Skip to content

Commit 810adaf

Browse files
jgriffithsDaniel Newton
jgriffiths
authored and
Daniel Newton
committed
build: standardize v2 scripts to use HWDIRS as per v1
No functional changes.
1 parent 5e3c402 commit 810adaf

File tree

3 files changed

+157
-137
lines changed

3 files changed

+157
-137
lines changed

‎release/scripts/v2applysigs.sh‎

Lines changed: 48 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ VER_DIR="${1}"
1010
shift
1111
SIGNER_KEY_LABELS="$@"
1212

13-
WORKING_DIR="staging/${VER_DIR}/jade2.0"
13+
WORKING_DIR_PREFIX="staging/${VER_DIR}"
14+
HWDIRS="jade2.0"
1415

1516
BLEDIR="build_v2_prod"
1617
NORADIODIR="build_v2_noradio_prod"
@@ -29,53 +30,58 @@ do
2930
PUBKEYS="${PUBKEYS} ../../../scripts/${key_label}.pub"
3031
done
3132

32-
pushd "${WORKING_DIR}"
33+
for hwdir in ${HWDIRS}; do
34+
WORKING_DIR="${WORKING_DIR_PREFIX}/${hwdir}"
3335

34-
for build in ${BUILDS}
35-
do
36-
for binary in ${BINARIES}
36+
pushd "${WORKING_DIR}"
37+
38+
for build in ${BUILDS}
3739
do
38-
sig_files=""
39-
for key_label in ${SIGNER_KEY_LABELS}
40+
for binary in ${BINARIES}
4041
do
41-
sig_file="${FILE_PREFIX}_${build}_${binary}.${key_label}.sig"
42-
sig_files="${sig_files} ${sig_file}"
43-
done
42+
sig_files=""
43+
for key_label in ${SIGNER_KEY_LABELS}
44+
do
45+
sig_file="${FILE_PREFIX}_${build}_${binary}.${key_label}.sig"
46+
sig_files="${sig_files} ${sig_file}"
47+
done
4448

45-
file_prefix="${FILE_PREFIX}_${build}_${binary}"
46-
infile="${file_prefix}.${FW_SUFFIX}"
47-
outfile="${file_prefix}_${SIGNED_SUFFIX}"
49+
file_prefix="${FILE_PREFIX}_${build}_${binary}"
50+
infile="${file_prefix}.${FW_SUFFIX}"
51+
outfile="${file_prefix}_${SIGNED_SUFFIX}"
52+
53+
espsecure.py sign_data --version 2 --pub-key ${PUBKEYS} --signature ${sig_files} --output "${outfile}" "${infile}"
54+
digests=""
55+
for pubkey in ${PUBKEYS}
56+
do
57+
# Verify the signature
58+
espsecure.py verify_signature --version 2 --keyfile "${pubkey}" "${outfile}"
59+
# Capture the signature digest
60+
digest=$(espsecure.py digest_sbv2_public_key --keyfile "${pubkey}" -o digest.bin >/dev/null && cat digest.bin | od -A n -t x1 | tr -d ' \n' && rm -f digest.bin)
61+
digests="$digests $digest"
62+
done
63+
# Make sure the signature digests match
64+
digests=$(echo ${digests} | tr ' ' '\n' | sort)
65+
file_digests=$(espsecure.py signature_info_v2 "${outfile}" | grep "Public key digest for block " | cut -d\: -f2 | sed "s/ //g" | sort)
66+
if [ "${digests}" != "${file_digests}" ]; then
67+
echo "mismatched digests:"
68+
echo "digests:"
69+
echo ${digests}
70+
echo "expected:"
71+
echo ${file_digests}
72+
exit 2
73+
fi
74+
done
4875

49-
espsecure.py sign_data --version 2 --pub-key ${PUBKEYS} --signature ${sig_files} --output "${outfile}" "${infile}"
50-
digests=""
51-
for pubkey in ${PUBKEYS}
52-
do
53-
# Verify the signature
54-
espsecure.py verify_signature --version 2 --keyfile "${pubkey}" "${outfile}"
55-
# Capture the signature digest
56-
digest=$(espsecure.py digest_sbv2_public_key --keyfile "${pubkey}" -o digest.bin >/dev/null && cat digest.bin | od -A n -t x1 | tr -d ' \n' && rm -f digest.bin)
57-
digests="$digests $digest"
58-
done
59-
# Make sure the signature digests match
60-
digests=$(echo ${digests} | tr ' ' '\n' | sort)
61-
file_digests=$(espsecure.py signature_info_v2 "${outfile}" | grep "Public key digest for block " | cut -d\: -f2 | sed "s/ //g" | sort)
62-
if [ "${digests}" != "${file_digests}" ]; then
63-
echo "mismatched digests:"
64-
echo "digests:"
65-
echo ${digests}
66-
echo "expected:"
67-
echo ${file_digests}
68-
exit 2
69-
fi
7076
done
77+
sha256sum "${FILE_PREFIX}"_*_"${SIGNED_SUFFIX}"
7178

72-
done
73-
sha256sum "${FILE_PREFIX}"_*_"${SIGNED_SUFFIX}"
79+
# Copy main fw binaries that have been signed, consistent with v1
80+
cp "${FILE_PREFIX}_ble_jade_${SIGNED_SUFFIX}" "${BLEDIR}/jade_${SIGNED_SUFFIX}"
81+
cp "${FILE_PREFIX}_noradio_jade_${SIGNED_SUFFIX}" "${NORADIODIR}/jade_${SIGNED_SUFFIX}"
82+
cp "${FILE_PREFIX}_ble_bootloader_${SIGNED_SUFFIX}" "${BLEDIR}/bootloader/bootloader_${SIGNED_SUFFIX}"
83+
cp "${FILE_PREFIX}_noradio_bootloader_${SIGNED_SUFFIX}" "${NORADIODIR}/bootloader/bootloader_${SIGNED_SUFFIX}"
7484

75-
# Copy main fw binaries that have been signed, consistent with v1
76-
cp "${FILE_PREFIX}_ble_jade_${SIGNED_SUFFIX}" "${BLEDIR}/jade_${SIGNED_SUFFIX}"
77-
cp "${FILE_PREFIX}_noradio_jade_${SIGNED_SUFFIX}" "${NORADIODIR}/jade_${SIGNED_SUFFIX}"
78-
cp "${FILE_PREFIX}_ble_bootloader_${SIGNED_SUFFIX}" "${BLEDIR}/bootloader/bootloader_${SIGNED_SUFFIX}"
79-
cp "${FILE_PREFIX}_noradio_bootloader_${SIGNED_SUFFIX}" "${NORADIODIR}/bootloader/bootloader_${SIGNED_SUFFIX}"
85+
popd
8086

81-
popd
87+
done

‎release/scripts/v2jadesign.sh‎

Lines changed: 64 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
#!/bin/bash
22

3+
set -e
4+
35
function usage {
46
echo "Usage: ${0} <version/dir> <key_label> [--serialport PORT]"
57
}
@@ -32,7 +34,8 @@ if [ -z "${VER_DIR}" -o -z "${KEY_LABEL}" ]; then
3234
exit 1
3335
fi
3436

35-
WORKING_DIR="staging/${VER_DIR}/jade2.0"
37+
WORKING_DIR_PREFIX="staging/${VER_DIR}"
38+
HWDIRS="jade2.0"
3639

3740
# Can log if required
3841
LOGGING=""
@@ -61,71 +64,76 @@ HASH_OPTS="-sha256 -binary"
6164
VERIFY_OPTS="-pubin -inkey ${PUBKEY} -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pss"
6265
JADE_SIGN_CMD="python ../../../../jade_bip85_rsa_sign.py ${JADE_SERIAL_ARG} ${LOGGING} ${CHECK_JADE_PUBKEY} --keylen ${KEYLEN} --index ${INDEX} --digest-files"
6366

64-
pushd "${WORKING_DIR}"
67+
for hwdir in ${HWDIRS}; do
68+
WORKING_DIR="${WORKING_DIR_PREFIX}/${hwdir}"
6569

66-
# Verify bootloaders are same
67-
sha1=$(sha256sum "${BLEDIR}/bootloader/bootloader.bin" | cut -d\ -f1)
68-
sha2=$(sha256sum "${NORADIODIR}/bootloader/bootloader.bin" | cut -d\ -f1)
69-
if [ -z "${sha1}" -o -z "${sha2}" -o "${sha1}" != "${sha2}" ]
70-
then
71-
echo "Bootloaders missing or differ!"
72-
popd
73-
exit 2
74-
fi
70+
pushd "${WORKING_DIR}"
7571

76-
# Copy binaries that need signing
77-
cp "${BLEDIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_ble_bootloader.bin"
78-
cp "${BLEDIR}/jade.bin" "${FILE_PREFIX}_ble_jade.bin"
79-
cp "${NORADIODIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_noradio_bootloader.bin"
80-
cp "${NORADIODIR}/jade.bin" "${FILE_PREFIX}_noradio_jade.bin"
81-
82-
# Hash the bootloaders and fws locally
83-
HASH_FILES=""
84-
for build in "ble" "noradio"
85-
do
86-
for program in "bootloader" "jade"
87-
do
88-
binary="${FILE_PREFIX}_${build}_${program}.bin"
89-
hash_file="${FILE_PREFIX}_${build}_${program}.hash"
90-
HASH_FILES="${HASH_FILES} ${hash_file}"
72+
# Verify bootloaders are same
73+
sha1=$(sha256sum "${BLEDIR}/bootloader/bootloader.bin" | cut -d\ -f1)
74+
sha2=$(sha256sum "${NORADIODIR}/bootloader/bootloader.bin" | cut -d\ -f1)
75+
if [ -z "${sha1}" -o -z "${sha2}" -o "${sha1}" != "${sha2}" ]
76+
then
77+
echo "Bootloaders missing or differ!"
78+
popd
79+
exit 2
80+
fi
81+
82+
# Copy binaries that need signing
83+
cp "${BLEDIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_ble_bootloader.bin"
84+
cp "${BLEDIR}/jade.bin" "${FILE_PREFIX}_ble_jade.bin"
85+
cp "${NORADIODIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_noradio_bootloader.bin"
86+
cp "${NORADIODIR}/jade.bin" "${FILE_PREFIX}_noradio_jade.bin"
9187

92-
openssl dgst ${HASH_OPTS} -out "${hash_file}" "${binary}"
88+
# Hash the bootloaders and fws locally
89+
HASH_FILES=""
90+
for build in "ble" "noradio"
91+
do
92+
for program in "bootloader" "jade"
93+
do
94+
binary="${FILE_PREFIX}_${build}_${program}.bin"
95+
hash_file="${FILE_PREFIX}_${build}_${program}.hash"
96+
HASH_FILES="${HASH_FILES} ${hash_file}"
97+
98+
openssl dgst ${HASH_OPTS} -out "${hash_file}" "${binary}"
99+
done
93100
done
94-
done
95101

96-
# Sign the hashes with jade
97-
echo "Please approve signing on your Jade device"
98-
${JADE_SIGN_CMD} ${HASH_FILES}
102+
# Sign the hashes with jade
103+
echo "Please approve signing on your Jade device"
104+
${JADE_SIGN_CMD} ${HASH_FILES}
99105

100-
# Check signatures with labeled pubkey, and rename if good
101-
for build in "ble" "noradio"
102-
do
103-
for program in "bootloader" "jade"
106+
# Check signatures with labeled pubkey, and rename if good
107+
for build in "ble" "noradio"
104108
do
105-
hash_file="${FILE_PREFIX}_${build}_${program}.hash"
106-
sig_file="${hash_file}.sig"
107-
openssl pkeyutl -verify ${VERIFY_OPTS} -sigfile "${sig_file}" -in "${hash_file}"
108-
if [ "${?}" -eq 0 ]
109-
then
110-
mv ${sig_file} "${FILE_PREFIX}_${build}_${program}.${SIG_SUFFIX}"
111-
rm "${hash_file}"
112-
else
113-
echo "Signature verification of ${sig_file} over ${hash_file} with ${PUBKEY} failed"
114-
fi
109+
for program in "bootloader" "jade"
110+
do
111+
hash_file="${FILE_PREFIX}_${build}_${program}.hash"
112+
sig_file="${hash_file}.sig"
113+
openssl pkeyutl -verify ${VERIFY_OPTS} -sigfile "${sig_file}" -in "${hash_file}"
114+
if [ "${?}" -eq 0 ]
115+
then
116+
mv ${sig_file} "${FILE_PREFIX}_${build}_${program}.${SIG_SUFFIX}"
117+
rm "${hash_file}"
118+
else
119+
echo "Signature verification of ${sig_file} over ${hash_file} with ${PUBKEY} failed"
120+
fi
121+
done
115122
done
116-
done
117123

118-
sha256sum *."${SIG_SUFFIX}"
124+
sha256sum *."${SIG_SUFFIX}"
119125

120-
# Verify jade pubkey matches expected (if feched)
121-
if [ -n "${CHECK_JADE_PUBKEY}" ]
122-
then
123-
sha1=$(sha256sum "${PUBKEY}" | cut -d\ -f1)
124-
sha2=$(sha256sum "${JADE_PUBKEY_FILE}" | cut -d\ -f1)
125-
if [ -z "${sha1}" -o -z "${sha2}" -o "${sha1}" != "${sha2}" ]
126+
# Verify jade pubkey matches expected (if feched)
127+
if [ -n "${CHECK_JADE_PUBKEY}" ]
126128
then
127-
echo "Error: Pubkey pem mismatch!"
129+
sha1=$(sha256sum "${PUBKEY}" | cut -d\ -f1)
130+
sha2=$(sha256sum "${JADE_PUBKEY_FILE}" | cut -d\ -f1)
131+
if [ -z "${sha1}" -o -z "${sha2}" -o "${sha1}" != "${sha2}" ]
132+
then
133+
echo "Error: Pubkey pem mismatch!"
134+
fi
128135
fi
129-
fi
130136

131-
popd
137+
popd
138+
139+
done

‎release/scripts/v2sign.sh‎

Lines changed: 45 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,8 @@ fi
1010
VER_DIR="${1}"
1111
KEY_LABEL="${2}"
1212

13-
WORKING_DIR="staging/${VER_DIR}/jade2.0"
13+
WORKING_DIR_PREFIX="staging/${VER_DIR}"
14+
HWDIRS="jade2.0"
1415

1516
# Relative paths from where it will be referenced in fw dir
1617
KEY="../../../scripts/${KEY_LABEL}.pem"
@@ -26,49 +27,54 @@ HASH_OPTS="-sha256 -binary"
2627
SIGN_OPTS="-inkey ${KEY} -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pss -pkeyopt rsa_pss_saltlen:32 -pkeyopt rsa_mgf1_md:sha256"
2728
VERIFY_OPTS="-pubin -inkey ${PUBKEY} -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pss"
2829

29-
pushd "${WORKING_DIR}"
30+
for hwdir in ${HWDIRS}; do
31+
WORKING_DIR="${WORKING_DIR_PREFIX}/${hwdir}"
3032

31-
[ -f ${PUBKEY} ] || (echo "Public key file ${PUBKEY} not found" && exit 2)
32-
[ -f ${KEY} ] || (echo "Private key file ${KEY} not found" && exit 2)
33+
pushd "${WORKING_DIR}"
3334

34-
# Verify bootloaders are same
35-
sha1=$(sha256sum "${BLEDIR}/bootloader/bootloader.bin" | cut -d\ -f1)
36-
sha2=$(sha256sum "${NORADIODIR}/bootloader/bootloader.bin" | cut -d\ -f1)
37-
if [ -z "${sha1}" -o -z "${sha2}" -o "${sha1}" != "${sha2}" ]
38-
then
39-
echo "Bootloaders missing or differ!"
40-
popd
41-
exit 2
42-
fi
35+
[ -f ${PUBKEY} ] || (echo "Public key file ${PUBKEY} not found" && exit 2)
36+
[ -f ${KEY} ] || (echo "Private key file ${KEY} not found" && exit 2)
4337

44-
# Copy binaries that need signing
45-
cp "${BLEDIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_ble_bootloader.bin"
46-
cp "${BLEDIR}/jade.bin" "${FILE_PREFIX}_ble_jade.bin"
47-
cp "${NORADIODIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_noradio_bootloader.bin"
48-
cp "${NORADIODIR}/jade.bin" "${FILE_PREFIX}_noradio_jade.bin"
38+
# Verify bootloaders are same
39+
sha1=$(sha256sum "${BLEDIR}/bootloader/bootloader.bin" | cut -d\ -f1)
40+
sha2=$(sha256sum "${NORADIODIR}/bootloader/bootloader.bin" | cut -d\ -f1)
41+
if [ -z "${sha1}" -o -z "${sha2}" -o "${sha1}" != "${sha2}" ]
42+
then
43+
echo "Bootloaders missing or differ!"
44+
popd
45+
exit 2
46+
fi
4947

50-
# Hash the bootloaders and fws locally
51-
for build in "ble" "noradio"
52-
do
53-
for program in "bootloader" "jade"
48+
# Copy binaries that need signing
49+
cp "${BLEDIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_ble_bootloader.bin"
50+
cp "${BLEDIR}/jade.bin" "${FILE_PREFIX}_ble_jade.bin"
51+
cp "${NORADIODIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_noradio_bootloader.bin"
52+
cp "${NORADIODIR}/jade.bin" "${FILE_PREFIX}_noradio_jade.bin"
53+
54+
# Hash the bootloaders and fws locally
55+
for build in "ble" "noradio"
5456
do
55-
filename_root="${FILE_PREFIX}_${build}_${program}"
56-
binary="${filename_root}.bin"
57-
hash_file="${filename_root}.hash"
58-
sig_file="${filename_root}.${SIG_SUFFIX}"
59-
60-
openssl dgst ${HASH_OPTS} -out "${hash_file}" "${binary}"
61-
openssl pkeyutl -sign ${SIGN_OPTS} -in "${hash_file}" -out "${sig_file}"
62-
openssl pkeyutl -verify ${VERIFY_OPTS} -sigfile "${sig_file}" -in "${hash_file}"
63-
if [ "${?}" -eq 0 ]
64-
then
65-
rm "${hash_file}"
66-
else
67-
echo "Signature verification of ${sig_file} over ${hash_file} with ${PUBKEY} failed"
68-
fi
57+
for program in "bootloader" "jade"
58+
do
59+
filename_root="${FILE_PREFIX}_${build}_${program}"
60+
binary="${filename_root}.bin"
61+
hash_file="${filename_root}.hash"
62+
sig_file="${filename_root}.${SIG_SUFFIX}"
63+
64+
openssl dgst ${HASH_OPTS} -out "${hash_file}" "${binary}"
65+
openssl pkeyutl -sign ${SIGN_OPTS} -in "${hash_file}" -out "${sig_file}"
66+
openssl pkeyutl -verify ${VERIFY_OPTS} -sigfile "${sig_file}" -in "${hash_file}"
67+
if [ "${?}" -eq 0 ]
68+
then
69+
rm "${hash_file}"
70+
else
71+
echo "Signature verification of ${sig_file} over ${hash_file} with ${PUBKEY} failed"
72+
fi
73+
done
6974
done
70-
done
7175

72-
sha256sum *."${SIG_SUFFIX}"
76+
sha256sum *."${SIG_SUFFIX}"
77+
78+
popd
7379

74-
popd
80+
done

0 commit comments

Comments
 (0)