Skip to content

Commit bd58aaa

Browse files
ahasztagtomchy
ahasztag
authored and
tomchy
committed
suit: Build system changes to signing process
This commit allows to sign the envelopes during the build process using the new, more robust method. Signed-off-by: Artur Hadasz <[email protected]>
1 parent 02fb95a commit bd58aaa

File tree

4 files changed

+214
-72
lines changed

4 files changed

+214
-72
lines changed

‎cmake/sysbuild/suit.cmake‎

Lines changed: 58 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -21,29 +21,6 @@ function(suit_set_absolute_or_relative_path path relative_root output_variable)
2121
set(${output_variable} "${path}" PARENT_SCOPE)
2222
endfunction()
2323

24-
# Sign an envelope using SIGN_SCRIPT.
25-
#
26-
# Usage:
27-
# suit_sign_envelope(<input_file> <output_file>)
28-
#
29-
# Parameters:
30-
# 'input_file' - path to input unsigned envelope
31-
# 'output_file' - path to output signed envelope
32-
function(suit_sign_envelope input_file output_file)
33-
cmake_path(GET ZEPHYR_NRF_MODULE_DIR PARENT_PATH NRF_DIR_PARENT)
34-
suit_set_absolute_or_relative_path(${SB_CONFIG_SUIT_ENVELOPE_SIGN_SCRIPT} ${NRF_DIR_PARENT} SIGN_SCRIPT)
35-
if(NOT EXISTS ${SIGN_SCRIPT})
36-
message(SEND_ERROR "DFU: ${SB_CONFIG_SUIT_ENVELOPE_SIGN_SCRIPT} does not exist. Corrupted configuration?")
37-
return()
38-
endif()
39-
set_property(
40-
GLOBAL APPEND PROPERTY SUIT_POST_BUILD_COMMANDS
41-
COMMAND ${PYTHON_EXECUTABLE} ${SIGN_SCRIPT}
42-
--input-file ${input_file}
43-
--output-file ${output_file}
44-
)
45-
endfunction()
46-
4724
# Register SUIT post build commands.
4825
#
4926
# Usage:
@@ -237,14 +214,16 @@ function(suit_create_package)
237214
set(STORAGE_BOOT_ARGS)
238215
sysbuild_get(app_config_dir IMAGE ${DEFAULT_IMAGE} VAR APPLICATION_CONFIG_DIR CACHE)
239216
get_property(SUIT_KMS_SCRIPT GLOBAL PROPERTY SUIT_KMS_SCRIPT)
217+
get_property(SUIT_SIGN_SCRIPT GLOBAL PROPERTY SUIT_SIGN_SCRIPT)
218+
240219
# If the user has not provided the path to the kms script, use the default one.
241220
if(NOT SUIT_KMS_SCRIPT)
242221
set(SUIT_KMS_SCRIPT "${ZEPHYR_SUIT_GENERATOR_MODULE_DIR}/ncs/basic_kms.py")
243222
endif()
244223

245-
246-
if(NOT DEFINED SB_CONFIG_SUIT_ENVELOPE_SIGN)
247-
set(SB_CONFIG_SUIT_ENVELOPE_SIGN FALSE)
224+
# If the user has not provided the path to the sign script, use the default one.
225+
if(NOT SUIT_SIGN_SCRIPT)
226+
set(SUIT_SIGN_SCRIPT "${ZEPHYR_SUIT_GENERATOR_MODULE_DIR}/ncs/sign_script.py")
248227
endif()
249228

250229
list(APPEND CORE_ARGS
@@ -345,7 +324,28 @@ function(suit_create_package)
345324
set(ENVELOPE_SUIT_FILE ${SUIT_ROOT_DIRECTORY}${target}.suit)
346325

347326
suit_render_template(${INPUT_ENVELOPE_JINJA_FILE} ${ENVELOPE_YAML_FILE} "${TEMPLATE_ARGS}")
348-
suit_create_envelope(${ENVELOPE_YAML_FILE} ${ENVELOPE_SUIT_FILE} ${SB_CONFIG_SUIT_ENVELOPE_SIGN})
327+
suit_create_envelope(${ENVELOPE_YAML_FILE} ${ENVELOPE_SUIT_FILE})
328+
329+
unset(sign_envelope)
330+
sysbuild_get(sign_envelope IMAGE ${image} VAR CONFIG_SUIT_ENVELOPE_TARGET_SIGN KCONFIG)
331+
if(sign_envelope)
332+
set(SUIT_SIGN_ARGS)
333+
unset(sign_key_id)
334+
unset(sign_private_key_name)
335+
unset(sign_alg_name)
336+
337+
sysbuild_get(sign_key_id IMAGE ${image} VAR CONFIG_SUIT_ENVELOPE_TARGET_SIGN_KEY_ID KCONFIG)
338+
sysbuild_get(sign_private_key_name IMAGE ${image} VAR CONFIG_SUIT_ENVELOPE_TARGET_SIGN_PRIVATE_KEY_NAME KCONFIG)
339+
sysbuild_get(sign_alg_name IMAGE ${image} VAR CONFIG_SUIT_ENVELOPE_TARGET_SIGN_ALG_NAME KCONFIG)
340+
341+
list(APPEND SUIT_SIGN_ARGS --key-name ${sign_private_key_name})
342+
list(APPEND SUIT_SIGN_ARGS --key-id ${sign_key_id})
343+
list(APPEND SUIT_SIGN_ARGS --alg ${sign_alg_name})
344+
list(APPEND SUIT_SIGN_ARGS --context ${SB_CONFIG_SUIT_ENVELOPE_KMS_SCRIPT_CONTEXT})
345+
list(APPEND SUIT_SIGN_ARGS --kms-script ${SUIT_KMS_SCRIPT})
346+
347+
suit_sign_envelope(${ENVELOPE_SUIT_FILE} ${ENVELOPE_SUIT_FILE} "${SUIT_SIGN_ARGS}" ${SUIT_SIGN_SCRIPT})
348+
endif()
349349

350350
unset(recovery)
351351
sysbuild_get(recovery IMAGE ${image} VAR CONFIG_SUIT_RECOVERY KCONFIG)
@@ -444,10 +444,23 @@ function(suit_create_package)
444444
set(APP_RECOVERY_ENVELOPE_YAML_FILE ${SUIT_ROOT_DIRECTORY}${APP_RECOVERY_NAME}.yaml)
445445
set(APP_RECOVERY_ENVELOPE_SUIT_FILE ${SUIT_ROOT_DIRECTORY}${APP_RECOVERY_NAME}.suit)
446446
suit_render_template(${INPUT_APP_RECOVERY_ENVELOPE_JINJA_FILE} ${APP_RECOVERY_ENVELOPE_YAML_FILE} "${TEMPLATE_ARGS}")
447-
suit_create_envelope(${APP_RECOVERY_ENVELOPE_YAML_FILE} ${APP_RECOVERY_ENVELOPE_SUIT_FILE} ${SB_CONFIG_SUIT_ENVELOPE_SIGN})
448-
list(APPEND STORAGE_BOOT_ARGS
449-
--input-envelope ${APP_RECOVERY_ENVELOPE_SUIT_FILE}
450-
)
447+
suit_create_envelope(${APP_RECOVERY_ENVELOPE_YAML_FILE} ${APP_RECOVERY_ENVELOPE_SUIT_FILE})
448+
449+
if(SB_CONFIG_SUIT_ENVELOPE_APP_RECOVERY_SIGN)
450+
set(SUIT_SIGN_ARGS)
451+
452+
list(APPEND SUIT_SIGN_ARGS --key-name ${SB_CONFIG_SUIT_ENVELOPE_APP_RECOVERY_SIGN_PRIVATE_KEY_NAME})
453+
list(APPEND SUIT_SIGN_ARGS --key-id ${SB_CONFIG_SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_ID})
454+
list(APPEND SUIT_SIGN_ARGS --alg ${SB_CONFIG_SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG_NAME})
455+
list(APPEND SUIT_SIGN_ARGS --context ${SB_CONFIG_SUIT_ENVELOPE_KMS_SCRIPT_CONTEXT})
456+
list(APPEND SUIT_SIGN_ARGS --kms-script ${SUIT_KMS_SCRIPT})
457+
458+
suit_sign_envelope(${APP_RECOVERY_ENVELOPE_SUIT_FILE} ${APP_RECOVERY_ENVELOPE_SUIT_FILE} "${SUIT_SIGN_ARGS}" ${SUIT_SIGN_SCRIPT})
459+
endif()
460+
461+
list(APPEND STORAGE_BOOT_ARGS
462+
--input-envelope ${APP_RECOVERY_ENVELOPE_SUIT_FILE}
463+
)
451464
set_property(GLOBAL APPEND PROPERTY SUIT_RECOVERY_DFU_ARTIFACTS ${APP_RECOVERY_ENVELOPE_SUIT_FILE})
452465
endif()
453466
endif()
@@ -491,7 +504,20 @@ function(suit_create_package)
491504
set(ROOT_ENVELOPE_YAML_FILE ${SUIT_ROOT_DIRECTORY}${ROOT_NAME}.yaml)
492505
set(ROOT_ENVELOPE_SUIT_FILE ${SUIT_ROOT_DIRECTORY}${ROOT_NAME}.suit)
493506
suit_render_template(${INPUT_ROOT_ENVELOPE_JINJA_FILE} ${ROOT_ENVELOPE_YAML_FILE} "${TEMPLATE_ARGS}")
494-
suit_create_envelope(${ROOT_ENVELOPE_YAML_FILE} ${ROOT_ENVELOPE_SUIT_FILE} ${SB_CONFIG_SUIT_ENVELOPE_SIGN})
507+
suit_create_envelope(${ROOT_ENVELOPE_YAML_FILE} ${ROOT_ENVELOPE_SUIT_FILE})
508+
509+
if(SB_CONFIG_SUIT_ENVELOPE_ROOT_SIGN)
510+
set(SUIT_SIGN_ARGS)
511+
512+
list(APPEND SUIT_SIGN_ARGS --key-name ${SB_CONFIG_SUIT_ENVELOPE_ROOT_SIGN_PRIVATE_KEY_NAME})
513+
list(APPEND SUIT_SIGN_ARGS --key-id ${SB_CONFIG_SUIT_ENVELOPE_ROOT_SIGN_KEY_ID})
514+
list(APPEND SUIT_SIGN_ARGS --alg ${SB_CONFIG_SUIT_ENVELOPE_ROOT_SIGN_ALG_NAME})
515+
list(APPEND SUIT_SIGN_ARGS --context ${SB_CONFIG_SUIT_ENVELOPE_KMS_SCRIPT_CONTEXT})
516+
list(APPEND SUIT_SIGN_ARGS --kms-script ${SUIT_KMS_SCRIPT})
517+
518+
suit_sign_envelope(${ROOT_ENVELOPE_SUIT_FILE} ${ROOT_ENVELOPE_SUIT_FILE} "${SUIT_SIGN_ARGS}" ${SUIT_SIGN_SCRIPT})
519+
endif()
520+
495521
list(APPEND STORAGE_BOOT_ARGS
496522
--input-envelope ${ROOT_ENVELOPE_SUIT_FILE}
497523
)

‎cmake/sysbuild/suit_utilities.cmake‎

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ endfunction()
7575
# 'input_file' - path to input yaml configuration
7676
# 'output_file' - path to output binary suit envelope
7777
# 'create_signature' - sign the envelope if set to true
78-
function(suit_create_envelope input_file output_file create_signature)
78+
function(suit_create_envelope input_file output_file)
7979
set_property(
8080
GLOBAL APPEND PROPERTY SUIT_POST_BUILD_COMMANDS
8181
COMMAND ${PYTHON_EXECUTABLE} ${SUIT_GENERATOR_CLI_SCRIPT}
@@ -84,10 +84,6 @@ function(suit_create_envelope input_file output_file create_signature)
8484
--output-file ${output_file}
8585
BYPRODUCTS ${output_file}
8686
)
87-
88-
if (create_signature AND SB_CONFIG_SUIT_ENVELOPE_SIGN_SCRIPT)
89-
suit_sign_envelope(${output_file} ${output_file})
90-
endif()
9187
endfunction()
9288

9389
# Create a SUIT DFU cache partition file from a list of payloads.
@@ -188,7 +184,7 @@ function(suit_encrypt_image args output_directory)
188184
endif()
189185

190186
if(NOT EXISTS ${encrypt_script})
191-
message(SEND_ERROR "DFU: ${encrypt_script} does not exist. Corrupted configuration?")
187+
message(SEND_ERROR "DFU: Encrypt script ${encrypt_script} does not exist. Corrupted configuration?")
192188
return()
193189
endif()
194190

@@ -207,3 +203,31 @@ function(suit_encrypt_image args output_directory)
207203
${args}
208204
)
209205
endfunction()
206+
207+
# Sign an envelope using the sign script.
208+
#
209+
# Usage:
210+
# suit_sign_envelope(<input_file> <output_file>)
211+
#
212+
# Parameters:
213+
# 'input_file' - path to input unsigned envelope
214+
# 'output_file' - path to output signed envelope
215+
# 'args' - list of other arguments for the sign script
216+
# 'sign_script_path' - path to the sign script
217+
function(suit_sign_envelope input_file output_file args sign_script_path)
218+
if(NOT EXISTS ${sign_script_path})
219+
message(SEND_ERROR "DFU: Sign script ${sign_script_path} does not exist. Corrupted configuration?")
220+
return()
221+
endif()
222+
list(APPEND args "--input-envelope" "${input_file}")
223+
list(APPEND args "--output-envelope" "${output_file}")
224+
list(APPEND args "--sign-script" "${sign_script_path}")
225+
226+
set_property(
227+
GLOBAL APPEND PROPERTY SUIT_POST_BUILD_COMMANDS
228+
COMMAND ${PYTHON_EXECUTABLE} ${SUIT_GENERATOR_CLI_SCRIPT}
229+
sign
230+
single-level
231+
${args}
232+
)
233+
endfunction()

‎sysbuild/Kconfig.suit‎

Lines changed: 122 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,6 @@ menuconfig SUIT_ENVELOPE
1414

1515
if SUIT_ENVELOPE
1616

17-
config SUIT_ENVELOPE_SIGN
18-
bool "Sign created SUIT envelope"
19-
help
20-
Sign created SUIT envelope by external script
21-
2217
config SUIT_ENVELOPE_ROOT_TEMPLATE_FILENAME
2318
string "Name of the default root envelope template"
2419
default "root_with_binary_nordic_top.yaml.jinja2"
@@ -27,19 +22,6 @@ config SUIT_ENVELOPE_ROOT_TEMPLATE_FILENAME
2722
name in the suit/<soc> directory inside the application directory. If the file is not found
2823
the default template from the base template directory is used.
2924

30-
31-
config SUIT_ENVELOPE_SIGN_SCRIPT
32-
string "Location of SUIT sign script"
33-
depends on SUIT_ENVELOPE_SIGN
34-
default "modules/lib/suit-generator/ncs/sign_script.py"
35-
help
36-
Python script called to sign SUIT envelope.
37-
You can use either absolute or relative path.
38-
In case relative path is used, the build system uses NRF parent directory.
39-
Script need to accept two arguments:
40-
- --input-file <STRING> - location of unsigned envelope in the build system
41-
- --output-file <STRING> - location of signed envelope to create by script
42-
4325
config SUIT_ENVELOPE_BASIC_KMS_SCRIPT_KEY_DIRECTORY
4426
string "The directory in which the keys are stored"
4527
default "${ZEPHYR_SUIT_GENERATOR_MODULE_DIR}/ncs"
@@ -90,6 +72,67 @@ config SUIT_ENVELOPE_NORDIC_TOP_CACHE_PARTITION_NUM
9072

9173
endif # SUIT_ENVELOPE_NORDIC_TOP_IN_ROOT
9274

75+
config SUIT_ENVELOPE_ROOT_SIGN
76+
bool "Sign the root envelope"
77+
78+
if SUIT_ENVELOPE_ROOT_SIGN
79+
80+
choice SUIT_ENVELOPE_ROOT_SIGN_KEY_GEN
81+
prompt "SUIT root envelope signing key generation"
82+
default SUIT_ENVELOPE_ROOT_SIGN_KEY_GEN1
83+
84+
config SUIT_ENVELOPE_ROOT_SIGN_KEY_GEN1
85+
bool "Key generation 1"
86+
87+
config SUIT_ENVELOPE_ROOT_SIGN_KEY_GEN2
88+
bool "Key generation 2"
89+
90+
config SUIT_ENVELOPE_ROOT_SIGN_KEY_GEN3
91+
bool "Key generation 3"
92+
93+
endchoice
94+
95+
config SUIT_ENVELOPE_ROOT_SIGN_KEY_ID
96+
hex "The key ID used to identify the OEM root public key on the device"
97+
default 0x4000AA00 if SUIT_ENVELOPE_ROOT_SIGN_KEY_GEN1
98+
default 0x4000AA01 if SUIT_ENVELOPE_ROOT_SIGN_KEY_GEN2
99+
default 0x4000AA02 if SUIT_ENVELOPE_ROOT_SIGN_KEY_GEN3
100+
help
101+
This string is translated to the numeric KEY ID by the encryption script
102+
103+
config SUIT_ENVELOPE_ROOT_SIGN_PRIVATE_KEY_NAME
104+
string "Name of the private key used for signing - to identify the key in the KMS"
105+
default "MANIFEST_OEM_ROOT_GEN1_priv" if SUIT_ENVELOPE_ROOT_SIGN_KEY_GEN1
106+
default "MANIFEST_OEM_ROOT_GEN2_priv" if SUIT_ENVELOPE_ROOT_SIGN_KEY_GEN2
107+
default "MANIFEST_OEM_ROOT_GEN3_priv" if SUIT_ENVELOPE_ROOT_SIGN_KEY_GEN3
108+
109+
choice SUIT_ENVELOPE_ROOT_SIGN_ALG
110+
prompt "Algorithm used to sign the root envelope"
111+
default SUIT_ENVELOPE_ROOT_SIGN_ALG_EDDSA
112+
113+
config SUIT_ENVELOPE_ROOT_SIGN_ALG_EDDSA
114+
bool "Use the EdDSA algorithm"
115+
116+
config SUIT_ENVELOPE_ROOT_SIGN_ALG_ECDSA_256
117+
bool "Use the ECDSA algorithm with key length of 256 bits"
118+
119+
config SUIT_ENVELOPE_ROOT_SIGN_ALG_ECDSA_384
120+
bool "Use the ECDSA algorithm with key length of 384 bits"
121+
122+
config SUIT_ENVELOPE_ROOT_SIGN_ALG_ECDSA_521
123+
bool "Use the ECDSA algorithm with key length of 521 bits"
124+
125+
endchoice
126+
127+
config SUIT_ENVELOPE_ROOT_SIGN_ALG_NAME
128+
string "String name of the algorithm used to sign the root envelope"
129+
default "eddsa" if SUIT_ENVELOPE_ROOT_SIGN_ALG_EDDSA
130+
default "es-256" if SUIT_ENVELOPE_ROOT_SIGN_ALG_ECDSA_256
131+
default "es-384" if SUIT_ENVELOPE_ROOT_SIGN_ALG_ECDSA_384
132+
default "es-521" if SUIT_ENVELOPE_ROOT_SIGN_ALG_ECDSA_521
133+
134+
endif # SUIT_ENVELOPE_ROOT_SIGN
135+
93136
config SUIT_BASE_MANIFEST_TEMPLATE_DIR
94137
string "Base manifest directory"
95138
default "${ZEPHYR_NRF_MODULE_DIR}/config/suit/templates"
@@ -164,6 +207,67 @@ config SUIT_ENVELOPE_APP_RECOVERY_ARTIFACT_NAME
164207
help
165208
Name of the root SUIT artifact.
166209

210+
config SUIT_ENVELOPE_APP_RECOVERY_SIGN
211+
bool "Sign the app recovery envelope"
212+
213+
if SUIT_ENVELOPE_APP_RECOVERY_SIGN
214+
215+
choice SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_GEN
216+
prompt "SUIT app recovery envelope signing key generation"
217+
default SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_GEN1
218+
219+
config SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_GEN1
220+
bool "Key generation 1"
221+
222+
config SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_GEN2
223+
bool "Key generation 2"
224+
225+
config SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_GEN3
226+
bool "Key generation 3"
227+
228+
endchoice
229+
230+
config SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_ID
231+
hex "The key ID used to identify the app recovery public key on the device"
232+
default 0x40022100 if SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_GEN1
233+
default 0x40022101 if SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_GEN2
234+
default 0x40022102 if SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_GEN3
235+
help
236+
This string is translated to the numeric KEY ID by the encryption script
237+
238+
config SUIT_ENVELOPE_APP_RECOVERY_SIGN_PRIVATE_KEY_NAME
239+
string "Name of the private key used for signing - to identify the key in the KMS"
240+
default "MANIFEST_APPLICATION_GEN1_priv" if SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_GEN1
241+
default "MANIFEST_APPLICATION_GEN2_priv" if SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_GEN2
242+
default "MANIFEST_APPLICATION_GEN3_priv" if SUIT_ENVELOPE_APP_RECOVERY_SIGN_KEY_GEN3
243+
244+
choice SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG
245+
prompt "Algorithm used to sign the app recovery envelope"
246+
default SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG_EDDSA
247+
248+
config SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG_EDDSA
249+
bool "Use the EdDSA algorithm"
250+
251+
config SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG_ECDSA_256
252+
bool "Use the ECDSA algorithm with key length of 256 bits"
253+
254+
config SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG_ECDSA_384
255+
bool "Use the ECDSA algorithm with key length of 384 bits"
256+
257+
config SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG_ECDSA_521
258+
bool "Use the ECDSA algorithm with key length of 521 bits"
259+
260+
endchoice
261+
262+
config SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG_NAME
263+
string "String name of the algorithm used to sign the app recovery envelope"
264+
default "eddsa" if SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG_EDDSA
265+
default "es-256" if SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG_ECDSA_256
266+
default "es-384" if SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG_ECDSA_384
267+
default "es-521" if SUIT_ENVELOPE_APP_RECOVERY_SIGN_ALG_ECDSA_521
268+
269+
endif # SUIT_ENVELOPE_APP_RECOVERY_SIGN
270+
167271
endif # SUIT_BUILD_RECOVERY
168272

169273
config SUIT_BUILD_FLASH_COMPANION

‎tests/subsys/suit/manifest_common/regenerate.sh‎

Lines changed: 4 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ generated_files=()
1010
SUIT_PROCESSOR_DIR="../../../../../modules/lib/suit-processor"
1111
SUIT_GENERATOR_DIR="../../../../../modules/lib/suit-generator"
1212
SIGN_SCRIPT=${SUIT_GENERATOR_DIR}/ncs/sign_script.py
13+
KMS_SCRIPT=${SUIT_GENERATOR_DIR}/ncs/basic_kms.py
1314
KEYS_DIR=${SUIT_GENERATOR_DIR}/ncs
1415

1516
if [ -z "$1" ]
@@ -30,21 +31,6 @@ if [ ! -f key_private.pem ]; then
3031
generated_files+=("\tpublic key:\t\t$PWD/key_public.pem")
3132
fi
3233

33-
# 0x4000AA00: Path(__file__).parent / "key_private_OEM_ROOT_GEN1.pem",
34-
# 0x40022100: Path(__file__).parent / "key_private_APPLICATION_GEN1.pem",
35-
# 0x40032100: Path(__file__).parent / "key_private_RADIO_GEN1.pem",
36-
if [ ! -f key_private_OEM_ROOT_GEN1.pem ]; then
37-
cp key_private.pem key_private_OEM_ROOT_GEN1.pem
38-
fi
39-
40-
if [ ! -f key_private_APPLICATION_GEN1.pem ]; then
41-
cp key_private.pem key_private_APPLICATION_GEN1.pem
42-
fi
43-
44-
if [ ! -f key_private_RADIO_GEN1.pem ]; then
45-
cp key_private.pem key_private_RADIO_GEN1.pem
46-
fi
47-
4834
if [ ! -f key_public.c ]; then
4935
echo "Generating public key as C source file..."
5036
suit-generator convert --input-file key_private.pem --output-file key_public.c
@@ -57,7 +43,9 @@ echo "Generating SUIT envelope for $1 input file ..."
5743
suit-generator create --input-file $1 --output-file sample.suit
5844
generated_files+=("\tunsigned binary envelope:\t\t$PWD/sample.suit")
5945
echo "Signing SUIT envelope using key_priv.pem ..."
60-
python3 ${SIGN_SCRIPT} --input-file sample.suit --output-file sample_signed.suit
46+
suit-generator sign single-level --input-envelope sample.suit --output-envelope sample_signed.suit \
47+
--key-name key_private --key-id 0x40000000 --sign-script ${SIGN_SCRIPT} \
48+
--kms-script ${KMS_SCRIPT}
6149
generated_files+=("\tsigned binary envelope:\t\t\t$PWD/sample_signed.suit")
6250
echo "Converting binary envelope into C code ..."
6351
zcbor convert \

0 commit comments

Comments
 (0)