fix(core): enable debuglink when PYOPT=0
What the developer wrote
Authored by cepetr
fix(core): enable debuglink when PYOPT=0
[no changelog]
What changed, and why it matters
This commit changes the build scripts for Trezor hardware wallets so that when building in a non-optimized debug mode (PYOPT=0), a USB debug interface feature is automatically requested. This debug interface is normally used only during development and testing to control and inspect the device. The change itself is small and appears intentional, but enabling debug interfaces in production-like builds can be a security concern if misused. There is no evidence in the commit that this fixes a known security vulnerability; it looks like a build configuration fix.
Verify that PYOPT=0 builds are never used for production firmware releases and that the debuglink interface is properly restricted or disabled in release builds. Review whether this change was intended to fix a broken debug build or to address a security issue where debuglink was unexpectedly absent.
Security signals we found
Debug interface enabled automatically in debug builds
No changelog entry provided
No CVE or security advisory referenced in commit
Change is limited to build scripts and only triggers under PYOPT=0
Evidence from the diff
The patch modifies core/SConscript.firmware and core/SConscript.kernel. When PYOPT == ‘0’ (debug/non-optimized build), it now appends ‘usb_iface_debug’ to FEATURES_WANTED in addition to setting DBG_CONSOLE. This ensures the debuglink USB interface is enabled for debug builds. Debuglink is a Trezor testing feature that allows external control of the device screen and buttons. The change is a build-system fix, not a runtime code change, and only affects debug builds.
Changed components
core/SConscript.firmwarecore/SConscript.kernelTrezor Core debug build configurationInspect captured patch +2 / −0
diff --git a/core/SConscript.firmware b/core/SConscript.firmware
index 534d2064..d369a71f 100644
--- a/core/SConscript.firmware
+++ b/core/SConscript.firmware
@@ -75,6 +75,7 @@ if DISABLE_OPTIGA:
if PYOPT == '0':
DBG_CONSOLE = DBG_CONSOLE or "VCP"
+ FEATURES_WANTED += ["usb_iface_debug"]
if DBG_CONSOLE != "":
FEATURES_WANTED += ["dbg_console"]
diff --git a/core/SConscript.kernel b/core/SConscript.kernel
index d89cf829..8761d328 100644
--- a/core/SConscript.kernel
+++ b/core/SConscript.kernel
@@ -70,6 +70,7 @@ if BITCOIN_ONLY == '0':
if PYOPT == '0':
DBG_CONSOLE = DBG_CONSOLE or "VCP"
+ FEATURES_WANTED += ["usb_iface_debug"]
if DBG_CONSOLE != "":
FEATURES_WANTED += ["dbg_console"]
Why this scored 28/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.