Build the firmware

The firmware is compiled on the Pi itself, so the code that runs on your wallet never passes through another machine as a finished program.

What the DIY version changes

The source comes from OneKey’s Classic 1S firmware, plus a small set of changes for running it on a Pi. Those changes matter, because the version of this firmware that runs on a normal computer was made for developers testing it, not for holding money:

Randomness from the chip. The unchanged version creates the same recovery phrase on every computer, because its random numbers come from a fixed formula. The DIY version reads them straight from the hardware random number generator in the Pi’s chip, which samples electronic noise. It tests every byte with the start-up and continuous health tests from NIST SP 800-90B and condenses four times as many bytes as it uses with SHA-256. If the generator is missing or fails a test, the wallet stops instead of creating a phrase.
No outside access. The unchanged version accepts connections from the whole network. The DIY version only from programs on the Pi itself.
Debug interface off. The debug interface can read out the recovery phrase. The build command below switches it off.
Screen and buttons. Drawing on the 1.3-inch screen and reading the joystick, instead of opening a window on a desktop.
Storage tied to this board. The stored wallet is encrypted with a key that also depends on this Pi’s serial number.

Every change is in one commit you can read in full: the DIY changes on GitHub.

Install the build tools

On the Pi

sudo apt update
sudo apt install -y git build-essential python3-venv protobuf-compiler libprotobuf-dev

Download the source

This downloads about 600 MB.

On the Pi

git clone --depth 1 --branch diy https://github.com/rayston92/firmware-classic1s.git ~/wallet
cd ~/wallet
git submodule update --init --recursive --depth 1

Check that you have exactly the code this guide was written for:

On the Pi

git log -1 --format=%H

It should print 3ea4eb1d01d38fe1b2989a4fcf263441c1ac9d4c. If it prints something else, the branch has changed since this guide was checked. Read what changed before you continue.

Set up Python

The build uses a few Python tools to generate code. Keep them in their own folder:

On the Pi

python3 -m venv ~/wallet-venv
. ~/wallet-venv/bin/activate
pip install "nanopb==0.4.*" protobuf mako munch click requests typing_extensions

Compile

On the Pi

cd ~/wallet/legacy
EMULATOR=1 DIY_HAT=1 DEBUG_LINK=0 BITCOIN_ONLY=1 ./script/cibuild

BITCOIN_ONLY=1 leaves out every coin except Bitcoin, as you chose on Your build.

This takes a while on a Pi Zero 2 W: probably one to two hours (it hasn’t been timed on a real Pi yet). Lines starting with CC scroll past while it works. Warnings are normal; it is finished when the prompt comes back. Keep your computer awake until then: if the SSH window closes, the build stops. Log in again and run the same command, and it carries on where it stopped.

If you log in again later, run . ~/wallet-venv/bin/activate before building again.

Checkpoint

On the Pi

ls -lh firmware/onekey_emu.elf

You should see one file, about 5 MB7 MB in size. That is your wallet’s firmware.