Trylle

Reproducible Bootloader Build

Independent build of the Baochip v0.10.0 bootloader firmware from source using GNU Guix. The presigned images for bao1x-boot0 and bao1x-boot1 below should be bit-for-bit identical to the official betrusted-io release.

Verify

Download the presign images from both releases and compare:

# From this release (baobit)
for f in bao1x-boot0-presign.img bao1x-boot1-presign.img; do
  curl --proto '=https' --tlsv1.2 -sSfLO \
      "https://github.com/sbellem/baobit/releases/download/v0.10.0-rc.2/$f"
done

# From official release (betrusted-io)
for f in bao1x-boot0-presign.img bao1x-boot1-presign.img; do
  curl --proto '=https' --tlsv1.2 -sSfLo \
      "official-$f" "https://ci.betrusted.io/releases/v0.10.0/baochip/bootloader/$f"
done

# Compare
sha512sum *-presign.img

If hashes match, the official release binary was built from the published source code.

For full verification instructions (including device-level checks), see VERIFY.md.

Assets

File	Description
`bao1x-boot0-presign.img`	Stage 0 bootloader (unsigned)
`bao1x-boot1-presign.img`	Stage 1 bootloader (unsigned)
`bao1x-alt-boot1-presign.img`	Alt stage 1 bootloader (unsigned)
`hashes.txt`	SHA-512 checksums for all files
`sums.txt`	MD5 checksums for all files
`baobit.441559d7.scm`	Guix channels file for reproducing this build
`elf-analysis.tar.gz`	Bootloader ELF analysis reports
`supplementary-images.tar.gz`	All other firmware images (dev-key signed)

Note: Signed .img and .uf2 files in the supplementary archive use development keys. For production firmware, download from the official release.

Reproduce This Build

curl --proto '=https' --tlsv1.2 -sSfLO \
    "https://github.com/sbellem/baobit/releases/download/v0.10.0-rc.2/baobit.441559d7.scm"
guix time-machine --channels=baobit.441559d7.scm -- build bao1x-boot0
guix time-machine --channels=baobit.441559d7.scm -- build bao1x-boot1