feat(core/prodtest): improve logging in `cert_write()`
What the developer wrote
Authored by Ondřej Vejpustek
feat(core/prodtest): improve logging in `cert_write()`
What changed, and why it matters
This commit only improves the error messages shown during a production-line test command for the Tropic secure element. It replaces vague messages like 'Unable to write certificate' with more specific ones that include the underlying error code. There is no change to security logic, access control, or data handling.
No security action needed; this is a diagnostic/logging improvement in production-test code.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change refactors error reporting in cert_write() within core/embed/projects/prodtest/cmd/prodtest_tropic.c. It separates the data_read() return-code check from the length/memcmp verification check and uses lt_ret_verbose(ret) to print the actual Tropic library error string. No functional behavior of the command changes; failures still abort with cli_error() and return.
Changed components
core/embed/projects/prodtest/cmd/prodtest_tropic.cInspect captured patch +9 / −3
diff --git a/core/embed/projects/prodtest/cmd/prodtest_tropic.c b/core/embed/projects/prodtest/cmd/prodtest_tropic.c
index 08ae42936..f99847fa9 100644
--- a/core/embed/projects/prodtest/cmd/prodtest_tropic.c
+++ b/core/embed/projects/prodtest/cmd/prodtest_tropic.c
@@ -1397,7 +1397,8 @@ static void cert_write(cli_t* cli, uint16_t first_slot, uint16_t slots_count) {
ret = data_write(tropic_handle, first_slot, slots_count, certificate,
certificate_length);
if (ret != LT_OK) {
- cli_error(cli, CLI_ERROR, "Unable to write certificate");
+ cli_error(cli, CLI_ERROR, "`data_write()` failed with error '%s'",
+ lt_ret_verbose(ret));
return;
}
@@ -1405,9 +1406,14 @@ static void cert_write(cli_t* cli, uint16_t first_slot, uint16_t slots_count) {
uint8_t certificate_read[TROPIC_SLOT_MAX_SIZE_V1 * slots_count];
ret = data_read(tropic_handle, first_slot, slots_count, certificate_read,
sizeof(certificate_read), &certificate_read_length);
- if (ret != LT_OK || certificate_read_length != certificate_length ||
+ if (ret != LT_OK) {
+ cli_error(cli, CLI_ERROR, "`data_read()` failed with error '%s'",
+ lt_ret_verbose(ret));
+ return;
+ }
+ if (certificate_read_length != certificate_length ||
memcmp(certificate, certificate_read, certificate_length) != 0) {
- cli_error(cli, CLI_ERROR, "Unable to read certificate");
+ cli_error(cli, CLI_ERROR, "Certificate does not match the expected value");
return;
}
Why this scored 14/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.