secure boot: Add warnings this feature is not finished yet

diff --git a/components/bootloader/Makefile.projbuild b/components/bootloader/Makefile.projbuild
index 3ed5e187839510677619d6ad4a3e4926d2c6db49..551bceb981cecdfe7fc4a9272d8b44db3659ce77 100644 (file)
--- a/components/bootloader/Makefile.projbuild
+++ b/components/bootloader/Makefile.projbuild
@@ -47,6 +47,16 @@ bootloader-flash: $(BOOTLOADER_BIN)
        $(BOOTLOADER_MAKE) flash
 
 else ifdef CONFIG_SECURE_BOOTLOADER_ONE_TIME_FLASH
+
+#### TEMPORARILY DISABLE THIS OPTION
+ifneq ("$(IDF_INSECURE_SECURE_BOOT)","1")
+bootloader:
+       @echo "Secure boot features are not yet mature, so the current secure bootloader will not properly secure the device"
+       @echo "If you flash this bootloader, you will be left with an non-updateable bootloader that is missing features."
+       @echo "If you really want to do this, set the environment variable IDF_INSECURE_SECURE_BOOT=1 and rerun make."
+       exit 1
+else
+
 # One time flashing requires user to run esptool.py command themselves,
 # and warning is printed about inability to reflash.
 
@@ -57,10 +67,20 @@ bootloader: $(BOOTLOADER_BIN)
        @echo $(SEPARATOR)
        @echo "* IMPORTANT: After first boot, BOOTLOADER CANNOT BE RE-FLASHED on same device"
 
+endif # IDF_INSECURE_SECURE_BOOT
 else ifdef CONFIG_SECURE_BOOTLOADER_REFLASHABLE
 # Reflashable secure bootloader
 # generates a digest binary (bootloader + digest)
 
+#### TEMPORARILY DISABLE THIS OPTION
+ifneq ("$(IDF_INSECURE_SECURE_BOOT)","1")
+bootloader:
+       @echo "Secure boot features are not yet mature, so the current secure bootloader will not properly secure the device."
+       @echo "If using this feature, expect to reflash the bootloader at least one more time."
+       @echo "If you really want to do this, set the environment variable IDF_INSECURE_SECURE_BOOT=1 and rerun make."
+       exit 1
+else
+
 BOOTLOADER_DIGEST_BIN := $(BOOTLOADER_BUILD_DIR)/bootloader-reflash-digest.bin
 SECURE_BOOTLOADER_KEY := $(BOOTLOADER_BUILD_DIR)/secure-bootloader-key.bin
 
@@ -83,6 +103,7 @@ $(BOOTLOADER_DIGEST_BIN): $(BOOTLOADER_BIN) $(SECURE_BOOTLOADER_KEY)
        @echo "DIGEST $(notdir $@)"
        $(Q) $(ESPSECUREPY) digest_secure_bootloader -k $(SECURE_BOOTLOADER_KEY) -o $@ $<
 
+endif # IDF_INSECURE_SECURE_BOOT
 else
 bootloader:
        @echo "Invalid bootloader target: bad sdkconfig?"

diff --git a/docs/security/secure-boot.rst b/docs/security/secure-boot.rst
index c08b17cb47ffa9b637c5a3c9c9323ebc848e9cfc..bdc1b716996456888a73494096497047dfca73cf 100644 (file)
--- a/docs/security/secure-boot.rst
+++ b/docs/security/secure-boot.rst
@@ -5,6 +5,7 @@ Secure Boot is a feature for ensuring only your code can run on the chip. Data l
 
 Secure Boot is separate from the Encrypted Flash feature, and you can use secure boot without encrypting the flash contents. However we recommend using both features together for a secure environment.
 
+**IMPORTANT: As Encrypted Flash feature and related security features are not yet released, Secure Boot should not be considered sufficient for a secure device and we strongly recommend not enabling the one-time secure bootloader feature until it is mature.**
 
 Background
 ----------