74b8fc0664
base_diff() captured patch_inv_off = len3 + CMD.header_sz before calling make_header_delta(), which signs the delta image via make_header_ex(is_diff=1). When a certificate chain is present, the delta (is_diff=1) header needs ~72 more bytes than the non-delta header for the four delta TLVs plus the base-hash TLV. For a window of cert-chain sizes, header_required_size(is_diff=0) still fit the current CMD.header_sz while header_required_size(is_diff=1) did not, so make_header_ex(is_diff=1) grew CMD.header_sz to the next power of two *after* patch_inv_off was captured. The HDR_IMG_DELTA_INVERSE TLV then encoded a stale, too-small offset; the bootloader (update_flash.c) uses it as a raw byte offset into the update partition to locate the inverse patch, so rollback read from the wrong offset and failed. Resolve the is_diff=1 header-size expansion (same logic as make_header_ex) before computing patch_inv_off. Add unit-sign-delta-cert-inv-off.py, which signs an ed25519 delta with a 300-byte chain (inside the triggering window) and asserts the inverse patch is the trailing HDR_IMG_DELTA_INVERSE_SIZE bytes of the file; it fails before this fix. |
||
|---|---|---|
| .. | ||
| otp | ||
| Makefile | ||
| README.md | ||
| keygen.c | ||
| keygen.py | ||
| sign.c | ||
| sign.py | ||
| user_settings.h | ||
| wolfBootKeyTools.sln | ||
| wolfBootKeygenTool.vcxproj | ||
| wolfBootSignTool.vcxproj | ||
README.md
Key Tools for signing and key generation
Sign
See code file ./tools/keytools/sign.c and documentation in docs/Signing.md.
KeyGen and KeyStore
See code file ./tools/keytools/keygen.c and documentation docs/keystore.md.
Flash OTP Keystore Generation, Primer, Startup
See documentation docs/flash-OTP.md.
Keystore Generation
Pack public keys into a single binary (otp.bin) formatted the way wolfBoot expects for
provisioning the device’s OTP/NVM keystore. No signing, no encryption—just a correctly laid-out image
with a header plus fixed-size "slots" for each key.
See code file ./tools/keytools/otp/otp-keystore-gen.c
Flash OTP Primer
See code file ./tools/keytools/otp/otp-keystore-primer.c
Flash OTP Startup
See code file ./tools/keytools/otp/startup.c
Quick Start (Linux)
make wolfboot_signing_private_key.der SIGN=ED25519
# or
./tools/keytools/keygen --ed25519 -g wolfboot_signing_private_key.der
Note the above example is a basic case where a single key is generated.
The tool supports multiple keys both with [-g privkey] and [-i pubkey] parameters.
See the local docs docs/keystore.md and the wolfBoot Keystore section of the manual for additional details.
Debugging and Development
DEBUG_SIGNTOOL
Enables additional diagnostic messages that may be useful during development and initial bring-up.
WOLFBOOT_SHOW_INCLUDE
Enables compile-time verbosity to indicate which user_settings.h file is being used.