Reproducible builds for firmware

[SkogsErik]

Summary

Enable reproducible builds so users can verify firmware authenticity.

Current state

Firmware builds are not reproducible. Users must trust binary distribution.

Requirements

• Pin all toolchain versions (esp-idf, gcc, etc.)
• Remove timestamps and random elements from build
• Document build environment (Docker/Nix)
• Provide hash verification instructions

Risk mitigated

• Backdoored firmware distributed by attacker
• Supply chain attacks on build infrastructure

Priority

MEDIUM for security hardening

Implementation notes

• Consider using Nix for hermetic builds
• Docker with pinned base image
• esp-idf has reproducibility challenges (research needed)
• Sign releases with maintainer key

References

• Reproducible Builds
• Nix for reproducibility