Support external firmware signing
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 52/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- cpp
- Domain
- cli, cryptography, security
Research direction
Start by locating the implementations of the picotool seal and info commands, then review how hashed images, HASH_VALUE items, and existing signing inputs are handled. Done means seal -sign accepts an external public key and signature for a previously hashed image, replaces HASH_VALUE with SIGNATURE, and optionally info -h prints the image hash.
Written by the indexing model from the issue text.
Description
It would be nice to use picotool for signing firmware images without exposing the private key. I imagine the following flow:
$ picotool seal -hash firmware.uf2 firmware.hashed.uf2
$ export HASH=`picotool info -h firmware.hashed.uf2` # add a -h flag to dump the hash, otherwise `picotool -m firmware.hashed.uf2|grep ...`
$ export SIGNATURE=... # Externally sign $HASH.
$ picotool seal -sign -signature "$SIGNATURE" -pubkey $PUBKEY firmware.hashed.uf2 firmware.signed.uf2
In other words, add support for an externally supplied public key and signature to picotool seal -sign, to convert a previously hashed image to a signed image by replacing its HASH_VALUE item with a SIGNATURE item. Optionally, add a picotool info -h for convenient dumping of a firmware image hash.
This is a generalization of #198 .
- Dominant language
- C++
- Stars
- 999
- Forks
- 189
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from raspberrypi/picotool
-
picotool load file.bin -o 0x11000000 always fails with second flash chip present and configured Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
raspberrypi/picotool#360 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
raspberrypi/picotool#347 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
raspberrypi/picotool#348 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 52/100
raspberrypi/picotool#344 · 3 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
raspberrypi/picotool#330 · 1 comment ·
All issues in raspberrypi/picotool
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Sensor initialization takes very long when `--initial-sim-time` is set to current UNIX timestamp Open
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
gazebosim/gz-sensors#662 · 1 comment ·
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
comp-datalake
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
ClickHouse/ClickHouse#121222 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
LadybirdBrowser/ladybird#12123 ·