This adds initial support for publishing imgtool to pypi.org.
The main imgtool.py was moved to imgtool package and made into the main
file, and a new imgtool.py that calls into the package, was added allowing
for the old usage behavior to remain functional.
Signed-off-by: Fabio Utzig <utzig@apache.org>
Generating images with no signature or encryption was broken by commit
06b77b8353
This allows generating images with just sha256 again, and fixes a few
leftovers from the imghash TLV change.
Signed-off-by: Fabio Utzig <utzig@apache.org>
Adds a new flag to imgtool, -E/--encrypt which accepts a public rsa-2048
key file that will be used to encrypt the image.
The encryption method uses AES-128-CTR to encrypt the image data (ignores
the header and TLVs), using a random key that is itself encrypted using
RSA-2048-OAEP and added to the generated image as a new TLV.
Signed-off-by: Fabio Utzig <utzig@apache.org>
The `--included-header` was "mandatory" when using imgtool with firmware
images generated by the Zephyr build system and it was a source of
issues when it was forgotten. This removes `--included-header` and adds
a new parameter `--pad-header` with inverted semantics, to be used only
when a zeroed header is required to be added to the firmware image.
Signed-off-by: Fabio Utzig <utzig@apache.org>
Overwrite only requires just magic + image_ok + copy_done. This fixes
issues generating images in overwrite only mode when the firmware image
is too big and overflows the swap status area.
Signed-off-by: Fabio Utzig <utzig@apache.org>
Add the new `--slot-size` and make `--pad` a bool flag, to allow
checking that firmware fits in the slot without overflowing into the
trailer region even when no padding was requested.
Fixes#241
Signed-off-by: Fabio Utzig <utzig@apache.org>
This adds a new command line flag to allow passing in the max number of
sectors for a swap when the image is padded. It defaults to 128 and
should match the value configured in the bootloader.
Fixes#285
Signed-off-by: Fabio Utzig <utzig@apache.org>
`create` as alias to `sign` was defined in the arg parsing, but was not
functional because it was missing the subcommands call dict. This makes
`create` call the `sign` method.
Signed-off-by: Fabio Utzig <utzig@apache.org>
The imgtool's `sign` command also works without a key, but it doesn't
sign, only appends a hash. Add a `create` alias to this command so that
this usage makes more sense.
Fixes#240
Signed-off-by: David Brown <david.brown@linaro.org>
The keygen command allows the `-p` argument which will prompt for a
password, and protect the private key with this password. When loading
keys, it will prompt for a password if it detects a password protected
key.
Signed-off-by: David Brown <david.brown@linaro.org>
Support for PKCS1.5 has been removed from the bootloader for a while
now, remove it as well from the tool.
Signed-off-by: David Brown <david.brown@linaro.org>
Although these files are likely implicitly licensed under the Apache 2.0
license because of the LICENSE file for this project, make this explicit
in these files.
Signed-off-by: David Brown <david.brown@linaro.org>
Add a `--rust` flag to the getpub subcommand to output the public key in
Rust format rather than C.
Signed-off-by: David Brown <david.brown@linaro.org>
The imgtool.py program has been assuming that the input image for
signing has a zero padded place for the header at the beginning of the
image. This is only true for some platforms.
Instead, make this included header space optional. By default, prepend
the header to the image. If `--included-header` is specified to the
sign command, consider the bytes at the beginning of the image to be
padded space for the header. This option is required for Zephyr builds.
If the --key is not specified, only the SHA256 hash is added to the TLV.
This is useful for testing configurations, where the crypto has not been
fully configured. Note that this configuration is not secure, and this
only verifies that the image has not been corrupted.
Changing the name of the command line argument changes the name of the
fields used to access it. Change the keysigning code to reflect this,
avoiding a stack dump when trying to generate keys.
Add support for the RSA-PSS signature algorithm to imgtool.py. This
algorithm has a strong security proof, and is recommended for all new
designs. The new algorithm is enabled by default for RSA signatures to
match the default in the bootloader also being changed.
This is the start of a python implementation of imgtool. This
implements all of the functionality that was missing in the zep2newt.py
tool, namely creation of keypairs, and converting the public version of
these keys into C code.
Fabio Utzig