1#!/bin/sh 2 3if [ -z "$1" ]; then 4 echo "Usage: $0 KEY" 5 exit 1 6fi 7 8TOOLS_DIR=$(dirname $0) 9 10TEMP_X509=$(mktemp XXXXXXXX.temp) 11 12REVISION=${2:-0} 13SHA_VAL=$(openssl dgst -sha512 -hex tispl.bin | sed -e "s/^.*= //g") 14BIN_SIZE=$(stat -c %s tispl.bin) 15 16cat <<EOF >$TEMP_X509 17[ req ] 18distinguished_name = req_distinguished_name 19x509_extensions = v3_ca 20prompt = no 21dirstring_type = nobmp 22 23[ req_distinguished_name ] 24CN = IOT2050 Firmware Signature 25 26[ v3_ca ] 27basicConstraints = CA:true 281.3.6.1.4.1.294.1.3 = ASN1:SEQUENCE:swrv 291.3.6.1.4.1.294.1.34 = ASN1:SEQUENCE:sysfw_image_integrity 30 31[ swrv ] 32swrv = INTEGER:$REVISION 33 34[ sysfw_image_integrity ] 35shaType = OID:2.16.840.1.101.3.4.2.3 36shaValue = FORMAT:HEX,OCT:$SHA_VAL 37imageSize = INTEGER:$BIN_SIZE 38EOF 39 40CERT_X509=$(mktemp XXXXXXXX.crt) 41 42openssl req -new -x509 -key $1 -nodes -outform DER -out $CERT_X509 -config $TEMP_X509 -sha512 43cat $CERT_X509 tispl.bin > tispl.bin_signed 44$TOOLS_DIR/binman/binman replace -i flash-pg1.bin -f tispl.bin_signed fit@180000 45$TOOLS_DIR/binman/binman replace -i flash-pg2.bin -f tispl.bin_signed fit@180000 46 47rm $TEMP_X509 $CERT_X509 48 49$TOOLS_DIR/binman/binman sign -i flash-pg1.bin -k $1 -a sha256,rsa4096 fit@380000 50$TOOLS_DIR/binman/binman sign -i flash-pg2.bin -k $1 -a sha256,rsa4096 fit@380000 51