fix(xbuild): emit raw deflate for embedded binaries
What the developer wrote
Authored by cepetr
fix(xbuild): emit raw deflate for embedded binaries
[no changelog]
What changed, and why it matters
This is a small build-tooling change in Trezor's firmware build system. It changes how embedded binary files are compressed before being baked into the firmware image: instead of producing standard zlib-wrapped deflate streams, it now produces raw deflate streams with a smaller 1KB window. There is no direct evidence this fixes a security vulnerability; it appears to be a compatibility or size optimization fix for the build pipeline.
No immediate security action required. Treat as a normal build-system fix. If reviewing, verify the embedded decompression code expects raw deflate with a 1KB window and that compressed size/integrity checks still pass in CI.
Security signals we found
No security framing in commit message or diff
Change is in build tooling, not device firmware runtime
No mention of vulnerability, CVE, researcher, or security issue
Raw deflate vs zlib wrapper is a format/encoding change, not a cryptographic or memory-safety fix
Evidence from the diff
The commit modifies core/embed/xbuild/src/clibrary/embed.rs, which compresses data embedded into firmware builds. The DeflateConfig is changed from best_compression() to a custom config with window_bits: -10. In libdeflate/miniz conventions, negative window_bits means raw deflate (no zlib header/footer) and -10 specifically selects a 1KB window. This likely ensures embedded compressed blobs match the decompression expectations of the embedded C code, which may expect raw deflate. The change is build-time only and affects how assets are packaged, not runtime behavior of the device itself.
Changed components
core/embed/xbuild/src/clibrary/embed.rsTrezor firmware build system (xbuild CLibrary embed compression)Inspect captured patch +7 / −1
diff --git a/core/embed/xbuild/src/clibrary/embed.rs b/core/embed/xbuild/src/clibrary/embed.rs
index e79241e3..a9a736ba 100644
--- a/core/embed/xbuild/src/clibrary/embed.rs
+++ b/core/embed/xbuild/src/clibrary/embed.rs
@@ -105,7 +105,13 @@ impl CLibrary {
let mut data_out = vec![0u8; compress_bound(data_in.len())];
- let config = DeflateConfig::best_compression();
+ let config = DeflateConfig {
+ // < 0 => raw deflate stream (no zlib header)
+ // -10 => 1KB window
+ window_bits: -10,
+ ..DeflateConfig::best_compression()
+ };
+
let (compressed, code) = compress_slice(&mut data_out, &data_in, config);
ensure!(
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.