Arduino Zero Fuse Bits - BOOTPROT

I'm working on a custom board with an ATSAMD21G18A, same as the Zero. So far, everything is working, and now I am finishing up with some scripts to allow me to program the bootloader in a production environment without using the Arduino IDE.

I have a script that calls OpenOCD to write the flash with the bootloader, the same as the IDE, but I don't see how to set the fuse bits. Specifically, I want to set BOOTPROT to protect the flash region where the bootloader resides. Am I correct in thinking the IDE does not write this fuse?

Any tips for writing the fuse from the command line? I'm using Mac OS X but could probably use Windows in a pinch.

Answering my own question:

From the OpenOCD manual:

@deffn Command {at91samd bootloader}
Shows or sets the bootloader size configuration, stored in the User Row of the
Flash. This is called the BOOTPROT region. When setting, the bootloader size
must be specified in bytes and it must be one of the permitted sizes according
to the datasheet. Settings are written immediately but only take effect on
MCU reset. Setting the bootloader size to 0 disables bootloader protection.

The script that the IDE runs calls "at91samd bootloader 0," which disables the bootloader protection. The fix is to add in "at91samd bootloader {sizeOf:bootloader}" after the bootloader is flashed. I believe the latest IDE fixes this, but you can edit your bootloader pattern in platform.txt by changing:

tools.openocd.bootloader.pattern="{path}/{cmd}" {bootloader.verbose} -s "{path}/share/openocd/scripts/" -f "{runtime.platform.path}/variants/{build.variant}/{build.openocdscript}" -c "telnet_port disabled; init; halt; at91samd bootloader 0; program {{{runtime.platform.path}/bootloaders/{bootloader.file}}} verify reset; shutdown"

to:

tools.openocd.bootloader.pattern="{path}/{cmd}" {bootloader.verbose} -s "{path}/share/openocd/scripts/" -f "{runtime.platform.path}/variants/{build.variant}/{build.openocdscript}" -c "telnet_port disabled; init; halt; at91samd bootloader 0; program {{{runtime.platform.path}/bootloaders/{bootloader.file}}} verify; at91samd bootloader 8192; reset; shutdown"