SWUpdate Signing workflow

[SCordibella]

Dear All,
I see the recipes swupdate-certificatesand swupdate-certificates-key.
I read here they are created to implement the swupdate signing. In fact the sw-descriptor.sig is already present in the generated swu. First question: what is the command used to sign the image?

Supposing that I want to implement a custom sign procedure I need to change the sign command, and as far as I understand the cip-core layer with the swupdate-signer feature is not already available for iot2050, is it correct?
Are there any plan to integrate it? How can I change the sign command right now?

To check the signed image before installing it I guess that I need to change the swupdate command line on the iot 2050 adding the -k flag (supposing that I am using CMS). Are there any examples of this? Is the actual signed image not verified on target?

Best regards,
Stefano.

[SCordibella]

Hi all, can any of @jan-kiszka, @huaqianli, or @BaochengSu help me with this?"

[jan-kiszka]

Unfortunately, meta-iot2050 still uses an older version of isar-cip-core. Briefly after the revision references here, upstream got https://gitlab.com/cip-project/cip-core/isar-cip-core/-/commit/980cd0089ed0b0318977522882c4f9d520f6688e which better supports custom signing, including the case of hardware security modules.

The command to sign is now found in https://gitlab.com/cip-project/cip-core/isar-cip-core/-/blob/next/recipes-devtools/swupdate-signer/files/sign-swu-cms, before that, it was in https://gitlab.com/cip-project/cip-core/isar-cip-core/-/blob/22346c57c9461da765151465d492f675d6e4efad/recipes-devtools/swupdate-certificates/files/sign-swu-rsa.

But also the version of isar-cip-core used here enforces swu signing and automatic verification when trying to apply an swu. In fact, the swupdate package refuses to take unsigned updates. It's "just" that the demo signature used here is not providing security as it uses a publicly known key.

[SCordibella]

Hi @jan-kiszka thank you for the information.
Do you have any plan to update isar-cip-core in meta-iot2050?

[SCordibella]

Hi @jan-kiszka, I've figured out what needs to be changed in the signing process, and I think it's necessary to modify the verification part as well. If I switch the signing script from openssl cms to openssl dgst, will I need to adjust anything on the verification side?