fix: build-docker.sh: build T1B1 firmware only for firmware target
What the developer wrote
Authored by Andrew Kozlik
fix: build-docker.sh: build T1B1 firmware only for firmware target
The legacy build ignored --targets and ran on every invocation that included
T1B1. CI invokes the script separately for prodtest/bootloader and for firmware,
so each T1B1 job built the identical legacy firmware twice.
What changed, and why it matters
This commit fixes a CI/build script inefficiency. The build script was building the same T1B1 (original Trezor) firmware twice because it ignored the requested build target. The fix makes the legacy T1B1 firmware build run only when the 'firmware' target is explicitly requested, and adjusts the CI workflow to initialize the build environment once and skip the redundant bootloader/prodtest step for T1B1. There is no security vulnerability here—just wasted build time.
No security action required. This is a build optimization/bugfix. Reviewers may verify CI duration improves and T1B1 artifacts are still produced correctly.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change modifies build-docker.sh so that the legacy T1B1 firmware build block is gated on both the model being T1B1 and the target list containing ‘firmware’. Previously, the legacy build ran on any invocation including T1B1 regardless of –targets. The CI workflow common.yml is updated to run an initialization step once, then skip the prodtest/bootloader build job for T1B1 (since the monolithic legacy build in the firmware step already produces the bootloader). This eliminates duplicate CI work.
Changed components
build-docker.sh.github/workflows/common.ymlInspect captured patch +7 / −2
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 663031e0..a39d06a9 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -123,9 +123,14 @@ jobs:
- run: mkdir _artifacts/
+ - name: Initialize build environment
+ run: ./build-docker.sh --init-only ${REF}
+
- name: Build prodtest & bootloader
+ # The T1B1 bootloader is built by the monolithic legacy build in the firmware step.
+ if: ${{ matrix.model != 'T1B1' }}
run: |
- ./build-docker.sh --models ${{ matrix.model }} --targets 'prodtest,bootloader' --skip-bitcoinonly ${REF}
+ ./build-docker.sh --no-init --models ${{ matrix.model }} --targets 'prodtest,bootloader' --skip-bitcoinonly ${REF}
cd build/ && cp -v --recursive --parents * ../_artifacts/
- name: Build secmon
diff --git a/build-docker.sh b/build-docker.sh
index c2f001f4..3d0a33d6 100755
--- a/build-docker.sh
+++ b/build-docker.sh
@@ -473,7 +473,7 @@ fi
# build legacy
-if echo "${MODELS[@]}" | grep -q T1B1 ; then
+if echo "${MODELS[@]}" | grep -q T1B1 && echo "${CORE_TARGETS[@]}" | grep -qw firmware ; then
for BITCOIN_ONLY in ${VARIANTS[@]}; do
DIRSUFFIX=${BITCOIN_ONLY/1/-bitcoinonly}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.