MCUBoot - Firmware signature looks different at each build

RE: MCUBoot - Firmware signature looks different at each build

Amanda Hsieh — Fri, 27 Oct 2023 13:17:28 GMT

Good to hear it works.

-Amanda H.

RE: MCUBoot - Firmware signature looks different at each build

Benjamin V. — Fri, 27 Oct 2023 06:22:39 GMT

Thank you for your response and promptness.

Indeed, what you said makes sense.

I just checked the app_to_sign.bin files and they are indeed identical.

I just ran imgtool verify --key <key.pem> app_update.bin on my two builds and both returned the same thing.

imgtool verify --key <key.pem> build/zephyr/app_update.bin
Image was correctly validated
Image version: 1.12.0+0
Image digest: 8f1d53663ec5c[...]836fb96bfc

Thanks again and have a great day,

RE: MCUBoot - Firmware signature looks different at each build

Amanda Hsieh — Thu, 26 Oct 2023 13:34:21 GMT

Hi,

The signature schemes are non-deterministic, so this is to be expected.

Given the signature is non-deterministic, one way to ensure two builds have created the same firmware is to do these two steps:

1. strip the signature and hash before comparing the firmware itself.

2. use the imgtool verify command to check that the signature of both images can be verified with the same key.

Regards,
Amanda H.

RE: MCUBoot - Firmware signature looks different at each build

Benjamin V. — Thu, 26 Oct 2023 06:56:43 GMT

Thanks for your investigations on my issue.

RE: MCUBoot - Firmware signature looks different at each build

Amanda Hsieh — Wed, 25 Oct 2023 19:03:10 GMT

Hi,

I am working on this case and will update it later.

Regards,
Amanda H.