What the developer wrote
Authored by Roman Zeyde
ci: don't copy `pyright/` at Dockerfile
[no changelog]
What changed, and why it matters
This commit updates the Nix package manager version used in Trezor's build containers from 2.4 to 2.31.4, and removes an unnecessary copy of a `pyright/` directory in the Docker image. These are routine CI/build maintenance changes. There is no direct evidence in the commit that this fixes a security vulnerability, though newer Nix versions may include general hardening and bug fixes.
Treat as routine CI hygiene. Verify that the Nix 2.31.4 upgrade does not break reproducible builds or firmware signing workflows. Review upstream Nix release notes for any security advisories relevant to the build pipeline, but no immediate security response is indicated by this commit alone.
Security signals we found
Build dependency version bump (Nix 2.4 → 2.31.4)
Removal of unused/unnecessary Docker COPY layer (`pyright/`)
No changelog entry requested, suggesting routine maintenance
No explicit security claim in commit title or message
Evidence from the diff
The diff changes two files: build-docker.sh and ci/Dockerfile. It bumps NIX_VERSION from 2.4 to 2.31.4 in both the shell script default and the Dockerfile build argument, and removes a COPY pyright/ pyright/ instruction from the Dockerfile. The Nix 2.4 to 2.31.4 jump is a major version upgrade that likely includes many upstream fixes, dependency updates, and hardening changes, but the commit message frames it only as ‘don’t copy pyright/ at Dockerfile’ with ‘[no changelog]’. No CVE, security advisory, or vulnerability description is present in the supplied materials.
Changed components
ci/Dockerfilebuild-docker.shNix package manager in CI/build containersInspect captured patch +2 / −3
diff --git a/build-docker.sh b/build-docker.sh
index 11fb5d43..15f11fa8 100755
--- a/build-docker.sh
+++ b/build-docker.sh
@@ -40,7 +40,7 @@ ALPINE_CDN=${ALPINE_CDN:-https://dl-cdn.alpinelinux.org/alpine}
ALPINE_RELEASE=${ALPINE_RELEASE:-3.15}
ALPINE_VERSION=${ALPINE_VERSION:-3.15.0}
ALPINE_TARBALL=${ALPINE_FILE:-alpine-minirootfs-$ALPINE_VERSION-$ALPINE_ARCH.tar.gz}
-NIX_VERSION=${NIX_VERSION:-2.4}
+NIX_VERSION=${NIX_VERSION:-2.31.4}
CONTAINER_FS_URL=${CONTAINER_FS_URL:-"$ALPINE_CDN/v$ALPINE_RELEASE/releases/$ALPINE_ARCH/$ALPINE_TARBALL"}
############## Options parsing ##############
diff --git a/ci/Dockerfile b/ci/Dockerfile
index 6df7d784..c4fc1ca1 100644
--- a/ci/Dockerfile
+++ b/ci/Dockerfile
@@ -14,7 +14,7 @@ RUN apk add --no-cache --update openssl \
RUN apk update && apk add bash git python3
# Download Nix and install it into the system.
-ARG NIX_VERSION=2.4
+ARG NIX_VERSION=2.31.4
RUN wget https://nixos.org/releases/nix/nix-${NIX_VERSION}/nix-${NIX_VERSION}-${ALPINE_ARCH}-linux.tar.xz \
&& tar xf nix-${NIX_VERSION}-${ALPINE_ARCH}-linux.tar.xz \
&& addgroup -g 30000 -S nixbld \
@@ -39,7 +39,6 @@ ENV \
# Trezor specific stuff starts here
COPY shell.nix shell.nix
-COPY pyright/ pyright/
# add and install git-filter-repo for common sync job
COPY common_sync/git-filter-repo git-filter-repo
RUN mv git-filter-repo $(git --exec-path)
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.