Informational 15 Bitcoin Committed Dec 18, 2025 · 18:07 UTC

build(core): exclude `embed/rtl/printf.c` from non-prodtest builds

6a637bd4 View source ↗

Public commit record

What the developer wrote

Authored by Roman Zeyde

100/100 · Strong

build(core): exclude `embed/rtl/printf.c` from non-prodtest builds

Otherwise, nightly CI fails with:
https://github.com/trezor/trezor-firmware/actions/runs/20320385493/job/58431441939

We currently use `printf()` only in prodtest / non-production builds[^1].

[no changelog]

[^1]: https://github.com/trezor/trezor-firmware/pull/6208#discussion_r2610006444

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference

The short version

What changed, and why it matters

This commit changes build scripts so that a file providing printf-style debugging output is only included in non-production builds. It is a build-system cleanup to fix a nightly CI failure, not a security fix. There is no indication it addresses a vulnerability or changes runtime behavior of shipped devices.

Recommended action

No security action required; treat as routine build maintenance.

Security signals we found

No strong security signals were identified.

Technical analysis

Evidence from the diff

The commit modifies eight SConscript files to conditionally include embed/rtl/printf.c only when PRODUCTION is not set. Previously the file was unconditionally included in SOURCE_MOD. The change is motivated by a failing nightly CI job and the fact that printf() is only used in prodtest/non-production builds. No code logic, parsing, or security boundary is changed.

Changed components

core/SConscript.boardloadercore/SConscript.bootloadercore/SConscript.bootloader_cicore/SConscript.bootloader_emucore/SConscript.firmwarecore/SConscript.kernelcore/SConscript.secmoncore/SConscript.unix

Inspect captured patch +28 / −8

diff --git a/core/SConscript.boardloader b/core/SConscript.boardloader
index e7664529..b3c70d79 100644
--- a/core/SConscript.boardloader
+++ b/core/SConscript.boardloader
@@ -5,6 +5,7 @@ import tools, models
 
 TREZOR_MODEL = ARGUMENTS.get('TREZOR_MODEL', 'T2T1')
 CMAKELISTS = int(ARGUMENTS.get('CMAKELISTS', 0))
+PRODUCTION = ARGUMENTS.get('PRODUCTION', '0') == '1'
 HW_REVISION = ARGUMENTS.get('HW_REVISION', None)
 DBG_CONSOLE = ARGUMENTS.get('DBG_CONSOLE', '')
 
@@ -98,10 +99,12 @@ SOURCE_MOD += [
     'embed/util/rsod/rsod_special.c',
     'embed/util/scm_revision/scm_revision.c',
     'embed/rtl/error_handling.c',
-    'embed/rtl/printf.c',
     'embed/rtl/strutils.c',
 ]
 
+if not PRODUCTION:
+    SOURCE_MOD += ['embed/rtl/printf.c']
+
 SOURCE_BOARDLOADER = [
     'embed/projects/boardloader/main.c',
     'embed/projects/boardloader/bld_version.c',
diff --git a/core/SConscript.bootloader b/core/SConscript.bootloader
index 6b5f2706..3789c009 100644
--- a/core/SConscript.bootloader
+++ b/core/SConscript.bootloader
@@ -124,13 +124,15 @@ SOURCE_MOD += [
     'embed/util/rsod/rsod_special.c',
     'embed/util/scm_revision/scm_revision.c',
     'embed/rtl/error_handling.c',
-    'embed/rtl/printf.c',
     'embed/rtl/strutils.c',
     'vendor/micropython/lib/uzlib/adler32.c',
     'vendor/micropython/lib/uzlib/crc32.c',
     'vendor/micropython/lib/uzlib/tinflate.c',
 ]
 
+if not PRODUCTION:
+    SOURCE_MOD += ['embed/rtl/printf.c']
+
 SOURCE_NANOPB = [
     'vendor/nanopb/pb_common.c',
     'vendor/nanopb/pb_decode.c',
diff --git a/core/SConscript.bootloader_ci b/core/SConscript.bootloader_ci
index ecc7dba7..e827bf1e 100644
--- a/core/SConscript.bootloader_ci
+++ b/core/SConscript.bootloader_ci
@@ -5,6 +5,7 @@ import tools, models, ui
 
 TREZOR_MODEL = ARGUMENTS.get('TREZOR_MODEL', 'T2T1')
 CMAKELISTS = int(ARGUMENTS.get('CMAKELISTS', 0))
+PRODUCTION = ARGUMENTS.get('PRODUCTION', '0') == '1'
 HW_REVISION = ARGUMENTS.get('HW_REVISION', None)
 
 FEATURES_WANTED = [
@@ -102,13 +103,15 @@ SOURCE_MOD += [
     'embed/util/rsod/rsod_special.c',
     'embed/util/scm_revision/scm_revision.c',
     'embed/rtl/error_handling.c',
-    'embed/rtl/printf.c',
     'embed/rtl/strutils.c',
     'vendor/micropython/lib/uzlib/adler32.c',
     'vendor/micropython/lib/uzlib/crc32.c',
     'vendor/micropython/lib/uzlib/tinflate.c',
 ]
 
+if not PRODUCTION:
+    SOURCE_MOD += ['embed/rtl/printf.c']
+
 SOURCE_NANOPB = [
     'vendor/nanopb/pb_common.c',
     'vendor/nanopb/pb_decode.c',
diff --git a/core/SConscript.bootloader_emu b/core/SConscript.bootloader_emu
index 996e9deb..009f4c1b 100644
--- a/core/SConscript.bootloader_emu
+++ b/core/SConscript.bootloader_emu
@@ -6,6 +6,8 @@ import tools, models, ui
 
 TREZOR_MODEL = ARGUMENTS.get('TREZOR_MODEL', 'T2T1')
 CMAKELISTS = int(ARGUMENTS.get('CMAKELISTS', 0))
+BOOTLOADER_QA = ARGUMENTS.get('BOOTLOADER_QA', '0') == '1'
+PRODUCTION = 0 if BOOTLOADER_QA else ARGUMENTS.get('PRODUCTION', '0') == '1'
 HW_REVISION = 'emulator'
 DBG_CONSOLE = ARGUMENTS.get('DBG_CONSOLE', '')
 
@@ -97,13 +99,15 @@ SOURCE_MOD += [
     'embed/util/rsod/rsod_special.c',
     'embed/util/scm_revision/scm_revision.c',
     'embed/rtl/error_handling.c',
-    'embed/rtl/printf.c',
     'embed/rtl/strutils.c',
     'vendor/micropython/lib/uzlib/adler32.c',
     'vendor/micropython/lib/uzlib/crc32.c',
     'vendor/micropython/lib/uzlib/tinflate.c',
 ]
 
+if not PRODUCTION:
+    SOURCE_MOD += ['embed/rtl/printf.c']
+
 SOURCE_NANOPB = [
     'vendor/nanopb/pb_common.c',
     'vendor/nanopb/pb_decode.c',
diff --git a/core/SConscript.firmware b/core/SConscript.firmware
index 52dbecab..68a1bc40 100644
--- a/core/SConscript.firmware
+++ b/core/SConscript.firmware
@@ -267,13 +267,15 @@ SOURCE_MOD += [
     'embed/util/rsod/rsod.c',
     'embed/util/scm_revision/scm_revision.c',
     'embed/rtl/error_handling.c',
-    'embed/rtl/printf.c',
     'embed/rtl/strutils.c',
     'vendor/micropython/lib/uzlib/adler32.c',
     'vendor/micropython/lib/uzlib/crc32.c',
     'vendor/micropython/lib/uzlib/tinflate.c',
 ]
 
+if not PRODUCTION:
+    SOURCE_MOD += ['embed/rtl/printf.c']
+
 CPPDEFINES_MOD += [
     'TRANSLATIONS',
     'FANCY_FATAL_ERROR',
diff --git a/core/SConscript.kernel b/core/SConscript.kernel
index 82e0e885..a310a10c 100644
--- a/core/SConscript.kernel
+++ b/core/SConscript.kernel
@@ -222,13 +222,15 @@ SOURCE_MOD += [
     'embed/util/rsod/rsod.c',
     'embed/util/rsod/rsod_special.c',
     'embed/rtl/error_handling.c',
-    'embed/rtl/printf.c',
     'embed/rtl/strutils.c',
     'vendor/micropython/lib/uzlib/adler32.c',
     'vendor/micropython/lib/uzlib/crc32.c',
     'vendor/micropython/lib/uzlib/tinflate.c',
 ]
 
+if not PRODUCTION:
+    SOURCE_MOD += ['embed/rtl/printf.c']
+
 CPPPATH_MOD += [
     'vendor/micropython/lib/uzlib',
 ]
diff --git a/core/SConscript.secmon b/core/SConscript.secmon
index 88b87fc0..130ce7b4 100644
--- a/core/SConscript.secmon
+++ b/core/SConscript.secmon
@@ -217,13 +217,15 @@ SOURCE_MOD += [
     'embed/util/image/image.c',
     'embed/util/rsod/rsod_special.c',
     'embed/rtl/error_handling.c',
-    'embed/rtl/printf.c',
     'embed/rtl/strutils.c',
     'vendor/micropython/lib/uzlib/adler32.c',
     'vendor/micropython/lib/uzlib/crc32.c',
     'vendor/micropython/lib/uzlib/tinflate.c',
 ]
 
+if not PRODUCTION:
+    SOURCE_MOD += ['embed/rtl/printf.c']
+
 CPPDEFINES_MOD += [
     'TRANSLATIONS',
     'RSOD_IN_COREAPP',
diff --git a/core/SConscript.unix b/core/SConscript.unix
index 69616adc..461aa85a 100644
--- a/core/SConscript.unix
+++ b/core/SConscript.unix
@@ -250,13 +250,15 @@ SOURCE_MOD += [
     'embed/util/rsod/rsod_special.c',
     'embed/util/scm_revision/scm_revision.c',
     'embed/rtl/error_handling.c',
-    'embed/rtl/printf.c',
     'embed/rtl/strutils.c',
     'vendor/micropython/lib/uzlib/adler32.c',
     'vendor/micropython/lib/uzlib/crc32.c',
     'vendor/micropython/lib/uzlib/tinflate.c',
 ]
 
+if not PRODUCTION:
+    SOURCE_MOD += ['embed/rtl/printf.c']
+
 CPPDEFINES_MOD += [
     'TRANSLATIONS',
     'FANCY_FATAL_ERROR',

Risk score

Why this scored 15/100

Our methodology →

Potential impact 0/30

Exploitability 0/25

Stealth signal 0/15

Affected reach 0/15

Confidence 10/10

Evidence quality 5/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 15/100

Community notes

Related watches

chore(core): remove sha1 from regular FW

refactor(crypto): pass static public key to `noise_xxpsk3_*_init()`

refactor(crypto): change order of parameters