I followed the OTAWebUpdater example in my application, and was able to do OTA updates fine. I then turned on flash encryption in development mode. The OTA updates still work. The same bin is uploaded, and gets encrypted by the chip. But now I want to use flash encryption in production mode. The chip's ability to encrypt is disabled, which is what I want: I know the key and can create a pre-encrypted bin with ESP-IDF tools. This encrypted bin works fine for flashing over USB with ESP-IDF tools. But trying to use the OTA upload with this same file, I get "Wrong magic byte" errors. I see in the Updater.cpp code where these are generated.

I did some research and found users have had similar problems with the esp libraries. Some have claimed to work around this by updating the header check, using raw versions of the write calls, and using a bin generated with the correct address for the currently non-active OTA partition. I tried to make a version of Updater that does similar, and invokes esp_partition_write_raw. The upload now appears to complete successfully, but the new code never runs. I'm not sure what to try next.

Has anyone found a method to do OTA updates with pre-encrypted bin? Or any ideas how I might get this working?