docker: make jade_builder use jade_builder_base
What the developer wrote
Authored by Jon Griffiths
docker: make jade_builder use jade_builder_base
Also add g++ for building libjade.
What changed, and why it matters
This commit changes the project's Docker build file to use a custom-built base image instead of the upstream Espressif one, and adds the g++ compiler package. The change is described by the project as a workaround for a bug where the upstream Docker image produces bad firmware images for older 1.x Jade devices. There is no security-relevant change visible in the diff itself.
No security action required. Treat as a routine build-infrastructure change. If desired, verify the provenance and contents of the new `blockstream/jade_builder_base` image separately, but that is outside the scope of this diff.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The Dockerfile is updated to replace the upstream espressif/idf:release-v5.4 base image with a Blockstream-maintained blockstream/jade_builder_base image, and to install g++ alongside existing build dependencies (clang-format-19, zlib1g-dev). The commit message frames this as a workaround for a firmware-image generation issue with 1.x devices when using the upstream-built v5.4.3 image. No cryptographic, access-control, or firmware-logic changes are present in the diff.
Changed components
DockerfileInspect captured patch +13 / −6
diff --git a/Dockerfile b/Dockerfile
index 5e3a30a..7ac5eab 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,11 +1,18 @@
# Dockerfile for building Jade firmware. build with e.g:
# $ docker build -t jade_builder .
#
-ARG IDF_INSTALL_TARGETS=esp32,esp32s3
-ARG IDF_CLONE_BRANCH_OR_TAG=v5.4.3
-ARG IDF_CLONE_SHALLOW=1
-# Use the expressif-provided docker which gives us all the tooling plus qemu.
-FROM espressif/idf:release-v5.4@sha256:11441b20e4a87dc722ad6d1ef5a920cf8901a62581d8c85a4299a4c0f142e1a3
+
+# FIXME: The idf built 5.4.3 docker images generates bad firmware images for 1.x
+# devices. Building this image ourselves (see gitlab/docker.yml) works,
+# so use our image instead until upstream is fixed.
+#ARG IDF_INSTALL_TARGETS=esp32,esp32s3
+#ARG IDF_CLONE_BRANCH_OR_TAG=v5.4.3
+#ARG IDF_CLONE_SHALLOW=1
+## Use the expressif-provided docker which gives us all the tooling plus qemu.
+#FROM espressif/idf:release-v5.4@sha256:11441b20e4a87dc722ad6d1ef5a920cf8901a62581d8c85a4299a4c0f142e1a3
+
+# See gitlab/docker.yml to build this image yourself.
+FROM blockstream/jade_builder_base@sha256:3d0c9d275f05e849b0caf4d5846c88c57fbc7f9b74c763693d8dd92fee13987c
# These ARGs are easily parseable (eg by HWI)
ARG ESP_IDF_BRANCH=v5.4.3
@@ -15,7 +22,7 @@ COPY requirements.txt /
# Install libjade/CI dependencies
RUN apt update -yqq
-RUN apt install --no-install-recommends --no-install-suggests -yqq clang-format-19 zlib1g-dev
+RUN apt install --no-install-recommends --no-install-suggests -yqq g++ clang-format-19 zlib1g-dev
# Don't write Python bytecode, so e.g. mounted local directories don't get
# cache files written by root that they can't easily delete.
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.