mirror of
https://github.com/RIOT-OS/RIOT.git
synced 2025-01-17 05:32:45 +01:00
fbf1cd16a6
This makes it easier to work with encrypted keys and multiple keys. The firmware binary can contain multiple public keys that are used to verify the manifest. The use case is that we want to include the production public key in the debug build, so we can seamlessly update to the production version without re-flashing the device. If the public keys is always generated on the fly, this would still require the production key password even for the debug build. Instead if we store the (unencrypted) public key, we can always include it in the debug build.
58 lines
1.6 KiB
Makefile
58 lines
1.6 KiB
Makefile
#
|
|
# path to suit-tool
|
|
SUIT_TOOL ?= $(RIOTBASE)/dist/tools/suit/suit-manifest-generator/bin/suit-tool
|
|
|
|
#
|
|
# SUIT encryption keys
|
|
#
|
|
|
|
# Specify key to use.
|
|
# Will use $(SUIT_KEY_DIR)/$(SUIT_KEY).pem as combined private/public key
|
|
# files.
|
|
SUIT_KEY ?= default
|
|
XDG_DATA_HOME ?= $(HOME)/.local/share
|
|
|
|
ifeq (1, $(RIOT_CI_BUILD))
|
|
SUIT_KEY_DIR ?= $(BINDIR)
|
|
else
|
|
SUIT_KEY_DIR ?= $(XDG_DATA_HOME)/RIOT/keys
|
|
endif
|
|
|
|
# we may accept multiple keys for the firmware
|
|
SUIT_SEC ?= $(foreach item,$(SUIT_KEY),$(SUIT_KEY_DIR)/$(item).pem)
|
|
|
|
# generate a list of the public keys
|
|
SUIT_PUBS ?= $(SUIT_SEC:.pem=.pem.pub)
|
|
|
|
SUIT_PUB_HDR = $(BINDIR)/riotbuild/public_key.h
|
|
SUIT_PUB_HDR_DIR = $(dir $(SUIT_PUB_HDR))
|
|
CFLAGS += -I$(SUIT_PUB_HDR_DIR)
|
|
BUILDDEPS += $(SUIT_PUB_HDR)
|
|
|
|
$(SUIT_SEC): | $(CLEAN)
|
|
$(Q)echo suit: generating key in $(SUIT_KEY_DIR)
|
|
$(Q)mkdir -p $(SUIT_KEY_DIR)
|
|
$(Q)$(RIOTBASE)/dist/tools/suit/gen_key.py $@ $(SUIT_SEC_PASSWORD)
|
|
|
|
%.pem.pub: %.pem
|
|
$(Q)openssl ec -inform pem -in $< -outform pem -pubout -out $@
|
|
|
|
# Convert public keys to C headers - only last 32 bytes are key material
|
|
#
|
|
# set FORCE so switching between keys using "SUIT_KEY=foo make ..."
|
|
# triggers a rebuild even if the new key would otherwise not (because the other
|
|
# key's mtime is too far back).
|
|
$(SUIT_PUB_HDR): $(SUIT_PUBS) FORCE | $(CLEAN)
|
|
$(Q)mkdir -p $(SUIT_PUB_HDR_DIR)
|
|
$(Q)( \
|
|
echo "const uint8_t public_key[][32] = {"; \
|
|
for i in $(SUIT_PUBS); do \
|
|
echo " {"; \
|
|
openssl ec -inform pem -pubin -in $$i -outform der | tail -c 32 | xxd -i; \
|
|
echo " },"; \
|
|
done; \
|
|
echo "};" \
|
|
) | '$(LAZYSPONGE)' $(LAZYSPONGE_FLAGS) '$@'
|
|
|
|
suit/genkey: $(SUIT_SEC)
|