Py: avoid brittle Bootloader import in editable installs
What the developer wrote
Authored by Cedric Wiese
Py: avoid brittle Bootloader import in editable installs
What changed, and why it matters
This is a minor Python import cleanup in a developer/test script. It changes how one internal class is imported so that the script works reliably when installed in 'editable' mode. There is no security issue here.
No security action needed. Treat as a normal maintenance/development fix.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies py/send_message.py to import Bootloader directly from bitbox02.bitbox02 rather than accessing it as bitbox02.Bootloader. This resolves a brittle import path when the package is installed in editable/development mode. The change is purely a code-quality/build-hygiene fix in a test/utility script and does not alter any firmware, cryptography, USB protocol handling, or trust boundary logic.
Changed components
py/send_message.pyInspect captured patch +3 / −2
diff --git a/py/send_message.py b/py/send_message.py
index 538e257..bbd8022 100755
--- a/py/send_message.py
+++ b/py/send_message.py
@@ -23,6 +23,7 @@ from tzlocal import get_localzone
from bitbox02 import util
from bitbox02 import bitbox02
+from bitbox02.bitbox02 import Bootloader
from bitbox02.communication import (
devices,
HARDENED,
@@ -1629,7 +1630,7 @@ class SendMessage:
class SendMessageBootloader:
"""Simple test application for bootloader"""
- def __init__(self, device: bitbox02.Bootloader):
+ def __init__(self, device: Bootloader):
self._device = device
self._stop = False
@@ -1849,7 +1850,7 @@ def connect_to_usb_bitbox(debug: bool, use_cache: bool) -> int:
"Could not connect to the BitBox, device may be already connected to another app."
)
return 1
- bootloader_connection = bitbox02.Bootloader(u2fhid.U2FHid(hid_device), bootloader)
+ bootloader_connection = Bootloader(u2fhid.U2FHid(hid_device), bootloader)
boot_app = SendMessageBootloader(bootloader_connection)
return boot_app.run()
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.