flash_the_ttgo_tdisplay

#!/bin/bash
set -o errexit
set -o nounset
set -o pipefail

cleanup() {
  rm -rf -- "${temp_directory}"
  if [ -n "${initial_tty_device_permissions:-}" ] &&
    [ "$(stat -c '%a' "${tty_device}")" != "${initial_tty_device_permissions}" ]; then
    sudo chmod "${initial_tty_device_permissions}" "${tty_device}"
  fi
}

working_directory="${HOME}/Downloads/diy_jade"
temp_directory="${working_directory}/temp"
trap cleanup EXIT

jade_git_tag="1.0.29"
jade_save_directory="${working_directory}/jade"
jade_repo_url="https://github.com/blockstream/jade.git"

esp_idf_git_tag="v5.1.2"
esp_idf_temp_directory="${temp_directory}/esp-idf"
esp_idf_save_directory="${working_directory}/esp-idf"
esp_idf_repo_url="https://github.com/espressif/esp-idf.git"

chosen_device="TTGO T-Display"
tty_device="/dev/ttyACM0"

clear
echo "------------------------------------------------------------"
echo "------------------------------------------------------------"
echo "---                                                      ---"
echo "---          Do-It-Yourself Jade Install Script          ---"
echo "---                Written by Epic Curious               ---"
echo "---                                                      ---"
echo "------------------------------------------------------------"
echo "------------------------------------------------------------"
echo

if [ "$(whoami)" = "root" ]; then
  echo -e "ALERT: You're running the script as root/superuser.\nYou may notice PIP 'sudo -H' warnings.\n"
fi

echo "LINUX ONLY. Flashing the ${chosen_device}..."

while read -r dependency; do
  if ! command -v "${dependency}" &> /dev/null; then
    echo -en "\n\nERROR:\n${dependency} was not found on your system.\nPlease install ${dependency} by running:\n\n"
    if [ "${dependency}" == "pip" ] || [ "${dependency}" == "virtualenv" ]; then
      echo -en "sudo apt update && sudo apt install -y python3-${dependency}\n\n"
    else
      echo -en "sudo apt update && sudo apt install -y ${dependency}\n\n"
    fi
    exit 1
  fi
done < <(curl -fsSL https://github.com/epiccurious/jade-diy/raw/master/depends.txt)

if [ ! -f "${esp_idf_save_directory}"/export.sh ]; then
  git clone --branch "${esp_idf_git_tag}" --single-branch --depth 1 "${esp_idf_repo_url}" "${esp_idf_temp_directory}"
  cd "${esp_idf_temp_directory}"/
  git submodule update --depth 1 --init --recursive
  ./install.sh esp32 &> /dev/null
  source ./export.sh 1> /dev/null
  mv "${esp_idf_temp_directory}" "${esp_idf_save_directory}"
fi
cd "${esp_idf_save_directory}"/
./install.sh esp32
source ./export.sh

if [ ! -d "${jade_save_directory}" ]; then
  git clone --branch "${jade_git_tag}" --single-branch --depth 1 "${jade_repo_url}" "${jade_save_directory}"
  cd "${jade_save_directory}"
  git submodule update --depth 1 --init --recursive &> /dev/null
fi
cd "${jade_save_directory}"
jade_version="$(git describe --tags)"

[ -f sdkconfig ] && mv sdkconfig sdkconfig.bak  # make sure sdkconfig is removed from previous builds

cp configs/sdkconfig_display_ttgo_tdisplay.defaults sdkconfig.defaults
sed -i.bak '/CONFIG_DEBUG_MODE/d' sdkconfig.defaults
sed -i.bak '1s/^/CONFIG_LOG_DEFAULT_LEVEL_NONE=y\n/' sdkconfig.defaults

echo "Would you like to enable Secure Boot?"
echo "Your options are:"
echo "  y - Yes (enable Secure Boot)"
echo "  n - No (do not enable Secure Boot or upgrade Secure Boot disabled device)"
echo "  u - Upgrade (upgrade existing Secure Boot enabled device)"

if [ "${CI:-false}" = true ]; then
  enable_secure_boot=n
else
  while true; do
    read -p "Please select an option (y/n/u): " enable_secure_boot
    case $enable_secure_boot in
      [Yy]* ) echo "Secure Boot is being enabled..."; break;;
      [Nn]* ) echo "Secure Boot will not be enabled."; break;;
      [Uu]* ) echo "Secure Boot enabled device will be upgraded."; break;;
      * ) echo "Invalid option, please enter y, n, or u.";;
    esac
  done
fi

if [[ "$enable_secure_boot" == "y" ]] || [[ "$enable_secure_boot" == "u" ]]; then
  echo -e "\nWARNING: You are about to enable Secure Boot on your device. This process is irreversible. Once Secure Boot is enabled, all future installations, updates, or firmware modifications will require the signing key created during this process. It is crucial to store the signing key (~/jade-diy.pem) in a secure, offline location and remove it from your computer to prevent unauthorized access.\n\n"

  echo -e "Please ensure that you have backed up the signing key and stored it securely offline. Failure to securely store this key could result in being unable to update or modify your device in the future.\n\n"

  echo -e "The process will begin in 10 seconds. Press Ctrl+C to cancel."
  for i in {10..1}; do
    printf "\rStarting in %d seconds..." "$i"
    sleep 1
  done

    if [ ! -f ~/jade-diy.pem ]; then
      openssl genrsa -out ~/jade-diy.pem 3072
    fi

    sed -i.bak '/CONFIG_EFUSE_VIRTUAL/d' sdkconfig.defaults

    sed -i.bak '/CONFIG_ESP32_DISABLE_BASIC_ROM_CONSOLE=/d' sdkconfig.defaults
    echo "CONFIG_ESP32_DISABLE_BASIC_ROM_CONSOLE=y" >> sdkconfig.defaults

    sed -i.bak '/CONFIG_SECURE_DISABLE_ROM_DL_MODE=/d' sdkconfig.defaults
    echo "CONFIG_SECURE_DISABLE_ROM_DL_MODE=y" >> sdkconfig.defaults

    sed -i.bak '/CONFIG_SECURE_BOOT_SIGNING_KEY=/d' sdkconfig.defaults
    echo 'CONFIG_SECURE_BOOT_SIGNING_KEY="../../../jade-diy.pem"' >> sdkconfig.defaults

    sed -i.bak '/CONFIG_SECURE_BOOT=/d' sdkconfig.defaults
    echo "CONFIG_SECURE_BOOT=y" >> sdkconfig.defaults

    sed -i.bak '/CONFIG_SECURE_FLASH_ENC_ENABLED=/d' sdkconfig.defaults
    echo "CONFIG_SECURE_FLASH_ENC_ENABLED=y" >> sdkconfig.defaults

    sed -i.bak '/CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE=/d' sdkconfig.defaults
    echo "CONFIG_SECURE_FLASH_ENCRYPTION_MODE_RELEASE=y" >> sdkconfig.defaults

    sed -i.bak '/CONFIG_ESP32_REV_MIN_/d' sdkconfig.defaults  # remove all REV_MIN entries
    echo "CONFIG_ESP32_REV_MIN_3=y" >> sdkconfig.defaults

    echo "Secure Boot configuration has been updated in sdkconfig.defaults... building bootloader"
    idf.py bootloader
else
    echo "Secure Boot has not been enabled."
fi
rm sdkconfig.defaults.bak

idf.py build

[ "${CI:-false}" = true ] && echo "Exiting the script for CI runners." && exit 0

while [ ! -c "${tty_device}" ]; do
  read -srn1 -p "Connect your ${chosen_device} and PRESS ANY KEY to continue... " && echo
done
initial_tty_device_permissions="$(stat -c '%a' "${tty_device}")"
if [ "${initial_tty_device_permissions:2}" -lt 6 ]; then
  echo -e "\nElevating write permissions for ${chosen_device}"
  sudo chmod o+rw "${tty_device}"
  echo
fi

if [[ "$enable_secure_boot" == "u" ]]; then
  echo "Upgrading secure boot enabled device... please confirm on screen"
  pip install cbor2
  # workaround to prevent changed idf manifest hash to flag build as dirty see https://github.com/Blockstream/Jade/issues/98
  git restore dependencies.lock
  ./jade_ota.py --noagent
  [ $? -eq  0 ] && echo "Update finished"
  exit 0
fi

if [[ "$enable_secure_boot" == "y" ]]; then
  echo "Flashing bootloader..."
  sleep 2
  esptool.py --chip esp32 --before=default_reset --after=no_reset write_flash --flash_mode dio --flash_freq 40m --flash_size keep 0x1000 build/bootloader/bootloader.bin
  echo "Flashing app..."
  sleep 2
  esptool.py --before default_reset --after no_reset --chip esp32  write_flash --flash_mode dio --flash_size keep --flash_freq 40m 0x9000 build/partition_table/partition-table.bin 0xe000 build/ota_data_initial.bin 0x10000 build/jade.bin
  echo -e "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
  echo -e "!!!    Flash complete, NOW WAIT FOR THE DEVICE TO BOOT PROPERLY OR IT WILL BRICK   !!!"
  echo -e "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
  sleep 5
  idf.py monitor
else
  idf.py flash
fi
echo -e "\nSUCCESS! Jade ${jade_version} is now installed on your ${chosen_device}.\nYou can close this window.\n"