ci(core): copy only target artifacts to Docker build output directory
What the developer wrote
Authored by Roman Zeyde
ci(core): copy only target artifacts to Docker build output directory
It seems that copying the full `build/` directory may fail on CI:
https://github.com/trezor/trezor-firmware/actions/runs/19740721662/job/56563676033
[no changelog]
What changed, and why it matters
This is a small build-script change for the Trezor hardware wallet firmware. It changes the CI build so that only the final firmware/bootloader files are copied out of the Docker container, instead of the entire build folder. The stated reason is to fix a CI failure, not to fix a security bug. There is no direct evidence in the commit that this is a security fix.
No security action required. Treat as a normal CI/build hygiene improvement. If auditing the reproducible build pipeline, note that output scope is now narrower, which is a minor hardening benefit.
Security signals we found
Change reduces the attack surface of the Docker build output directory by copying fewer files
No explicit security claim in commit message or diff
No references to vulnerabilities, CVEs, researchers, or advisories
Change is framed as CI reliability improvement
Evidence from the diff
The commit modifies build-docker.sh. Previously, after building, the script removed /build/* and copied the whole build/ directory into /build. Now it creates per-target subdirectories under /build/ and copies only build/$item/$item* (the binary and its fingerprint) for each of bootloader, secmon, firmware, and prodtest. The rm -rf /build/* was moved earlier, before the build. The commit message explicitly frames this as a CI reliability fix, referencing a failed GitHub Actions run.
Changed components
build-docker.shTrezor Core firmware CI build pipelineInspect captured patch +5 / −2
diff --git a/build-docker.sh b/build-docker.sh
index 6a5876732..958a8f5a6 100755
--- a/build-docker.sh
+++ b/build-docker.sh
@@ -275,16 +275,19 @@ for TREZOR_MODEL in ${MODELS[@]}; do
set -e -o pipefail
cd /reproducible-build/trezor-firmware/core
$GIT_CLEAN_REPO
+ rm -rf /build/*
uv run make clean vendor $MAKE_TARGETS QUIET_MODE=1
for item in bootloader secmon firmware prodtest; do
if [ -s build/\$item/\$item.bin ]; then
uv run ../python/tools/firmware-fingerprint.py \
-o build/\$item/\$item.bin.fingerprint \
build/\$item/\$item.bin
+
+ # copy only the artifacts to the build output directory
+ mkdir /build/\$item/
+ cp -v build/\$item/\$item* /build/\$item/
fi
done
- rm -rf /build/*
- cp -r build/* /build
chown -R $USER:$GROUP /build
EOF
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.