{"id":25692391,"url":"https://github.com/embetrix/stm32mp-sign-tool","last_synced_at":"2025-04-24T05:14:55.260Z","repository":{"id":267982110,"uuid":"902964388","full_name":"embetrix/stm32mp-sign-tool","owner":"embetrix","description":"The stm32mp-sign-tool is an utility for signing and verifying firmware images compatible with STM32MP MPUs","archived":false,"fork":false,"pushed_at":"2025-01-10T10:25:24.000Z","size":106,"stargazers_count":8,"open_issues_count":2,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-24T05:14:36.475Z","etag":null,"topics":["cpp","cryptography","ecdsa-cryptography","embedded-systems","hsm","lightweight","pkcs11","security","signing-keys","signing-tool","stm32mp1","stm32mpu"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/embetrix.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-12-13T16:27:21.000Z","updated_at":"2025-02-27T11:40:52.000Z","dependencies_parsed_at":"2024-12-13T17:43:56.232Z","dependency_job_id":"9645fd42-652b-418a-9c01-b1846bb963de","html_url":"https://github.com/embetrix/stm32mp-sign-tool","commit_stats":null,"previous_names":["embetrix/stm32mp-sign-tool"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/embetrix%2Fstm32mp-sign-tool","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/embetrix%2Fstm32mp-sign-tool/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/embetrix%2Fstm32mp-sign-tool/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/embetrix%2Fstm32mp-sign-tool/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/embetrix","download_url":"https://codeload.github.com/embetrix/stm32mp-sign-tool/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250566510,"owners_count":21451233,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cpp","cryptography","ecdsa-cryptography","embedded-systems","hsm","lightweight","pkcs11","security","signing-keys","signing-tool","stm32mp1","stm32mpu"],"created_at":"2025-02-24T23:09:03.394Z","updated_at":"2025-04-24T05:14:55.235Z","avatar_url":"https://github.com/embetrix.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# stm32mp-sign-tool\n\n![pipeline status](https://github.com/embetrix/stm32mp-sign-tool/actions/workflows/cmake-single-platform.yml/badge.svg)\n\n## Overview\n\nThe `stm32mp-sign-tool` is a lightweight open-source alternative to `STM32_SigningTool_CLI` that does not require the full `STM32CubeProgrammer` installation and dependencies. \nIt is a utility for signing and verifying firmware images for STM32MP MPUs.\nIt uses ECDSA (Elliptic Curve Digital Signature Algorithm) to ensure the integrity and authenticity of the firmware used in secure boot process.\n\n**Disclaimer:** This tool is entirely developed based on the [public specification](https://wiki.st.com/stm32mpu/wiki/STM32_header_for_binary_files) of the STM32 header format. It does not use reverse engineering or incorporate any proprietary code. Additionally, it does not implement all the functionalities of the [official ST Tools](https://wiki.st.com/stm32mpu/wiki/Signing_tool). Use this utility with care, as it is not affiliated with nor endorsed by STMicroelectronics.\n\n## Features\n\n- Sign/Verify firmware images with ECDSA (NIST P-256 or brainpool 256).\n- Support for HSM Token (PKCS#11).\n- Currently supports only STM32MP15x MPU firmware image headers.\n\n## Requirements\n\n- C++ compiler\n- CMake\n- OpenSSL library\n- Optional: PKCS#11 libraries and tools for HSM signing\n\n## Installation\n\n### Install Dependencies\n\n#### Ubuntu\n\n```sh\nsudo apt-get update\nsudo apt-get install -y openssl libssl-dev python3 softhsm2 opensc libengine-pkcs11-openssl\n```\n\n## Build\n\n```sh\ncmake .\nmake\n```\n\n## Test\n\n```sh\nctest -V\n```\n\n## Install\n\n```sh\nsudo make install\n```\n\n## Usage\n\n### Sign a Firmware Image\n\nGenerate an ECDSA key:\n\n```sh\nopenssl ecparam -name prime256v1 -genkey -out \u003cprivate_key.pem\u003e\n```\n\nSign a firmware image using the following command:\n\n```sh\nstm32mp-sign-tool -k \u003cprivate_key_file\u003e -i \u003cimage.stm32\u003e -o \u003cimage.stm32.signed\u003e\n```\n\n### Sign a Firmware Image using a HSM Token\n\nGenerate an ECDSA key:\n\n```sh\npkcs11-tool --pin \u003cpin\u003e --module \u003cModule Path\u003e --keypairgen --key-type EC:prime256v1 --id \u003cKeyID\u003e --label \u003cKeyLabel\u003e\n```\n\nSign a firmware image using the URI of the key:\n\n```sh\nstm32mp-sign-tool -v -k \"pkcs11:object=\u003cKeyLabel\u003e\" -p \u003cpin\u003e -i \u003cimage.stm32\u003e -o \u003cimage.stm32.signed\u003e\n```\n\n### Generating the public key hashes\n\n```sh\nstm32mp-sign-tool -v -k \u003cprivate_key_file\u003e -h \u003chash output\u003e\n```\nor\n\n```sh\nstm32mp-sign-tool -v -k \"pkcs11:object=\u003cKeyLabel\u003e\" -p \u003cpin\u003e -h \u003chash output\u003e\n```\n\n## License\n\nThis project is licensed under the terms of the **GNU General Public License v3 (GPLv3)**. You are free to use, modify, and distribute this software under the conditions outlined in the GPLv3 license.\n\nFor more information about the GPLv3 license, refer to the [LICENSE](LICENSE) file in this repository or visit [GNU's official page](https://www.gnu.org/licenses/gpl-3.0.html).\n\n## Contributor License Agreement (CLA)\n\nBy submitting a pull request to this repository, you agree to the following terms:\n\n1. You certify that your contribution is your original work or that you have the necessary rights to submit it.\n2. You grant the project maintainers a perpetual, worldwide, non-exclusive, royalty-free, irrevocable license to:\n   - Use, modify, sublicense, and distribute your contribution under the terms of the **GPLv3**.\n   - Use, modify, sublicense, and distribute your contribution under alternative licenses, including commercial licenses.\n3. You understand that you retain the copyright to your contribution but agree it may be relicensed under these terms.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fembetrix%2Fstm32mp-sign-tool","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fembetrix%2Fstm32mp-sign-tool","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fembetrix%2Fstm32mp-sign-tool/lists"}