Update build firmware.sh to add no bootloader build by default (#315)
What changed, and why it matters
This change simply updates the project's firmware build script and documentation to also produce a 'no bootloader' firmware image by default. It is a developer convenience for testing on development boards and does not alter any runtime code, cryptographic checks, or security behavior of the actual device firmware.
No security action required. Reviewers may want to confirm that release packaging does not accidentally ship the no-bootloader artifact as a production upgrade file, but the commit itself does not change release behavior.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies build_firmware.sh to run make clean && make disco and copy the resulting bin/hex files into release/disco-nobootloader.{bin,hex}. Documentation files are updated to explain that this artifact is for development-board flashing and matches the nix build output. No source code, bootloader logic, signature verification, or device runtime behavior is changed.
Changed components
build_firmware.shdocs/build.mddocs/reproducible-build.mdInspect captured patch +21 / −0
diff --git a/build_firmware.sh b/build_firmware.sh
index 95cecce..e49ee9f 100755
--- a/build_firmware.sh
+++ b/build_firmware.sh
@@ -40,6 +40,16 @@ echo "
"
+echo -e "${INFO}
+═════════════════════ Building firmware without bootloader ════════════════
+${ENDCOLOR}"
+make clean
+make disco
+cp ./bin/specter-diy.bin ./release/disco-nobootloader.bin
+cp ./bin/specter-diy.hex ./release/disco-nobootloader.hex
+echo -e "Standard firmware without bootloader saved to release/disco-nobootloader.{bin,hex}"
+echo -e "The BIN image can be flashed directly to a development board without the secure bootloader."
+
echo -e "${INFO}
═════════════════════ Adding signature to the binary ══════════════════════
${ENDCOLOR}"
diff --git a/docs/build.md b/docs/build.md
index 798731f..f510ea2 100644
--- a/docs/build.md
+++ b/docs/build.md
@@ -123,6 +123,13 @@ To launch a simulator either run `bin/micropython_unix simulate.py` or simly run
If something is not working you can clean up with `make clean`
+### Automated build script
+
+The top-level `build_firmware.sh` helper runs the full secure build, including the bootloader and signed upgrade package. It
+also creates `release/disco-nobootloader.{bin,hex}`, which contain the plain firmware without the secure bootloader. The
+`disco-nobootloader.bin` image is identical to the `nix build` output and can be flashed directly to a development board when
+you need a faster iteration loop.
+
## Run Unittests
Currently unittests work only on linuxport, and there are... not many... Contributions are very welcome!
diff --git a/docs/reproducible-build.md b/docs/reproducible-build.md
index a258474..f6f1abb 100644
--- a/docs/reproducible-build.md
+++ b/docs/reproducible-build.md
@@ -22,6 +22,10 @@ docker build -t diy .
docker run -ti -v `pwd`:/app diy
```
+The container runs `./build_firmware.sh`, which now also drops `release/disco-nobootloader.{bin,hex}` alongside the signed
+artifacts. The `disco-nobootloader.bin` image matches the standard `nix build` output and can be flashed directly to a
+development board when you want to skip the secure bootloader during testing.
+
At the end of the build you will be presented with a base32 encoded hash of the firmware upgrade file that should be signed and asked to provide signatures.
Get signatures from the description of the github release and enter one by one in the same order as provided in the release.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.