build(core): update panic=immediate-abort for newer rustc
What the developer wrote
Authored by Martin Milata
build(core): update panic=immediate-abort for newer rustc
[no changelog]
What changed, and why it matters
This is a build-system update that changes how the Trezor firmware's Rust code handles unrecoverable errors (panics) in release builds. It switches to a newer Rust compiler feature called 'panic-immediate-abort' and adjusts build flags accordingly. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a toolchain compatibility change.
Treat as a routine build-system update. Verify that release firmware still builds and passes tests with the newer Rust toolchain, and that panic behavior on the device remains acceptable (no regression in failure handling). No urgent security action is indicated by the commit itself.
Security signals we found
Changes panic handling in release builds, which can affect how the device responds to unexpected failures
Removes a nightly compiler flag and replaces it with a Cargo feature, suggesting toolchain hardening/maintenance
No changelog entry, consistent with a build maintenance change rather than a security fix
Evidence from the diff
The commit updates the Trezor Core Rust build configuration for newer rustc versions. In core/embed/rust/Cargo.toml, it adds cargo-features = [“panic-immediate-abort”] and changes the release profile from panic = “abort” to panic = “immediate-abort”. In core/site_scons/tools.py, it removes the old -Z build-std-features=panic_immediate_abort flag and limits -Z build-std=core to non-debug builds, while keeping panic = “abort” for debug emulator builds so debug_assert! still works. The change is framed as a build compatibility update with [no changelog].
Changed components
core/embed/rust/Cargo.tomlcore/site_scons/tools.pyTrezor Core firmware Rust build configurationInspect captured patch +6 / −4
diff --git a/core/embed/rust/Cargo.toml b/core/embed/rust/Cargo.toml
index fa78610a..075c4f97 100644
--- a/core/embed/rust/Cargo.toml
+++ b/core/embed/rust/Cargo.toml
@@ -1,3 +1,5 @@
+cargo-features = ["panic-immediate-abort"]
+
[package]
name = "trezor_lib"
version = "0.1.0"
@@ -93,12 +95,13 @@ universal_fw = []
crate-type = ["staticlib"]
[profile.dev]
+# Keep panic mechanism on emulator PYOPT=0 builds
panic = "abort"
split-debuginfo = "off"
debug = 2
[profile.release]
-panic = "abort"
+panic = "immediate-abort"
opt-level = "z"
lto = true
codegen-units = 1
diff --git a/core/site_scons/tools.py b/core/site_scons/tools.py
index 96aa4f16..148da870 100644
--- a/core/site_scons/tools.py
+++ b/core/site_scons/tools.py
@@ -168,11 +168,10 @@ def add_rust_lib(*, env, build, profile, features, all_paths, build_dir):
"--no-default-features",
"--features " + ",".join(lib_features),
]
- if not (build == "unix" and is_debug):
- # Keep panic mechanism on debug emulator (for `debug_assert!`)
+ if not is_debug:
cargo_opts += [
+ # Needed by panic=immediate-abort
"-Z build-std=core",
- "-Z build-std-features=panic_immediate_abort",
]
build_cmd = "cargo build " + " ".join(cargo_opts)
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.