From f7e901bdc04f990f2911a8ece0983796f98bdaa0 Mon Sep 17 00:00:00 2001
From: cj-vana <cj@depth23.online>
Date: Thu, 14 May 2026 21:23:11 -0600
Subject: [PATCH] =?UTF-8?q?forge:=20step=209=20=E2=80=94=20harden=20produc?=
 =?UTF-8?q?tion=20bot=20builds?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...dd-bot-build-flags-and-key-hardening.patch | 59 +++++++++++++++++++
 scripts/build-representative.sh               |  2 +-
 2 files changed, 60 insertions(+), 1 deletion(-)
 create mode 100644 patches/meshcore/0007-Add-bot-build-flags-and-key-hardening.patch

diff --git a/patches/meshcore/0007-Add-bot-build-flags-and-key-hardening.patch b/patches/meshcore/0007-Add-bot-build-flags-and-key-hardening.patch
new file mode 100644
index 0000000..9597828
--- /dev/null
+++ b/patches/meshcore/0007-Add-bot-build-flags-and-key-hardening.patch
@@ -0,0 +1,59 @@
+diff --git a/platformio.ini b/platformio.ini
+index 864e5e1f..dfed7dbd 100644
+--- a/platformio.ini
++++ b/platformio.ini
+@@ -54,6 +54,14 @@ build_src_filter =
+ 
+ ; ----------------- ESP32 ---------------------
+ 
++[cmesh_bot_production]
++build_flags =
++  -D CMESH_BOT_ENABLED=1
++  -UENABLE_PRIVATE_KEY_IMPORT
++  -UENABLE_PRIVATE_KEY_EXPORT
++  -D ENABLE_PRIVATE_KEY_IMPORT=0
++  -D ENABLE_PRIVATE_KEY_EXPORT=0
++
+ [esp32_base]
+ extends = arduino_base
+ platform = platformio/espressif32@6.11.0
+diff --git a/variants/heltec_v3/platformio.ini b/variants/heltec_v3/platformio.ini
+index 803ee683..ca9cf00d 100644
+--- a/variants/heltec_v3/platformio.ini
++++ b/variants/heltec_v3/platformio.ini
+@@ -144,6 +144,7 @@ build_flags =
+   -D MAX_CONTACTS=350
+   -D MAX_GROUP_CHANNELS=40
+   -D DISPLAY_CLASS=SSD1306Display
++  ${cmesh_bot_production.build_flags}
+ ; NOTE: DO NOT ENABLE -->  -D MESH_PACKET_LOGGING=1
+ ; NOTE: DO NOT ENABLE -->  -D MESH_DEBUG=1
+ build_src_filter = ${Heltec_lora32_v3.build_src_filter}
+@@ -163,6 +164,7 @@ build_flags =
+   -D MAX_CONTACTS=350
+   -D MAX_GROUP_CHANNELS=40
+   -D DISPLAY_CLASS=SSD1306Display
++  ${cmesh_bot_production.build_flags}
+   -D BLE_PIN_CODE=123456   ; dynamic, random PIN
+   -D AUTO_SHUTDOWN_MILLIVOLTS=3400
+   -D BLE_DEBUG_LOGGING=1
+diff --git a/variants/rak4631/platformio.ini b/variants/rak4631/platformio.ini
+index ea7e49c3..d6610098 100644
+--- a/variants/rak4631/platformio.ini
++++ b/variants/rak4631/platformio.ini
+@@ -122,6 +122,7 @@ build_flags =
+   -D DISPLAY_CLASS=SSD1306Display
+   -D MAX_CONTACTS=350
+   -D MAX_GROUP_CHANNELS=40
++  ${cmesh_bot_production.build_flags}
+ ; NOTE: DO NOT ENABLE -->  -D MESH_PACKET_LOGGING=1
+ ; NOTE: DO NOT ENABLE -->  -D MESH_DEBUG=1
+ build_src_filter = ${rak4631.build_src_filter}
+@@ -143,6 +144,7 @@ build_flags =
+   -D DISPLAY_CLASS=SSD1306Display
+   -D MAX_CONTACTS=350
+   -D MAX_GROUP_CHANNELS=40
++  ${cmesh_bot_production.build_flags}
+   -D BLE_PIN_CODE=123456
+   -D BLE_DEBUG_LOGGING=1
+   -D OFFLINE_QUEUE_SIZE=256
diff --git a/scripts/build-representative.sh b/scripts/build-representative.sh
index f305a22..7a8e7cf 100644
--- a/scripts/build-representative.sh
+++ b/scripts/build-representative.sh
@@ -102,7 +102,7 @@ export FIRMWARE_VERSION="${FIRMWARE_VERSION:-local}"
 failed_envs=()
 for env in "${REPRESENTATIVE_ENVS[@]}"; do
   log_path="${LOG_DIR}/${env}.log"
-  echo "Building ${env}"
+  echo "Building ${env} (CMESH_BOT_ENABLED=1, private-key import/export disabled)"
   if (cd "$MESHCORE_DIR" && /usr/bin/env bash build.sh build-firmware "$env") >"$log_path" 2>&1; then
     if compgen -G "${MESHCORE_DIR}/out/${env}-*" >/dev/null; then
       cp "${MESHCORE_DIR}/out/${env}-"* "$ARTIFACT_DIR"/