What the developer wrote
Authored by k9ert
Add bootloader to upgrade binary (#323)
What changed, and why it matters
This commit changes a build script so that the upgrade package now includes the bootloader alongside the main application firmware, and adds a safety flag that stops the script on first error. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a build/packaging improvement.
Review the bootloader upgrade mechanism and upgrade-generator.py to ensure the bootloader is authenticated and that including it in the upgrade package does not introduce downgrade or malicious replacement risks. No immediate action is indicated by the commit alone.
Security signals we found
Build script now includes bootloader in upgrade binary
Build script now fails fast with set -e
No explicit security claim in commit message or diff
Evidence from the diff
The diff modifies build_firmware.sh in the Specter DIY repository. It adds set -e to make the build script fail fast on errors, and adds a -b <bootloader.hex> argument to the upgrade-generator.py invocation so the generated upgrade binary contains the bootloader. The change is small and touches only build tooling. No security relevance is stated in the commit message or diff.
Changed components
build_firmware.shrelease/specter_upgrade.bin generation processInspect captured patch +4 / −2
diff --git a/build_firmware.sh b/build_firmware.sh
index e49ee9f..ad5ad03 100755
--- a/build_firmware.sh
+++ b/build_firmware.sh
@@ -1,4 +1,6 @@
#!/bin/bash
+
+set -e
INFO="\e[1;36m"
ENDCOLOR="\e[0m"
@@ -24,7 +26,7 @@ mkdir -p release
python3 ./bootloader/tools/make-initial-firmware.py -s ./bootloader/build/stm32f469disco/startup/release/startup.hex -b ./bootloader/build/stm32f469disco/bootloader/release/bootloader.hex -f ./bin/specter-diy.hex -bin ./release/initial_firmware.bin
echo -e "Initial firmware saved to release/initial_firmware.bin"
-python3 ./bootloader/tools/upgrade-generator.py gen -f ./bin/specter-diy.hex -p stm32f469disco ./release/specter_upgrade.bin
+python3 ./bootloader/tools/upgrade-generator.py gen -f ./bin/specter-diy.hex -b ./bootloader/build/stm32f469disco/bootloader/release/bootloader.hex -p stm32f469disco ./release/specter_upgrade.bin
cp ./release/specter_upgrade.bin ./release/specter_upgrade_unsigned.bin
echo "Unsigned upgrate file saved to release/specter_upgrade_unsigned.bin"
@@ -74,4 +76,4 @@ cat sha256.txt
echo "
Hashes saved to release/sha256.txt file.
-"
\ No newline at end of file
+"
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.