Give your contract manufacturer a signed production firmware image, its hash, a flashing procedure and a test plan. Keep private signing keys, debug builds, source code and unreleased SBOMs in house. The factory needs to program and test units, not to build or sign your software.
Why the handoff is a supply chain event
The factory is a supplier with physical access to every unit before it reaches a customer. Anything you hand over can be copied, reused or lost. The goal is to hand over the least that gets units built correctly, in a form that cannot be quietly changed.
The handoff list
| Give the factory | Keep in house |
|---|---|
| Signed production image, versioned | Private signing keys |
| SHA-256 hash sent through a separate channel | Source code and build scripts |
| Flashing and test procedure | Debug and engineering builds |
| Pass or fail criteria per unit | Cloud admin credentials |
| Per-unit identifiers format | Full SBOM, unless contract needs it |
| Contact for deviations | Unreleased firmware |
Steps for a clean handoff
- Sign once, upstream. Your release process produces the image and signs it. The factory never holds a key that can sign.
- Send the hash by a different route. If the image and hash travel together, an attacker who changes one can change the other. A short call or a separate message closes that gap.
- Make the factory verify. The flashing station should check the hash before programming and log the result per batch.
- Lock debug access before units leave the line. Treat an open debug port on shipped units as a defect, and make closing it a pass or fail test item.
- Record serial to firmware version. If you ever need to find devices running a specific build, this table is how.
- Audit the first run. Send someone, or request photos and logs, for the first production batch.
Where problems usually hide
The cheap failure is a development image used because the production one was late. It boots, it passes a basic test, and it ships with test credentials or open debug features. A written rule that the line accepts images matching a published hash, plus a check on a sample from each batch, catches this.
The second failure is a shared folder with every version of firmware in it. Keep the currently approved build alone there and archive the rest on your side.
Contract language to ask for
Talk to your counsel for wording. In practice, ask for: notice of any subcontractor that touches your firmware, a rule on handling of rejected units, and the right to inspect line procedures. Annex I of the Cyber Resilience Act talks about limiting attack surfaces, including external interfaces, so what leaves the factory with open interfaces is your concern as manufacturer.
Where Safeguard fits
Safeguard's SBOM and dependency scanning gives you the component list for your app and backend repositories, which you can attach to a release record. The factory process itself stays a manual control you design.
Quick check
Should the factory build firmware from our source?
Usually no. Building and signing in your own pipeline keeps provenance in one place. The factory flashes a finished, signed image.
Do we need to share the SBOM with the factory?
Rarely. The factory does not need component detail to program units. Share it if a contract says so.
Sources
Last reviewed: 19 October 2026.
