fix(build): force UV to use nix-provided Python
What the developer wrote
Authored by M1nd3r
fix(build): force UV to use nix-provided Python
[no changelog]
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
What changed, and why it matters
This commit changes the Trezor firmware build environment so that a Python package tool called 'uv' is forced to use the Python interpreter provided by the Nix build system, rather than silently downloading and using its own. The change prevents the build from unexpectedly pulling in outside Python binaries, which could make builds less reproducible and theoretically allow a compromised or malicious interpreter to be introduced if the download mechanism were attacked. It is a build-hardening fix, not a fix for an active exploit.
Treat as a low-risk build-hardening improvement. Review whether other build environments or CI pipelines using uv enforce equivalent UV_PYTHON_PREFERENCE/UV_PYTHON_DOWNLOADS settings, and verify the Nix-provided Python version is pinned and audited.
Security signals we found
Build environment now pins uv to the Nix-provided Python interpreter
Disables uv's automatic Python interpreter downloads
Reduces supply-chain risk from externally downloaded build tooling
No changelog entry; marked as build fix only
Evidence from the diff
The patch adds two environment variables to shell.nix: UV_PYTHON_PREFERENCE=only-system and UV_PYTHON_DOWNLOADS=never. By default, uv prefers its own managed Python builds and may automatically download interpreters, bypassing the python3 binary supplied by the Nix shell. The change ensures uv uses only the Nix-provided system Python and never downloads an alternative interpreter. This improves build reproducibility and reduces supply-chain exposure, but the diff itself does not show an exploitable vulnerability or any incident.
Changed components
shell.nixTrezor firmware Nix build shelluv Python package manager configurationInspect captured patch +6 / −0
diff --git a/shell.nix b/shell.nix
index c0aca672..1a652587 100644
--- a/shell.nix
+++ b/shell.nix
@@ -146,6 +146,12 @@ stdenvNoCC.mkDerivation ({
DYLD_LIBRARY_PATH = "${libffi}/lib:${libjpeg.out}/lib:${libusb1}/lib:${libressl.out}/lib";
NIX_ENFORCE_PURITY = 0;
+ # Force uv to use the nix-provided Python instead of its own managed builds.
+ # Without this, uv defaults to python-preference=managed + python-downloads=automatic,
+ # silently downloading/reusing its own interpreter and ignoring python3 on PATH.
+ UV_PYTHON_PREFERENCE = "only-system";
+ UV_PYTHON_DOWNLOADS = "never";
+
# Fix bdist-wheel problem by setting source date epoch to a more recent date
SOURCE_DATE_EPOCH = 1600000000;
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.