Image signing guide

From Tizen Wiki
Jump to: navigation, search

SECURITY DISCLAIMER

The signer is the entity responsible for managing the keys used to sign software. This role may be performed by the 3rd party organization that developed or built the software.

Prerequisite

To sign and verify package, you should have certificate chain

  • Root CA : PEM format
  • Child certificate and its private key : bind with PKCS12 format

Sign image

Signing image is almost same with OS upgrade and OS recovery except argument

  • Usage
    • OS Upgrade : delta-generation.sh TOTA_UPG_PATH TARGET SIGN_PKCS_FILE_PATH SIGN_PKCS_PASSWORD
    • OS Recovery : generate_package.sh TOTA_UPG_PATH TARGET SIGN_PKCS_FILE_PATH SIGN_PKCS_PASSWORD
  • Argument
    • SIGN_PKCS_FILE_PATH is the PKCS12 file path you made on prerequisite stage
    • SIGN_PKCS_PASSWORD is the password you used to create the PKCS file
      • e.g) delta-generation.sh . rpi3 child.p12 "YOUR_PASSWORD"
  • If package signing succeed, you can see the these messages

Tota package signing.png

Verify image

  • Image verifier try to verify image before OS upgrade(recovery) when root CA exists
  • Root CA
    • Directory : /usr/share/ca-certificates/img-verifier
    • Target image
      • OS Upgrade : new ramdisk-recovery, old rootfs
        • Upgrade agent try to verify package two times, so you should include Root CA in both old rootfs and new ramdisk-recovery
          • Root CA in old rootfs is used to verify new ramdisk-recovery
          • Root CA in new ramdisk-recovery is used to verify upgrade package
      • OS Recovery : new ramdisk-recovery
    • To insert Root CA in the ramdisk-recovery, you can follow this guide