chore(tools): generate `ts-tvl` config with `riscv_fw_version`
What changed, and why it matters
This commit is a routine tooling update. It adds a new configuration field called `riscv_fw_version` to a script that generates test configuration files for the Tropic secure element model. The generated value is a simple, hard-coded version number (1.0.0). There is no indication this change fixes or introduces a security vulnerability.
No security action required. Review as normal tooling/maintenance change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change extends core/tools/generate_tropic_model_config.py to emit an additional YAML key riscv_fw_version containing a 4-byte little-endian version blob (major=1, minor=0, patch=0). The corresponding test fixture tests/tropic_model/config.yml is regenerated to include the new key. No code paths, cryptographic parameters, or access controls are modified.
Changed components
core/tools/generate_tropic_model_config.pytests/tropic_model/config.ymlInspect captured patch +15 / −0
diff --git a/core/tools/generate_tropic_model_config.py b/core/tools/generate_tropic_model_config.py
index 492e297ae..d85fe670b 100755
--- a/core/tools/generate_tropic_model_config.py
+++ b/core/tools/generate_tropic_model_config.py
@@ -30,6 +30,11 @@ EXTRA_FILES = [
VENDOR_CONFIG_DIR / "tropic01_ese_public_key_1.pem",
]
+# Version of the RISCV Firmware (also know as Application FW)
+RISCV_FW_MAJOR = 1
+RISCV_FW_MINOR = 0
+RISCV_FW_PATCH = 0
+
@click.command()
@click.option("--check", is_flag=True)
@@ -92,6 +97,13 @@ def generate_config(check: bool) -> None:
data += b"\x00" * (SLOT_LEN - len(data))
user_data[TROPIC_DEVICE_CERT_FIRST_SLOT + i] = {"value": data}
+ # Set RISC-V FW version
+ riscv_fw_version = (
+ b"\x00"
+ + RISCV_FW_PATCH.to_bytes(1, "little")
+ + RISCV_FW_MINOR.to_bytes(1, "little")
+ + RISCV_FW_MAJOR.to_bytes(1, "little")
+ )
config_dict = {
"s_t_priv": "tropic01_ese_private_key_1.pem",
"s_t_pub": "tropic01_ese_public_key_1.pem",
@@ -106,6 +118,7 @@ def generate_config(check: bool) -> None:
"origin": 2, # imported key
}
},
+ "riscv_fw_version": riscv_fw_version,
}
config = yaml.dump(config_dict)
diff --git a/tests/tropic_model/config.yml b/tests/tropic_model/config.yml
index ee773694e..c9d1a1a14 100644
--- a/tests/tropic_model/config.yml
+++ b/tests/tropic_model/config.yml
@@ -30,6 +30,8 @@ r_user_data:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+riscv_fw_version: !!binary |
+ AAAAAQ==
s_t_priv: tropic01_ese_private_key_1.pem
s_t_pub: tropic01_ese_public_key_1.pem
x509_certificate: tropic01_ese_certificate_1.pem
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.