build: add a script for testing v1 firmware signing
What the developer wrote
Authored by Jon Griffiths
build: add a script for testing v1 firmware signing
What changed, and why it matters
This commit adds a new build helper script that signs production firmware files with a private key during release testing. It does not change any device code, cryptographic checks, or user-facing behavior. It is purely a release-engineering convenience script.
No security action required. Treat as normal build tooling. Optionally review script for shell quoting and permissions as part of routine release-hardening, but the commit itself introduces no vulnerability.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff introduces release/scripts/v1applysig.sh, a bash script that iterates over staging directories for jade/jade1.1 variants and runs espsecure.py sign_data (ESP32 secure-boot v2) on bootloader.bin and jade.bin using a supplied private key file. The script validates inputs and aborts on errors. No runtime firmware, verification logic, or key material is added; the script only automates an existing signing step.
Changed components
release/scripts/v1applysig.shInspect captured patch +25 / −0
diff --git a/release/scripts/v1applysig.sh b/release/scripts/v1applysig.sh
new file mode 100755
index 0000000..1b290c0
--- /dev/null
+++ b/release/scripts/v1applysig.sh
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+set -e
+
+if [ -z "${1}" -o -z "${2}" ]
+then
+ echo "Usage: ${0} <version/dir> <key_file>"
+ exit 1
+fi
+VER_DIR="${1}"
+KEY=$(realpath ${2})
+
+[ -d staging/${VER_DIR} ] || false # Version directory must exist
+[ -f ${KEY} ] || false # Private key file must exist
+
+VARIANTS="jade jade1.1"
+
+for variant in ${VARIANTS}; do
+ for build_dir in staging/${VER_DIR}/${variant}/build_*prod; do
+ pushd ${build_dir}
+ espsecure.py sign_data --version 2 --keyfile ${KEY} --output bootloader/bootloader_signed.bin bootloader/bootloader.bin
+ espsecure.py sign_data --version 2 --keyfile ${KEY} --output jade_signed.bin jade.bin
+ popd
+ done
+done
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.