What the developer wrote
Authored by matejcik
fix(core/tools): fix `headertool_pq.py`
- headtool_pq now signs with dev_keys only when `sign_dev_keys` is True.
[no changelog]
What changed, and why it matters
This commit fixes a developer tool used to prepare Trezor firmware images. Previously, the tool always signed firmware with internal 'dev keys' regardless of user intent. Now it only signs with dev keys when the user explicitly requests it via the `sign_dev_keys` option. This is a tooling bug fix, not a vulnerability in the device firmware itself, but it could have caused developers to accidentally produce firmware signed with test keys instead of production keys.
Treat as a low-risk tooling correction. Developers using `headertool_pq.py` should update to ensure firmware images are signed only with intended keys. No end-user action or firmware update is required.
Security signals we found
Fixes unintended use of development-only signing keys
Developer tooling bug, not runtime firmware vulnerability
No changelog entry provided by vendor
No CVE or security advisory referenced in commit
Evidence from the diff
The patch modifies core/tools/trezor_core_tools/headertool_pq.py. Before the fix, fw.sign_with_devkeys() was called unconditionally and the ‘Signing with dev keys…’ message was always printed. After the fix, both the message and the signing call are guarded by if sign_dev_keys:. This aligns the tool’s behavior with its CLI option. The change is small (+3/-2) and limited to a single developer utility.
Changed components
core/tools/trezor_core_tools/headertool_pq.pyInspect captured patch +3 / −2
diff --git a/core/tools/trezor_core_tools/headertool_pq.py b/core/tools/trezor_core_tools/headertool_pq.py
index 1013c370..f988cdd9 100755
--- a/core/tools/trezor_core_tools/headertool_pq.py
+++ b/core/tools/trezor_core_tools/headertool_pq.py
@@ -79,8 +79,9 @@ def cli(
else:
echo = click.echo
- echo("Signing with dev keys...", err=True)
- fw.sign_with_devkeys()
+ if sign_dev_keys:
+ echo("Signing with dev keys...", err=True)
+ fw.sign_with_devkeys()
echo(f"Detected image type: {fw.NAME}")
echo(fw.format(verbose))
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.