fix(core/build): copy secmon to artifacts/pub
What the developer wrote
Authored by Martin Milata
fix(core/build): copy secmon to artifacts/pub
[no changelog]
What changed, and why it matters
This is a small build-script fix that changes which compiled files get copied into a public artifacts folder. Previously, both the 'Kernel' and 'Secmon' projects were excluded from being copied. Now, only the 'Kernel' project is excluded, while 'Secmon' is copied when it is built as a dependency of another project. There is no direct evidence in the commit that this change fixes a security vulnerability; it appears to be a build/artifact packaging correction.
No immediate security action required. Treat as a routine build fix. If security relevance is suspected, verify whether missing Secmon artifacts in pub affected reproducible builds, firmware signing workflows, or supply-chain verification, but the diff itself does not indicate a vulnerability.
Security signals we found
No security-relevant keywords in commit title or message
No changelog entry provided
Change is limited to build artifact copying logic
No code execution, memory safety, or cryptographic changes visible
Evidence from the diff
In core/embed/xtask/src/cargo.rs, the condition controlling whether a built binary is copied to the artifacts/pub directory is refined. The original code skipped copying for Project::Secmon and Project::Kernel. The new code skips only Project::Kernel, and additionally skips Project::Secmon when it is built as a dependency (is_dependency == true). When Secmon is built as a top-level project, it is now copied to pub. This is a build artifact routing change with no visible runtime security implications in the diff.
Changed components
core/embed/xtask/src/cargo.rsInspect captured patch +3 / −1
diff --git a/core/embed/xtask/src/cargo.rs b/core/embed/xtask/src/cargo.rs
index 32c47d59..d0c774ee 100644
--- a/core/embed/xtask/src/cargo.rs
+++ b/core/embed/xtask/src/cargo.rs
@@ -138,8 +138,10 @@ fn build_impl(args: BuildArgs, is_dependency: bool) -> Result<()> {
)?;
}
+ let is_kernel = matches!(args.project, Project::Kernel);
+ let is_secmon = matches!(args.project, Project::Secmon);
// Copy the final binary to the `pub` directory
- if !matches!(args.project, Project::Secmon | Project::Kernel) {
+ if !(is_kernel || (is_secmon && is_dependency)) {
let version_file = helpers::get_version_file(args.project)?;
let infix =
(matches!(args.project, Project::Firmware) && args.btc_only).then_some("btconly");
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.