What the developer wrote
Authored by obrusvit
chore: utilize cargo-audit
- cargo-audit is cargo subcommand which audits Cargo.toml files for
crates containing security vulnerabilities
- new makefile targets:
- `make -C core audit_rust` to audit firmware dependencies
- `make -C rust audit` to audit libs dependencies
[no changelog]
What changed, and why it matters
This commit only adds tooling: it introduces cargo-audit (a Rust dependency vulnerability scanner) into the project's build environment and Makefile targets. It does not change any firmware code, fix any vulnerability, or alter how the device behaves. It is a development/CI hygiene improvement, not a security patch.
No security action required. This is a build/development tooling change. Reviewers may optionally verify that `cargo audit` is run in CI and that findings are triaged appropriately going forward.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff adds cargo-audit to shell.nix and creates two new Makefile targets: make -C core audit_rust and make -C rust audit. The rust/Makefile check target is extended to depend on audit. No source code, dependency versions, or runtime logic are modified. The commit message explicitly frames this as a chore to utilize cargo-audit for scanning Cargo.toml files.
Changed components
core/Makefilerust/Makefileshell.nixInspect captured patch +14 / −1
diff --git a/core/Makefile b/core/Makefile
index a1b2275d..caf780fb 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -271,6 +271,9 @@ clippy:
export BUILD_DIR=$(abspath $(UNIX_BUILD_DIR)) ; \
cd embed/rust ; cargo clippy $(TESTOPTS) --all-features --target=$(RUST_TARGET)
+audit_rust: ## run cargo audit on rust dependencies
+ cd embed/rust ; cargo audit
+
## code generation:
templates: translations ## render Mako templates (for lists of coins, tokens, etc.)
diff --git a/rust/Makefile b/rust/Makefile
index 4a4ca221..0dd4700f 100644
--- a/rust/Makefile
+++ b/rust/Makefile
@@ -2,7 +2,9 @@
CRATES_TEST = trezor-thp trezor-tjpgdec
CRATES = ${CRATES_TEST} trezor-client
-check: clippy test
+.PHONY: check audit
+
+check: clippy test audit
style:
@for D in $(CRATES); do ( \
@@ -31,3 +33,10 @@ test:
cd $$D; \
cargo test \
); done
+
+audit:
+ @set -e; for D in $(CRATES); do ( \
+ echo "[AUDIT $$D]"; \
+ cd $$D; \
+ cargo audit \
+ ); done
diff --git a/shell.nix b/shell.nix
index 47f0832a..008d751d 100644
--- a/shell.nix
+++ b/shell.nix
@@ -84,6 +84,7 @@ stdenvNoCC.mkDerivation ({
oldNixpkgs.SDL2_image
bash
bloaty # for binsize
+ cargo-audit
check
crowdin-cli # for translations
curl # for connect tests
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.