Building picblobs

picblobs uses the repository root .bazelrc. The imported modules/picblobs/.bazelrc is retained only as deprecated source context. Invoke every build through Task; the Taskfile owns the required Bazel configurations and declared toolchains.

Module Build

task picblobs:bazel-build
task picblobs:provider-stage
task picblobs:stage

The representative build covers the provider and the supported Linux, Windows, and FreeBSD platform slices. The provider stage copies the Go payload-provider binary into the module package. The blob stage builds platform payloads and extracts release artifacts into the Python package tree.

Pinned Mbed Target Build

First materialize a matched server/client pair, then compile both firmware roles. See the PoC workflow before using real key material.

task picblobs:mbed-blobs -- \
  --server-ip=192.0.2.10 \
  --auth-key-file=/secure/path/mbed-poc.key \
  --port=9999

task picblobs:mbed-compile

The build consumes Mbed OS 5.15.9 at commit dfcb61e052d1192d99a07dca6fb4970281afc8e4 and the GCC ARM 9-2019-q4 Linux toolchain from Bazel repositories pinned by SHA-256. It uses Mbed's real legacy build system for NUCLEO_F429ZI/GCC_ARM, not the POSIX API mocks used by the executable integration test.

Build one role while iterating with either command:

task picblobs:mbed-compile -- --role=server
task picblobs:mbed-compile -- --role=client

Outputs are separated under .local/picblobs/mbed/NUCLEO_F429ZI/GCC_ARM/server/ and client/. A lock serializes clean builds sharing that root. Success requires a nontrivial .bin and an ELF with a valid header; the builder prints each artifact's size and SHA-256.

Validate a Local Mbed Checkout

task picblobs:mbed-compile -- \
  --mbed-os=/absolute/path/to/mbed-os

The override must expose Mbed's tools/make.py and version header and report exactly 5.15.9. When Git metadata is present, the builder also requires the pinned commit. It resolves detached HEADs, symbolic refs, packed refs, and worktree or submodule gitdir/commondir layouts rather than trusting a version string alone. The compiler remains the declared GCC ARM 9.x toolchain, and build output must remain outside both source trees.

Configuration Freshness

Compilation rejects a zero port, zero server IPv4 address, all-zero or mismatched authentication keys, stale blob code, and role headers that do not share the same port and key. Regenerate both headers together with task picblobs:mbed-blobs; do not hand-edit the C arrays. The reference records the exact layouts and source paths.