Browse Source
* Add Dockerfile for building the firmware Setting up a local environment for building the firmware can be a painful process. This wraps that process up in a Dockerfile containing all the deps needed which is then used in the justfile to build the firmware. * Add just targets for signing and cleaning * Change sha target to take a sha and verify it directly * Add docs for verifying the firmware SHA sum * Add version param to sign just target * Update verify-sha output to be more explicitPASS1-140
Alex Sears
3 years ago
committed by
GitHub
GitHub
8 changed files with 92 additions and 4 deletions
@ -0,0 +1,32 @@ |
|||
FROM ubuntu:18.04 AS cross_build |
|||
RUN apt-get update && \ |
|||
apt-get install -y git make gcc-arm-none-eabi python3 gcc && \ |
|||
rm -rf /var/lib/apt/lists/* |
|||
COPY docs /workspace/passport-firmware/docs |
|||
COPY extmod /workspace/passport-firmware/extmod |
|||
COPY lib /workspace/passport-firmware/lib |
|||
COPY mpy-cross /workspace/passport-firmware/mpy-cross |
|||
COPY py /workspace/passport-firmware/py |
|||
WORKDIR /workspace/passport-firmware/mpy-cross |
|||
RUN make |
|||
|
|||
FROM ubuntu:18.04 AS cosign_build |
|||
WORKDIR /workspace |
|||
RUN apt-get update && \ |
|||
apt-get install -y git make libssl-dev gcc && \ |
|||
rm -rf /var/lib/apt/lists/* |
|||
COPY ports/stm32/boards/Passport/tools/cosign /workspace/passport-firmware/ports/stm32/boards/Passport/tools/cosign |
|||
COPY ports/stm32/boards/Passport/include /workspace/passport-firmware/ports/stm32/boards/Passport/include |
|||
COPY lib /workspace/passport-firmware/lib |
|||
COPY ports/stm32/boards/Passport/common /workspace/passport-firmware/ports/stm32/boards/Passport/common |
|||
WORKDIR /workspace/passport-firmware/ports/stm32/boards/Passport/tools/cosign |
|||
RUN make |
|||
|
|||
FROM ubuntu:18.04 AS firmware_builder |
|||
COPY --from=cosign_build \ |
|||
/workspace/passport-firmware/ports/stm32/boards/Passport/tools/cosign/x86/release/cosign /usr/bin/cosign |
|||
COPY --from=cross_build \ |
|||
/workspace/passport-firmware/mpy-cross/mpy-cross /usr/bin/mpy-cross |
|||
RUN apt-get update && \ |
|||
apt-get install -y make gcc-arm-none-eabi autotools-dev automake libtool python3 && \ |
|||
rm -rf /var/lib/apt/lists/* |
|||
@ -0,0 +1,46 @@ |
|||
commit_sha := `git rev-parse HEAD` |
|||
base_path := 'ports/stm32' |
|||
firmware_path := base_path + '/build-Passport/firmware.bin' |
|||
|
|||
# build the firmware inside docker |
|||
docker-build: |
|||
#!/usr/bin/env bash |
|||
set -euxo pipefail |
|||
docker build -t foundation-devices/firmware-builder:{{ commit_sha }} . |
|||
docker run -it --rm -v "$PWD":/workspace \ |
|||
-w /workspace/{{ base_path }} \ |
|||
--entrypoint bash \ |
|||
foundation-devices/firmware-builder:{{ commit_sha }} \ |
|||
-c 'make BOARD=Passport MPY_CROSS=/usr/bin/mpy-cross' |
|||
|
|||
# run the built firmware through SHA256 |
|||
verify-sha sha: docker-build |
|||
#!/usr/bin/env bash |
|||
sha=$(shasum -a 256 {{ firmware_path }} | awk '{print $1}') |
|||
|
|||
echo -e "Expected SHA:\t{{ sha }}" |
|||
echo -e "Actual SHA:\t${sha}" |
|||
if [ "$sha" = "{{ sha }}" ]; then |
|||
echo "Hashes match!" |
|||
else |
|||
echo "ERROR: Hashes DO NOT match!" |
|||
fi |
|||
|
|||
# sign the built firmware using a private key and the cosign tool |
|||
sign keypath version filepath=firmware_path: docker-build |
|||
#!/usr/bin/env bash |
|||
set -euxo pipefail |
|||
|
|||
docker run -it --rm -v "$PWD":/workspace \ |
|||
-w /workspace \ |
|||
--entrypoint bash \ |
|||
foundation-devices/firmware-builder:{{ commit_sha }} \ |
|||
-c "cosign -f {{ filepath }} -k {{ keypath }} -v {{ version }}" |
|||
|
|||
# clean firmware build |
|||
clean: |
|||
docker run -it --rm -v "$PWD":/workspace \ |
|||
-w /workspace/{{ base_path }} \ |
|||
--entrypoint bash \ |
|||
foundation-devices/firmware-builder:{{ commit_sha }} \ |
|||
-c "make clean BOARD=Passport" |
|||
Loading…
Reference in new issue