fix(build-docker): stop swallowing pub-bin copy errors
What the developer wrote
Authored by Andrew Kozlik
fix(build-docker): stop swallowing pub-bin copy errors
kernel never has a pub bin, and secmon has none when built only as a
firmware dependency; skip the copy in those known-benign cases instead
of producing "cp: cannot stat" noise and blanket-ignoring cp's exit
status, so a genuine copy failure is no longer silently discarded.
What changed, and why it matters
This change fixes a build script that was ignoring copy errors. Previously, the script would silently ignore any failure when copying public binary files, which could hide real problems. Now it only skips the copy when the file genuinely doesn't exist for known cases (the kernel, and secmon when built as a dependency), and will report actual copy failures.
No immediate action required; this is a build-hardening improvement. Ensure the change is included in release builds so real artifact-copy failures are not masked.
Security signals we found
Build script silently ignored copy failures before this fix
Fix removes unconditional `|| true` error suppression
Known-benign missing files are now explicitly skipped with a file existence check
Evidence from the diff
In build-docker.sh, the line cp ... || true was replaced with a glob into an array, a check whether the glob resolved to an existing file, and a conditional copy. This stops suppressing genuine cp failures (e.g., permission errors, disk full) while still avoiding ‘cannot stat’ noise for components that legitimately have no public binary.
Changed components
build-docker.shInspect captured patch +4 / −1
### build-docker.sh
@@ -370,7 +370,10 @@ for TREZOR_MODEL in ${MODELS[@]}; do
mkdir -p /build/\$item/
gzip build-xtask/artifacts/$TREZOR_MODEL/\$item.elf
cp -v build-xtask/artifacts/$TREZOR_MODEL/\$item* /build/\$item/
- cp -v build-xtask/artifacts/pub/\$item-$TREZOR_MODEL-*.bin /build/\$item/ || true # n/a for kernel
+ pub_bin=(build-xtask/artifacts/pub/\$item-$TREZOR_MODEL-*.bin)
+ if [ -f "\$pub_bin" ]; then
+ cp -v "\${pub_bin[@]}" /build/\$item/
+ fi # no pub bin for kernel, or for secmon when built only as a dependency
fi
done
chown -R $USER:$GROUP /buildWhy this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.