ci(core): collect secmon fingerprint as well
What the developer wrote
Authored by Roman Zeyde
ci(core): collect secmon fingerprint as well
In some models, secmon is not built -> `secmon.bin` will be empty [1].
Use `-s` (instead of `-f`) to skip empty `.bin` files.
[1] https://github.com/trezor/trezor-firmware/blob/9d4223c2613f0542716c45a02781bcac7e5803a2/core/SConscript.secmon#L240-L247
[no changelog]
What changed, and why it matters
This is a minor build-script change that adds the secure-monitor (secmon) component to the list of firmware artifacts whose fingerprints are collected during CI. It also switches the file-existence check from `-f` to `-s` so that empty placeholder files are skipped. There is no user-facing or security-relevant code change.
No security action required. Treat as routine CI maintenance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies build-docker.sh to include secmon in the reproducible-build fingerprint loop and changes the shell test from [ -f ... ] to [ -s ... ]. This prevents firmware-fingerprint.py from being invoked on empty secmon.bin files for models that do not build a secure monitor. The change is purely CI/build hygiene.
Changed components
build-docker.shInspect captured patch +2 / −2
diff --git a/build-docker.sh b/build-docker.sh
index 0f73e81e8..6a5876732 100755
--- a/build-docker.sh
+++ b/build-docker.sh
@@ -276,8 +276,8 @@ for TREZOR_MODEL in ${MODELS[@]}; do
cd /reproducible-build/trezor-firmware/core
$GIT_CLEAN_REPO
uv run make clean vendor $MAKE_TARGETS QUIET_MODE=1
- for item in bootloader firmware prodtest; do
- if [ -f build/\$item/\$item.bin ]; then
+ for item in bootloader secmon firmware prodtest; do
+ if [ -s build/\$item/\$item.bin ]; then
uv run ../python/tools/firmware-fingerprint.py \
-o build/\$item/\$item.bin.fingerprint \
build/\$item/\$item.bin
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.