Skip to content

SFT-5622: allow boot and recovery bin and assets in the recovery bundle #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
eupn wants to merge 6 commits into from
Closed

SFT-5622: allow boot and recovery bin and assets in the recovery bundle #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3c7530f
`signer`: include recovery OS and bootloader into recovery tar
eupn Aug 6, 2025
a001a9e
`signer`: include recovery OS assets if they exist
eupn Aug 6, 2025
267378f
`tools/signer`: sign the bootloader for recovery bundle, include `bla…
eupn Aug 12, 2025
380d956
`Justfile`: add `sign-dev-bl` for bootloader signing
eupn Aug 12, 2025
fb20a14
`image-builder`: fix `/keyos/` paths
eupn Jan 21, 2026
10e7213
`signer`: implement recovery bundle manifest
eupn Jan 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 11 additions & 6 deletions Justfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,18 +11,23 @@ sign-dev VERSION CONFIG_PATH=env_var_or_default("COSIGN_TOML_PATH", "~/cosign2.t
@echo "Signing all files for version {{VERSION}} with config {{CONFIG_PATH}}"
cargo run --manifest-path tools/signer/Cargo.toml -- sign-files --developer {{VERSION}} {{CONFIG_PATH}}

# Sign individual files with the provided key
sign-dev-bl VERSION CONFIG_PATH=env_var_or_default("COSIGN_TOML_PATH", "~/cosign2.toml"):
@echo "Signing all files for version {{VERSION}} with config {{CONFIG_PATH}}"
cargo run --manifest-path tools/signer/Cargo.toml -- sign-files --developer --sign-bootloader {{VERSION}} {{CONFIG_PATH}}

# Create tar file (only when all files have two signatures)
create-tar VERSION:
create-tar VERSION CONFIG_PATH=env_var_or_default("COSIGN_TOML_PATH", "~/cosign2.toml"):
@echo "Creating tar file for version {{VERSION}}"
cargo run --manifest-path tools/signer/Cargo.toml -- create-tar {{VERSION}}
cargo run --manifest-path tools/signer/Cargo.toml -- create-tar {{VERSION}} {{CONFIG_PATH}}

create-recovery-tar VERSION:
create-recovery-tar VERSION CONFIG_PATH=env_var_or_default("COSIGN_TOML_PATH", "~/cosign2.toml"):
@echo "Creating recovery tar file for version {{VERSION}}"
cargo run --manifest-path tools/signer/Cargo.toml -- create-tar {{VERSION}} --recovery
cargo run --manifest-path tools/signer/Cargo.toml -- create-tar {{VERSION}} {{CONFIG_PATH}} --recovery

create-recovery-tar-dev VERSION:
create-recovery-tar-dev VERSION CONFIG_PATH=env_var_or_default("COSIGN_TOML_PATH", "~/cosign2.toml"):
@echo "Creating recovery tar file for version {{VERSION}} (one signature)"
cargo run --manifest-path tools/signer/Cargo.toml -- create-tar {{VERSION}} --recovery --allow-one-signature
cargo run --manifest-path tools/signer/Cargo.toml -- create-tar {{VERSION}} {{CONFIG_PATH}} --recovery --allow-one-signature

# Sign the tar file with the provided key
sign-tar VERSION CONFIG_PATH=env_var_or_default("COSIGN_TOML_PATH", "~/cosign2.toml"):
Expand Down
4 changes: 2 additions & 2 deletions tools/image-builder/src/main.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -346,7 +346,7 @@ fn create_system_partition(file: &mut File, version_folder: &str) -> Result<()>
.write_all(&fs::read(&app_bin_path)?)?;

// Copy apps directory if it exists
let apps_dir_path = format!("{}/apps", version_folder);
let apps_dir_path = format!("{}/keyos/apps", version_folder);
if Path::new(&apps_dir_path).exists() {
println!(" {} Copying apps directory", "→".blue());
let apps_dir_disk = fs.root_dir().create_dir("apps")?;
Expand Down Expand Up @@ -488,7 +488,7 @@ fn print_hashes(version_folder: &str, is_production: bool) -> Result<()> {
print_digest_of_cosigned_file("recovery image", Path::new(&recovery_bin_path))?;

// Print app hashes if apps directory exists
let apps_dir_path = format!("{}/apps", version_folder);
let apps_dir_path = format!("{}/keyos/apps", version_folder);
if Path::new(&apps_dir_path).exists() {
for entry in fs::read_dir(&apps_dir_path)? {
let app_dir = entry?;
Expand Down
Loading