WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity
3,681 Commits
31 Branches
32 Tags
44 MiB
Commit Graph

42 Commits (f0ad5692d2e4dade11104e11d7ece265cda7b77c)

Author SHA1 Message Date
David Garske 95227f823c fdt: rewrite device tree parser with capacity bound and full validation 2026-09-02 10:48:52 +02:00
David Garske c8faa5adc2 Authenticate raw device tree via signed HDR_DEVICE_TREE_DIGEST TLV (Fenrir #7998) 2026-08-13 08:39:22 +02:00
David Garske 4a16dce4f8 efi: authenticate the kernel command line via a signed HDR_CMDLINE manifest TLV 2026-08-10 21:03:50 +02:00
Mattia Moffa e6c87d86a9 Add --custom-tlv-pubkey-der option to signing tool 
Allows extracting a public key from a DER file and adding it in the same
format as the keystore:

- `X||Y` for ECC
- Raw for Ed25519/Ed448
- Public key DER for RSA
 2026-07-30 15:38:11 +02:00
Brett Nicholas 95e90f2e91 revined comment 2026-07-22 09:42:45 -06:00
Brett Nicholas 22b2fe5dc9 add custom file-backed TLV sign option 2026-07-21 16:19:04 -06:00
Brett Nicholas 6c148b2e9e increase custom TLV size limit to UINT16_MAX 2026-07-21 15:15:10 -06:00
Brett Nicholas 4d31ef5502 Add self-header feature with support for sim and AURIX TC3xx 2026-02-27 11:39:51 +01:00
Brett Nicholas a3af00114b Improve docs for USER_XXX variables to clarify intent 2025-12-10 07:43:32 +01:00
Brett Nicholas 57b874be2d Simplify use of user-supplied keys and certificates with test app via 
new `USER_ variables`
 2025-12-10 07:43:32 +01:00
gojimmypi 1ad66e9a6b
Improve docs, add targets and tests per https://github.com/wolfSSL/wolfBoot/pull/598#pullrequestreview-3492319645 2025-11-21 17:54:14 -08:00
gojimmypi 7d0e735522
doc polish 2025-11-20 17:05:12 -08:00
gojimmypi eaf029fbc5
CMake Improvements 2025-11-18 17:44:43 -08:00
gojimmypi d513adc3b7 Introduce keygen --no-overwrite to avoid prompt 2025-11-13 17:59:22 +01:00
Brett Nicholas 38d1441627 copilot review feedback 2025-05-28 09:37:14 -06:00
Brett Nicholas 7660bf66f8 Add wolfHSM cert chain verification for ECC and RSA 2025-05-27 15:42:59 -06:00
Daniele Lacamera 6c8aafe09d Remove keytools dependency on IMAGE_HEADER_SIZE. 
- Added getenv() to override the value at runtime
- Removed doc on old python tools
 2024-11-26 10:57:06 +01:00
Daniele Lacamera 3a69b0e41a Don't fail if the image contains no base sha 
+ Added --no-base-sha option to sign
 2024-11-22 11:58:17 +01:00
Brett Nicholas 6d1adc2376 Add documention for `--exportpubkey` and `--nolocalkeys` to Signing.md 2024-11-13 09:52:49 +01:00
David Garske 06c5280211 Minor doc fixes. 2024-07-03 11:48:17 -07:00
David Garske 918fdc57fd Added keygen `--der` option to allow ECC private key as ASN.1/DER. Added sign tool ECC key load support for ASN.1/DER private key (default is raw pub x/y, priv d). Refactored sign tool RSA/ECC logic to consolidate code and allow proper "auto" detection for different RSA key sizes. 2024-06-26 20:11:04 +02:00
jordan 726cd28ea1 Update PQ docs, and fix spelling errors. 2024-05-07 19:25:18 +02:00
Jim Norton 7b0f78d488 Updated documentation. 2024-04-05 08:52:03 +02:00
David Garske 2826f70ca7 Improve documentation for new custom TLV. 2024-03-08 11:38:46 +01:00
David Garske 5ba777c748 Add documentation for ECC P-521. 2024-03-01 12:28:07 -08:00
Daniele Lacamera 304e0e876e Added sign option `--custom-tlv-buffer` 2024-02-29 17:29:29 +01:00
Daniele Lacamera 43f7730576 Added support for custom TLVs in manifest header 2024-02-29 17:29:29 +01:00
David Garske 05b83544fb Fixes based on peer review. Add output of signed policy to file (append .sig). Tested successfully with multiple PCRs. In example unlock_disk extend PCR with random value after unseal to prevent unsealing after boot. 2023-09-12 12:26:48 +02:00
David Garske 490286be7d Support for sealing/unseal a secret based on an externally signed PCR policy. 
* Added new `WOLFBOOT_TPM_SEAL` and `WOLFBOOT_TPM_SEAL_NV_BASE` config options.
* Added new `tools/tpm/policy_create` tool for assisting with creation of a policy digest. The sign keytool `--policy=file` signs the policy.
* Added new `WOLFBOOT_TPM_VERIFY` option to enable offloading of the asymmetric verification to the TPM. By default wolfCrypt will be used.
* Added example seal/unseal to update_flash for ARCH_SIM.
* Renamed `WOLFBOOT_TPM_KEYSTORE_NV_INDEX` to `WOLFBOOT_TPM_KEYSTORE_NV_BASE` to support multiple public keys.
* Refactored most TPM code into tpm.c.
* Refactored the keystore ROT to use new `wolfBoot_check_rot` API.
* Refactored the sign keytool to have a sign_digest function to allow signing firmware and policy for sealing/unsealing.
* Fix for make distclean && make using the wrong key tools.
 2023-09-12 12:26:48 +02:00
David Garske 2f0e699f82 Fix for keytools with path having spaces. Added note about sign.c use of `WOLFBOOT_SECTOR_SIZE` for delta support. 2023-08-18 10:39:42 -07:00
David Garske 3797238546 Documentation and code comment cleanups: 
* Update documentation for signing with `--no-sign`, as the key argument should not be supplied.
* Recommend `make keysclean` instead of distclean on keys mismatch.
* Renesas headings/readme link and white-space.
 2023-08-04 10:13:56 +02:00
Daniele Lacamera 21493fcd8d Deprecate python keytools. 2023-08-03 08:05:18 +02:00
Daniele Lacamera c9a7c2bc8d Updated documentation with new keygen syntax 2022-07-20 20:17:22 +02:00
David Garske fd167e1afc For signing with HSM add step for putting the right public key into bootloader for root of trust. 2022-07-15 18:53:13 +02:00
Daniele Lacamera a9ffb3c98a Fixed typos. Removed verbose command line help. 2022-05-24 17:24:31 +02:00
Daniele Lacamera 063c21430c Added partition ID. Extended sign manual 2022-05-24 13:31:50 +02:00
David Garske 6068a8047c wolfBoot improvements (from elms): 
* Add `WOLFBOOT_DUALBOOT` for dynamic fallback
* Refactor header field parsing
* Cleanup compiler warnings and logic extra check
* Option to leave out partition based functions
* Add `WOLFBOOT_FIXED_PARTITIONS` enable using partition enum and related functions
* Wrap all delta update references
* Update raspberry documentation
* EFI refactoring
* Add `keytools_check` target
* Add "library" target
 2022-05-20 08:06:07 +02:00
Daniele Lacamera 2e7b63eae5 Adding support for ED448 verification 2021-12-13 12:05:37 +01:00
David Garske c473a53ebe Improvements to the key tools documentation. 2020-06-24 09:04:24 -07:00
David Garske 99cf42b9a3 Added missing items from signing tool Visual Studio project. Updated signing documentation. 2020-03-11 12:25:51 -07:00
David Garske e7446c570f Fixes for Device Tree (DTS) handling. Updated documentation. 2020-03-06 15:33:41 -08:00
David Garske c0b534edd7 wolfBoot Aarch64 support (Xilinx Zynq and Raspberry Pi): 
* Added Aarch64 boot/startup support
* Added configuration templates for Raspberry Pi 3 and Xilinx ZynqMP UltraScale+
* Added Xilinx Zynq QSPI bare-metal Driver
* Added `NO_XIP` option for full `ext_flash_*` API on all partitions
* Added Xilinx SDK Project Template
* Added support for DTS image partitions
* Added wolfBoot signing tool in Native C (`tools/keytools/sign.c`).
* Added libwolfboot functions `int wolfBoot_fallback_is_possible(void);` and `int wolfBoot_dualboot_candidate(void);`
* Performance improvement to only hash application firmware image once
 2020-03-04 12:04:46 -08:00