fix(core/build): fix headertool keys selection
What the developer wrote
Authored by tychovrahe
fix(core/build): fix headertool keys selection
[no changelog]
What changed, and why it matters
This commit fixes a logic error in the build scripts that decide whether to use development or production signing keys when preparing Trezor firmware images. Before the fix, the condition was accidentally inverted, so production builds may have used development keys and development builds may have used production keys. Using the wrong keys could make firmware signatures invalid or cause devices to reject genuine firmware, but the commit itself does not show an exploitable runtime vulnerability in shipped code.
Verify that production release pipelines now use production keys and that any artifacts produced by the buggy build script were rebuilt or rejected. Review CI logs for `-D` flag usage on production builds. No emergency runtime patch is required because the fix is in the build system.
Security signals we found
Inverted boolean condition in build script
Wrong cryptographic signing keys selected for firmware image
Build artifact integrity / authenticity affected
No runtime exploit or memory safety issue shown in diff
Evidence from the diff
The change corrects a boolean negation bug in core/SConscript.firmware and core/SConscript.secmon. The headertool command appends the -D flag to select development keys. The original expression not (BOOTLOADER_DEVEL or not PRODUCTION) evaluated to the opposite of the intended BOOTLOADER_DEVEL or not PRODUCTION. The patch removes the leading not, making development keys used exactly when BOOTLOADER_DEVEL is set or PRODUCTION is unset. This is a build-time configuration fix; it affects firmware image signing metadata rather than on-device code behavior.
Changed components
core/SConscript.firmwarecore/SConscript.secmonfirmware image header tooling (`headertool`)firmware binary signing / key selection stepInspect captured patch +3 / −3
diff --git a/core/SConscript.firmware b/core/SConscript.firmware
index 482abef7..50e35c71 100644
--- a/core/SConscript.firmware
+++ b/core/SConscript.firmware
@@ -1061,14 +1061,14 @@ if 'STM32F427xx' in CPPDEFINES_HAL or 'STM32F429xx' in CPPDEFINES_HAL:
'$OBJCOPY -O binary -j .vendorheader -j .header -j .flash -j .data --pad-to 0x08100000 $SOURCE ${TARGET}.p1',
'$OBJCOPY -O binary -j .flash2 $SOURCE ${TARGET}.p2',
'$CAT ${TARGET}.p1 ${TARGET}.p2 > $TARGET',
- '$HEADERTOOL -h $TARGET ' + ('-D' if not (BOOTLOADER_DEVEL or not PRODUCTION) else ''),
+ '$HEADERTOOL -h $TARGET ' + ('-D' if (BOOTLOADER_DEVEL or not PRODUCTION) else ''),
'$DD if=$TARGET of=${TARGET}.p1 skip=0 bs=128k count=6',
'$CP $TARGET ' + BINARY_NAME,
]
else:
action_bin=[
'$OBJCOPY -O binary -j .vendorheader -j .header -j .flash -j .data $SOURCE ${TARGET}',
- '$HEADERTOOL -h $TARGET ' + ('-D' if not (BOOTLOADER_DEVEL or not PRODUCTION) else ''),
+ '$HEADERTOOL -h $TARGET ' + ('-D' if (BOOTLOADER_DEVEL or not PRODUCTION) else ''),
'$CP $TARGET ' + BINARY_NAME,
]
diff --git a/core/SConscript.secmon b/core/SConscript.secmon
index c0d96df4..5d1a1be8 100644
--- a/core/SConscript.secmon
+++ b/core/SConscript.secmon
@@ -437,7 +437,7 @@ if TREZOR_MODEL in ('T3B1', 'T3T1'):
else:
action_bin=[
'$OBJCOPY -O binary -j .secmon_header -j .flash -j .data -j .gnu.sgstubs $SOURCE ${TARGET}',
- '$HEADERTOOL -h $TARGET ' + ('-D' if not (BOOTLOADER_DEVEL or not PRODUCTION) else ''),
+ '$HEADERTOOL -h $TARGET ' + ('-D' if (BOOTLOADER_DEVEL or not PRODUCTION) else ''),
'$CP $TARGET ' + BINARY_NAME,
]
Why this scored 40/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.