build: further verify signature digests in signed v2 binaries
What the developer wrote
Authored by Jon Griffiths
build: further verify signature digests in signed v2 binaries
What changed, and why it matters
This change tightens a build-time signing script for Blockstream Jade hardware wallet firmware. It adds checks that the public-key digests recorded inside a signed binary match the digests of the keys that were actually used to sign it, and makes the script stop on any error. The patch is defensive: it reduces the chance that a corrupted or wrongly-signed firmware image is produced during release, but it does not by itself fix a vulnerability in already-shipped devices.
Treat as a low-risk hardening improvement. Reviewers may want to confirm whether this change was prompted by an observed signing mismatch or is purely preventive, and whether any prior release artifacts need to be re-checked with the new digest comparison.
Security signals we found
build/release script hardening
cryptographic signature digest verification added
set -e added to fail fast on signing errors
defensive check against mismatched public-key digests in signed binary
no runtime or device-side code changed
Evidence from the diff
The commit modifies release/scripts/v2applysigs.sh, which applies ESP32 secure-boot-v2 signatures to firmware binaries. It adds set -e, captures each signing public key’s SHA-256 digest via espsecure.py digest_sbv2_public_key, and compares the sorted list of those digests against the sorted list of ‘Public key digest for block’ values reported by espsecure.py signature_info_v2 from the signed output. If they differ, the script exits with code 2. It also moves the final sha256sum outside the per-file loop. This is a build-integrity hardening measure, not a runtime firmware bug fix.
Changed components
release/scripts/v2applysigs.shInspect captured patch +19 / −4
diff --git a/release/scripts/v2applysigs.sh b/release/scripts/v2applysigs.sh
index c3292f6..eb66a7b 100755
--- a/release/scripts/v2applysigs.sh
+++ b/release/scripts/v2applysigs.sh
@@ -1,4 +1,5 @@
#!/bin/bash
+set -e
if [ -z "${1}" -o -z "${2}" ]
then
@@ -46,16 +47,30 @@ do
outfile="${file_prefix}_${SIGNED_SUFFIX}"
espsecure.py sign_data --version 2 --pub-key ${PUBKEYS} --signature ${sig_files} --output "${outfile}" "${infile}"
- espsecure.py signature_info_v2 "${outfile}"
-
+ digests=""
for pubkey in ${PUBKEYS}
do
+ # Verify the signature
espsecure.py verify_signature --version 2 --keyfile "${pubkey}" "${outfile}"
- done
+ # Capture the signature digest
+ digest=$(espsecure.py digest_sbv2_public_key --keyfile "${pubkey}" -o digest.bin >/dev/null && cat digest.bin | od -A n -t x1 | tr -d ' \n' && rm -f digest.bin)
+ digests="$digests $digest"
+ done
+ # Make sure the signature digests match
+ digests=$(echo ${digests} | tr ' ' '\n' | sort)
+ file_digests=$(espsecure.py signature_info_v2 "${outfile}" | grep "Public key digest for block " | cut -d\: -f2 | sed "s/ //g" | sort)
+ if [ "${digests}" != "${file_digests}" ]; then
+ echo "mismatched digests:"
+ echo "digests:"
+ echo ${digests}
+ echo "expected:"
+ echo ${file_digests}
+ exit 2
+ fi
done
- sha256sum "${FILE_PREFIX}"_*_"${SIGNED_SUFFIX}"
done
+sha256sum "${FILE_PREFIX}"_*_"${SIGNED_SUFFIX}"
# Copy main fw binaries that have been signed, consistent with v1
cp "${FILE_PREFIX}_ble_jade_${SIGNED_SUFFIX}" "${BLEDIR}/jade_${SIGNED_SUFFIX}"
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.