SFT-6948: removed unnecessary add-secrets build inputs and inherited items
What the developer wrote
Authored by Matt Gleason
SFT-6948: removed unnecessary add-secrets build inputs and inherited
items
What changed, and why it matters
This commit removes unused build dependencies from a Nix build script that adds secrets to Passport firmware. The change drops references to pkg-config and OpenSSL that were apparently not actually needed. There is no direct evidence this fixes a security vulnerability; it appears to be a cleanup or build-hardening change.
No immediate security action required. Treat as routine build cleanup. If auditing, verify that removing pkg-config and OpenSSL does not break reproducibility or unexpectedly alter the resulting build artifacts.
Security signals we found
Reduction of build dependencies can be considered a minor supply-chain/attack-surface hardening measure, but no explicit security claim is made.
No memory safety, cryptographic, authentication, or authorization changes are visible.
Evidence from the diff
The commit modifies flake.nix and nix/add-secrets.nix. It removes system from the inherited arguments passed to cosign.nix and add-secrets.nix, and removes nativeBuildInputs = [ pkgs.pkg-config ] and buildInputs = [ pkgs.openssl ] from add-secrets.nix. The commit message frames this as removing ‘unnecessary’ inputs and inherited items. No functional code changes are present in the diff, and no security relevance is stated.
Changed components
nix/add-secrets.nixflake.nixInspect captured patch +2 / −4
diff --git a/flake.nix b/flake.nix
index 98e0422..6e710e5 100644
--- a/flake.nix
+++ b/flake.nix
@@ -54,8 +54,8 @@
;
}
// import ./nix/mpy-cross.nix { inherit self pkgs; }
- // import ./nix/cosign.nix { inherit self system pkgs; }
- // import ./nix/add-secrets.nix { inherit self system pkgs; }
+ // import ./nix/cosign.nix { inherit self pkgs; }
+ // import ./nix/add-secrets.nix { inherit self pkgs; }
);
devShells = forAllSystems (
diff --git a/nix/add-secrets.nix b/nix/add-secrets.nix
index 370590d..104b459 100644
--- a/nix/add-secrets.nix
+++ b/nix/add-secrets.nix
@@ -9,8 +9,6 @@
pname = "passport-add-secrets";
version = "0.1.0";
src = self + "/ports/stm32/boards/Passport";
- nativeBuildInputs = [ pkgs.pkg-config ];
- buildInputs = [ pkgs.openssl ];
dontConfigure = true;
NIX_CFLAGS_COMPILE = "-Wno-error=int-conversion";
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.