Disable patches check on github

deploy.py

@@ -770,7 +770,8 @@ class OpenSKInstaller:
       info("Nothing to do.")
       return 0
 
-    subprocess.run(["./maintainers/patches", "check"], check=False)
+    if self.args.check_patches:
+      subprocess.run(["./maintainers/patches", "check"], check=False)
 
     # Compile what needs to be compiled
     board_props = SUPPORTED_BOARDS[self.args.board]
@@ -1108,6 +1109,14 @@ if __name__ == "__main__":
             "of variable-time arithmetic for computations over secret key."),
   )
 
+  main_parser.add_argument(
+      "--disable-check-patches",
+      action="store_false",
+      default=True,
+      dest="check_patches",
+      help=("Don't check that patches are in sync with their submodules."),
+  )
+
   main_parser.set_defaults(features=["with_ctap1"])
 
   # Start parsing to know if we're going to list things or not.

maintainers/reproduce_board.sh

@@ -20,10 +20,10 @@ echo "========================================" >> reproducible/elf2tab.txt
 echo "Board: $BOARD" >> reproducible/elf2tab.txt
 echo "----------------------------------------" >> reproducible/elf2tab.txt
 
-./deploy.py --verbose-build --board=$BOARD --no-app --programmer=none
+./deploy.py --verbose-build --disable-check-patches --board=$BOARD --no-app --programmer=none
 ./third_party/tock/tools/sha256sum/target/debug/sha256sum third_party/tock/target/thumbv7em-none-eabi/release/$BOARD.bin >> reproducible/binaries.sha256sum
 tar -rvf reproducible/reproduced.tar third_party/tock/target/thumbv7em-none-eabi/release/$BOARD.bin
 
-./deploy.py --verbose-build --board=$BOARD --opensk --programmer=none --elf2tab-output=reproducible/elf2tab.txt
+./deploy.py --verbose-build --disable-check-patches --board=$BOARD --opensk --programmer=none --elf2tab-output=reproducible/elf2tab.txt
 ./third_party/tock/tools/sha256sum/target/debug/sha256sum target/${BOARD}_merged.hex >> reproducible/binaries.sha256sum
 tar -rvf reproducible/reproduced.tar target/${BOARD}_merged.hex