build: use the espressif-provided docker file to build
What the developer wrote
Authored by Jon Griffiths
build: use the espressif-provided docker file to build
Bumps the idf version to 5.4.3.
What changed, and why it matters
This commit only changes how the project's firmware is built. It switches the build container from a generic Debian image to an official Espressif image and updates the ESP-IDF (Espressif's development framework) version from 5.4 to 5.4.3. There is no indication in the commit of any security bug, vulnerability fix, or change to the firmware code itself.
No security action required. Treat as a routine build-system maintenance change. If desired, verify the SHA256 of the upstream Espressif image and review the ESP-IDF 5.4.3 release notes for any relevant toolchain or component fixes before adopting this build image.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The Dockerfile is refactored to base the build environment on espressif/idf:release-v5.4 (sha256:11441b20e4a87dc722ad6d1ef5a920cf8901a62581d8c85a4299a4c0f142e1a3) instead of debian:bookworm-slim. It bumps ESP_IDF_BRANCH from v5.4 to v5.4.3 and ESP_IDF_COMMIT to ea1c174c1cbb7348bd8ba0ff1eb306246938dd80. Build dependencies are simplified, Python dependencies are installed into the IDF virtualenv, and QEMU support is inherited from the upstream image. No application/firmware source code is modified.
Changed components
Dockerfile (build environment only)Inspect captured patch +21 / −5
diff --git a/Dockerfile b/Dockerfile
index 0085fc7..76ebdb6 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,26 @@
-FROM debian:bookworm-slim@sha256:12c396bd585df7ec21d5679bb6a83d4878bc4415ce926c9e5ea6426d23c60bdc
+# Dockerfile for building Jade firmware. build with e.g:
+# $ docker build -t jade_builder .
+#
+ARG IDF_INSTALL_TARGETS=esp32,esp32s3
+ARG IDF_CLONE_BRANCH_OR_TAG=v5.4.3
+ARG IDF_CLONE_SHALLOW=1
+# Use the expressif-provided docker which gives us all the tooling plus qemu.
+FROM espressif/idf:release-v5.4@sha256:11441b20e4a87dc722ad6d1ef5a920cf8901a62581d8c85a4299a4c0f142e1a3
# These ARGs are easily parseable (eg by HWI)
-ARG ESP_IDF_BRANCH=v5.4
-ARG ESP_IDF_COMMIT=67c1de1eebe095d554d281952fde63c16ee2dca0
+ARG ESP_IDF_BRANCH=v5.4.3
+ARG ESP_IDF_COMMIT=ea1c174c1cbb7348bd8ba0ff1eb306246938dd80
-SHELL ["/bin/bash", "-c"]
COPY requirements.txt /
-RUN dpkg --add-architecture i386 && apt-get update -qq && apt-get upgrade --no-install-recommends --no-install-suggests -yqq && apt-get install --no-install-recommends --no-install-suggests -yqq git wget libncurses-dev flex bison gperf libffi-dev libssl-dev dfu-util cmake ninja-build build-essential ca-certificates ccache curl make pkg-config python3 python3-dev python3-pip python3-setuptools python3-serial python3-click python3-cryptography python3-future python3-pyparsing python3-pyelftools python3-pkg-resources python3-wheel python3-venv python3-sphinx unzip bluez-tools bluez libusb-1.0-0 clang lld clang-format libglib2.0 libpixman-1-0 libsdl2-2.0-0 libgcrypt20-dev virtualenv libslirp0 gcc-multilib libc6-dev-i386 libsdl2-dev:i386 libcurl4-openssl-dev:i386 libmbedtls-dev:i386 && apt-get -yqq autoremove && apt-get -yqq clean && rm -rf /var/lib/apt/lists/* /var/cache/* /tmp/* /usr/share/doc /usr/share/man /usr/share/info /usr/share/locale /usr/share/common-licenses && update-alternatives --install /usr/bin/python python /usr/bin/python3 10 && python3 -m pip install --break-system-packages --user pycodestyle && mkdir ~/esp && cd ~/esp && git clone --quiet --depth=1 --branch ${ESP_IDF_BRANCH} --single-branch --recursive --shallow-submodules https://github.com/espressif/esp-idf.git && cd ~/esp/esp-idf && git checkout ${ESP_IDF_COMMIT} && ./install.sh esp32 esp32s3 && python ~/esp/esp-idf/tools/idf_tools.py install qemu-xtensa && virtualenv -p python3 /venv && source /venv/bin/activate && pip install --require-hashes -r /requirements.txt
+# Install libjade/CI dependencies
+RUN apt update -yqq
+RUN apt install --no-install-recommends --no-install-suggests -yqq clang-format-19 zlib1g-dev
+
+# Don't write Python bytecode, so e.g. mounted local directories don't get
+# cache files written by root that they can't easily delete.
+ENV PYTHONDONTWRITEBYTECODE=1
+
+# Install our Python dependencies directly into the idf environment,
+# to prevent any confusion over which env we are in at any given time.
+RUN cd /opt/esp/idf && . ./export.sh && pip install --require-hashes -r /requirements.txt && pip install sphinx
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.