Skip to content

Commit b357ea6

Browse files
author
Jamie C. Driver
committed
releases: helper scripts to facilitate signing jade v2 firmwares
1 parent 6ab12bb commit b357ea6

File tree

8 files changed

+318
-0
lines changed

8 files changed

+318
-0
lines changed

‎release/README.txt‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,3 +122,37 @@ eg: './scripts/mkhashes.sh 0.1.33' or './scripts/mkhashes.sh 0.1.32 0.1.33 0.1.3
122122
- NOTE: Should not be needed in normal operation, as the hash files are produced at
123123
the same times as the compressed firmware file.
124124
Needed to generate hash files for older fw files, or to regenerate hash files.
125+
126+
Jade v2 Signing
127+
===============
128+
129+
* scripts/v2sign.sh <version/dir> <key_label>
130+
eg: './scripts/v2sign.sh 1.0.33 v2pk1'
131+
- For the 'jade2.0' subdir in 'staging/upload/<version/dir>', signs the ble and noradio
132+
firmware and bootloader binaries with the private key named (which must be present as
133+
'scripts/<key_label>.pem'). (Note: the binaries are first hashed with sha256, and
134+
the digests signed.)
135+
The signature files are created in the top level of the version directory, and are
136+
verified with the public key 'scripts/<key_label>.pub'
137+
138+
* scripts/v2jadesign.sh <version/dir> <key_label>
139+
eg: './scripts/v2jadesign.sh 1.0.33 v2pk1'
140+
- For the 'jade2.0' subdir in 'staging/upload/<version/dir>', signs the ble and noradio
141+
firmware and bootloader binaries with the Jade unit connected by usb/serial.
142+
The RSA key is derived from the signer hd wallet root master key using bip85.
143+
(Note: the binaries are first hashed with sha256, and the digests passed to Jade for
144+
signing in a single call.)
145+
The signature files are created in the top level of the version directory, and are
146+
verified with the public key 'scripts/<key_label>.pub'
147+
148+
* scripts/v2applysigs.sh <version/dir> <key_label> [ <key_label> ... ]
149+
eg: './scripts/v2applysigs.sh 1.0.33 v2pk1 v2pk2 v2pk3'
150+
- For the 'jade2.0' subdir in 'staging/upload/<version/dir>', for each of the ble and
151+
noradio firmware and bootloader binaries, assembles the relevant signatures with the
152+
original binary, into a single signed binary file.
153+
The signed bnary files are created in the top level of the version directory but the
154+
jade fw files are copied back into their respective build directories (consistent with
155+
the v1 signing process).
156+
The final signed binaries are verified with the public keys 'scripts/<key_label>.pub'
157+
listed/used.
158+

‎release/scripts/v2applysigs.sh‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#!/bin/bash
2+
3+
if [ -z "${1}" -o -z "${2}" ]
4+
then
5+
echo "Usage: ${0} <version/dir> <key_label> [ <key_label> ... ]"
6+
exit 1
7+
fi
8+
VER_DIR="${1}"
9+
shift
10+
SIGNER_KEY_LABELS="$@"
11+
12+
WORKING_DIR="staging/${VER_DIR}/jade2.0"
13+
14+
BLEDIR="build_v2_prod"
15+
NORADIODIR="build_v2_noradio_prod"
16+
17+
FILE_PREFIX="v2_${VER_DIR}"
18+
FW_SUFFIX="bin"
19+
SIGNED_SUFFIX="signed.bin"
20+
21+
BUILDS="ble noradio"
22+
BINARIES="bootloader jade"
23+
24+
# Relative paths from where it will be referenced in fw dir
25+
PUBKEYS=""
26+
for key_label in ${SIGNER_KEY_LABELS}
27+
do
28+
PUBKEYS="${PUBKEYS} ../../../scripts/${key_label}.pub"
29+
done
30+
31+
pushd "${WORKING_DIR}"
32+
33+
for build in ${BUILDS}
34+
do
35+
for binary in ${BINARIES}
36+
do
37+
sig_files=""
38+
for key_label in ${SIGNER_KEY_LABELS}
39+
do
40+
sig_file="${FILE_PREFIX}_${build}_${binary}.${key_label}.sig"
41+
sig_files="${sig_files} ${sig_file}"
42+
done
43+
44+
file_prefix="${FILE_PREFIX}_${build}_${binary}"
45+
infile="${file_prefix}.${FW_SUFFIX}"
46+
outfile="${file_prefix}_${SIGNED_SUFFIX}"
47+
48+
espsecure.py sign_data --version 2 --pub-key ${PUBKEYS} --signature ${sig_files} --output "${outfile}" "${infile}"
49+
espsecure.py signature_info_v2 "${outfile}"
50+
51+
for pubkey in ${PUBKEYS}
52+
do
53+
espsecure.py verify_signature --version 2 --keyfile "${pubkey}" "${outfile}"
54+
done
55+
done
56+
57+
sha256sum "${FILE_PREFIX}"_*_"${SIGNED_SUFFIX}"
58+
done
59+
60+
# Copy main fw binaries that have been signed
61+
cp "${FILE_PREFIX}_ble_jade_${SIGNED_SUFFIX}" "${BLEDIR}/jade_${SIGNED_SUFFIX}"
62+
cp "${FILE_PREFIX}_noradio_jade_${SIGNED_SUFFIX}" "${NORADIODIR}/jade_${SIGNED_SUFFIX}"
63+
64+
popd

‎release/scripts/v2jadesign.sh‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
#!/bin/bash
2+
3+
if [ -z "${1}" -o -z "${2}" ]
4+
then
5+
echo "Usage: ${0} <version/dir> <key_label>"
6+
exit 1
7+
fi
8+
VER_DIR="${1}"
9+
KEY_LABEL="${2}"
10+
11+
WORKING_DIR="staging/${VER_DIR}/jade2.0"
12+
13+
# Can log if required
14+
LOGGING=""
15+
#LOGGING="--log INFO"
16+
17+
# Can fetch and check the pubkey from Jade - but slower and really no need
18+
# as we verify the signature with the expected pubkey at the end.
19+
CHECK_JADE_PUBKEY=""
20+
JADE_PUBKEY_FILE="jade_signing_key.pub"
21+
#CHECK_JADE_PUBKEY="--savepubkey ${JADE_PUBKEY_FILE}"
22+
23+
# Standard for Jade fw signing
24+
KEYLEN=3072
25+
INDEX=1784767589
26+
27+
# Relative paths from where it will be referenced in fw dir
28+
PUBKEY="../../../scripts/${KEY_LABEL}.pub"
29+
30+
BLEDIR="build_v2_prod"
31+
NORADIODIR="build_v2_noradio_prod"
32+
33+
FILE_PREFIX="v2_${VER_DIR}"
34+
SIG_SUFFIX="${KEY_LABEL}.sig"
35+
36+
HASH_OPTS="-sha256 -binary"
37+
VERIFY_OPTS="-pubin -inkey ${PUBKEY} -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pss"
38+
JADE_SIGN_CMD="python ../../../../jade_bip85_rsa_sign.py ${LOGGING} ${CHECK_JADE_PUBKEY} --keylen ${KEYLEN} --index ${INDEX} --digest-files"
39+
40+
pushd "${WORKING_DIR}"
41+
42+
# Verify bootloaders are same
43+
sha1=$(sha256sum "${BLEDIR}/bootloader/bootloader.bin" | cut -d\ -f1)
44+
sha2=$(sha256sum "${NORADIODIR}/bootloader/bootloader.bin" | cut -d\ -f1)
45+
if [ -z "${sha1}" -o -z "${sha2}" -o "${sha1}" != "${sha2}" ]
46+
then
47+
echo "Bootloaders missing or differ!"
48+
popd
49+
exit 2
50+
fi
51+
52+
# Copy binaries that need signing
53+
cp "${BLEDIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_ble_bootloader.bin"
54+
cp "${BLEDIR}/jade.bin" "${FILE_PREFIX}_ble_jade.bin"
55+
cp "${NORADIODIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_noradio_bootloader.bin"
56+
cp "${NORADIODIR}/jade.bin" "${FILE_PREFIX}_noradio_jade.bin"
57+
58+
# Hash the bootloaders and fws locally
59+
HASH_FILES=""
60+
for build in "ble" "noradio"
61+
do
62+
for program in "bootloader" "jade"
63+
do
64+
binary="${FILE_PREFIX}_${build}_${program}.bin"
65+
hash_file="${FILE_PREFIX}_${build}_${program}.hash"
66+
HASH_FILES="${HASH_FILES} ${hash_file}"
67+
68+
openssl dgst ${HASH_OPTS} -out "${hash_file}" "${binary}"
69+
done
70+
done
71+
72+
# Sign the hashes with jade
73+
echo "Please approve signing on your Jade device"
74+
${JADE_SIGN_CMD} ${HASH_FILES}
75+
76+
# Check signatures with labeled pubkey, and rename if good
77+
for build in "ble" "noradio"
78+
do
79+
for program in "bootloader" "jade"
80+
do
81+
hash_file="${FILE_PREFIX}_${build}_${program}.hash"
82+
sig_file="${hash_file}.sig"
83+
openssl pkeyutl -verify ${VERIFY_OPTS} -sigfile "${sig_file}" -in "${hash_file}"
84+
if [ "${?}" -eq 0 ]
85+
then
86+
mv ${sig_file} "${FILE_PREFIX}_${build}_${program}.${SIG_SUFFIX}"
87+
rm "${hash_file}"
88+
else
89+
echo "Signature verification of ${sig_file} over ${hash_file} with ${PUBKEY} failed"
90+
fi
91+
done
92+
done
93+
94+
sha256sum *."${SIG_SUFFIX}"
95+
96+
# Verify jade pubkey matches expected (if feched)
97+
if [ -n "${CHECK_JADE_PUBKEY}" ]
98+
then
99+
sha1=$(sha256sum "${PUBKEY}" | cut -d\ -f1)
100+
sha2=$(sha256sum "${JADE_PUBKEY_FILE}" | cut -d\ -f1)
101+
if [ -z "${sha1}" -o -z "${sha2}" -o "${sha1}" != "${sha2}" ]
102+
then
103+
echo "Error: Pubkey pem mismatch!"
104+
fi
105+
fi
106+
107+
popd

‎release/scripts/v2pk1.pub‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAlV05rBBmSebxHrlpYiHo
3+
5IDzzMZ6iLdiz1bY+CkYScwb1xFFl2LfXIwqmb0YpDGON96SFWZR26E4mbkb5qWT
4+
XAJ6n0rE/Bei2Akt0PxZ8b/Rk3dDGbFHLIeNb6sJsFV232no4eA2GilX2AGbSVpY
5+
uecmIVvzIqapeeg9VmjCAVtGo89HmC3aug+iQDbYo9WG2cgyTwAVouFPBRtfMqxi
6+
RhyWSk1FY08i+i59wRg4MMRWWdWE+uNsIuwJmfm6wIYyEbq6V1sArhs1g6VyKRnd
7+
VBKSWZKpcfZuHvT9BcksQ9y9Cw5IexQ+8/miHWOoYyuQACt+P3J1rvjNVxEqV2rw
8+
e+Iz0ZJlmVUb4Ku9vC8G7XQloZAMeVVAvNkuyiN2E+3PDtkobsvBnCD+5RsYZ2h1
9+
Jdv3WnkdthT+JLYISVRFKHW/O0VjBoNbVWd1e5ev4m7GxUFO2XNtil7TgQ7P/co1
10+
DzGBIbFFVwzBpBIB9yYo63ETUx8zd+VUkQ/j5cRynU8DAgMBAAE=
11+
-----END PUBLIC KEY-----

‎release/scripts/v2pk2.pub‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAxErJHx1UY7r9EBHBmneH
3+
8S45WAMFbjWpS4VvsVRW1kbune4SpsjRXtciO3qJTFFDANpcO1BNm29YWskgKr45
4+
GdhVQjsggFzMsvbV8PYOLOHZcK+Hw5bV9cKycvq9GcaHSQHXVlQl8EiFFNsb7m6K
5+
bPVbylvhXfzt116VXLKiaZj6L1nbjhoqylf0VoAd90BzdDngiN0nwIbhMF3Kqtdu
6+
ix+/+kwnJ7IYiBR2wgHyCuckjTsWx/fL8qgTcn1XrZ/Jrs2qDzHFHGGBRksR6Kra
7+
i6oC0xBatDcaxVCgSXOuuJd+GM4sPn0TD0K43fSnoyit8Lk6aV23jx2m6QZ4ISU3
8+
pii8IlBhqEFTGs8VXTtV7j9755mxd6cibt0N7QowvSo3DWD80CdZiTWcUH3owHJB
9+
iT7iBJaMXRy+TiOzqmGCQjcLThwUL27+5Fvd+XoszE7s3ezdR9is9k99p1Sji09X
10+
ahFFhKbLvyGGhgS1ziSVlbgPkPxw/3tIj1gYVQc2GmcZAgMBAAE=
11+
-----END PUBLIC KEY-----

‎release/scripts/v2pk3.pub‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAg7FH/iN3AqL3xBAiiimf
3+
671/656eSMKrgTrUvu8dr5Z7vC9eNRYHgvIlf5piQN5MosFThJoULOLU4d0a44HQ
4+
xZMI8Lyz/NhHxeZI7XJR9UHZav0MvJj9BUhX16nX9FsNaBm5tu/klK8HNqappi+1
5+
JSMFwjCaFTjciyfaRBqIfEnSkeIDO8wfIcLR7o45TpPT/u8njnkvrDS5/B2Ka3g8
6+
gEsgaQXJJ3pubY9HOu5//fOj2Dvvb0IjcSpa0AQifx1n2zD1Nz/dpUKToKGKquZx
7+
dZYLQOWF09o3u8RX1eUTXdOnM/+JEk7dNOnqtWSdCUyf/XqlRJ2r5Crvj91lNiFT
8+
j6XgMlnF45Mn/65gVSuqYhum7MNIOSI2+brPrv1Y3KWw1ljNWDqZWV2zwofHxaOj
9+
SNNKFM7mnRy5u8wh9Jqr9p/tkxZA2sn3qvhDXIotoGLNNNjsWM32ek/7FJRyCEeu
10+
u5A+Dy16U1dPrhcwSpZsln8CzrYqTxexsSzBGq9JggPFAgMBAAE=
11+
-----END PUBLIC KEY-----

‎release/scripts/v2pkdev.pub‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEAufP/ss5BAxgp4TxQNFu4
3+
l2ZomknoIK7wW5PvF59zA+IalObbnmvAHrBaXH5QJiXmEmq76ltwF4BfkTsst0ZK
4+
as0b628r72sS380abov3j6QIqCJ6Xzpqq9WCyHbIDM375/JnRRQXbhU3orsbYIkz
5+
WBKx1ULSuCYY3sWyDrZ4IRuDyKz3ne8dex2fbIDTxqbmQaa/0fkqGVEDO852NPyf
6+
CcfOs4JIcyf/9yarcdEBILQbaGLSGtyE6lakRDnv3QZpMALZk+dU3T80zpDfdc0E
7+
8Ew1T6FuIKGAWgnQn5K47D8G4NMnTd2IxoR39XlRyvwe4YOaTgiFTRyKE0ge3NDE
8+
E+TKm9KlRtYQyY2tGD6IL1JJ7muVRg0Qr7Km2E15a/HdNNx+LsxlUAUDewXOGQRs
9+
pNEi80If5ZuPKusBJGCcuDFW3Bk76E5HSJn+S8+3b43piPJSILj0SpnTPkwwZYBF
10+
deIMsr/mmLbvKzsPV42xHDcUnfwUlFHAnjtBqF5kEWrlAgMBAAE=
11+
-----END PUBLIC KEY-----

‎release/scripts/v2sign.sh‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/bash
2+
3+
if [ -z "${1}" -o -z "${2}" ]
4+
then
5+
echo "Usage: ${0} <version/dir> <key_label>"
6+
exit 1
7+
fi
8+
VER_DIR="${1}"
9+
KEY_LABEL="${2}"
10+
11+
WORKING_DIR="staging/${VER_DIR}/jade2.0"
12+
13+
# Relative paths from where it will be referenced in fw dir
14+
KEY="../../../scripts/${KEY_LABEL}.pem"
15+
PUBKEY="../../../scripts/${KEY_LABEL}.pub"
16+
17+
BLEDIR="build_v2_prod"
18+
NORADIODIR="build_v2_noradio_prod"
19+
20+
FILE_PREFIX="v2_${VER_DIR}"
21+
SIG_SUFFIX="${KEY_LABEL}.sig"
22+
23+
HASH_OPTS="-sha256 -binary"
24+
SIGN_OPTS="-inkey ${KEY} -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pss -pkeyopt rsa_pss_saltlen:32 -pkeyopt rsa_mgf1_md:sha256"
25+
VERIFY_OPTS="-pubin -inkey ${PUBKEY} -pkeyopt digest:sha256 -pkeyopt rsa_padding_mode:pss"
26+
27+
pushd "${WORKING_DIR}"
28+
29+
# Verify bootloaders are same
30+
sha1=$(sha256sum "${BLEDIR}/bootloader/bootloader.bin" | cut -d\ -f1)
31+
sha2=$(sha256sum "${NORADIODIR}/bootloader/bootloader.bin" | cut -d\ -f1)
32+
if [ -z "${sha1}" -o -z "${sha2}" -o "${sha1}" != "${sha2}" ]
33+
then
34+
echo "Bootloaders missing or differ!"
35+
popd
36+
exit 2
37+
fi
38+
39+
# Copy binaries that need signing
40+
cp "${BLEDIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_ble_bootloader.bin"
41+
cp "${BLEDIR}/jade.bin" "${FILE_PREFIX}_ble_jade.bin"
42+
cp "${NORADIODIR}/bootloader/bootloader.bin" "${FILE_PREFIX}_noradio_bootloader.bin"
43+
cp "${NORADIODIR}/jade.bin" "${FILE_PREFIX}_noradio_jade.bin"
44+
45+
# Hash the bootloaders and fws locally
46+
for build in "ble" "noradio"
47+
do
48+
for program in "bootloader" "jade"
49+
do
50+
filename_root="${FILE_PREFIX}_${build}_${program}"
51+
binary="${filename_root}.bin"
52+
hash_file="${filename_root}.hash"
53+
sig_file="${filename_root}.${SIG_SUFFIX}"
54+
55+
openssl dgst ${HASH_OPTS} -out "${hash_file}" "${binary}"
56+
openssl pkeyutl -sign ${SIGN_OPTS} -in "${hash_file}" -out "${sig_file}"
57+
openssl pkeyutl -verify ${VERIFY_OPTS} -sigfile "${sig_file}" -in "${hash_file}"
58+
if [ "${?}" -eq 0 ]
59+
then
60+
rm "${hash_file}"
61+
else
62+
echo "Signature verification of ${sig_file} over ${hash_file} with ${PUBKEY} failed"
63+
fi
64+
done
65+
done
66+
67+
sha256sum *."${SIG_SUFFIX}"
68+
69+
popd

0 commit comments

Comments
 (0)