Changes between Version 42 and Version 43 of buildroot

Timestamp:

04/02/2021 10:42:35 PM (4 years ago)

Author:

Tim Harvey

Comment:

add image signing to swupdate example

buildroot

@@ -862 +862 @@
 make newport_swupdate_defconfig
 make
-
+# create a private/public key combo for signature verifcation
+openssl genrsa -out swupdate-priv.pem # private
+openssl rsa -in swupdate-priv.pem -out swupdate-public.pem -outform PEM -pubout # public
+# sign the sw-description
+openssl dgst -sha256 -sign swupdate-priv.pem sw-description > sw-description.sig
 # build swupdate image
 cp output/images/rootfs.ext4.gz .
-for i in sw-description update.sh rootfs.ext4.gz; do
+for i in sw-description sw-description.sig update.sh rootfs.ext4.gz; do
         echo $i; done | cpio -ov -H crc > my-software.swu
 }}}
+ * Note that you can skip the inclusion of sw-description.sig and the pub/priv key if you don't care about signatures and have not define CONFIG_SIGNED_IMAGES in your swupdate.config
 
 Here are some one-time steps you will need to do to your boot firmware:
@@ -908 +913 @@
 cd /tmp
 wget http://myserver/my-software.swu
-swupdate -i mysoftware.swu
-}}}
+wget http://myserver/swupdate-public.pem
+swupdate -i mysoftware.swu -k swupdate-public.pem
+}}}
+ * Note that you can skip the -k param have not enabled signed images via CONFIG_SIGNED_IMAGES in your swupdate.config
 
 Note that if you require support for SWUpdate to complete an install that isn't already there (for example you want to add the capability to update GSC firmware via the gsc_update utility) you will either need to a) add a static linked version of that tool to your image or b) do a 2-stage update where you add the required tools first, then use them in a future update