SFT-6948: added "add-secrets" to devshell
What the developer wrote
Authored by Matt Gleason
SFT-6948: added "add-secrets" to devshell
What changed, and why it matters
This commit adds a developer-only build helper called 'add-secrets' to the project's Nix development shell. It does not change the firmware that runs on user devices, nor does it alter how secrets are generated, stored, or protected in production. It simply makes an existing internal tool easier for developers to compile and run during build/test workflows.
No security action required. Treat as a normal build-system change. If reviewing further, confirm that tools/add-secrets itself follows the project's existing secret-handling policies, but that is outside the scope of this commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch adds a Nix derivation (nix/add-secrets.nix) that builds tools/add-secrets from the Passport STM32 board directory, and exposes it in the flake’s devShell packages list. The tool is compiled with OpenSSL and installed into the Nix store as a command-line utility. There is no modification to firmware code, signing logic, secure-element handling, or any runtime behavior on the hardware wallet itself.
Changed components
nix/add-secrets.nix (new build derivation)flake.nix (devShell package list)Inspect captured patch +32 / −0
diff --git a/flake.nix b/flake.nix
index f8edcf2..98e0422 100644
--- a/flake.nix
+++ b/flake.nix
@@ -55,6 +55,7 @@
}
// import ./nix/mpy-cross.nix { inherit self pkgs; }
// import ./nix/cosign.nix { inherit self system pkgs; }
+ // import ./nix/add-secrets.nix { inherit self system pkgs; }
);
devShells = forAllSystems (
@@ -131,6 +132,7 @@
xterm
]
++ [
+ customPackages.add-secrets
customPackages.cosign
customPackages.mpy-cross
customPackages.rust-core
diff --git a/nix/add-secrets.nix b/nix/add-secrets.nix
new file mode 100644
index 0000000..370590d
--- /dev/null
+++ b/nix/add-secrets.nix
@@ -0,0 +1,30 @@
+# SPDX-FileCopyrightText: 2025 Foundation Devices, Inc. <hello@foundation.xyz>
+# SPDX-License-Identifier: GPL-3.0-or-later
+{
+ self,
+ pkgs,
+ ...
+}: {
+ add-secrets = pkgs.stdenv.mkDerivation {
+ pname = "passport-add-secrets";
+ version = "0.1.0";
+ src = self + "/ports/stm32/boards/Passport";
+ nativeBuildInputs = [ pkgs.pkg-config ];
+ buildInputs = [ pkgs.openssl ];
+ dontConfigure = true;
+ NIX_CFLAGS_COMPILE = "-Wno-error=int-conversion";
+
+ buildPhase = ''
+ runHook preBuild
+ make -C tools/add-secrets
+ runHook postBuild
+ '';
+
+ installPhase = ''
+ runHook preInstall
+ mkdir -p $out/bin
+ cp tools/add-secrets/x86/release/add-secrets $out/bin/add-secrets
+ runHook postInstall
+ '';
+ };
+}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.