00bc8b5823
wolfBoot_find_header() and the sign tool's re-parser checked each field's 4+len against (uint16_t)(header_size - IMAGE_HEADER_OFFSET). For any header of 64 KiB or more the cast wraps (0x10000 -> 0), so the guard rejects every field and an image the tool signs cannot be parsed by the bootloader - a pack/parse roundtrip break, fail-safe but fatal for large TLVs (post-quantum signatures, big cert chains). Compare in the uint32_t domain in both walkers. No shipped config reaches this size yet (largest example is 12288), so this pins the roundtrip for future large-header configs. unit-parser-large-header (new) builds the walker with IMAGE_HEADER_SIZE = 0x10008 - exactly the wrap boundary - and asserts a 300-byte TLV and a 4-byte version field are located (both were rejected pre-fix, proven against the pre-fix walker in a scratch build). |
||
|---|---|---|
| .. | ||
| otp | ||
| Makefile | ||
| README.md | ||
| keygen.c | ||
| keygen.py | ||
| sign.c | ||
| sign.py | ||
| user_settings.h | ||
| wolfBootKeyTools.sln | ||
| wolfBootKeygenTool.vcxproj | ||
| wolfBootSignTool.vcxproj | ||
README.md
Key Tools for signing and key generation
Sign
See code file ./tools/keytools/sign.c and documentation in docs/Signing.md.
KeyGen and KeyStore
See code file ./tools/keytools/keygen.c and documentation docs/keystore.md.
Flash OTP Keystore Generation, Primer, Startup
See documentation docs/flash-OTP.md.
Keystore Generation
Pack public keys into a single binary (otp.bin) formatted the way wolfBoot expects for
provisioning the device’s OTP/NVM keystore. No signing, no encryption—just a correctly laid-out image
with a header plus fixed-size "slots" for each key.
See code file ./tools/keytools/otp/otp-keystore-gen.c
Flash OTP Primer
See code file ./tools/keytools/otp/otp-keystore-primer.c
Flash OTP Startup
See code file ./tools/keytools/otp/startup.c
Quick Start (Linux)
make wolfboot_signing_private_key.der SIGN=ED25519
# or
./tools/keytools/keygen --ed25519 -g wolfboot_signing_private_key.der
Note the above example is a basic case where a single key is generated.
The tool supports multiple keys both with [-g privkey] and [-i pubkey] parameters.
See the local docs docs/keystore.md and the wolfBoot Keystore section of the manual for additional details.
Debugging and Development
DEBUG_SIGNTOOL
Enables additional diagnostic messages that may be useful during development and initial bring-up.
WOLFBOOT_SHOW_INCLUDE
Enables compile-time verbosity to indicate which user_settings.h file is being used.