build(core): enable Tropic by default for non-emulator targets
What the developer wrote
Authored by Roman Zeyde
build(core): enable Tropic by default for non-emulator targets
Disable it by default only for at `SConscript.unix` (since currently `emu.py` doesn't start Tropic emulator).
[no changelog]
What changed, and why it matters
This commit changes the default build settings for the Trezor firmware so that a hardware security component called Tropic is enabled by default for real hardware builds, while keeping it disabled only for the software emulator used on PCs. It also removes the explicit default values for disabling Optiga and Tropic from the Makefile, making them optional overrides instead. There is no indication of a security vulnerability or fix in the change itself.
No security action required. Reviewers may want to confirm that enabling Tropic by default on hardware builds is intentional and consistent with product requirements, and that emulator builds remain functional without Tropic.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies core/Makefile and core/SConscript.unix. In the Makefile, DISABLE_OPTIGA and DISABLE_TROPIC default variables are removed, and their propagation to SCons is made conditional on the user explicitly setting them. In SConscript.unix, the default for DISABLE_TROPIC changes from ‘0’ (enabled) to ‘1’ (disabled) for emulator/unix targets. The net effect is that Tropic is enabled by default for non-emulator hardware builds and disabled by default for emulator builds. This is a build-system configuration change, not a code-level security patch.
Changed components
core/Makefilecore/SConscript.unixInspect captured patch +9 / −5
diff --git a/core/Makefile b/core/Makefile
index bed0da445..6f259e0df 100644
--- a/core/Makefile
+++ b/core/Makefile
@@ -33,8 +33,6 @@ BITCOIN_ONLY ?= 0
BOOTLOADER_QA ?= 0
BOOTLOADER_DEVEL ?= 0
UNSAFE_FW ?= 0
-DISABLE_OPTIGA ?= 0
-DISABLE_TROPIC ?= 1
TREZOR_MODEL ?= T2T1
TREZOR_MEMPERF ?= 0
ADDRESS_SANITIZER ?= 0
@@ -129,8 +127,6 @@ SCONS_VARS = \
UNSAFE_FW="$(UNSAFE_FW)" \
CFLAGS="$(CFLAGS)" \
CMAKELISTS="$(CMAKELISTS)" \
- DISABLE_OPTIGA="$(DISABLE_OPTIGA)" \
- DISABLE_TROPIC="$(DISABLE_TROPIC)" \
HW_REVISION="$(HW_REVISION)" \
LOG_STACK_USAGE="$(LOG_STACK_USAGE)" \
MICROPY_ENABLE_SOURCE_LINE="$(MICROPY_ENABLE_SOURCE_LINE)" \
@@ -149,6 +145,14 @@ SCONS_VARS = \
BLOCK_ON_VCP="$(BLOCK_ON_VCP)" \
DBG_CONSOLE="$(DBG_CONSOLE)" \
+ifdef DISABLE_OPTIGA
+SCONS_VARS += DISABLE_OPTIGA="$(DISABLE_OPTIGA)"
+endif
+
+ifdef DISABLE_TROPIC
+SCONS_VARS += DISABLE_TROPIC="$(DISABLE_TROPIC)"
+endif
+
SCONS_OPTS = -Q -j $(JOBS)
ifeq ($(QUIET_MODE),1)
SCONS_OPTS += --quiet
diff --git a/core/SConscript.unix b/core/SConscript.unix
index f864d841c..452b5ec9d 100644
--- a/core/SConscript.unix
+++ b/core/SConscript.unix
@@ -12,7 +12,7 @@ TREZOR_MODEL = ARGUMENTS.get('TREZOR_MODEL', 'T2T1')
CMAKELISTS = int(ARGUMENTS.get('CMAKELISTS', 0))
HW_REVISION ='emulator'
THP = ARGUMENTS.get('THP', '0') == '1' # Trezor-Host Protocol
-DISABLE_TROPIC = ARGUMENTS.get('DISABLE_TROPIC', '0') == '1'
+DISABLE_TROPIC = ARGUMENTS.get('DISABLE_TROPIC', '1') == '1'
BENCHMARK = ARGUMENTS.get('BENCHMARK', '0') == '1'
PYOPT = ARGUMENTS.get('PYOPT', '1')
FROZEN = ARGUMENTS.get('TREZOR_EMULATOR_FROZEN', 0)
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.