2.2.5 updated certificates to be identical across all versions

- contains DigiCertGlobalRootCA and DigiCertHighAssuranceEVRootCA
- EC support put back in place
- flow diagram still not updated

Author: HomeACcessoryKid

Changelog.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 2.2.5 updated certificates to be identical across all versions
+- contains DigiCertGlobalRootCA and DigiCertHighAssuranceEVRootCA
+- EC support put back in place
+- flow diagram still not updated
+
 ## 2.2.4 TEST: new scheme without initial certificate checking
 - to test, made it broken without EC support (like 2.2.0)
 - added a sysparam ota_count to set LCM outcomes also from user space

Makefile

@@ -43,10 +43,9 @@ EXTRA_WOLFSSL_CFLAGS = \
 	-DHAVE_ECC_SIGN \
 	-DHAVE_ECC_VERIFY \
 	-DHAVE_ECC_KEY_IMPORT \
+	-DHAVE_ECC_DHE \
+	-DHAVE_SUPPORTED_CURVES \
 
-#	-DHAVE_ECC_DHE \
-#	-DHAVE_SUPPORTED_CURVES \
-#
 #	-DDEBUG_WOLFSSL \
 
 #   -DNO_SHA \

certs.h

@@ -120,6 +120,120 @@ unsigned char certs_sector[] = {
   0x34, 0x30, 0x4b, 0x50, 0x4d, 0x62, 0x70, 0x31, 0x5a, 0x57, 0x56, 0x62,
   0x64, 0x34, 0x3d, 0x0a, 0x2d, 0x2d, 0x2d, 0x2d, 0x2d, 0x45, 0x4e, 0x44,
   0x20, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45,
-  0x2d, 0x2d, 0x2d, 0x2d, 0x2d, 0x0a
+  0x2d, 0x2d, 0x2d, 0x2d, 0x2d, 0x0a, 0x2d, 0x2d, 0x2d, 0x2d, 0x2d, 0x42,
+  0x45, 0x47, 0x49, 0x4e, 0x20, 0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49,
+  0x43, 0x41, 0x54, 0x45, 0x2d, 0x2d, 0x2d, 0x2d, 0x2d, 0x0a, 0x4d, 0x49,
+  0x49, 0x44, 0x78, 0x54, 0x43, 0x43, 0x41, 0x71, 0x32, 0x67, 0x41, 0x77,
+  0x49, 0x42, 0x41, 0x67, 0x49, 0x51, 0x41, 0x71, 0x78, 0x63, 0x4a, 0x6d,
+  0x6f, 0x4c, 0x51, 0x4a, 0x75, 0x50, 0x43, 0x33, 0x6e, 0x79, 0x72, 0x6b,
+  0x59, 0x6c, 0x64, 0x7a, 0x41, 0x4e, 0x42, 0x67, 0x6b, 0x71, 0x68, 0x6b,
+  0x69, 0x47, 0x39, 0x77, 0x30, 0x42, 0x41, 0x51, 0x55, 0x46, 0x41, 0x44,
+  0x42, 0x73, 0x0a, 0x4d, 0x51, 0x73, 0x77, 0x43, 0x51, 0x59, 0x44, 0x56,
+  0x51, 0x51, 0x47, 0x45, 0x77, 0x4a, 0x56, 0x55, 0x7a, 0x45, 0x56, 0x4d,
+  0x42, 0x4d, 0x47, 0x41, 0x31, 0x55, 0x45, 0x43, 0x68, 0x4d, 0x4d, 0x52,
+  0x47, 0x6c, 0x6e, 0x61, 0x55, 0x4e, 0x6c, 0x63, 0x6e, 0x51, 0x67, 0x53,
+  0x57, 0x35, 0x6a, 0x4d, 0x52, 0x6b, 0x77, 0x46, 0x77, 0x59, 0x44, 0x56,
+  0x51, 0x51, 0x4c, 0x45, 0x78, 0x42, 0x33, 0x0a, 0x64, 0x33, 0x63, 0x75,
+  0x5a, 0x47, 0x6c, 0x6e, 0x61, 0x57, 0x4e, 0x6c, 0x63, 0x6e, 0x51, 0x75,
+  0x59, 0x32, 0x39, 0x74, 0x4d, 0x53, 0x73, 0x77, 0x4b, 0x51, 0x59, 0x44,
+  0x56, 0x51, 0x51, 0x44, 0x45, 0x79, 0x4a, 0x45, 0x61, 0x57, 0x64, 0x70,
+  0x51, 0x32, 0x56, 0x79, 0x64, 0x43, 0x42, 0x49, 0x61, 0x57, 0x64, 0x6f,
+  0x49, 0x45, 0x46, 0x7a, 0x63, 0x33, 0x56, 0x79, 0x59, 0x57, 0x35, 0x6a,
+  0x0a, 0x5a, 0x53, 0x42, 0x46, 0x56, 0x69, 0x42, 0x53, 0x62, 0x32, 0x39,
+  0x30, 0x49, 0x45, 0x4e, 0x42, 0x4d, 0x42, 0x34, 0x58, 0x44, 0x54, 0x41,
+  0x32, 0x4d, 0x54, 0x45, 0x78, 0x4d, 0x44, 0x41, 0x77, 0x4d, 0x44, 0x41,
+  0x77, 0x4d, 0x46, 0x6f, 0x58, 0x44, 0x54, 0x4d, 0x78, 0x4d, 0x54, 0x45,
+  0x78, 0x4d, 0x44, 0x41, 0x77, 0x4d, 0x44, 0x41, 0x77, 0x4d, 0x46, 0x6f,
+  0x77, 0x62, 0x44, 0x45, 0x4c, 0x0a, 0x4d, 0x41, 0x6b, 0x47, 0x41, 0x31,
+  0x55, 0x45, 0x42, 0x68, 0x4d, 0x43, 0x56, 0x56, 0x4d, 0x78, 0x46, 0x54,
+  0x41, 0x54, 0x42, 0x67, 0x4e, 0x56, 0x42, 0x41, 0x6f, 0x54, 0x44, 0x45,
+  0x52, 0x70, 0x5a, 0x32, 0x6c, 0x44, 0x5a, 0x58, 0x4a, 0x30, 0x49, 0x45,
+  0x6c, 0x75, 0x59, 0x7a, 0x45, 0x5a, 0x4d, 0x42, 0x63, 0x47, 0x41, 0x31,
+  0x55, 0x45, 0x43, 0x78, 0x4d, 0x51, 0x64, 0x33, 0x64, 0x33, 0x0a, 0x4c,
+  0x6d, 0x52, 0x70, 0x5a, 0x32, 0x6c, 0x6a, 0x5a, 0x58, 0x4a, 0x30, 0x4c,
+  0x6d, 0x4e, 0x76, 0x62, 0x54, 0x45, 0x72, 0x4d, 0x43, 0x6b, 0x47, 0x41,
+  0x31, 0x55, 0x45, 0x41, 0x78, 0x4d, 0x69, 0x52, 0x47, 0x6c, 0x6e, 0x61,
+  0x55, 0x4e, 0x6c, 0x63, 0x6e, 0x51, 0x67, 0x53, 0x47, 0x6c, 0x6e, 0x61,
+  0x43, 0x42, 0x42, 0x63, 0x33, 0x4e, 0x31, 0x63, 0x6d, 0x46, 0x75, 0x59,
+  0x32, 0x55, 0x67, 0x0a, 0x52, 0x56, 0x59, 0x67, 0x55, 0x6d, 0x39, 0x76,
+  0x64, 0x43, 0x42, 0x44, 0x51, 0x54, 0x43, 0x43, 0x41, 0x53, 0x49, 0x77,
+  0x44, 0x51, 0x59, 0x4a, 0x4b, 0x6f, 0x5a, 0x49, 0x68, 0x76, 0x63, 0x4e,
+  0x41, 0x51, 0x45, 0x42, 0x42, 0x51, 0x41, 0x44, 0x67, 0x67, 0x45, 0x50,
+  0x41, 0x44, 0x43, 0x43, 0x41, 0x51, 0x6f, 0x43, 0x67, 0x67, 0x45, 0x42,
+  0x41, 0x4d, 0x62, 0x4d, 0x35, 0x58, 0x50, 0x6d, 0x0a, 0x2b, 0x39, 0x53,
+  0x37, 0x35, 0x53, 0x30, 0x74, 0x4d, 0x71, 0x62, 0x66, 0x35, 0x59, 0x45,
+  0x2f, 0x79, 0x63, 0x30, 0x6c, 0x53, 0x62, 0x5a, 0x78, 0x4b, 0x73, 0x50,
+  0x56, 0x6c, 0x44, 0x52, 0x6e, 0x6f, 0x67, 0x6f, 0x63, 0x73, 0x46, 0x39,
+  0x70, 0x70, 0x6b, 0x43, 0x78, 0x78, 0x4c, 0x65, 0x79, 0x6a, 0x39, 0x43,
+  0x59, 0x70, 0x4b, 0x6c, 0x42, 0x57, 0x54, 0x72, 0x54, 0x33, 0x4a, 0x54,
+  0x57, 0x0a, 0x50, 0x4e, 0x74, 0x30, 0x4f, 0x4b, 0x52, 0x4b, 0x7a, 0x45,
+  0x30, 0x6c, 0x67, 0x76, 0x64, 0x4b, 0x70, 0x56, 0x4d, 0x53, 0x4f, 0x4f,
+  0x37, 0x7a, 0x53, 0x57, 0x31, 0x78, 0x6b, 0x58, 0x35, 0x6a, 0x74, 0x71,
+  0x75, 0x6d, 0x58, 0x38, 0x4f, 0x6b, 0x68, 0x50, 0x68, 0x50, 0x59, 0x6c,
+  0x47, 0x2b, 0x2b, 0x4d, 0x58, 0x73, 0x32, 0x7a, 0x69, 0x53, 0x34, 0x77,
+  0x62, 0x6c, 0x43, 0x4a, 0x45, 0x4d, 0x0a, 0x78, 0x43, 0x68, 0x42, 0x56,
+  0x66, 0x76, 0x4c, 0x57, 0x6f, 0x6b, 0x56, 0x66, 0x6e, 0x48, 0x6f, 0x4e,
+  0x62, 0x39, 0x4e, 0x63, 0x67, 0x6b, 0x39, 0x76, 0x6a, 0x6f, 0x34, 0x55,
+  0x46, 0x74, 0x33, 0x4d, 0x52, 0x75, 0x4e, 0x73, 0x38, 0x63, 0x6b, 0x52,
+  0x5a, 0x71, 0x6e, 0x72, 0x47, 0x30, 0x41, 0x46, 0x46, 0x6f, 0x45, 0x74,
+  0x37, 0x6f, 0x54, 0x36, 0x31, 0x45, 0x4b, 0x6d, 0x45, 0x46, 0x42, 0x0a,
+  0x49, 0x6b, 0x35, 0x6c, 0x59, 0x59, 0x65, 0x42, 0x51, 0x56, 0x43, 0x6d,
+  0x65, 0x56, 0x79, 0x4a, 0x33, 0x68, 0x6c, 0x4b, 0x56, 0x39, 0x55, 0x75,
+  0x35, 0x6c, 0x30, 0x63, 0x55, 0x79, 0x78, 0x2b, 0x6d, 0x4d, 0x30, 0x61,
+  0x42, 0x68, 0x61, 0x6b, 0x61, 0x48, 0x50, 0x51, 0x4e, 0x41, 0x51, 0x54,
+  0x58, 0x4b, 0x46, 0x78, 0x30, 0x31, 0x70, 0x38, 0x56, 0x64, 0x74, 0x65,
+  0x5a, 0x4f, 0x45, 0x33, 0x0a, 0x68, 0x7a, 0x42, 0x57, 0x42, 0x4f, 0x55,
+  0x52, 0x74, 0x43, 0x6d, 0x41, 0x45, 0x76, 0x46, 0x35, 0x4f, 0x59, 0x69,
+  0x69, 0x41, 0x68, 0x46, 0x38, 0x4a, 0x32, 0x61, 0x33, 0x69, 0x4c, 0x64,
+  0x34, 0x38, 0x73, 0x6f, 0x4b, 0x71, 0x44, 0x69, 0x72, 0x43, 0x6d, 0x54,
+  0x43, 0x76, 0x32, 0x5a, 0x64, 0x6c, 0x59, 0x54, 0x42, 0x6f, 0x53, 0x55,
+  0x65, 0x68, 0x31, 0x30, 0x61, 0x55, 0x41, 0x73, 0x67, 0x0a, 0x45, 0x73,
+  0x78, 0x42, 0x75, 0x32, 0x34, 0x4c, 0x55, 0x54, 0x69, 0x34, 0x53, 0x38,
+  0x73, 0x43, 0x41, 0x77, 0x45, 0x41, 0x41, 0x61, 0x4e, 0x6a, 0x4d, 0x47,
+  0x45, 0x77, 0x44, 0x67, 0x59, 0x44, 0x56, 0x52, 0x30, 0x50, 0x41, 0x51,
+  0x48, 0x2f, 0x42, 0x41, 0x51, 0x44, 0x41, 0x67, 0x47, 0x47, 0x4d, 0x41,
+  0x38, 0x47, 0x41, 0x31, 0x55, 0x64, 0x45, 0x77, 0x45, 0x42, 0x2f, 0x77,
+  0x51, 0x46, 0x0a, 0x4d, 0x41, 0x4d, 0x42, 0x41, 0x66, 0x38, 0x77, 0x48,
+  0x51, 0x59, 0x44, 0x56, 0x52, 0x30, 0x4f, 0x42, 0x42, 0x59, 0x45, 0x46,
+  0x4c, 0x45, 0x2b, 0x77, 0x32, 0x6b, 0x44, 0x2b, 0x4c, 0x39, 0x48, 0x41,
+  0x64, 0x53, 0x59, 0x4a, 0x68, 0x6f, 0x49, 0x41, 0x75, 0x39, 0x6a, 0x5a,
+  0x43, 0x76, 0x44, 0x4d, 0x42, 0x38, 0x47, 0x41, 0x31, 0x55, 0x64, 0x49,
+  0x77, 0x51, 0x59, 0x4d, 0x42, 0x61, 0x41, 0x0a, 0x46, 0x4c, 0x45, 0x2b,
+  0x77, 0x32, 0x6b, 0x44, 0x2b, 0x4c, 0x39, 0x48, 0x41, 0x64, 0x53, 0x59,
+  0x4a, 0x68, 0x6f, 0x49, 0x41, 0x75, 0x39, 0x6a, 0x5a, 0x43, 0x76, 0x44,
+  0x4d, 0x41, 0x30, 0x47, 0x43, 0x53, 0x71, 0x47, 0x53, 0x49, 0x62, 0x33,
+  0x44, 0x51, 0x45, 0x42, 0x42, 0x51, 0x55, 0x41, 0x41, 0x34, 0x49, 0x42,
+  0x41, 0x51, 0x41, 0x63, 0x47, 0x67, 0x61, 0x58, 0x33, 0x4e, 0x65, 0x63,
+  0x0a, 0x6e, 0x7a, 0x79, 0x49, 0x5a, 0x67, 0x59, 0x49, 0x56, 0x79, 0x48,
+  0x62, 0x49, 0x55, 0x66, 0x34, 0x4b, 0x6d, 0x65, 0x71, 0x76, 0x78, 0x67,
+  0x79, 0x64, 0x6b, 0x41, 0x51, 0x56, 0x38, 0x47, 0x4b, 0x38, 0x33, 0x72,
+  0x5a, 0x45, 0x57, 0x57, 0x4f, 0x4e, 0x66, 0x71, 0x65, 0x2f, 0x45, 0x57,
+  0x31, 0x6e, 0x74, 0x6c, 0x4d, 0x4d, 0x55, 0x75, 0x34, 0x6b, 0x65, 0x68,
+  0x44, 0x4c, 0x49, 0x36, 0x7a, 0x0a, 0x65, 0x4d, 0x37, 0x62, 0x34, 0x31,
+  0x4e, 0x35, 0x63, 0x64, 0x62, 0x6c, 0x49, 0x5a, 0x51, 0x42, 0x32, 0x6c,
+  0x57, 0x48, 0x6d, 0x69, 0x52, 0x6b, 0x39, 0x6f, 0x70, 0x6d, 0x7a, 0x4e,
+  0x36, 0x63, 0x4e, 0x38, 0x32, 0x6f, 0x4e, 0x4c, 0x46, 0x70, 0x6d, 0x79,
+  0x50, 0x49, 0x6e, 0x6e, 0x67, 0x69, 0x4b, 0x33, 0x42, 0x44, 0x34, 0x31,
+  0x56, 0x48, 0x4d, 0x57, 0x45, 0x5a, 0x37, 0x31, 0x6a, 0x46, 0x0a, 0x68,
+  0x53, 0x39, 0x4f, 0x4d, 0x50, 0x61, 0x67, 0x4d, 0x52, 0x59, 0x6a, 0x79,
+  0x4f, 0x66, 0x69, 0x5a, 0x52, 0x59, 0x7a, 0x79, 0x37, 0x38, 0x61, 0x47,
+  0x36, 0x41, 0x39, 0x2b, 0x4d, 0x70, 0x65, 0x69, 0x7a, 0x47, 0x4c, 0x59,
+  0x41, 0x69, 0x4a, 0x4c, 0x51, 0x77, 0x47, 0x58, 0x46, 0x4b, 0x33, 0x78,
+  0x50, 0x6b, 0x4b, 0x6d, 0x4e, 0x45, 0x56, 0x58, 0x35, 0x38, 0x53, 0x76,
+  0x6e, 0x77, 0x32, 0x0a, 0x59, 0x7a, 0x69, 0x39, 0x52, 0x4b, 0x52, 0x2f,
+  0x35, 0x43, 0x59, 0x72, 0x43, 0x73, 0x53, 0x58, 0x61, 0x51, 0x33, 0x70,
+  0x6a, 0x4f, 0x4c, 0x41, 0x45, 0x46, 0x65, 0x34, 0x79, 0x48, 0x59, 0x53,
+  0x6b, 0x56, 0x58, 0x79, 0x53, 0x47, 0x6e, 0x59, 0x76, 0x43, 0x6f, 0x43,
+  0x57, 0x77, 0x39, 0x45, 0x31, 0x43, 0x41, 0x78, 0x32, 0x2f, 0x53, 0x36,
+  0x63, 0x43, 0x5a, 0x64, 0x6b, 0x47, 0x43, 0x65, 0x0a, 0x76, 0x45, 0x73,
+  0x58, 0x43, 0x53, 0x2b, 0x30, 0x79, 0x78, 0x35, 0x44, 0x61, 0x4d, 0x6b,
+  0x48, 0x4a, 0x38, 0x48, 0x53, 0x58, 0x50, 0x66, 0x71, 0x49, 0x62, 0x6c,
+  0x6f, 0x45, 0x70, 0x77, 0x38, 0x6e, 0x4c, 0x2b, 0x65, 0x2f, 0x49, 0x42,
+  0x63, 0x6d, 0x32, 0x50, 0x4e, 0x37, 0x45, 0x65, 0x71, 0x4a, 0x53, 0x64,
+  0x6e, 0x6f, 0x44, 0x66, 0x7a, 0x41, 0x49, 0x4a, 0x39, 0x56, 0x4e, 0x65,
+  0x70, 0x0a, 0x2b, 0x4f, 0x6b, 0x75, 0x45, 0x36, 0x4e, 0x33, 0x36, 0x42,
+  0x39, 0x4b, 0x0a, 0x2d, 0x2d, 0x2d, 0x2d, 0x2d, 0x45, 0x4e, 0x44, 0x20,
+  0x43, 0x45, 0x52, 0x54, 0x49, 0x46, 0x49, 0x43, 0x41, 0x54, 0x45, 0x2d,
+  0x2d, 0x2d, 0x2d, 0x2d, 0x0a
 };
-unsigned int certs_sector_len = 1458;
+unsigned int certs_sector_len = 2825;

deploy.md

@@ -10,33 +10,33 @@ cd life-cycle-manager
 - initial steps to be expanded
 
 #### These are the steps if not introducing a new key pair
-- create/update the file versions1/latest-pre-release without new-line and setup 2.2.4 version folder
+- create/update the file versions1/latest-pre-release without new-line and setup 2.2.5 version folder
 ```
-mkdir versions1/2.2.4v
-echo -n 2.2.4 > versions1/2.2.4v/latest-pre-release
-cp versions1/certs.sector versions1/certs.sector.sig versions1/2.2.4v
-cp versions1/public*key*   versions1/2.2.4v
+mkdir versions1/2.2.5v
+echo -n 2.2.5 > versions1/2.2.5v/latest-pre-release
+cp versions1/certs.sector versions1/certs.sector.sig versions1/2.2.5v
+cp versions1/public*key*   versions1/2.2.5v
 ```
 - set local.mk to the ota-main program
 ```
-make -j6 rebuild OTAVERSION=2.2.4
-mv firmware/otamain.bin versions1/2.2.4v
+make -j6 rebuild OTAVERSION=2.2.5
+mv firmware/otamain.bin versions1/2.2.5v
 ```
 - set local.mk back to ota-boot program
 ```
-make -j6 rebuild OTAVERSION=2.2.4
-mv firmware/otaboot.bin versions1/2.2.4v
-make -j6 rebuild OTAVERSION=2.2.4 OTABETA=1
-cp firmware/otaboot.bin versions1/2.2.4v/otabootbeta.bin
+make -j6 rebuild OTAVERSION=2.2.5
+mv firmware/otaboot.bin versions1/2.2.5v
+make -j6 rebuild OTAVERSION=2.2.5 OTABETA=1
+cp firmware/otaboot.bin versions1/2.2.5v/otabootbeta.bin
 ```
 - remove the older version files
 #
 - update Changelog
 - if you can sign the binaries locally, do so, else follow later steps
 - test otaboot for basic behaviour
 - commit and sync submodules
-- commit and sync this as version 2.2.4  
-- set up a new github release 2.2.4 as a pre-release using the just commited master...  
+- commit and sync this as version 2.2.5  
+- set up a new github release 2.2.5 as a pre-release using the just commited master...  
 - upload the certs and binaries to the pre-release assets on github  
 #
 - erase the flash and upload the privatekey
@@ -46,18 +46,18 @@ esptool.py -p /dev/cu.usbserial-* --baud 230400 write_flash 0xf9000 versions1-pr
 ```
 - upload the ota-boot BETA program to the device that contains the private key
 ```
-make flash OTAVERSION=2.2.4 OTABETA=1
+make flash OTAVERSION=2.2.5 OTABETA=1
 ```
 - power cycle to prevent the bug for software reset after flash  
 - setup wifi and select the ota-demo repo without pre-release checkbox  
 - create the 2 signature files next to the bin file and upload to github one by one  
 - verify the hashes on the computer  
 ```
-openssl sha384 versions1/2.2.4v/otamain.bin
-xxd versions1/2.2.4v/otamain.bin.sig
+openssl sha384 versions1/2.2.5v/otamain.bin
+xxd versions1/2.2.5v/otamain.bin.sig
 ```
 
-- upload the file versions1/2.2.4v/latest-pre-release to the 'latest release' assets on github
+- upload the file versions1/2.2.5v/latest-pre-release to the 'latest release' assets on github
 
 #### Testing
 
@@ -110,14 +110,14 @@ esptool.py -p /dev/cu.usbserial-* --baud 230400 write_flash 0xf9000 versionsN-1-
 ```
 - collect public-1.key.sig and store it in the new version folder and copy it to versions1
 ```
-cp  versions1/2.2.4v/public-1.key.sig versions1
+cp  versions1/2.2.5v/public-1.key.sig versions1
 ```
 - then flash the new private key
 ```
 esptool.py -p /dev/cu.usbserial-* --baud 230400 write_flash 0xf9000 versions1-privatekey.der
 ```
 - collect cert.sector.sig and store it in the new version folder and copy it to versions1 
 ```
-cp  versions1/2.2.4v/certs.sector.sig versions1
+cp  versions1/2.2.5v/certs.sector.sig versions1
 ```
 - continue with a normal deployment to create the 2 signature files next to the bin files

versions1/2.2.4v/latest-pre-release

@@ -0,0 +1 @@
+2.2.5