imgtool: add key password support

Imgtool can sign a binary for multiple boards, which requires the use of
multiple key pairs. To simplify the automation of this process, a key
password argument is added.

Signed-off-by: Maxime Méré <[email protected]>

Author: meremST

scripts/imgtool/main.py

@@ -99,14 +99,16 @@ def save_signature(sigfile, sig):
         f.write(signature)
 
 
-def load_key(keyfile):
+def load_key(keyfile, passwd=None):
     # TODO: better handling of invalid pass-phrase
     key = keys.load(keyfile)
     if key is not None:
         return key
-    passwd = getpass.getpass("Enter key passphrase: ").encode('utf-8')
-    return keys.load(keyfile, passwd)
 
+    if passwd is None:
+        passwd = getpass.getpass("Enter key passphrase: ")
+
+    return keys.load(keyfile, passwd.encode('utf-8'))
 
 def get_password():
     while True:
@@ -423,6 +425,7 @@ def convert(self, value, param, ctx):
               default='hash', help='In what format to add the public key to '
               'the image manifest: full key or hash of the key.')
 @click.option('-k', '--key', metavar='filename')
+@click.option('--key-pswd', required=False, help='Password for the key file')
 @click.option('--fix-sig', metavar='filename',
               help='fixed signature for the image. It will be used instead of '
               'the signature calculated using the public key')
@@ -447,7 +450,7 @@ def convert(self, value, param, ctx):
 @click.command(help='''Create a signed or unsigned image\n
                INFILE and OUTFILE are parsed as Intel HEX if the params have
                .hex extension, otherwise binary format is used''')
-def sign(key, public_key_format, align, version, pad_sig, header_size,
+def sign(key, key_pswd, public_key_format, align, version, pad_sig, header_size,
          pad_header, slot_size, pad, confirm, max_sectors, overwrite_only,
          endian, encrypt_keylen, encrypt, compression, infile, outfile,
          dependencies, load_addr, hex_addr, erased_val, save_enctlv,
@@ -469,7 +472,7 @@ def sign(key, public_key_format, align, version, pad_sig, header_size,
                       non_bootable=non_bootable)
     compression_tlvs = {}
     img.load(infile)
-    key = load_key(key) if key else None
+    key = load_key(key, passwd=key_pswd) if key else None
     enckey = load_key(encrypt) if encrypt else None
     if enckey and key:
         if ((isinstance(key, keys.ECDSA256P1) and