fix(core): fix build on strange configurations
What the developer wrote
Authored by matejcik
fix(core): fix build on strange configurations
where some other completely unrelated package provides a "version.h"
file that happens to come first on the include path.
"version.h" is too generic a name to generally rely on C's imperfect
header resolution; a redirect via a symlink seems to be the most correct
solution
What changed, and why it matters
This commit fixes a build problem in Trezor's firmware. The code used a very common filename, version.h, which could accidentally pull in the wrong file from another software package during compilation. The fix creates a symlink with a more specific name, firmware_version.h, and uses that instead. There is no direct evidence this is a security vulnerability; it appears to be a build reliability fix.
Treat as a normal build/maintenance fix. No urgent security action is indicated by the commit itself. If the project wants to be defensive, it could audit whether any prior builds in affected configurations compiled with an unintended version.h, since wrong version metadata could mislead version checks or reproducibility.
Security signals we found
Header name collision could theoretically cause wrong version metadata to be compiled into firmware
No input validation, memory safety, or cryptographic change present
No vendor disclosure of security relevance
No CVE or advisory referenced
Evidence from the diff
The change in core/embed/upymod/modtrezorutils/modtrezorutils.c replaces the include of generic version.h with firmware_version.h, and adds a symlink firmware_version.h pointing to the intended ../../projects/firmware/version.h. This resolves include-path ambiguity where an unrelated package’s version.h could be picked up first. The commit message frames this as a build fix for ‘strange configurations.’ No runtime behavior change is intended, and no security boundary is visibly crossed.
Changed components
core/embed/upymod/modtrezorutils/modtrezorutils.ccore/embed/upymod/modtrezorutils/firmware_version.h (new symlink)Inspect captured patch +2 / −1
diff --git a/core/embed/upymod/modtrezorutils/firmware_version.h b/core/embed/upymod/modtrezorutils/firmware_version.h
new file mode 120000
index 00000000..73975dc3
--- /dev/null
+++ b/core/embed/upymod/modtrezorutils/firmware_version.h
@@ -0,0 +1 @@
+../../projects/firmware/version.h
\ No newline at end of file
diff --git a/core/embed/upymod/modtrezorutils/modtrezorutils.c b/core/embed/upymod/modtrezorutils/modtrezorutils.c
index 12ff619a..4dcd5b5f 100644
--- a/core/embed/upymod/modtrezorutils/modtrezorutils.c
+++ b/core/embed/upymod/modtrezorutils/modtrezorutils.c
@@ -27,7 +27,7 @@
#include "py/runtime.h"
#include <sec/image.h>
-#include "version.h"
+#include "firmware_version.h"
#if MICROPY_PY_TREZORUTILS
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.