chore: adding the bootloader to upgrade binary for next release
What the developer wrote
Authored by k9ert
chore: adding the bootloader to upgrade binary for next release
What changed, and why it matters
This is a build-script change for a hardware-wallet project. It adds a command-line flag so that the upgrade package generator includes the bootloader file alongside the main firmware. It also adds `set -e` so the build script stops on errors. There is no direct evidence in the commit that this fixes or introduces a security vulnerability; it appears to be a release-engineering change.
Review the bootloader upgrade mechanism and signing process for the upgrade binary, since bundling the bootloader increases the attack surface of the upgrade package. Verify that the bootloader image is authenticated before flashing and that downgrade or malicious bootloader replacement is prevented. No immediate action is required solely based on this commit.
Security signals we found
Build script now bundles bootloader into upgrade binary
Build script now exits on first error (`set -e`)
No security-relevant description in commit message or diff
Evidence from the diff
The commit modifies build_firmware.sh. It adds set -e for stricter shell error handling and passes -b ./bootloader/build/stm32f469disco/bootloader/release/bootloader.hex to upgrade-generator.py when generating specter_upgrade.bin. This causes the upgrade binary to bundle the bootloader. The commit title frames this as a release preparation step (‘chore’). No vulnerability, CVE, or security advisory is mentioned in the commit or supplied references.
Changed components
build_firmware.shrelease/specter_upgrade.bin generation processInspect captured patch +5 / −2
diff --git a/build_firmware.sh b/build_firmware.sh
index 95cecce..2822c71 100755
--- a/build_firmware.sh
+++ b/build_firmware.sh
@@ -1,4 +1,7 @@
#!/bin/bash
+
+set -e
+
INFO="\e[1;36m"
ENDCOLOR="\e[0m"
@@ -24,7 +27,7 @@ mkdir -p release
python3 ./bootloader/tools/make-initial-firmware.py -s ./bootloader/build/stm32f469disco/startup/release/startup.hex -b ./bootloader/build/stm32f469disco/bootloader/release/bootloader.hex -f ./bin/specter-diy.hex -bin ./release/initial_firmware.bin
echo -e "Initial firmware saved to release/initial_firmware.bin"
-python3 ./bootloader/tools/upgrade-generator.py gen -f ./bin/specter-diy.hex -p stm32f469disco ./release/specter_upgrade.bin
+python3 ./bootloader/tools/upgrade-generator.py gen -f ./bin/specter-diy.hex -b ./bootloader/build/stm32f469disco/bootloader/release/bootloader.hex -p stm32f469disco ./release/specter_upgrade.bin
cp ./release/specter_upgrade.bin ./release/specter_upgrade_unsigned.bin
echo "Unsigned upgrate file saved to release/specter_upgrade_unsigned.bin"
@@ -64,4 +67,4 @@ cat sha256.txt
echo "
Hashes saved to release/sha256.txt file.
-"
\ No newline at end of file
+"
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.