iot2050-sign-fw.sh 1.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748
  1. #!/bin/sh
  2. if [ -z "$1" ]; then
  3. echo "Usage: $0 KEY"
  4. exit 1
  5. fi
  6. TEMP_X509=$(mktemp XXXXXXXX.temp)
  7. REVISION=${2:-0}
  8. SHA_VAL=$(openssl dgst -sha512 -hex tispl.bin | sed -e "s/^.*= //g")
  9. BIN_SIZE=$(stat -c %s tispl.bin)
  10. cat <<EOF >$TEMP_X509
  11. [ req ]
  12. distinguished_name = req_distinguished_name
  13. x509_extensions = v3_ca
  14. prompt = no
  15. dirstring_type = nobmp
  16. [ req_distinguished_name ]
  17. CN = IOT2050 Firmware Signature
  18. [ v3_ca ]
  19. basicConstraints = CA:true
  20. 1.3.6.1.4.1.294.1.3 = ASN1:SEQUENCE:swrv
  21. 1.3.6.1.4.1.294.1.34 = ASN1:SEQUENCE:sysfw_image_integrity
  22. [ swrv ]
  23. swrv = INTEGER:$REVISION
  24. [ sysfw_image_integrity ]
  25. shaType = OID:2.16.840.1.101.3.4.2.3
  26. shaValue = FORMAT:HEX,OCT:$SHA_VAL
  27. imageSize = INTEGER:$BIN_SIZE
  28. EOF
  29. CERT_X509=$(mktemp XXXXXXXX.crt)
  30. openssl req -new -x509 -key $1 -nodes -outform DER -out $CERT_X509 -config $TEMP_X509 -sha512
  31. cat $CERT_X509 tispl.bin > tispl.bin_signed
  32. source/tools/binman/binman replace -i flash-pg1.bin -f tispl.bin_signed fit@180000
  33. source/tools/binman/binman replace -i flash-pg2.bin -f tispl.bin_signed fit@180000
  34. rm $TEMP_X509 $CERT_X509
  35. source/tools/binman/binman sign -i flash-pg1.bin -k $1 -a sha256,rsa4096 fit@380000
  36. source/tools/binman/binman sign -i flash-pg2.bin -k $1 -a sha256,rsa4096 fit@380000