From 68f5a3d0d339c8b721dd6a3c3b51db6f41fcb5fe Mon Sep 17 00:00:00 2001 From: "Earle F. Philhower, III" Date: Thu, 13 Dec 2018 06:23:22 -0800 Subject: [PATCH] Keep signing commands in platform.txt on release (#5491) * Keep signing commands in platform.txt on release The boards packager was deleting what was at the time it was written unused lines in fht platform.txt file before deploying to Arduino. One of these lines is now needed for signing to work, so don't delete it. Also, explicitly call "python signing.py" because it looks like Arduino is sanitizing/removing executable bits on files when extracting from boards manager installations. Fixes #5483 * Create the build subdir, if needed, for autosign If the temporary build/core directory isn't available, make it in order that Updater.cpp will see the generated signing header and not the one in the main core. --- package/build_boards_manager_package.sh | 1 - platform.txt | 14 +++++++------- tools/signing.py | 3 +++ 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/package/build_boards_manager_package.sh b/package/build_boards_manager_package.sh index 3f108d16d..be0ce0366 100755 --- a/package/build_boards_manager_package.sh +++ b/package/build_boards_manager_package.sh @@ -86,7 +86,6 @@ $SED 's/runtime.tools.xtensa-lx106-elf-gcc.path={runtime.platform.path}\/tools\/ $SED 's/runtime.tools.esptool.path={runtime.platform.path}\/tools\/esptool//g' | \ $SED 's/tools.esptool.path={runtime.platform.path}\/tools\/esptool/tools.esptool.path=\{runtime.tools.esptool.path\}/g' | \ $SED 's/tools.mkspiffs.path={runtime.platform.path}\/tools\/mkspiffs/tools.mkspiffs.path=\{runtime.tools.mkspiffs.path\}/g' |\ -$SED 's/recipe.hooks.core.prebuild.1.pattern.*//g' |\ $SED 's/recipe.hooks.core.prebuild.2.pattern.*//g' |\ $SED 's/recipe.hooks.core.prebuild.3.pattern.*//g' |\ $SED "s/version=.*/version=$ver/g" |\ diff --git a/platform.txt b/platform.txt index 30eece595..225c66fa5 100644 --- a/platform.txt +++ b/platform.txt @@ -76,14 +76,14 @@ compiler.elf2hex.extra_flags= ## generate file with git version number ## needs bash, git, and echo -recipe.hooks.core.prebuild.1.pattern=bash -c "mkdir -p {build.path}/core && echo \#define ARDUINO_ESP8266_GIT_VER 0x`git --git-dir {runtime.platform.path}/.git rev-parse --short=8 HEAD 2>/dev/null || echo ffffffff` >{build.path}/core/core_version.h" -recipe.hooks.core.prebuild.2.pattern=bash -c "mkdir -p {build.path}/core && echo \#define ARDUINO_ESP8266_GIT_DESC `cd "{runtime.platform.path}"; git describe --tags 2>/dev/null || echo unix-{version}` >>{build.path}/core/core_version.h" -recipe.hooks.core.prebuild.3.pattern="{runtime.tools.signing}" --mode header --publickey "{build.source.path}/public.key" --out "{build.path}/core/Updater_Signing.h" +recipe.hooks.core.prebuild.1.pattern=python "{runtime.tools.signing}" --mode header --publickey "{build.source.path}/public.key" --out "{build.path}/core/Updater_Signing.h" +recipe.hooks.core.prebuild.2.pattern=bash -c "mkdir -p {build.path}/core && echo \#define ARDUINO_ESP8266_GIT_VER 0x`git --git-dir {runtime.platform.path}/.git rev-parse --short=8 HEAD 2>/dev/null || echo ffffffff` >{build.path}/core/core_version.h" +recipe.hooks.core.prebuild.3.pattern=bash -c "mkdir -p {build.path}/core && echo \#define ARDUINO_ESP8266_GIT_DESC `cd "{runtime.platform.path}"; git describe --tags 2>/dev/null || echo unix-{version}` >>{build.path}/core/core_version.h" ## windows-compatible version without git -recipe.hooks.core.prebuild.1.pattern.windows=cmd.exe /c mkdir {build.path}\core & (echo #define ARDUINO_ESP8266_GIT_VER 0x00000000 & echo #define ARDUINO_ESP8266_GIT_DESC win-{version} ) > {build.path}\core\core_version.h -recipe.hooks.core.prebuild.2.pattern.windows=cmd.exe /c if exist {build.source.path}\public.key echo #error Cannot automatically build signed binaries on Windows > {build.path}\core\Updater_Signing.h -recipe.hooks.core.prebuild.3.pattern.windows= +recipe.hooks.core.prebuild.1.pattern.windows=cmd.exe /c rem cannot sign on windows +recipe.hooks.core.prebuild.2.pattern.windows=cmd.exe /c mkdir {build.path}\core & (echo #define ARDUINO_ESP8266_GIT_VER 0x00000000 & echo #define ARDUINO_ESP8266_GIT_DESC win-{version} ) > {build.path}\core\core_version.h +recipe.hooks.core.prebuild.3.pattern.windows=cmd.exe /c if exist {build.source.path}\public.key echo #error Cannot automatically build signed binaries on Windows > {build.path}\core\Updater_Signing.h ## Build the app.ld linker file recipe.hooks.linking.prelink.1.pattern="{compiler.path}{compiler.c.cmd}" -CC -E -P {build.vtable_flags} "{runtime.platform.path}/tools/sdk/ld/eagle.app.v6.common.ld.h" -o "{build.path}/local.eagle.app.v6.common.ld" @@ -110,7 +110,7 @@ recipe.objcopy.eep.pattern= #recipe.objcopy.hex.pattern="{compiler.path}{compiler.elf2hex.cmd}" {compiler.elf2hex.flags} {compiler.elf2hex.extra_flags} "{build.path}/{build.project_name}.elf" "{build.path}/{build.project_name}.hex" recipe.objcopy.hex.1.pattern="{runtime.tools.esptool.path}/{compiler.esptool.cmd}" -eo "{runtime.platform.path}/bootloaders/eboot/eboot.elf" -bo "{build.path}/{build.project_name}.bin" -bm {build.flash_mode} -bf {build.flash_freq} -bz {build.flash_size} -bs .text -bp 4096 -ec -eo "{build.path}/{build.project_name}.elf" -bs .irom0.text -bs .text -bs .data -bs .rodata -bc -ec -recipe.objcopy.hex.2.pattern="{runtime.tools.signing}" --mode sign --privatekey "{build.source.path}/private.key" --bin "{build.path}/{build.project_name}.bin" --out "{build.path}/{build.project_name}.bin.signed" +recipe.objcopy.hex.2.pattern=python "{runtime.tools.signing}" --mode sign --privatekey "{build.source.path}/private.key" --bin "{build.path}/{build.project_name}.bin" --out "{build.path}/{build.project_name}.bin.signed" # No signing on Windows recipe.objcopy.hex.1.pattern.windows="{runtime.tools.esptool.path}/{compiler.esptool.cmd}" -eo "{runtime.platform.path}/bootloaders/eboot/eboot.elf" -bo "{build.path}/{build.project_name}.bin" -bm {build.flash_mode} -bf {build.flash_freq} -bz {build.flash_size} -bs .text -bp 4096 -ec -eo "{build.path}/{build.project_name}.elf" -bs .irom0.text -bs .text -bs .data -bs .rodata -bc -ec diff --git a/tools/signing.py b/tools/signing.py index e0a6a1676..a323cbc0c 100755 --- a/tools/signing.py +++ b/tools/signing.py @@ -38,6 +38,9 @@ def main(): # and they can check for the positive acknowledgement above. # sys.stderr.write("Not enabling binary signing\n") val += "#define ARDUINO_SIGNING 0\n" + outdir = os.path.dirname(args.out) + if not os.path.exists(outdir): + os.makedirs(outdir) with open(args.out, "w") as f: f.write(val) return 0