ci: fix Nix installation in Docker builds
What the developer wrote
Authored by Roman Zeyde
ci: fix Nix installation in Docker builds
[no changelog]
What changed, and why it matters
This commit updates a CI Docker build script used to create container images for Trezor's automated build/test pipeline. It replaces an 'apk update' command with explicit package installation flags and adds 'coreutils' to the installed packages. There is no indication this change fixes or introduces a security vulnerability in the Trezor firmware itself; it is a build-infrastructure maintenance tweak.
No security action required. Treat as routine CI maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff in ci/Dockerfile changes one RUN line from ‘apk update && apk add bash git python3’ to ‘apk add –no-cache –update bash coreutils git python3’. This is a CI container image build change: it removes a separate package index update, uses Alpine’s –no-cache/–update flags, and adds coreutils. No firmware code, cryptographic logic, bootloader, or device-facing behavior is modified. The commit title and message describe it as fixing Nix installation in Docker builds and explicitly include ‘[no changelog]’.
Changed components
ci/DockerfileInspect captured patch +1 / −1
diff --git a/ci/Dockerfile b/ci/Dockerfile
index c4fc1ca1..3a7a6918 100644
--- a/ci/Dockerfile
+++ b/ci/Dockerfile
@@ -11,7 +11,7 @@ ADD alpine-minirootfs-${ALPINE_VERSION}-${ALPINE_ARCH}.tar.gz /
RUN apk add --no-cache --update openssl \
&& echo hosts: files dns > /etc/nsswitch.conf
# Add basic packages
-RUN apk update && apk add bash git python3
+RUN apk add --no-cache --update bash coreutils git python3
# Download Nix and install it into the system.
ARG NIX_VERSION=2.31.4
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.