ci(core): copy kernel artifacts from Docker build
What the developer wrote
Authored by Roman Zeyde
ci(core): copy kernel artifacts from Docker build
Note: kernel.bin will not be fingerprinted since it is not supported by `firmware-fingerprint.py`
[no changelog]
What changed, and why it matters
This is a small build-script change for Trezor hardware wallets. It adds the new 'kernel' build artifact to the list of files copied out of the Docker build container, and makes the script continue copying artifacts even when a fingerprinting step fails. There is no direct evidence this fixes a security vulnerability; it appears to be a CI/build hygiene improvement.
Treat as routine build maintenance. If kernel.bin is intentionally not fingerprinted, ensure another integrity mechanism (e.g., deterministic build hashes, signed release manifests) covers it. Review whether tolerating fingerprint failures could mask future regressions.
Security signals we found
Build pipeline change that could affect reproducibility/artifact completeness
Fingerprinting bypass now tolerated with a logged message
No changelog entry provided
Evidence from the diff
The commit modifies build-docker.sh. It iterates over bootloader, secmon, kernel, firmware, prodtest. Two changes: (1) ‘kernel’ is added to the artifact list, with a note that kernel.bin is not supported by firmware-fingerprint.py; (2) the fingerprint command is followed by ‘|| echo …’ so a fingerprint failure no longer aborts the subsequent copy step, and the copy step is now guarded by ‘if [ -d build/$item/ ]’ rather than being inside the fingerprint size check. This prevents a missing fingerprint from silently dropping the entire artifact directory from the output.
Changed components
build-docker.sh CI build scriptTrezor Core firmware build artifactskernel.bin artifact handlingInspect captured patch +5 / −3
diff --git a/build-docker.sh b/build-docker.sh
index c5127437..11fb5d43 100755
--- a/build-docker.sh
+++ b/build-docker.sh
@@ -277,12 +277,14 @@ for TREZOR_MODEL in ${MODELS[@]}; do
$GIT_CLEAN_REPO
rm -rf /build/*
uv run make clean vendor $MAKE_TARGETS QUIET_MODE=1
- for item in bootloader secmon firmware prodtest; do
+ for item in bootloader secmon kernel firmware prodtest; do
if [ -s build/\$item/\$item.bin ]; then
uv run ../python/tools/firmware-fingerprint.py \
-o build/\$item/\$item.bin.fingerprint \
- build/\$item/\$item.bin
-
+ build/\$item/\$item.bin \
+ || echo "No fingerprint for build/\$item/\$item.bin"
+ fi
+ if [ -d build/\$item/ ]; then
# copy only the artifacts to the build output directory
mkdir /build/\$item/
cp -v build/\$item/\$item* /build/\$item/
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.