build: ciscript includes firmware sign

so that emulator build uses pipenv to ensure stable environment for python-trezor
but fetching python-trezor and friends doesn't needlessly slow down non-emulator builds
that don't need it

.travis.yml

@@ -33,13 +33,22 @@ matrix:
         - $PYTHON -m pip install --user pipenv
         - pipenv install
       script:
-        - script/cibuild && pipenv run script/test
+        # use outer environment (with protobuf & ecdsa) to build,
+        # then use pipenv to run tests
+        - ./script/cibuild && pipenv run script/test
+
+# using two "separate" python environments is somewhat unwieldy, and it would be nicer
+# to consolidate everything into one.
+# Unfortunately, installing pipenv and fetching python-trezor from git takes about one minute.
+# For now, we keep the envs separate. If the number of "outer" modules grows significantly,
+# they should probably be moved into pipenv.
 
 install:
   - curl -LO "https://github.com/google/protobuf/releases/download/v${PROTOBUF_VERSION}/protoc-${PROTOBUF_VERSION}-linux-x86_64.zip"
   - unzip "protoc-${PROTOBUF_VERSION}-linux-x86_64.zip" -d protoc
   - export PATH="$(pwd)/protoc/bin:$PATH"
   - $PYTHON -m pip install --user "protobuf==${PROTOBUF_VERSION}"
+  - $PYTHON -m pip install --user ecdsa  # for firmware_sign
 
 script:
   - script/cibuild

Makefile.include

@@ -143,10 +143,10 @@ upload: sign
 	trezorctl firmware_update -f $(NAME).bin
 
 sign: $(NAME).bin
-	../bootloader/firmware_sign.py -f $(NAME).bin
+	$(PYTHON) ../bootloader/firmware_sign.py -f $(NAME).bin
 
 release: $(NAME).bin
-	../bootloader/firmware_sign.py -f $(NAME).bin
+	$(PYTHON) ../bootloader/firmware_sign.py -f $(NAME).bin
 	cp $(NAME).bin $(NAME)-$(APPVER).bin
 	chmod -x $(NAME)-$(APPVER).bin
 	xxd -p $(NAME)-$(APPVER).bin | tr -d '\n' > $(NAME)-$(APPVER).bin.hex

script/cibuild

@@ -20,4 +20,4 @@ fi
 make -C vendor/nanopb/generator/proto
 make -C firmware/protob
 
-make -C firmware
+make -C firmware sign