docker: add a CI job for jade_builder_base
What the developer wrote
Authored by Jon Griffiths
docker: add a CI job for jade_builder_base
The idf provided 5.4.3 builds invalid firmwares for 1.x devices. Until
this is fixed upstream, build our own base image using the idf dockerfile.
What changed, and why it matters
This commit adds a new manual CI job that builds a custom Docker base image for compiling Jade firmware. It is a build-infrastructure change, not a code change that affects the device firmware itself. There is no security vulnerability in the diff.
No security action required. Review CI secrets handling (DOCKER_HUB_TOKEN, DOCKER_HUB_USER) as standard hygiene, but the commit itself is benign infrastructure work.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit adds a GitLab CI job build_jade_builder_base in gitlab/docker.yml. It downloads the upstream ESP-IDF v5.4.3 Dockerfile and entrypoint, builds a custom base image with shallow clone and limited target support (esp32, esp32s3), tags it, logs into Docker Hub, and pushes it. The change is purely CI/infrastructure and does not modify firmware, cryptographic, or wallet-handling code.
Changed components
gitlab/docker.ymlInspect captured patch +35 / −0
diff --git a/gitlab/docker.yml b/gitlab/docker.yml
index 0c75415..4c90634 100644
--- a/gitlab/docker.yml
+++ b/gitlab/docker.yml
@@ -1,3 +1,38 @@
+build_jade_builder_base:
+ stage: docker_build
+ needs: []
+ when: manual
+ variables:
+ DOCKER_HOST: tcp://localhost:2375
+ DOCKER_TLS_CERTDIR: ""
+ DOCKER_BUILDKIT: 1
+ BUILDX_GIT_INFO: false
+ image: docker:23
+ services:
+ - docker:23-dind
+ tags:
+ - cloud
+ retry:
+ max: 2
+ when: [runner_system_failure, unknown_failure, stuck_or_timeout_failure]
+ script:
+ - mkdir tmp
+ - cd tmp
+ - wget https://github.com/espressif/esp-idf/raw/refs/tags/v5.4.3/tools/docker/Dockerfile
+ - wget https://github.com/espressif/esp-idf/raw/refs/tags/v5.4.3/tools/docker/entrypoint.sh
+ - docker build
+ --network=host
+ --build-arg IDF_CLONE_BRANCH_OR_TAG=v5.4.3
+ --build-arg IDF_CLONE_SHALLOW=1
+ --build-arg IDF_INSTALL_TARGETS=esp32,esp32s3
+ -t blockstream/jade_builder_base:${CI_COMMIT_SHA}
+ -t blockstream/jade_builder_base:latest
+ .
+ --progress=plain
+ - echo "$DOCKER_HUB_TOKEN" | docker login --username "$DOCKER_HUB_USER" --password-stdin
+ - docker push blockstream/jade_builder_base:${CI_COMMIT_SHA}
+ - if [ ${CI_COMMIT_BRANCH} == "master" ]; then docker push blockstream/jade_builder_base:latest; fi
+
build_jade_builder:
stage: docker_build
needs: []
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.