fix(core): remove "Go to bootloader" item from non-debug builds
What the developer wrote
Authored by Roman Zeyde
fix(core): remove "Go to bootloader" item from non-debug builds
[no changelog]
What changed, and why it matters
This commit removes a 'Go to bootloader' menu option from normal user builds of the Trezor hardware wallet, keeping it only in debug/developer builds. The change prevents an ordinary user from intentionally or accidentally rebooting the device into bootloader mode through the on-device menu. While entering bootloader mode is a normal part of firmware updates, exposing it in production builds could let a local attacker with brief physical access force the device into a state where they could attempt to install modified firmware or interfere with an update. The patch is narrow: it only hides the menu item behind a debug-only compile flag, so the underlying bootloader entry mechanism still exists for legitimate update workflows.
Treat as a minor hardening change. Verify that production builds no longer show the bootloader menu item, that legitimate firmware-update flows still trigger bootloader mode through other approved paths, and that the RebootToBootloader message cannot be reached from other UI screens or via USB/debug interfaces in production. Consider adding a changelog entry for transparency even though the commit message requests none.
Security signals we found
UI exposure of sensitive reboot-to-bootloader action restricted to debug builds
Potential local physical-access attack surface reduced
No changelog entry provided despite behavior change
Single-line, UI-only mitigation; underlying bootloader entry path remains available
Evidence from the diff
In core/embed/rust/src/ui/layout_eckhart/firmware/device_menu_screen.rs, the commit adds #[cfg(feature = “debug”)] to the MenuItem that emits DeviceMenuMsg::RebootToBootloader. This means the ‘reboot_to_bootloader__title’ entry is compiled into the UI only when the debug feature is enabled. The change is purely UI-level: the firmware still supports the RebootToBootloader message and the underlying reboot-to-bootloader capability, but non-debug builds no longer present the option to the user. The diff is a single-line guard with no changelog entry.
Changed components
core/embed/rust/src/ui/layout_eckhart/firmware/device_menu_screen.rsTrezor Safe 5 / layout_eckhart firmware UI menuDeviceMenuMsg::RebootToBootloader handlingInspect captured patch +1 / −0
diff --git a/core/embed/rust/src/ui/layout_eckhart/firmware/device_menu_screen.rs b/core/embed/rust/src/ui/layout_eckhart/firmware/device_menu_screen.rs
index f13ba30e..f6208e97 100644
--- a/core/embed/rust/src/ui/layout_eckhart/firmware/device_menu_screen.rs
+++ b/core/embed/rust/src/ui/layout_eckhart/firmware/device_menu_screen.rs
@@ -482,6 +482,7 @@ impl DeviceMenuScreen {
TR::buttons__restart.into(),
DeviceMenuMsg::Reboot,
));
+ #[cfg(feature = "debug")]
items.add(MenuItem::return_msg(
TR::reboot_to_bootloader__title.into(),
DeviceMenuMsg::RebootToBootloader,
Why this scored 36/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.