I wanted a hardware security key and after some searching decided to build one myself, based on an open source project and a €10 Waveshare RP2350-One. The build worked on the first try, but it reached out to the network while building, and I realized I didn’t much like not knowing exactly what I was flashing onto my device every time. So I thought maybe Nix could help.
The flake linked above pins every upstream requirement in flake.lock. Nothing is vendored, and the upstream tree isn’t patched. The two mid-build fetches, picotool from git and a git checkout of mbedtls, are supplied from those pinned inputs instead, which is what makes a sandboxed build possible at all.
What surprised me most was that the builds come out bit-identical. Most MCU builds bake in a timestamp or a build path somewhere, so I expected to spend a while patching that out. nix run .#verify rebuilds and diffs against the store.
The flake also includes helpers to flash the board, sign images, and burn the OTP for secure boot. The signing key lives in pass and never enters the store. One of my blog’s readers on Fedora let me know they got it working with nix-user-chroot and successfully flashed their board.
Any feedback or experiences with this form of packaging are very welcome.