interface BootloaderCheck {
  // Official bootloader hash
  expectedHash: string;
  
  // Device-reported hash
  actualHash: string;
  
  // Verification result
  valid: boolean;
  
  // Bootloader version
  version: string;
}

interface DeviceCertificate {
  // Unique device identifier
  deviceId: string;
  
  // Certificate signed by Trezor
  signature: Buffer;
  
  // Public key for verification
  publicKey: Buffer;
  
  // Certificate validity
  valid: boolean;
  
  // Issue date
  issuedAt: Date;
}

interface AuthenticityReport {
  // Overall result
  status: 'authentic' | 'warning' | 'failed';
  
  // Individual check results
  checks: {
    bootloader: CheckResult;
    firmware: CheckResult;
    certificate?: CheckResult;
    secureElement?: CheckResult;
  };
  
  // Device information
  device: {
    model: string;
    firmwareVersion: string;
    bootloaderVersion: string;
    serialNumber?: string;
  };
  
  // Verification metadata
  timestamp: number;
  suiteVersion: string;
}

interface CheckResult {
  name: string;
  status: 'pass' | 'fail' | 'unknown';
  message: string;
  details?: any;
}

┌────────────────┐
│ TREZOR        │
│                │
│ Bootloader     │
│ 2.1.0          │
│                │
│ Vendor: trezor │
│ VendorHash OK  │
│ FirmwareHash OK│
└────────────────┘

const validateFirmware = async (firmware: Buffer) => {
  // Check firmware signatures
  const signatures = extractSignatures(firmware);
  
  // Verify against official public keys
  const validSignatures = signatures.filter(sig => 
    OFFICIAL_KEYS.some(key => verifySignature(firmware, sig, key))
  );
  
  // Require minimum valid signatures (m-of-n)
  const REQUIRED_SIGNATURES = 2;
  
  if (validSignatures.length < REQUIRED_SIGNATURES) {
    throw new Error('Firmware not officially signed');
  }
  
  return true;
};

// Shared package for device verification
import { verifyDevice } from '@trezor/device-authenticity';

const result = await verifyDevice({
  device,
  timestamp: Date.now(),
  checkAll: true,
});

if (!result.authentic) {
  showAuthenticityWarning(result);
}

// Location: suite-common/device-authenticity/

export interface DeviceAuthenticityCheck {
  performCheck(device: Device): Promise<AuthenticityResult>;
  verifyBootloader(device: Device): Promise<BootloaderResult>;
  verifyFirmware(device: Device): Promise<FirmwareResult>;
  verifyCertificate(device: Device): Promise<CertificateResult>;
}

<AuthenticityWarning
  severity="high"
  title="Device Authenticity Could Not Be Verified"
  message="This device may not be a genuine Trezor. Using counterfeit devices could result in loss of funds."
  actions={[
    {
      label: 'Contact Support',
      onClick: openSupport,
      variant: 'primary',
    },
    {
      label: 'See Details',
      onClick: showDetails,
      variant: 'secondary',
    },
    {
      label: 'Continue Anyway',
      onClick: continueWithWarning,
      variant: 'tertiary',
      warning: true,
    },
  ]}
/>

<Banner
  variant="critical"
  dismissible={false}
>
  <Translation id="TR_DEVICE_NOT_AUTHENTIC" />
  <Link to="/device/authenticity">
    <Translation id="TR_LEARN_MORE" />
  </Link>
</Banner>

const contactSupport = (report: AuthenticityReport) => {
  const supportData = {
    type: 'device_authenticity',
    report: sanitizeReport(report),
    suiteVersion: VERSION,
    platform: PLATFORM,
  };
  
  // Open support form with pre-filled data
  window.open(
    `https://trezor.io/support/technical/issue?` +
    `data=${encodeURIComponent(JSON.stringify(supportData))}`
  );
};