What the developer wrote
Authored by cepetr
chore(core): production feature cleanup
[no changelog]
What changed, and why it matters
This is a small build-configuration cleanup in the Trezor firmware. It changes which internal feature flag the 'production' build mode depends on, removing one old reference and switching another. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be routine maintenance to keep production builds using the correct set of features.
Treat as low-priority build maintenance. If this commit is part of a security release, request the vendor's advisory or changelog entry to confirm security relevance. Otherwise, no immediate action is required beyond normal review.
Security signals we found
Feature flag dependency change in production build configuration
No runtime code or cryptographic changes visible in diff
No changelog entry provided
Evidence from the diff
The commit removes the ‘production’ feature from core/embed/crypto/Cargo.toml and changes the ‘production’ feature in core/embed/projects/kernel/Cargo.toml from depending on ‘sys/production’ to depending on ‘io/production’. This is a Cargo feature dependency refactor. The diff does not show any runtime code changes, memory-safety fixes, cryptographic changes, or privilege-boundary changes. Without additional context, this looks like a build-system cleanup rather than a security patch.
Changed components
core/embed/crypto/Cargo.tomlcore/embed/projects/kernel/Cargo.tomlInspect captured patch +1 / −2
### core/embed/crypto/Cargo.toml
@@ -38,7 +38,6 @@ eos = []
mldsa = []
nem = []
noise = ["aes_gcm"]
-production = ["rtl/production"]
secp256k1_zkp = []
sphincsplus = []
thp = ["dep:trezor-thp"]
### core/embed/projects/kernel/Cargo.toml
@@ -34,7 +34,7 @@ dbg_console_system_view = ["dbg_console", "sys/dbg_console_system_view"]
debuglink = ["io/usb_iface_debug"]
force_bootloader_upgrade = []
optiga_testing = ["sec/optiga_testing"]
-production = ["sys/production"]
+production = ["io/production"]
storage_insecure_testing_mode = ["sec/storage_insecure_testing_mode"]
universal_fw = ["io/usb_iface_webauthn"]
unsafe_fw = []Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.