From 9582aeeb45ef86229a32071d817ce384092fce0a Mon Sep 17 00:00:00 2001
From: Brett Nicholas <7547222+bigbrett@users.noreply.github.com>
Date: Tue, 16 Jun 2026 14:43:00 -0600
Subject: [PATCH] fix missing sign operation for no-keystore mode

---
 Makefile | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 3fe8cf02..b408ebf9 100644
--- a/Makefile
+++ b/Makefile
@@ -152,6 +152,12 @@ else
     OBJS+=./src/flash_otp_keystore.o
   else ifeq ($(WOLFHSM_NO_KEYSTORE),1)
     CFLAGS+=-DWOLFBOOT_NO_KEYSTORE
+    # No built-in keystore is compiled in, but firmware images must still be
+    # signed (for test/factory builds). src/keystore.o normally triggers
+    # generation of the signing key via 'src/keystore.c: $(PRIVATE_KEY)'.
+    # Without it, tie the key to the bootloader build so the signing key is
+    # still produced before any downstream signing step runs.
+    WOLFBOOT_SIGN_KEY_DEP=$(PRIVATE_KEY)
   else
     OBJS+=./src/keystore.o
   endif
@@ -560,7 +566,7 @@ factory_wstage1.bin: $(BINASSEMBLE) stage1/loader_stage1.bin wolfboot.bin $(BOOT
 wolfboot_stage1.bin: wolfboot.elf stage1/loader_stage1.bin
 	$(Q) cp stage1/loader_stage1.bin wolfboot_stage1.bin
 
-wolfboot.elf: include/target.h $(LSCRIPT) $(OBJS) $(BINASSEMBLE) FORCE
+wolfboot.elf: include/target.h $(LSCRIPT) $(OBJS) $(BINASSEMBLE) $(WOLFBOOT_SIGN_KEY_DEP) FORCE
 	$(Q)(test $(SIGN) = NONE) || (test $(FLASH_OTP_KEYSTORE) = 1) || (test "$(WOLFHSM_NO_KEYSTORE)" = "1") || (grep -q $(SIGN_ALG) src/keystore.c) || \
 		(echo "Key mismatch: please run 'make keysclean' to remove all keys if you want to change algorithm" && false)
 	@echo "\t[LD] $@"