1#!/bin/sh
2
3if [ -z "$1" ]; then
4	echo "Usage: $0 KEY"
5	exit 1
6fi
7
8TOOLS_DIR=$(dirname $0)
9
10TEMP_X509=$(mktemp XXXXXXXX.temp)
11
12REVISION=${2:-0}
13SHA_VAL=$(openssl dgst -sha512 -hex tispl.bin | sed -e "s/^.*= //g")
14BIN_SIZE=$(stat -c %s tispl.bin)
15
16cat <<EOF >$TEMP_X509
17[ req ]
18distinguished_name     = req_distinguished_name
19x509_extensions        = v3_ca
20prompt                 = no
21dirstring_type         = nobmp
22
23[ req_distinguished_name ]
24CN                     = IOT2050 Firmware Signature
25
26[ v3_ca ]
27basicConstraints       = CA:true
281.3.6.1.4.1.294.1.3    = ASN1:SEQUENCE:swrv
291.3.6.1.4.1.294.1.34   = ASN1:SEQUENCE:sysfw_image_integrity
30
31[ swrv ]
32swrv = INTEGER:$REVISION
33
34[ sysfw_image_integrity ]
35shaType                = OID:2.16.840.1.101.3.4.2.3
36shaValue               = FORMAT:HEX,OCT:$SHA_VAL
37imageSize              = INTEGER:$BIN_SIZE
38EOF
39
40CERT_X509=$(mktemp XXXXXXXX.crt)
41
42openssl req -new -x509 -key $1 -nodes -outform DER -out $CERT_X509 -config $TEMP_X509 -sha512
43cat $CERT_X509 tispl.bin > tispl.bin_signed
44$TOOLS_DIR/binman/binman replace -i flash-pg1.bin -f tispl.bin_signed fit@180000
45$TOOLS_DIR/binman/binman replace -i flash-pg2.bin -f tispl.bin_signed fit@180000
46
47rm $TEMP_X509 $CERT_X509
48
49$TOOLS_DIR/binman/binman sign -i flash-pg1.bin -k $1 -a sha256,rsa4096 fit@380000
50$TOOLS_DIR/binman/binman sign -i flash-pg2.bin -k $1 -a sha256,rsa4096 fit@380000
51