .../vendorheader/vendor_dev_DO_NOT_SIGN.json  |   1 +
 .../D002/vendorheader/vendor_unsafe.json      |   1 +
 .../vendorheader/vendor_dev_DO_NOT_SIGN.json  |   1 +
 .../T2B1/vendorheader/vendor_prodtest.json    |   1 +
 .../T2B1/vendorheader/vendor_trezor.json      |   1 +
 .../vendorheader/vendor_trezor_btconly.json   |   1 +
 .../T2B1/vendorheader/vendor_unsafe.json      |   1 +
 .../vendorheader/vendor_dev_DO_NOT_SIGN.json  |   1 +
 .../T2T1/vendorheader/vendor_prodtest.json    |   1 +
 .../T2T1/vendorheader/vendor_satoshilabs.json |   1 +
 .../T2T1/vendorheader/vendor_unsafe.json      |   1 +
 .../vendorheader/vendor_dev_DO_NOT_SIGN.json  |   1 +
 .../T3B1/vendorheader/vendor_prodtest.json    |   3 ++-
 .../T3B1/vendorheader/vendor_trezor.json      |   1 +
 .../vendorheader/vendor_trezor_btconly.json   |   1 +
 .../T3B1/vendorheader/vendor_unsafe.json      |   1 +
 .../vendorheader_prodtest_unsigned.bin        | Bin 512 -> 512 bytes
 .../vendorheader/vendor_dev_DO_NOT_SIGN.json  |   1 +
 .../T3T1/vendorheader/vendor_prodtest.json    |   3 ++-
 .../T3T1/vendorheader/vendor_trezor.json      |   1 +
 .../vendorheader/vendor_trezor_btconly.json   |   1 +
 .../T3T1/vendorheader/vendor_unsafe.json      |   1 +
 .../vendorheader_prodtest_unsigned.bin        | Bin 1024 -> 1024 bytes
 .../vendorheader/vendor_dev_DO_NOT_SIGN.json  |   1 +
 .../T3W1/vendorheader/vendor_prodtest.json    |   1 +
 .../T3W1/vendorheader/vendor_trezor.json      |   1 +
 .../vendorheader/vendor_trezor_btconly.json   |   1 +
 .../T3W1/vendorheader/vendor_unsafe.json      |   1 +
 .../vendorheader_prodtest_unsigned.bin        | Bin 1024 -> 1024 bytes
 31 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/core/embed/models/D001/vendorheader/vendor_dev_DO_NOT_SIGN.json b/core/embed/models/D001/vendorheader/vendor_dev_DO_NOT_SIGN.json
index 379c30a8d3..cb4c1f60e4 100644
--- a/core/embed/models/D001/vendorheader/vendor_dev_DO_NOT_SIGN.json
+++ b/core/embed/models/D001/vendorheader/vendor_dev_DO_NOT_SIGN.json
@@ -7,6 +7,7 @@
     "sig_m": 2,
     "trust": {
         "_reserved": 0,
+        "deny_provisioning_access": false,
         "_dont_provide_secret": false,
         "allow_run_with_secret": false,
         "show_vendor_string": false,
diff --git a/core/embed/models/D001/vendorheader/vendor_unsafe.json b/core/embed/models/D001/vendorheader/vendor_unsafe.json
index c92f619947..d0f1a3a470 100644
--- a/core/embed/models/D001/vendorheader/vendor_unsafe.json
+++ b/core/embed/models/D001/vendorheader/vendor_unsafe.json
@@ -7,6 +7,7 @@
     "sig_m": 2,
     "trust": {
         "_reserved": 0,
+        "deny_provisioning_access": false,
         "_dont_provide_secret": false,
         "allow_run_with_secret": false,
         "show_vendor_string": true,
diff --git a/core/embed/models/D002/vendorheader/vendor_dev_DO_NOT_SIGN.json b/core/embed/models/D002/vendorheader/vendor_dev_DO_NOT_SIGN.json
index d4483d0867..1631002280 100644
--- a/core/embed/models/D002/vendorheader/vendor_dev_DO_NOT_SIGN.json
+++ b/core/embed/models/D002/vendorheader/vendor_dev_DO_NOT_SIGN.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/D002/vendorheader/vendor_unsafe.json b/core/embed/models/D002/vendorheader/vendor_unsafe.json
index 500fcb84e2..e03e841f12 100644
--- a/core/embed/models/D002/vendorheader/vendor_unsafe.json
+++ b/core/embed/models/D002/vendorheader/vendor_unsafe.json
@@ -6,6 +6,7 @@
     "version": [0, 1],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": false,
         "show_vendor_string": true,
         "require_user_click": true,
diff --git a/core/embed/models/T2B1/vendorheader/vendor_dev_DO_NOT_SIGN.json b/core/embed/models/T2B1/vendorheader/vendor_dev_DO_NOT_SIGN.json
index a8241cccef..cd049ac74c 100644
--- a/core/embed/models/T2B1/vendorheader/vendor_dev_DO_NOT_SIGN.json
+++ b/core/embed/models/T2B1/vendorheader/vendor_dev_DO_NOT_SIGN.json
@@ -7,6 +7,7 @@
     "sig_m": 2,
     "trust": {
         "_reserved": 0,
+        "deny_provisioning_access": false,
         "_dont_provide_secret": false,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
diff --git a/core/embed/models/T2B1/vendorheader/vendor_prodtest.json b/core/embed/models/T2B1/vendorheader/vendor_prodtest.json
index 5e7d392e5a..4cdb215b5e 100644
--- a/core/embed/models/T2B1/vendorheader/vendor_prodtest.json
+++ b/core/embed/models/T2B1/vendorheader/vendor_prodtest.json
@@ -7,6 +7,7 @@
     "sig_m": 2,
     "trust": {
         "_reserved": 0,
+        "deny_provisioning_access": false,
         "_dont_provide_secret": false,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
diff --git a/core/embed/models/T2B1/vendorheader/vendor_trezor.json b/core/embed/models/T2B1/vendorheader/vendor_trezor.json
index 307cfb8e98..9c29d12f05 100644
--- a/core/embed/models/T2B1/vendorheader/vendor_trezor.json
+++ b/core/embed/models/T2B1/vendorheader/vendor_trezor.json
@@ -7,6 +7,7 @@
     "sig_m": 2,
     "trust": {
         "_reserved": 0,
+        "deny_provisioning_access": false,
         "_dont_provide_secret": false,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
diff --git a/core/embed/models/T2B1/vendorheader/vendor_trezor_btconly.json b/core/embed/models/T2B1/vendorheader/vendor_trezor_btconly.json
index 958bc944f8..58525c552c 100644
--- a/core/embed/models/T2B1/vendorheader/vendor_trezor_btconly.json
+++ b/core/embed/models/T2B1/vendorheader/vendor_trezor_btconly.json
@@ -7,6 +7,7 @@
     "sig_m": 2,
     "trust": {
         "_reserved": 0,
+        "deny_provisioning_access": false,
         "_dont_provide_secret": false,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
diff --git a/core/embed/models/T2B1/vendorheader/vendor_unsafe.json b/core/embed/models/T2B1/vendorheader/vendor_unsafe.json
index 5e27e9ccd7..3b1df91541 100644
--- a/core/embed/models/T2B1/vendorheader/vendor_unsafe.json
+++ b/core/embed/models/T2B1/vendorheader/vendor_unsafe.json
@@ -7,6 +7,7 @@
     "sig_m": 2,
     "trust": {
         "_reserved": 0,
+        "deny_provisioning_access": false,
         "_dont_provide_secret": false,
         "allow_run_with_secret": false,
         "show_vendor_string": true,
diff --git a/core/embed/models/T2T1/vendorheader/vendor_dev_DO_NOT_SIGN.json b/core/embed/models/T2T1/vendorheader/vendor_dev_DO_NOT_SIGN.json
index f20be5bf83..828cef56cc 100644
--- a/core/embed/models/T2T1/vendorheader/vendor_dev_DO_NOT_SIGN.json
+++ b/core/embed/models/T2T1/vendorheader/vendor_dev_DO_NOT_SIGN.json
@@ -7,6 +7,7 @@
     "sig_m": 2,
     "trust": {
         "_reserved": 0,
+        "deny_provisioning_access": false,
         "_dont_provide_secret": false,
         "allow_run_with_secret": false,
         "show_vendor_string": false,
diff --git a/core/embed/models/T2T1/vendorheader/vendor_prodtest.json b/core/embed/models/T2T1/vendorheader/vendor_prodtest.json
index bc34f23f68..0c30bce99c 100644
--- a/core/embed/models/T2T1/vendorheader/vendor_prodtest.json
+++ b/core/embed/models/T2T1/vendorheader/vendor_prodtest.json
@@ -7,6 +7,7 @@
     "sig_m": 2,
     "trust": {
         "_reserved": 0,
+        "deny_provisioning_access": false,
         "_dont_provide_secret": false,
         "allow_run_with_secret": false,
         "show_vendor_string": false,
diff --git a/core/embed/models/T2T1/vendorheader/vendor_satoshilabs.json b/core/embed/models/T2T1/vendorheader/vendor_satoshilabs.json
index b9d6339337..6363c74622 100644
--- a/core/embed/models/T2T1/vendorheader/vendor_satoshilabs.json
+++ b/core/embed/models/T2T1/vendorheader/vendor_satoshilabs.json
@@ -7,6 +7,7 @@
     "sig_m": 2,
     "trust": {
         "_reserved": 0,
+        "deny_provisioning_access": false,
         "_dont_provide_secret": false,
         "allow_run_with_secret": false,
         "show_vendor_string": false,
diff --git a/core/embed/models/T2T1/vendorheader/vendor_unsafe.json b/core/embed/models/T2T1/vendorheader/vendor_unsafe.json
index 19eb2e6523..1b44636efa 100644
--- a/core/embed/models/T2T1/vendorheader/vendor_unsafe.json
+++ b/core/embed/models/T2T1/vendorheader/vendor_unsafe.json
@@ -7,6 +7,7 @@
     "sig_m": 2,
     "trust": {
         "_reserved": 0,
+        "deny_provisioning_access": false,
         "_dont_provide_secret": false,
         "allow_run_with_secret": false,
         "show_vendor_string": true,
diff --git a/core/embed/models/T3B1/vendorheader/vendor_dev_DO_NOT_SIGN.json b/core/embed/models/T3B1/vendorheader/vendor_dev_DO_NOT_SIGN.json
index 7ded76ed4e..b84d72b788 100644
--- a/core/embed/models/T3B1/vendorheader/vendor_dev_DO_NOT_SIGN.json
+++ b/core/embed/models/T3B1/vendorheader/vendor_dev_DO_NOT_SIGN.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3B1/vendorheader/vendor_prodtest.json b/core/embed/models/T3B1/vendorheader/vendor_prodtest.json
index ad4be7ce06..e4a015cfd6 100644
--- a/core/embed/models/T3B1/vendorheader/vendor_prodtest.json
+++ b/core/embed/models/T3B1/vendorheader/vendor_prodtest.json
@@ -3,9 +3,10 @@
     "text": "UNSAFE, FACTORY TEST ONLY",
     "hw_model": "T3B1",
     "expiry": 0,
-    "version": [0, 0],
+    "version": [0, 1],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": false,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3B1/vendorheader/vendor_trezor.json b/core/embed/models/T3B1/vendorheader/vendor_trezor.json
index e9ce3cf43d..a9fc979ed6 100644
--- a/core/embed/models/T3B1/vendorheader/vendor_trezor.json
+++ b/core/embed/models/T3B1/vendorheader/vendor_trezor.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3B1/vendorheader/vendor_trezor_btconly.json b/core/embed/models/T3B1/vendorheader/vendor_trezor_btconly.json
index 35112ca2ce..16602b8b03 100644
--- a/core/embed/models/T3B1/vendorheader/vendor_trezor_btconly.json
+++ b/core/embed/models/T3B1/vendorheader/vendor_trezor_btconly.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3B1/vendorheader/vendor_unsafe.json b/core/embed/models/T3B1/vendorheader/vendor_unsafe.json
index 5ac4215741..9563cbed05 100644
--- a/core/embed/models/T3B1/vendorheader/vendor_unsafe.json
+++ b/core/embed/models/T3B1/vendorheader/vendor_unsafe.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": false,
         "show_vendor_string": true,
         "require_user_click": true,
diff --git a/core/embed/models/T3B1/vendorheader/vendorheader_prodtest_unsigned.bin b/core/embed/models/T3B1/vendorheader/vendorheader_prodtest_unsigned.bin
index e5c243ab0f5c1e4c56d2b921d3e5aa45d7772693..a6df2b28b701367fe16b61e7575476a98cce2367 100644
GIT binary patch
delta 27
dcmZo*X<!iw35p71U}As(MkeNZ=8Zz{7y&>H1g!u7

delta 27
ccmZo*X<!iw35p71U}As*Cgys^jY97j0YCZ#ssI20

diff --git a/core/embed/models/T3T1/vendorheader/vendor_dev_DO_NOT_SIGN.json b/core/embed/models/T3T1/vendorheader/vendor_dev_DO_NOT_SIGN.json
index d173b7637f..3ff2b93def 100644
--- a/core/embed/models/T3T1/vendorheader/vendor_dev_DO_NOT_SIGN.json
+++ b/core/embed/models/T3T1/vendorheader/vendor_dev_DO_NOT_SIGN.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3T1/vendorheader/vendor_prodtest.json b/core/embed/models/T3T1/vendorheader/vendor_prodtest.json
index 902d02da1f..1bbbfc7582 100644
--- a/core/embed/models/T3T1/vendorheader/vendor_prodtest.json
+++ b/core/embed/models/T3T1/vendorheader/vendor_prodtest.json
@@ -3,9 +3,10 @@
     "text": "UNSAFE, FACTORY TEST ONLY",
     "hw_model": "T3T1",
     "expiry": 0,
-    "version": [0, 0],
+    "version": [0, 1],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": false,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3T1/vendorheader/vendor_trezor.json b/core/embed/models/T3T1/vendorheader/vendor_trezor.json
index 72d6398f97..044a4b4418 100644
--- a/core/embed/models/T3T1/vendorheader/vendor_trezor.json
+++ b/core/embed/models/T3T1/vendorheader/vendor_trezor.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3T1/vendorheader/vendor_trezor_btconly.json b/core/embed/models/T3T1/vendorheader/vendor_trezor_btconly.json
index 4b610ea9fc..139d151da4 100644
--- a/core/embed/models/T3T1/vendorheader/vendor_trezor_btconly.json
+++ b/core/embed/models/T3T1/vendorheader/vendor_trezor_btconly.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3T1/vendorheader/vendor_unsafe.json b/core/embed/models/T3T1/vendorheader/vendor_unsafe.json
index 6d1987da0f..025a668d25 100644
--- a/core/embed/models/T3T1/vendorheader/vendor_unsafe.json
+++ b/core/embed/models/T3T1/vendorheader/vendor_unsafe.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": false,
         "show_vendor_string": true,
         "require_user_click": true,
diff --git a/core/embed/models/T3T1/vendorheader/vendorheader_prodtest_unsigned.bin b/core/embed/models/T3T1/vendorheader/vendorheader_prodtest_unsigned.bin
index 557b001f137a9ba08ef19fb107bde16361d5485c..15dc7e766e955cb187c0096a5e22438e3ef8fe1f 100644
GIT binary patch
delta 27
dcmZqRXy6bE35p71U}1m&MkeNZ=8Zz{m;pff1i1hJ

delta 27
ccmZqRXy6bE35p71U}1m)Cgys^jY9930YK&iwg3PC

diff --git a/core/embed/models/T3W1/vendorheader/vendor_dev_DO_NOT_SIGN.json b/core/embed/models/T3W1/vendorheader/vendor_dev_DO_NOT_SIGN.json
index c88c58a88b..c96a77a2b1 100644
--- a/core/embed/models/T3W1/vendorheader/vendor_dev_DO_NOT_SIGN.json
+++ b/core/embed/models/T3W1/vendorheader/vendor_dev_DO_NOT_SIGN.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3W1/vendorheader/vendor_prodtest.json b/core/embed/models/T3W1/vendorheader/vendor_prodtest.json
index 2e23951dc7..c3d5145cab 100644
--- a/core/embed/models/T3W1/vendorheader/vendor_prodtest.json
+++ b/core/embed/models/T3W1/vendorheader/vendor_prodtest.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": false,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3W1/vendorheader/vendor_trezor.json b/core/embed/models/T3W1/vendorheader/vendor_trezor.json
index 7e5e4de1e8..2e6825d082 100644
--- a/core/embed/models/T3W1/vendorheader/vendor_trezor.json
+++ b/core/embed/models/T3W1/vendorheader/vendor_trezor.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3W1/vendorheader/vendor_trezor_btconly.json b/core/embed/models/T3W1/vendorheader/vendor_trezor_btconly.json
index 39e33087fe..57e87da2c7 100644
--- a/core/embed/models/T3W1/vendorheader/vendor_trezor_btconly.json
+++ b/core/embed/models/T3W1/vendorheader/vendor_trezor_btconly.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": true,
         "show_vendor_string": false,
         "require_user_click": false,
diff --git a/core/embed/models/T3W1/vendorheader/vendor_unsafe.json b/core/embed/models/T3W1/vendorheader/vendor_unsafe.json
index 1881294d93..fa52250689 100644
--- a/core/embed/models/T3W1/vendorheader/vendor_unsafe.json
+++ b/core/embed/models/T3W1/vendorheader/vendor_unsafe.json
@@ -6,6 +6,7 @@
     "version": [0, 0],
     "sig_m": 2,
     "trust": {
+        "deny_provisioning_access": true,
         "allow_run_with_secret": false,
         "show_vendor_string": true,
         "require_user_click": true,
diff --git a/core/embed/models/T3W1/vendorheader/vendorheader_prodtest_unsigned.bin b/core/embed/models/T3W1/vendorheader/vendorheader_prodtest_unsigned.bin
index a5714a79a81e119fb91727b75bb139f5e96af3bb..9cb2e0d7ef7498a5be6d7e79c5d45c33e0ef9b4c 100644
GIT binary patch
delta 27
ccmZqRXy6bE35p71U}1m)CgytPjY9930YLBsxBvhE

delta 27
ccmZqRXy6bE35p71U}1m)Cgys^jY9930YK&iwg3PC