fix(build): forward `REPRODUCIBLE_XTASK_BUILD_OPTS` into reproducible build script
What the developer wrote
Authored by M1nd3r
fix(build): forward `REPRODUCIBLE_XTASK_BUILD_OPTS` into reproducible build script
[no changelog]
What changed, and why it matters
This is a small build-script fix. It makes an environment variable named REPRODUCIBLE_XTASK_BUILD_OPTS actually get passed into the Docker container during reproducible firmware builds, and adds a help message about it. On its own, the change does not look like a security vulnerability or a security fix; it is more like a missing plumbing for a build option.
Treat as a routine build fix. If reviewing for security, verify how REPRODUCIBLE_XTASK_BUILD_OPTS is populated and whether its contents are validated before being passed into the build container, because uncontrolled build options could affect build integrity or reproducibility. No immediate patching urgency is indicated by this commit alone.
Security signals we found
No direct security signal in the diff: no bounds checks, crypto changes, privilege changes, or input sanitization.
The change exposes an additional environment variable into the build container, which could in principle affect build reproducibility or build flags if the variable contains untrusted content.
No CVE, advisory, or vendor security statement is present in the supplied materials.
Evidence from the diff
The commit modifies build-docker.sh. It forwards REPRODUCIBLE_XTASK_BUILD_OPTS into the Docker container as XTASK_BUILD_OPTS and documents the variable in the help text. The diff only touches shell script plumbing; there is no change to firmware code, cryptography, or container isolation. The patch is additive and does not alter existing default behavior.
Changed components
build-docker.shreproducible build pipelineInspect captured patch +2 / −0
diff --git a/build-docker.sh b/build-docker.sh
index e62e32ed..6953538e 100755
--- a/build-docker.sh
+++ b/build-docker.sh
@@ -60,6 +60,7 @@ function help_and_die() {
echo "Option --prodtest is deprecated. Use "--targets prodtest" to build prodtest."
echo "Set PRODUCTION=0 to run non-production builds."
echo "Set VENDOR_HEADER=vendorheader_prodtest_unsigned.bin to use the specified vendor header for prodtest."
+ echo "USE REPRODUCIBLE_XTASK_BUILD_OPTS to pass additional parameters for xtask build."
exit 0
}
@@ -315,6 +316,7 @@ EOF
--env TREZOR_MODEL="$TREZOR_MODEL" \
--env PRODUCTION="$PRODUCTION" \
--env VENDOR_HEADER="$VENDOR_HEADER" \
+ --env XTASK_BUILD_OPTS="$REPRODUCIBLE_XTASK_BUILD_OPTS" \
--init \
"$SNAPSHOT_NAME" \
/nix/var/nix/profiles/default/bin/nix-shell --run "bash /local/build/$SCRIPT_NAME"
Why this scored 16/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.